227 files changed, 12877 insertions, 3379 deletions
diff --git a/.sops.yaml b/.sops.yaml
index 948383b2..a65dca8e 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -8,6 +8,12 @@ creation_rules:
  - path_regex: ^hosts/surtr/email/ca
    key_groups:
      - age: [ *admin_gkleen ]
+  - path_regex: ^home-modules/lmu-hausschrift/
+    key_groups:
+      - age: [ *admin_gkleen ]
+  - path_regex: ^accounts/gkleen@sif/
+    key_groups:
+      - age: [ *admin_gkleen ]
  - path_regex: surtr\/?[^\/]*$
    key_groups:
      - age: [ *admin_gkleen, *machine_surtr ]
diff --git a/_sources/generated.json b/_sources/generated.json
index b85cb274..dd73e455 100644
--- a/_sources/generated.json
+++ b/_sources/generated.json
@@ -22,7 +22,7 @@
    },
    "bpf-examples": {
        "cargoLocks": null,
-        "date": "2025-03-06",
+        "date": "2025-09-19",
        "extract": null,
        "name": "bpf-examples",
        "passthru": null,
@@ -34,12 +34,12 @@
            "name": null,
            "owner": "xdp-project",
            "repo": "bpf-examples",
-            "rev": "64e7da048b14822bef06f3971189c4c0985422e7",
+            "rev": "d621b4fb25c4877415a563887606ab0fe47ad59a",
-            "sha256": "sha256-cyyRNvU35ujxkLraOqw2oiZwUblBpJaEncPl2++VHL4=",
+            "sha256": "sha256-IQBTYtqHsghbb/Mpx29Hjr9AsLVG6w3BqfJYSKoMotU=",
            "sparseCheckout": [],
            "type": "github"
        },
-        "version": "64e7da048b14822bef06f3971189c4c0985422e7"
+        "version": "d621b4fb25c4877415a563887606ab0fe47ad59a"
    },
    "emacs-scratch_el": {
        "cargoLocks": null,
@@ -76,12 +76,12 @@
            "name": null,
            "owner": "Mange",
            "repo": "emoji-data",
-            "rev": "v2.6",
+            "rev": "v2.7",
-            "sha256": "sha256-6nBiT9q139P1pXLqkV1JejE0s2rZn1gUbNsejXJR6RU=",
+            "sha256": "sha256-bUFh0Q7xcnKTBgVBUJU8BH6zzq1Y3krLfJJAgx5TqKs=",
            "sparseCheckout": [],
            "type": "github"
        },
-        "version": "v2.6"
+        "version": "v2.7"
    },
    "lesspipe": {
        "cargoLocks": null,
@@ -91,15 +91,15 @@
        "passthru": null,
        "pinned": false,
        "src": {
-            "sha256": "sha256-afJuTByGUMU6kFqGGa3pbPaFVdYGcJYiR0RfDNYNgDk=",
+            "sha256": "sha256-yb3IzdaMiv1PwqHOfSyHvmWXyStvK/XXC49saXVAJFU=",
            "type": "tarball",
-            "url": "https://github.com/wofr06/lesspipe/archive/refs/tags/v2.17.tar.gz"
+            "url": "https://github.com/wofr06/lesspipe/archive/refs/tags/v2.20.tar.gz"
        },
-        "version": "2.17"
+        "version": "2.20"
    },
    "mako": {
        "cargoLocks": null,
-        "date": "2025-03-21",
+        "date": "2025-09-11",
        "extract": null,
        "name": "mako",
        "passthru": null,
@@ -109,13 +109,13 @@
            "fetchSubmodules": false,
            "leaveDotGit": false,
            "name": null,
-            "rev": "2a06a341efae601431a6944f94cfe4965a46cb44",
+            "rev": "8318972590420c042c0177af16e26a1768550fab",
-            "sha256": "sha256-QH2rxJcNiurHFEtkmq6Ki15k11b6ft6WYiZKbGs7SS0=",
+            "sha256": "sha256-Y/exF/Pv60E31Zl+M1zboWkmkZgOUCA3l93OKbtvZ+g=",
            "sparseCheckout": [],
            "type": "git",
            "url": "https://github.com/emersion/mako"
        },
-        "version": "2a06a341efae601431a6944f94cfe4965a46cb44"
+        "version": "8318972590420c042c0177af16e26a1768550fab"
    },
    "mpv-autosave": {
        "cargoLocks": null,
@@ -223,7 +223,7 @@
    },
    "mpv-subselect": {
        "cargoLocks": null,
-        "date": "2024-12-22",
+        "date": "2025-04-04",
        "extract": null,
        "name": "mpv-subselect",
        "passthru": null,
@@ -233,13 +233,13 @@
            "fetchSubmodules": false,
            "leaveDotGit": false,
            "name": null,
-            "rev": "77d0148aa6aa952f07f06212cabe32d54dfdf49e",
+            "rev": "26d24a0fd1d69988eaedda6056a2c87d0a55b6cb",
-            "sha256": "sha256-VxwwTxE8c8rRQt/m2NA7cRC7+7O1ItYFFGv81nxqIxg=",
+            "sha256": "sha256-+eVga4b7KIBnfrtmlgq/0HNjQVS3SK6YWVXCPvOeOOc=",
            "sparseCheckout": [],
            "type": "git",
            "url": "https://github.com/CogentRedTester/mpv-sub-select"
        },
-        "version": "77d0148aa6aa952f07f06212cabe32d54dfdf49e"
+        "version": "26d24a0fd1d69988eaedda6056a2c87d0a55b6cb"
    },
    "mpv-youtube-quality": {
        "cargoLocks": null,
@@ -261,6 +261,36 @@
        },
        "version": "1f8c31457459ffc28cd1c3f3c2235a53efad7148"
    },
+    "netbootxyz-efi": {
+        "cargoLocks": null,
+        "date": null,
+        "extract": null,
+        "name": "netbootxyz-efi",
+        "passthru": null,
+        "pinned": false,
+        "src": {
+            "name": null,
+            "sha256": "sha256-ipbZJ0mPCuwzb/TDtXXUBTuWOcSsKGAJ1GEGIgB2G7E=",
+            "type": "url",
+            "url": "https://github.com/netbootxyz/netboot.xyz/releases/download/2.0.88/netboot.xyz.efi"
+        },
+        "version": "2.0.88"
+    },
+    "netbootxyz-lkrn": {
+        "cargoLocks": null,
+        "date": null,
+        "extract": null,
+        "name": "netbootxyz-lkrn",
+        "passthru": null,
+        "pinned": false,
+        "src": {
+            "name": null,
+            "sha256": "sha256-igy3O30noS25dU7ZnHuKrWqLLkjjd/L46IdCTd038dI=",
+            "type": "url",
+            "url": "https://github.com/netbootxyz/netboot.xyz/releases/download/2.0.88/netboot.xyz.lkrn"
+        },
+        "version": "2.0.88"
+    },
    "postfix-mta-sts-resolver": {
        "cargoLocks": null,
        "date": null,
@@ -297,11 +327,11 @@
        "passthru": null,
        "pinned": false,
        "src": {
-            "sha256": "sha256-Nz/lBhQbzWSnOKN4n0OUdJzDTpf3mfY0+FXoCqF03TU=",
+            "sha256": "sha256-mg4iyp/heYzSoK+pGSMYfZb5UauoBMrEL1QPH6EoJ8o=",
            "type": "tarball",
-            "url": "https://github.com/hansmi/prometheus-lvm-exporter/archive/refs/tags/v0.4.0.tar.gz"
+            "url": "https://github.com/hansmi/prometheus-lvm-exporter/archive/refs/tags/v0.6.1.tar.gz"
        },
-        "version": "0.4.0"
+        "version": "0.6.1"
    },
    "psql-versioning": {
        "cargoLocks": null,
@@ -323,6 +353,26 @@
        },
        "version": "330cb9da36651b701085ad53ae75ff296d02202a"
    },
+    "quickshell": {
+        "cargoLocks": null,
+        "date": "2025-09-19",
+        "extract": null,
+        "name": "quickshell",
+        "passthru": null,
+        "pinned": false,
+        "src": {
+            "deepClone": false,
+            "fetchSubmodules": false,
+            "leaveDotGit": false,
+            "name": null,
+            "rev": "e9a574d919a89602d2868621576b2ccae54a5cb0",
+            "sha256": "sha256-wOv1guIi9THD1NjOtBU2Xh/Avg9xv7nIjsfFSkr1NeQ=",
+            "sparseCheckout": [],
+            "type": "git",
+            "url": "https://git.outfoxxed.me/quickshell/quickshell.git"
+        },
+        "version": "e9a574d919a89602d2868621576b2ccae54a5cb0"
+    },
    "scutiger": {
        "cargoLocks": null,
        "date": null,
@@ -367,7 +417,7 @@
    },
    "swayosd": {
        "cargoLocks": null,
-        "date": "2025-03-03",
+        "date": "2025-07-07",
        "extract": null,
        "name": "swayosd",
        "passthru": null,
@@ -377,13 +427,13 @@
            "fetchSubmodules": false,
            "leaveDotGit": false,
            "name": null,
-            "rev": "b3c78fce3d90be2ce6a6ffee0e22a50379952e2b",
+            "rev": "73aed75146b81aaf67c4301353790ff5a17aed1f",
-            "sha256": "sha256-V3V18BoBRJU8mtvwWXvdYPbKBDIHdu5LzVSkDkGJjFU=",
+            "sha256": "sha256-p31HNelptAw7Sk0NmYP4FkoUCdA5uAsrXC20JJp24Vw=",
            "sparseCheckout": [],
            "type": "git",
            "url": "https://github.com/ErikReider/SwayOSD"
        },
-        "version": "b3c78fce3d90be2ce6a6ffee0e22a50379952e2b"
+        "version": "73aed75146b81aaf67c4301353790ff5a17aed1f"
    },
    "tomorrow-night-paradise-theme": {
        "cargoLocks": null,
@@ -407,7 +457,7 @@
    },
    "v4l2loopback": {
        "cargoLocks": null,
-        "date": "2025-03-24",
+        "date": "2025-08-18",
        "extract": null,
        "name": "v4l2loopback",
        "passthru": null,
@@ -419,16 +469,16 @@
            "name": null,
            "owner": "umlaeute",
            "repo": "v4l2loopback",
-            "rev": "84cccedd9d3979f0a8ec5478b100ea57adf29696",
+            "rev": "5eaa59e7c41d0e6f35a6c14c3b756d94d25f58ed",
-            "sha256": "sha256-o31+j5OdMV0e5GvyoGSR1RK6GjTwz9sfhfUK+vbW+b4=",
+            "sha256": "sha256-YcSpNfItvUdPVirlDyGdYuCnVvxHhh780x+OI5VNZmE=",
            "sparseCheckout": [],
            "type": "github"
        },
-        "version": "84cccedd9d3979f0a8ec5478b100ea57adf29696"
+        "version": "5eaa59e7c41d0e6f35a6c14c3b756d94d25f58ed"
    },
    "xcompose": {
        "cargoLocks": null,
-        "date": "2025-03-11",
+        "date": "2025-06-05",
        "extract": null,
        "name": "xcompose",
        "passthru": null,
@@ -440,12 +490,12 @@
            "name": null,
            "owner": "kragen",
            "repo": "xcompose",
-            "rev": "8b5a6a0c788fd0a4b921d9d3737174defb863873",
+            "rev": "4d8eab4d05a19537ce79294ae0459fdae78ffb20",
-            "sha256": "sha256-6EjQErdBOd5hqcrdaf88E1UZVYIc3FOfv34hvUwOWdA=",
+            "sha256": "sha256-vKY4u5Z2IL111orLLkkF4AoVzqluKG/VQhNUUCqO/k8=",
            "sparseCheckout": [],
            "type": "github"
        },
-        "version": "8b5a6a0c788fd0a4b921d9d3737174defb863873"
+        "version": "4d8eab4d05a19537ce79294ae0459fdae78ffb20"
    },
    "yt-dlp": {
        "cargoLocks": null,
@@ -456,10 +506,10 @@
        "pinned": false,
        "src": {
            "name": null,
-            "sha256": "sha256-G/4OZg0acKCeJ7LVj5LjCx4uNizEh4KfL4JDRq5J+5E=",
+            "sha256": "sha256-koKtHerbTJCy5tO8+fNgq/iMXy5LqDba17UTh7CG11c=",
            "type": "url",
-            "url": "https://pypi.org/packages/source/y/yt_dlp/yt_dlp-2025.3.31.tar.gz"
+            "url": "https://pypi.org/packages/source/y/yt_dlp/yt_dlp-2025.9.23.tar.gz"
        },
-        "version": "2025.3.31"
+        "version": "2025.9.23"
    }
 }
 \ No newline at end of file
diff --git a/_sources/generated.nix b/_sources/generated.nix
index ddcbbf10..8eac064b 100644
--- a/_sources/generated.nix
+++ b/_sources/generated.nix
@@ -18,15 +18,15 @@
  };
  bpf-examples = {
    pname = "bpf-examples";
-    version = "64e7da048b14822bef06f3971189c4c0985422e7";
+    version = "d621b4fb25c4877415a563887606ab0fe47ad59a";
    src = fetchFromGitHub {
      owner = "xdp-project";
      repo = "bpf-examples";
-      rev = "64e7da048b14822bef06f3971189c4c0985422e7";
+      rev = "d621b4fb25c4877415a563887606ab0fe47ad59a";
      fetchSubmodules = true;
-      sha256 = "sha256-cyyRNvU35ujxkLraOqw2oiZwUblBpJaEncPl2++VHL4=";
+      sha256 = "sha256-IQBTYtqHsghbb/Mpx29Hjr9AsLVG6w3BqfJYSKoMotU=";
    };
-    date = "2025-03-06";
+    date = "2025-09-19";
  };
  emacs-scratch_el = {
    pname = "emacs-scratch_el";
@@ -42,36 +42,36 @@
  };
  emoji-data = {
    pname = "emoji-data";
-    version = "v2.6";
+    version = "v2.7";
    src = fetchFromGitHub {
      owner = "Mange";
      repo = "emoji-data";
-      rev = "v2.6";
+      rev = "v2.7";
      fetchSubmodules = true;
-      sha256 = "sha256-6nBiT9q139P1pXLqkV1JejE0s2rZn1gUbNsejXJR6RU=";
+      sha256 = "sha256-bUFh0Q7xcnKTBgVBUJU8BH6zzq1Y3krLfJJAgx5TqKs=";
    };
  };
  lesspipe = {
    pname = "lesspipe";
-    version = "2.17";
+    version = "2.20";
    src = fetchTarball {
-      url = "https://github.com/wofr06/lesspipe/archive/refs/tags/v2.17.tar.gz";
+      url = "https://github.com/wofr06/lesspipe/archive/refs/tags/v2.20.tar.gz";
-      sha256 = "sha256-afJuTByGUMU6kFqGGa3pbPaFVdYGcJYiR0RfDNYNgDk=";
+      sha256 = "sha256-yb3IzdaMiv1PwqHOfSyHvmWXyStvK/XXC49saXVAJFU=";
    };
  };
  mako = {
    pname = "mako";
-    version = "2a06a341efae601431a6944f94cfe4965a46cb44";
+    version = "8318972590420c042c0177af16e26a1768550fab";
    src = fetchgit {
      url = "https://github.com/emersion/mako";
-      rev = "2a06a341efae601431a6944f94cfe4965a46cb44";
+      rev = "8318972590420c042c0177af16e26a1768550fab";
      fetchSubmodules = false;
      deepClone = false;
      leaveDotGit = false;
      sparseCheckout = [ ];
-      sha256 = "sha256-QH2rxJcNiurHFEtkmq6Ki15k11b6ft6WYiZKbGs7SS0=";
+      sha256 = "sha256-Y/exF/Pv60E31Zl+M1zboWkmkZgOUCA3l93OKbtvZ+g=";
    };
-    date = "2025-03-21";
+    date = "2025-09-11";
  };
  mpv-autosave = {
    pname = "mpv-autosave";
@@ -136,17 +136,17 @@
  };
  mpv-subselect = {
    pname = "mpv-subselect";
-    version = "77d0148aa6aa952f07f06212cabe32d54dfdf49e";
+    version = "26d24a0fd1d69988eaedda6056a2c87d0a55b6cb";
    src = fetchgit {
      url = "https://github.com/CogentRedTester/mpv-sub-select";
-      rev = "77d0148aa6aa952f07f06212cabe32d54dfdf49e";
+      rev = "26d24a0fd1d69988eaedda6056a2c87d0a55b6cb";
      fetchSubmodules = false;
      deepClone = false;
      leaveDotGit = false;
      sparseCheckout = [ ];
-      sha256 = "sha256-VxwwTxE8c8rRQt/m2NA7cRC7+7O1ItYFFGv81nxqIxg=";
+      sha256 = "sha256-+eVga4b7KIBnfrtmlgq/0HNjQVS3SK6YWVXCPvOeOOc=";
    };
-    date = "2024-12-22";
+    date = "2025-04-04";
  };
  mpv-youtube-quality = {
    pname = "mpv-youtube-quality";
@@ -162,6 +162,22 @@
    };
    date = "2020-02-10";
  };
+  netbootxyz-efi = {
+    pname = "netbootxyz-efi";
+    version = "2.0.88";
+    src = fetchurl {
+      url = "https://github.com/netbootxyz/netboot.xyz/releases/download/2.0.88/netboot.xyz.efi";
+      sha256 = "sha256-ipbZJ0mPCuwzb/TDtXXUBTuWOcSsKGAJ1GEGIgB2G7E=";
+    };
+  };
+  netbootxyz-lkrn = {
+    pname = "netbootxyz-lkrn";
+    version = "2.0.88";
+    src = fetchurl {
+      url = "https://github.com/netbootxyz/netboot.xyz/releases/download/2.0.88/netboot.xyz.lkrn";
+      sha256 = "sha256-igy3O30noS25dU7ZnHuKrWqLLkjjd/L46IdCTd038dI=";
+    };
+  };
  postfix-mta-sts-resolver = {
    pname = "postfix-mta-sts-resolver";
    version = "1.5.0";
@@ -180,10 +196,10 @@
  };
  prometheus-lvm-exporter = {
    pname = "prometheus-lvm-exporter";
-    version = "0.4.0";
+    version = "0.6.1";
    src = fetchTarball {
-      url = "https://github.com/hansmi/prometheus-lvm-exporter/archive/refs/tags/v0.4.0.tar.gz";
+      url = "https://github.com/hansmi/prometheus-lvm-exporter/archive/refs/tags/v0.6.1.tar.gz";
-      sha256 = "sha256-Nz/lBhQbzWSnOKN4n0OUdJzDTpf3mfY0+FXoCqF03TU=";
+      sha256 = "sha256-mg4iyp/heYzSoK+pGSMYfZb5UauoBMrEL1QPH6EoJ8o=";
    };
  };
  psql-versioning = {
@@ -200,6 +216,20 @@
    };
    date = "2023-11-23";
  };
+  quickshell = {
+    pname = "quickshell";
+    version = "e9a574d919a89602d2868621576b2ccae54a5cb0";
+    src = fetchgit {
+      url = "https://git.outfoxxed.me/quickshell/quickshell.git";
+      rev = "e9a574d919a89602d2868621576b2ccae54a5cb0";
+      fetchSubmodules = false;
+      deepClone = false;
+      leaveDotGit = false;
+      sparseCheckout = [ ];
+      sha256 = "sha256-wOv1guIi9THD1NjOtBU2Xh/Avg9xv7nIjsfFSkr1NeQ=";
+    };
+    date = "2025-09-19";
+  };
  scutiger = {
    pname = "scutiger";
    version = "0.2.0";
@@ -226,17 +256,17 @@
  };
  swayosd = {
    pname = "swayosd";
-    version = "b3c78fce3d90be2ce6a6ffee0e22a50379952e2b";
+    version = "73aed75146b81aaf67c4301353790ff5a17aed1f";
    src = fetchgit {
      url = "https://github.com/ErikReider/SwayOSD";
-      rev = "b3c78fce3d90be2ce6a6ffee0e22a50379952e2b";
+      rev = "73aed75146b81aaf67c4301353790ff5a17aed1f";
      fetchSubmodules = false;
      deepClone = false;
      leaveDotGit = false;
      sparseCheckout = [ ];
-      sha256 = "sha256-V3V18BoBRJU8mtvwWXvdYPbKBDIHdu5LzVSkDkGJjFU=";
+      sha256 = "sha256-p31HNelptAw7Sk0NmYP4FkoUCdA5uAsrXC20JJp24Vw=";
    };
-    date = "2025-03-03";
+    date = "2025-07-07";
  };
  tomorrow-night-paradise-theme = {
    pname = "tomorrow-night-paradise-theme";
@@ -254,34 +284,34 @@
  };
  v4l2loopback = {
    pname = "v4l2loopback";
-    version = "84cccedd9d3979f0a8ec5478b100ea57adf29696";
+    version = "5eaa59e7c41d0e6f35a6c14c3b756d94d25f58ed";
    src = fetchFromGitHub {
      owner = "umlaeute";
      repo = "v4l2loopback";
-      rev = "84cccedd9d3979f0a8ec5478b100ea57adf29696";
+      rev = "5eaa59e7c41d0e6f35a6c14c3b756d94d25f58ed";
      fetchSubmodules = true;
-      sha256 = "sha256-o31+j5OdMV0e5GvyoGSR1RK6GjTwz9sfhfUK+vbW+b4=";
+      sha256 = "sha256-YcSpNfItvUdPVirlDyGdYuCnVvxHhh780x+OI5VNZmE=";
    };
-    date = "2025-03-24";
+    date = "2025-08-18";
  };
  xcompose = {
    pname = "xcompose";
-    version = "8b5a6a0c788fd0a4b921d9d3737174defb863873";
+    version = "4d8eab4d05a19537ce79294ae0459fdae78ffb20";
    src = fetchFromGitHub {
      owner = "kragen";
      repo = "xcompose";
-      rev = "8b5a6a0c788fd0a4b921d9d3737174defb863873";
+      rev = "4d8eab4d05a19537ce79294ae0459fdae78ffb20";
      fetchSubmodules = false;
-      sha256 = "sha256-6EjQErdBOd5hqcrdaf88E1UZVYIc3FOfv34hvUwOWdA=";
+      sha256 = "sha256-vKY4u5Z2IL111orLLkkF4AoVzqluKG/VQhNUUCqO/k8=";
    };
-    date = "2025-03-11";
+    date = "2025-06-05";
  };
  yt-dlp = {
    pname = "yt-dlp";
-    version = "2025.3.31";
+    version = "2025.9.23";
    src = fetchurl {
-      url = "https://pypi.org/packages/source/y/yt_dlp/yt_dlp-2025.3.31.tar.gz";
+      url = "https://pypi.org/packages/source/y/yt_dlp/yt_dlp-2025.9.23.tar.gz";
-      sha256 = "sha256-G/4OZg0acKCeJ7LVj5LjCx4uNizEh4KfL4JDRq5J+5E=";
+      sha256 = "sha256-koKtHerbTJCy5tO8+fNgq/iMXy5LqDba17UTh7CG11c=";
    };
  };
 }
diff --git a/accounts/gkleen@eostre.nix b/accounts/gkleen@eostre.nix
index 72818d44..28daf3fd 100644
--- a/accounts/gkleen@eostre.nix
+++ b/accounts/gkleen@eostre.nix
@@ -1,16 +1,16 @@
 { flake, userName, pkgs, ... }:
 {
  imports = with flake.nixosModules.userProfiles.${userName}; [
-    zsh utils tmux
+    utils
  ];
  config = {
    home-manager.users.${userName} = {
      home.stateVersion = "20.09";
-      nixpkgs.config = {
+      # nixpkgs.config = {
-        allowUnfree = true;
+      #   allowUnfree = true;
-      };
+      # };
      home.packages = with pkgs; [
        thunderbird libreoffice element-desktop keepassxc vlc
diff --git a/accounts/gkleen@installer.nix b/accounts/gkleen@installer.nix
index c7a418f8..5fe1db38 100644
--- a/accounts/gkleen@installer.nix
+++ b/accounts/gkleen@installer.nix
@@ -1,7 +1,11 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 {
-  home-manager.users.${userName} = { config, ... } : {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName} = { config, ... } : {
    home.stateVersion = config.home.version.release;
  };
 }
diff --git a/accounts/gkleen@sif/default.nix b/accounts/gkleen@sif/default.nix
index 11f24f31..36b722e4 100644
--- a/accounts/gkleen@sif/default.nix
+++ b/accounts/gkleen@sif/default.nix
@@ -49,10 +49,22 @@ let
    ];
  };
-  lockCommand = "${lib.getExe' config.systemd.package "systemctl"} --user start gtklock.service";
+  # lockCommand = "${lib.getExe' config.systemd.package "systemctl"} --user start gtklock.service";
+  lockCommand = "${lib.getExe' cfg.programs.quickshell.package "qs"} ipc call Lockscreen setLocked true";
+  editor = pkgs.symlinkJoin {
+    inherit (cfg.services.emacs.package) name;
+    buildInputs = with pkgs; [ makeWrapper ];
+    paths = [ cfg.services.emacs.package ];
+    postBuild = ''
+      wrapProgram $out/bin/emacsclient \
+        --inherit-argv0 \
+        --add-flags ${lib.escapeShellArg (lib.escapeShellArgs cfg.services.emacs.client.arguments)}
+    '';
+  };
 in {
  imports = with flake.nixosModules.userProfiles.${userName}; [
-    mpv yt-dlp (args: import ./xcompose.nix (inputs // args))
+    zsh tmux mpv yt-dlp (args: import ./xcompose.nix (inputs // args))
  ];
  config = {
@@ -60,16 +72,18 @@ in {
      imports = [
        ./libvirt
        ./niri
-        flakeInputs.nix-index-database.hmModules.nix-index
+        ./shell
+        ./synadm
+        flakeInputs.nix-index-database.homeModules.nix-index
        flakeInputs.impermanence.nixosModules.home-manager.impermanence
      ];
      home.stateVersion = "20.09";
-      nixpkgs.config = {
+      # nixpkgs.config = {
-        allowUnfree = true;
+      #   allowUnfree = true;
-        zathura.useMupdf = false;
+      #   zathura.useMupdf = false;
-      };
+      # };
      nix.registry = {
        "flk" = {
@@ -160,6 +174,7 @@ in {
            };
          };
        };
+        chromium.enable = true;
        zathura = {
          enable = true;
@@ -175,13 +190,93 @@ in {
          gpu-api = "vulkan";
        };
-        zsh.initExtra = ''
+        zsh.initContent = let
-          source ${./zshrc}
+          zshrc = pkgs.resholve.mkDerivation {
+            pname = "zshrc";
+            version = "0.0.0";
+            src = ./zshrc;
+            dontUnpack = true;
+            dontConfigure = true;
+            dontBuild = true;
+            installPhase = ''
+              mkdir -p $out/share
+              install "$src" $out/share/zshrc
+            '';
+            solutions = {
+              default = {
+                scripts = [ "share/zshrc" ];
+                interpreter = "none";
+                inputs = with pkgs; [
+                  coreutils
+                  rpm
+                  binutils
+                  squashfsTools
+                  unzip
+                  cfg.programs.git.package
+                  magickWrapped
+                  curl
+                  file
+                  gnutar
+                  cpio
+                  magic-wormhole
+                  cfg.programs.zsh.package
+                  fuse
+                  util-linux
+                  findutils
+                  qrencode
+                  tty-clock
+                  cfg.programs.jq.package
+                  eza
+                  less
+                  config.systemd.package
+                  config.programs.ssh.package
+                  gnused
+                  miniserve
+                  p7zip
+                ];
+                execer = with pkgs; [
+                  "cannot:${lib.getExe' rpm "rpm2cpio"}"
+                  "cannot:${lib.getExe' squashfsTools "unsquashfs"}"
+                  "cannot:${lib.getExe' unzip "unzip"}"
+                  "cannot:${lib.getExe cfg.programs.git.package}"
+                  "cannot:${lib.getExe cpio}"
+                  "cannot:${lib.getExe' magic-wormhole "wormhole"}"
+                  "cannot:${lib.getExe' fuse "fusermount"}"
+                  "cannot:${lib.getExe less}"
+                  "cannot:${lib.getExe' config.systemd.package "systemctl"}"
+                  "cannot:${lib.getExe config.programs.ssh.package}"
+                  "cannot:${lib.getExe' p7zip "7z"}"
+                ];
+                wrapper = with pkgs; [
+                  "${lib.getExe' magickWrapped "magick"}:${lib.getExe' imagemagick "magick"}"
+                ];
+                fake = {
+                  builtin = ["print"];
+                  external = ["sudo" "umount"];
+                };
+              };
+            };
+          };
+          magickWrapped = pkgs.symlinkJoin {
+            inherit (pkgs.imagemagick) name;
+            paths = [ pkgs.imagemagick ];
+            buildInputs = with pkgs; [ makeWrapper ];
+            postBuild = ''
+              wrapProgram $out/bin/magick \
+                --prefix PATH : ${lib.makeBinPath (with pkgs; [ ghostscript ])}
+            '';
+          };
+        in ''
+          source ${zshrc}/share/zshrc
        '';
        zsh.dirHashes = let
          flakeHashes = mapAttrs' (n: v: nameValuePair (inputNames.${n} or n) (toString v)) flakeInputs;
          inputNames = {
-            "nixpkgs" = "nixos";
          };
        in flakeHashes // {
          u2w = "$HOME/projects/uni2work";
@@ -193,6 +288,16 @@ in {
          pro = "$HOME/projects/pro";
          media = "$HOME/media";
        };
+        jq.colors = {
+          arrays = "1;37";
+          "false" = "0;37";
+          "null" = "2;37";
+          numbers = "0;37";
+          objectKeys = "1;34";
+          objects = "1;37";
+          strings = "0;32";
+          "true" = "0;37";
+        };
        obs-studio = {
          enable = true;
@@ -202,7 +307,7 @@ in {
        gh = {
          enable = true;
          settings = {
-            editor = lib.getExe' config.home-manager.users.${userName}.programs.emacs.package "emacsclient";
+            editor = lib.getExe' editor "emacsclient";
            gitProtocol = "ssh";
          };
        };
@@ -228,16 +333,10 @@ in {
            # notify_on_cmd_finish = "invisible 120";
          };
          keybindings = {
-            "kitty_mod+n" = "detach_window";
+            "kitty_mod+n" = "new_os_window_with_cwd";
            "kitty_mod+m" = "detach_window ask";
-          };
+            "kitty_mod+enter" = "new_window_with_cwd";
-        };
+            "kitty_mod+t" = "new_tab_with_cwd";
-        wpaperd = {
-          enable = true;
-          settings.default = {
-            path = "~/.wallpapers";
-            duration = "15m";
-            mode = "center";
          };
        };
        fuzzel = {
@@ -250,7 +349,7 @@ in {
              font = "Fira Sans";
            };
            colors = {
-              background = "000000aa";
+              background = "000000cc";
              text = "cdd6f4ff";
              match = "94e2d5ff";
              selection = "585b70ff";
@@ -267,15 +366,28 @@ in {
          enable = true;
          extraAbbreviations = ["i.A." "d.h." "D.h." "gdw."];
        };
+        nushell = {
+          enable = true;
+          settings.show_banner = false;
+        };
+        fd.enable = true;
      };
      services = {
+        wpaperd = {
+          enable = false;
+          settings.default = {
+            path = "~/.wallpapers";
+            duration = "15m";
+            mode = "center";
+          };
+        };
        emacs = {
          enable = true;
          socketActivation.enable = true;
          client = {
            enable = true;
-            arguments = mkForce ["--reuse-frame" "--alternate-editor" "\"\""];
+            arguments = mkForce ["--create-frame" "--alternate-editor" (lib.getExe cfg.services.emacs.package)];
          };
        };
        gpg-agent = {
@@ -338,20 +450,6 @@ in {
          serverUrl = "https://etesync.yggdrasil.li";
        };
-        swayidle = {
-          enable = true;
-          events = [
-            { event = "before-sleep"; command = lockCommand; }
-            { event = "lock"; command = lockCommand; }
-          ];
-          timeouts = [
-            { timeout = 600; command = lockCommand; }
-          ];
-          extraArgs = [
-            "-w"
-            "idlehint" "30"
-          ];
-        };
        poweralertd.enable = true;
      };
@@ -383,6 +481,15 @@ in {
          name = "Paper-Mono-Dark";
        };
      };
+      qt.enable = true;
+      qt.platformTheme.name = "gtk";
+      qt.kde.settings = {
+        kwalletrc = {
+          KSecretD.Enabled = false;
+          Wallet."Default Wallet" = "store";
+        };
+      };
      xsession.preferStatusNotifierItems = true;
@@ -392,20 +499,19 @@ in {
        packages = with pkgs; [
          fira fira-code pwvucontrol wrappedKeepassxc wl-clipboard-rs
          mumble pulseaudio-ctl pamixer libnotify screen-message
-          wrappedYTMDesktop libsForQt5.qt5ct playerctl evince
+          wrappedYTMDesktop libsForQt5.qt5ct playerctl evince papers
          thunderbird zoom-us xdg-desktop-portal steam steam-run
          wireshark virt-manager rclone cached-nix-shell worktime
-          fira-code-symbols libreoffice xournalpp google-chrome
+          fira-code-symbols libreoffice xournalpp
          nixos-shell virt-viewer freerdp gnome-icon-theme
          paper-icon-theme sshpassSecret weechat element-desktop
-          flakeInputs.deploy-rs.packages.${config.nixpkgs.system}.deploy-rs
+          sieve-connect gimp3 inkscape udiskie glab nitrokey-app
-          sieve-connect gimp inkscape udiskie glab nitrokey-app
          pynitrokey gtklock wlrctl remmina openscad spice-record
-          libguestfs-with-appliance nerd-fonts.fira-mono
+          nerd-fonts.fira-mono
          nerd-fonts.symbols-only nerd-fonts.fira-code powerline-fonts
-          swtpm (hunspellWithDicts (with hunspellDicts; [en_GB-large de_DE]))
+          swtpm (hunspell.withDicts (dicts: with dicts; [en_GB-large de_DE]))
-          # synadm
+          libation libqalculate
-        ];
+        ] ++ mapAttrsToList (_name: pkg: pkgs.callPackage pkg {}) (customUtils.nixImport { dir = ./utils; });
        file = {
          ".backup-munin".source = ./backup-patterns;
@@ -422,15 +528,12 @@ in {
        sessionVariables = {
          # GDK_SCALE = 96.0 / 282.0;
          # QT_AUTO_SCREEN_SCALE_FACTOR = 1;
-          QT_QPA_PLATFORMTHEME = "qt5ct";
+          QT_QPA_PLATFORMTHEME = lib.mkForce "gtk3";
          LIBVIRT_DEFAULT_URI = "qemu:///system";
          STACK_XDG = 1;
-          EDITOR = pkgs.writeShellScript "editor" ''
+          EDITOR = lib.getExe' editor "emacsclient";
-            args=("--reuse-frame" "--alternate-editor" "")
-            args+=("$@")
-            exec -a emacsclient ${lib.getExe' cfg.services.emacs.package "emacsclient"} "''${args[@]}"
-          '';
          RCLONE_PASSWORD_COMMAND = "${lib.getExe' pkgs.libsecret "secret-tool"} lookup service rclone";
+          SYSTEMD_TINT_BACKGROUND = "false";
        };
        extraProfileCommands = ''
@@ -467,13 +570,21 @@ in {
            General = {
              dot_as_separator = 0;
            };
+            Mode = {
+              calculate_as_you_type = 1;
+            };
          };
        };
-        "emacs/init.el".source = ./emacs.el;
+        "emacs/init.el".source = pkgs.substitute {
-        "systemd/user/xdg-desktop-portal.service.d/after-graphical-session.conf".text = ''
+          src = ./emacs.el;
-          [Unit]
+          substitutions = [
-          After=graphical-session.target
+            "--subst-var-by" "ksshaskpass" (lib.getExe pkgs.kdePackages.ksshaskpass)
-        '';
+          ];
+        };
+        # "systemd/user/xdg-desktop-portal.service.d/after-graphical-session.conf".text = ''
+        #   [Unit]
+        #   After=graphical-session.target
+        # '';
        "systemd/user/home-manager.service.d/before-graphical-session.conf".text = ''
          [Unit]
          Before=graphical-session-pre.target
@@ -487,6 +598,8 @@ in {
      xdg.dataFile = {
        "dbus-1/services/org.keepassxc.KeePassXC.service".source = "${wrappedKeepassxc}/share/dbus-1/services/org.keepassxc.KeePassXC.service";
        "dbus-1/services/org.freedesktop.secrets.service.service".source = "${wrappedKeepassxc}/share/dbus-1/services/org.freedesktop.secrets.service.service";
+        "dbus-1/services/org.kde.kwalletd6.service".source = "${pkgs.kdePackages.kwallet}/share/dbus-1/services/org.kde.kwalletd6.service";
+        "dbus-1/services/org.kde.kwalletd5.service".source = "${pkgs.kdePackages.kwallet}/share/dbus-1/services/org.kde.kwalletd5.service";
        "emoji-data/list.txt".source = pkgs.stdenv.mkDerivation {
          inherit (sources.emoji-data) pname src;
          version = lib.removePrefix "v" sources.emoji-data.version;
@@ -574,11 +687,11 @@ in {
            exec -- \
              ${lib.getExe' config.systemd.package "systemd-run"} --wait --user --slice-inherit \
              --property 'CPUAccounting=yes' --property 'CPUQuotaPeriodSec=50ms' \
-              --property 'Environment=DSCP=46' \
+              -E DSCP=46 -E NIXOS_OZONE_WL \
-              -- ${lib.getExe pkgs.dscp} ${lib.getExe' pkgs.google-chrome "google-chrome-stable"} \
+              -- ${lib.getExe pkgs.dscp} ${lib.getExe cfg.programs.chromium.package} \
              --class=Rainbow \
-              --kiosk "https://web.openrainbow.com" \
+              --app="https://web.openrainbow.com" \
-              --user-data-dir=''${HOME}/.config/google-chrome-rainbow
+              --user-data-dir=''${HOME}/.config/chromium-rainbow
          '');
          icon = pkgs.fetchurl {
            url = "https://web.openrainbow.com/rb/2.139.17/assets/skins/rainbow/images/homepage/logo__rainbow.svg";
@@ -588,6 +701,53 @@ in {
            StartupWMClass = "Rainbow";
          };
        };
+        kimai = {
+          name = "Kimai";
+          exec = toString (pkgs.writeShellScript "kimai" ''
+            exec -- \
+              ${lib.getExe cfg.programs.chromium.package} \
+              --class=Kimai \
+              --app="https://kimai.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/chromium-kimai
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.kimai.org/images/kimai_logo.png";
+            hash = "sha256-lnlOttzR2SwXA70R+egJUkeKr4U5V0avqTk8uX4bqfs=";
+          };
+          settings = {
+            StartupWMClass = "Kimai";
+            StartupNotify = "true";
+          };
+        };
+        audiobookshelf = {
+          name = "Audiobookshelf";
+          exec = toString (pkgs.writeShellScript "audiobookshelf" ''
+            exec -- \
+              ${lib.getExe cfg.programs.chromium.package} \
+              --class=Audiobookshelf \
+              --app="https://audiobookshelf.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/chromium-audiobookshelf
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.audiobookshelf.org/Logo.png";
+            hash = "sha256-JGPk+WNT1C4DC4lSMb0K0YmAMT5LvmSOeO0QRzkc7Lk=";
+          };
+          settings = {
+            StartupWMClass = "Audiobookshelf";
+            StartupNotify = "true";
+          };
+        };
+        thunderbird-lmu = {
+          name = "Thunderbird (LMU)";
+          exec = "thunderbird --name thunderbird -P lmu %U";
+          icon = "thunderbird";
+          genericName = "Email Client";
+          categories = [ "Network" "Chat" "Email" "Feed" "GTK" "News" ];
+          settings = {
+            StartupWMClass = "thunderbird";
+            StartupNotify = "true";
+          };
+        };
      };
      fonts = {
diff --git a/accounts/gkleen@sif/emacs.el b/accounts/gkleen@sif/emacs.el
index 5cee16b0..3beefba6 100644
--- a/accounts/gkleen@sif/emacs.el
+++ b/accounts/gkleen@sif/emacs.el
@@ -51,7 +51,7 @@
 ;; (require 'scratch)
 (global-set-key (kbd "C-x B") 'scratch-create)
-(setq initial-major-mode 'scratch-mode)
+;; (setq initial-major-mode 'scratch-mode)
 (setq initial-scratch-message "")
 (global-set-key (kbd "C-x K") 'kill-current-buffer)
@@ -254,3 +254,5 @@ necessarily running."
 (bind-key "C-x C-m" #'move-file)
 (let ((ssh_auth_sock (string-chop-newline (shell-command-to-string "gpgconf --list-dirs agent-ssh-socket")))) (setenv "SSH_AUTH_SOCK" ssh_auth_sock))
+(setenv "SSH_ASKPASS_REQUIRE" "prefer")
+(setenv "SSH_ASKPASS" "@ksshaskpass@")
diff --git a/accounts/gkleen@sif/niri/default.nix b/accounts/gkleen@sif/niri/default.nix
index 216a98ea..5ae372c1 100644
--- a/accounts/gkleen@sif/niri/default.nix
+++ b/accounts/gkleen@sif/niri/default.nix
@@ -3,13 +3,10 @@ let
  cfg = config.programs.niri;
  kdl = flakeInputs.niri-flake.lib.kdl;
+  sleaf = name: arg: kdl.node name [arg] [];
  niri = cfg.package;
  terminal = lib.getExe config.programs.kitty.package;
-  makoctl = lib.getExe' config.services.mako.package "makoctl";
-  loginctl = lib.getExe' hostConfig.systemd.package "loginctl";
-  systemctl = lib.getExe' hostConfig.systemd.package "systemctl";
-  swayosd-client = lib.getExe' config.services.swayosd.package "swayosd-client";
  focus_or_spawn = pkgs.writeShellApplication {
    name = "focus-or-spawn";
@@ -35,7 +32,11 @@ let
          if jq -e '.is_focused' <<<"$window_json" >/dev/null; then
            niri msg action focus-workspace-previous
          else
-            niri msg action focus-window --id "$(jq -r '.id' <<<"$window_json")"
+            if [[ $(jq -r --arg workspace_name "$workspace_name" 'map(select(.name == $workspace_name)) | .[0].is_focused' <<<"$workspaces_json") != "true" ]] && [[ $(jq -r --arg workspace_name "$workspace_name" 'map(select(.name == $workspace_name)) | .[0].id' <<<"$workspaces_json") = $(jq -r '.workspace_id' <<<"$window_json") ]]; then
+                niri msg action focus-workspace "$workspace_name"
+            else
+                niri msg action focus-window --id "$(jq -r '.id' <<<"$window_json")"
+            fi
          fi
          exit 0
        fi
@@ -45,7 +46,6 @@ let
    '';
  };
  focus-or-spawn-action = config.lib.niri.actions.spawn (lib.getExe focus_or_spawn);
-  focus-or-spawn-action-app_id = app_id: focus-or-spawn-action ''select(.app_id == "${app_id}")'';
  with_adjacent_workspace = pkgs.writeShellApplication {
    name = "with-adjacent-workspace";
@@ -84,7 +84,7 @@ let
  };
  with-adjacent-workspace-action = config.lib.niri.actions.spawn (lib.getExe with_adjacent_workspace) "^${lib.concatMapStringsSep "|" ({ name, ...}: name) cfg.scratchspaces}$";
  focus-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"FocusWorkspace":{"reference":{"Id": .id}}}}'';
-  move-column-to-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}}}}'';
+  move-column-to-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}, "focus": true}}}'';
  with_unnamed_workspace = pkgs.writeShellApplication {
    name = "with-unnamed-workspace";
@@ -131,7 +131,7 @@ let
      windows_json="$(niri msg -j windows)"
      active_workspace="$(jq -r '.[] | select(.is_focused) | .workspace_id' <<<"$windows_json")"
-      window_ix="$(gojq -r --arg active_workspace "$active_workspace" '.[] | select('"$window_select"') | "\(.title)\u0000icon\u001f\(.app_id)"' <<<"$windows_json" | fuzzel --log-level=warning --dmenu --index)"
+      window_ix="$(gojq -r --arg active_workspace "$active_workspace" '.[] | select('"$window_select"') | "\(.title)\u0000icon\u001f\(.app_id)"' <<<"$windows_json" | fuzzel --width=60 --log-level=warning --dmenu --index)"
      # shellcheck disable=SC2016
      window_json="$(gojq -rc --arg active_workspace "$active_workspace" --arg window_ix "$window_ix" 'map(select('"$window_select"')) | .[($window_ix | tonumber)]' <<<"$windows_json")"
@@ -141,13 +141,26 @@ let
    '';
  };
  with-select-window-action = config.lib.niri.actions.spawn (lib.getExe with_select_window);
-in {
-  imports = [
-    ./waybar.nix
-    ./mako.nix
-    ./swayosd.nix
-  ];
+  with_predicate_window = pred: pkgs.writeShellApplication {
+    name = "with-predicate-window";
+    runtimeInputs = [ niri pkgs.gojq pkgs.socat ];
+    text = ''
+      action="$1"
+      shift
+      windows_json="$(niri msg -j windows)"
+      window_json="$(gojq -rc 'map(select(${pred})) | .[0]' <<<"$windows_json")"
+      [[ -z "$window_json" || $window_json = "null" ]] && exit 1
+      jq -c "$action" <<<"$window_json" | socat STDIO "$NIRI_SOCKET"
+    '';
+  };
+  with-urgent-window-action = config.lib.niri.actions.spawn (lib.getExe (with_predicate_window ".is_urgent"));
+  with-focused-window-action = config.lib.niri.actions.spawn (lib.getExe (with_predicate_window ".is_focused"));
+in {
  options = {
    programs.niri.scratchspaces = lib.mkOption {
      type = lib.types.listOf (lib.types.submodule ({ config, ... }: {
@@ -171,6 +184,17 @@ in {
            type = lib.types.nullOr lib.types.str;
            default = null;
          };
+          moveKey = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = let
+              keys = lib.splitString "+" config.key;
+              defMoveKey = lib.concatStringsSep "+" (lib.flatten [
+                (lib.take (lib.length keys - 1) keys)
+                ["Shift"]
+                (lib.takeEnd 1 keys)
+              ]);
+            in if config.key == null then null else defMoveKey;
+          };
          spawn = lib.mkOption {
            type = lib.types.nullOr (lib.types.listOf lib.types.str);
            default = null;
@@ -197,36 +221,7 @@ in {
  };
  config = {
-    systemd.user.services.xwayland-satellite = {
+    home.packages = [ pkgs.xwayland-satellite-unstable ];
-      Unit = {
-        BindsTo = [ "graphical-session.target" ];
-        PartOf = [ "graphical-session.target" ];
-        After = [ "graphical-session.target" ];
-        Requisite = [ "graphical-session.target" ];
-      };
-      Service = {
-        Type = "notify";
-        NotifyAccess = "all";
-        Environment = [ "DISPLAY=:0" ];
-        ExecStart = ''${lib.getExe pkgs.xwayland-satellite-unstable} ''${DISPLAY}'';
-        ExecStartPre = "${systemctl} --user import-environment DISPLAY";
-        StandardOutput = "journal";
-      };
-      Install = {
-        WantedBy = [ "graphical-session.target" ];
-      };
-    };
-    services.swayidle = {
-      events = [
-        { event = "after-resume"; command = "${lib.getExe niri} msg action power-on-monitors"; }
-      ];
-      timeouts = [
-        { timeout = 540;
-          command = "${lib.getExe niri} msg action power-off-monitors";
-        }
-      ];
-    };
    systemd.user.sockets.niri-workspace-history = {
      Socket = {
@@ -245,11 +240,11 @@ in {
      Service = {
        Type = "simple";
        Sockets = [ "niri-workspace-history.socket" ];
-        ExecStart = pkgs.writers.writePython3 "niri-workspace-history" {} ''
+        ExecStart = pkgs.writers.writePython3 "niri-workspace-history" { flakeIgnore = ["E501"]; } ''
          import os
          import socket
          import json
-          import sys
+          # import sys
          from collections import defaultdict
          from threading import Thread, Lock
          from socketserver import StreamRequestHandler, ThreadingTCPServer
@@ -273,11 +268,9 @@ in {
              workspaces = list()
              def focus_workspace(output, workspace):
-                  global workspace_history, history_lock
                  with history_lock:
-                      workspace_history[output] = [workspace] + [ws for ws in workspace_history[output] if ws != workspace]  # noqa: E501
+                      workspace_history[output] = [workspace] + [ws for ws in workspace_history[output] if ws != workspace]
-                      print(json.dumps(workspace_history), file=sys.stderr)
+                      # print(json.dumps(workspace_history), file=sys.stderr)
              sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
              sock.connect(os.environ["NIRI_SOCKET"])
@@ -299,16 +292,14 @@ in {
          class RequestHandler(StreamRequestHandler):
              def handle(self):
-                  global workspace_history, history_lock
+                  with detaching(TextIOWrapper(self.wfile, encoding='utf-8', write_through=True)) as out:
-                  with detaching(TextIOWrapper(self.wfile, encoding='utf-8', write_through=True)) as out:  # noqa: E501
                      with history_lock:
                          json.dump(workspace_history, out)
          class Server(ThreadingTCPServer):
              def __init__(self):
-                  ThreadingTCPServer.__init__(self, ("", 8000), RequestHandler, bind_and_activate=False)  # noqa: E501
+                  ThreadingTCPServer.__init__(self, ("", 8000), RequestHandler, bind_and_activate=False)
                  self.socket = socket.fromfd(3, self.address_family, self.socket_type)
@@ -334,6 +325,79 @@ in {
        '';
      };
    };
+    systemd.user.services.niri-workspace-sort = {
+      Unit = {
+        BindsTo = [ "niri.service" ];
+        After = [ "niri.service" ];
+      };
+      Install = {
+        WantedBy = [ "niri.service" ];
+      };
+      Service = {
+        Type = "simple";
+        ExecStart = pkgs.writers.writePython3 "niri-workspace-sort" { flakeIgnore = ["E501"]; } ''
+          import os
+          import sys
+          import socket
+          import json
+          outputs = None
+          only = {'HDMI-A-1': {'bmr'}, 'eDP-1': {'vid'}}
+          class Niri(socket.socket):
+              def __init__(self):
+                  super().__init__(socket.AF_UNIX, socket.SOCK_STREAM)
+                  super().connect(os.environ["NIRI_SOCKET"])
+                  self.fh = super().makefile(mode='rw', buffering=1, encoding='utf-8')
+              def cmd(self, obj):
+                  print(json.dumps(obj, separators=(',', ':')), flush=True, file=self.fh)
+              def event_stream(self):
+                  self.cmd("EventStream")
+                  return self.fh
+          with Niri() as niri, Niri().event_stream() as niri_stream:
+              for line in niri_stream:
+                  workspaces = None
+                  if line_json := json.loads(line):
+                      if "WorkspacesChanged" in line_json:
+                          workspaces = line_json["WorkspacesChanged"]["workspaces"]
+                  if workspaces is None:
+                      continue
+                  old_outputs = outputs
+                  outputs = {ws["output"] for ws in workspaces}
+                  if old_outputs is None:
+                      print("Initial outputs: {}".format(outputs), file=sys.stderr)
+                      continue
+                  new_outputs = outputs - old_outputs
+                  if not new_outputs:
+                      continue
+                  print("New outputs: {}".format(new_outputs), file=sys.stderr)
+                  relevant_workspaces = list(filter(lambda ws: (ws["name"] is not None) or (ws["active_window_id"] is not None), workspaces))
+                  target_output = next(iter(outputs - set(only.keys())))
+                  if not target_output:
+                      continue
+                  for ws in relevant_workspaces:
+                      ws_ident = ws["name"] if ws["name"] is not None else (ws["output"], ws["idx"])
+                      if ws["output"] not in set(only.keys()):
+                          continue
+                      if ws_ident in only[ws["output"]]:
+                          continue
+                      print("{} -> {}".format(ws_ident, target_output), file=sys.stderr)
+                      niri.cmd({"Action": {"MoveWorkspaceToMonitor": {"reference": {"Id": ws["id"]}, "output": target_output}}})
+        '';
+        Restart = "on-failure";
+        RestartSec = 10;
+      };
+    };
    programs.niri.scratchspaces = [
      { name = "pwctl";
@@ -347,8 +411,8 @@ in {
          { title = "^Access Request.*"; }
          { title = ".*Passkey credentials$"; }
        ];
-        windowRuleExtra = [
+        windowRuleExtra = with kdl; [
-          (kdl.leaf "open-focused" false)
+          (sleaf "open-focused" false)
        ];
        key = "Mod+Control+P";
        app-id = "org.keepassxc.KeePassXC";
@@ -375,6 +439,20 @@ in {
        app-id = "com.github.wwmm.easyeffects";
        spawn = [ "easyeffects" ];
      }
+      { name = "time";
+        key = "Mod+Control+K";
+        app-id = "chrome-kimai.yggdrasil.li__-Default";
+        spawn = [ (toString (pkgs.resholve.writeScript "kimai" {
+          interpreter = pkgs.runtimeShell;
+          inputs = [ pkgs.dex ];
+          execer = [ "cannot:${lib.getExe pkgs.dex}" ];
+        } ''
+          exec dex $HOME/.local/state/nix/profile/share/applications/kimai.desktop
+        '')) ];
+        windowRuleExtra = with kdl; [
+          (sleaf "block-out-from" "screencast")
+        ];
+      }
    ];
    programs.niri.config =
      let
@@ -384,10 +462,12 @@ in {
          then v
          else null;
        opt-props = lib.filterAttrs (lib.const (value: value != null));
+        normalize-nodes = nodes: lib.remove null (lib.flatten nodes);
      in
-        [ (flag "prefer-no-csd")
+        normalize-nodes [
+          (flag "prefer-no-csd")
-          (leaf "screenshot-path" "~/screenshots/%Y-%m-%dT%H:%M:%S.png")
+          (sleaf "screenshot-path" "~/screenshots/%Y-%m-%dT%H:%M:%S.png")
          (plain "hotkey-overlay" [
            (flag "skip-at-startup")
@@ -395,80 +475,88 @@ in {
          (plain "input" [
            (plain "keyboard" [
-              (leaf "repeat-delay" 300)
+              (sleaf "repeat-delay" 300)
-              (leaf "repeat-rate" 50)
+              (sleaf "repeat-rate" 50)
              (plain "xkb" [
-                (leaf "layout" "us,us")
+                (sleaf "layout" "us,us")
-                (leaf "variant" "dvp,")
+                (sleaf "variant" "dvp,")
-                (leaf "options" "compose:caps,grp:win_space_toggle")
+                (sleaf "options" "compose:caps,grp:win_space_toggle")
              ])
            ])
            (flag "workspace-auto-back-and-forth")
-            # (leaf "focus-follows-mouse" {})
+            # (sleaf "focus-follows-mouse" {})
            # (flag "warp-mouse-to-focus")
            # (plain "touchpad" [ (flag "off") ])
            (plain "trackball" [
-              (leaf "scroll-method" "on-button-down")
+              (sleaf "scroll-method" "on-button-down")
-              (leaf "scroll-button" 278)
+              (sleaf "scroll-button" 278)
            ])
            (plain "touch" [
-              (leaf "map-to-output" "eDP-1")
+              (sleaf "map-to-output" "eDP-1")
            ])
          ])
-          (plain "environment" (lib.mapAttrsToList leaf {
+          (plain "gestures" [
+            (plain "hot-corners" [(flag "off")])
+          ])
+          (plain "environment" (lib.mapAttrsToList sleaf {
            NIXOS_OZONE_WL = "1";
            QT_QPA_PLATFORM = "wayland";
            QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
            GDK_BACKEND = "wayland";
            SDL_VIDEODRIVER = "wayland";
            DISPLAY = ":0";
+            ELECTRON_OZONE_PLATFORM_HINT = "auto";
+            SSH_ASKPASS_REQUIRE = "prefer";
+            SSH_ASKPASS = lib.getExe pkgs.kdePackages.ksshaskpass;
+            SUDO_ASKPASS = lib.getExe pkgs.kdePackages.ksshaskpass;
          }))
-          (node "output" "eDP-1" [
+          (node "output" ["eDP-1"] [
-            (leaf "scale" 1.5)
+            (sleaf "scale" 1.5)
-            (leaf "position" { x = 0; y = 0; })
+            (sleaf "position" { x = 0; y = 0; })
          ])
-          (node "output" "Ancor Communications Inc ASUS PB287Q 0x0000DD9B" [
+          (node "output" ["Ancor Communications Inc ASUS PB287Q 0x0000DD9B"] [
-            (leaf "scale" 1.5)
+            (sleaf "scale" 1.5)
-            (leaf "position" { x = 2560; y = 0; })
+            (sleaf "position" { x = 2560; y = 0; })
          ])
-          (node "output" "HP Inc. HP 727pu CN4417143K" [
+          (node "output" ["HP Inc. HP 727pu CN4417143K"] [
-            (leaf "mode" "2560x1440@119.998")
+            (sleaf "mode" "2560x1440@119.998")
-            (leaf "scale" 1)
+            (sleaf "scale" 1)
-            (leaf "position" { x = 2560; y = 0; })
+            (sleaf "position" { x = 2560; y = 0; })
            (flag "variable-refresh-rate")
          ])
          (plain "debug" [
-            (leaf "render-drm-device" "/dev/dri/by-path/pci-0000:00:02.0-render")
+            (sleaf "render-drm-device" "/dev/dri/by-path/pci-0000:00:02.0-render")
          ])
          (plain "animations" [
-            (leaf "slowdown" 0.5)
+            (sleaf "slowdown" 0.5)
            (plain "workspace-switch" [(flag "off")])
          ])
          (plain "layout" [
-            (leaf "gaps" 8)
+            (sleaf "gaps" 8)
            (plain "struts" [
-              (leaf "left" 0)
+              (sleaf "left" 26)
-              (leaf "right" 0)
+              (sleaf "right" 26)
-              (leaf "top" 0)
+              (sleaf "top" 0)
-              (leaf "bottom" 0)
+              (sleaf "bottom" 0)
            ])
            (plain "border" [
-              (leaf "width" 2)
+              (sleaf "width" 2)
-              (leaf "active-gradient" {
+              (sleaf "active-gradient" {
                from = "hsla(195 100% 45% 1)";
                to = "hsla(155 100% 37.5% 1)";
                angle = 29;
                relative-to = "workspace-view";
              })
-              (leaf "inactive-gradient" {
+              (sleaf "inactive-gradient" {
                from = "hsla(0 0% 27.7% 1)";
                to = "hsla(0 0% 23% 1)";
                angle = 29;
@@ -479,29 +567,29 @@ in {
              (flag "off")
            ])
-            (plain "preset-column-widths" (map (prop: leaf "proportion" prop) [
+            (plain "preset-column-widths" (map (prop: sleaf "proportion" prop) [
              (1. / 4.) (1. / 3.) (1. / 2.) (2. / 3.) (3. / 4.) (1.)
            ]))
-            (plain "default-column-width" [ (leaf "proportion" (1. / 2.)) ])
+            (plain "default-column-width" [ (sleaf "proportion" (1. / 2.)) ])
-            (plain "preset-window-heights" (map (prop: leaf "proportion" prop) [
+            (plain "preset-window-heights" (map (prop: sleaf "proportion" prop) [
              (1. / 3.) (1. / 2.) (2. / 3.) (1.)
            ]))
            (flag "always-center-single-column")
            (plain "tab-indicator" [
-              (leaf "gap" 4)
+              (sleaf "gap" 4)
-              (leaf "width" 8)
+              (sleaf "width" 8)
-              (leaf "gaps-between-tabs" 4)
+              (sleaf "gaps-between-tabs" 4)
              (flag "place-within-column")
-              (leaf "length" { total-proportion = 1.; })
+              (sleaf "length" { total-proportion = 1.; })
-              (leaf "active-gradient" {
+              (sleaf "active-gradient" {
                from = "hsla(195 100% 60% 0.75)";
                to = "hsla(155 100% 50% 0.75)";
                angle = 29;
                relative-to = "workspace-view";
              })
-              (leaf "inactive-gradient" {
+              (sleaf "inactive-gradient" {
                from = "hsla(0 0% 42% 0.66)";
                to = "hsla(0 0% 35% 0.66)";
                angle = 29;
@@ -515,127 +603,140 @@ in {
          ])
          (map (name:
-            (node "workspace" name [
+            (node "workspace" [name] [
-              (leaf "open-on-output" "eDP-1")
+              (sleaf "open-on-output" "eDP-1")
            ])
          ) (map ({name, ...}: name) cfg.scratchspaces))
          (map (name:
-            (leaf "workspace" name)
+            (sleaf "workspace" name)
          ) ["comm" "web" "vid" "bmr"])
          (plain "window-rule" [
-            (leaf "clip-to-geometry" true)
+            (sleaf "clip-to-geometry" true)
          ])
          (plain "window-rule" [
-            (leaf "match" { is-floating = true; })
+            (sleaf "match" { is-floating = true; })
-            (leaf "geometry-corner-radius" 8)
+            (sleaf "geometry-corner-radius" 8)
            (plain "shadow" [ (flag "on") ])
          ])
          (plain "window-rule" [
-            (leaf "match" { app-id = "^org\\.keepassxc\\.KeePassXC$"; })
+            (sleaf "match" { app-id = "^org\\.keepassxc\\.KeePassXC$"; })
-            (leaf "block-out-from" "screencast")
+            (sleaf "block-out-from" "screencast")
          ])
-          (plain "window-rule" [
+          (plain "window-rule" (normalize-nodes [
            (map (title:
-              (leaf "match" { app-id = "^org\\.keepassxc\\.KeePassXC$"; inherit title; })
+              (sleaf "match" { app-id = "^org\\.keepassxc\\.KeePassXC$"; inherit title; })
-            ) ["^Unlock Database.*" "^Access Request.*" ".*Passkey credentials$"])
+            ) ["^Unlock Database.*" "^Access Request.*" ".*Passkey credentials$" "Browser Access Request$"])
-            (leaf "open-focused" true)
+            (sleaf "open-focused" true)
-            (leaf "open-floating" true)
+            (sleaf "open-floating" true)
-          ])
+          ]))
          (map ({ name, match, exclude, windowRuleExtra, ... }:
-            (optional-node (match != []) (plain "window-rule" [
+            (optional-node (match != []) (plain "window-rule" (normalize-nodes [
-              (map (leaf "match") match)
+              (map (sleaf "match") match)
-              (map (leaf "exclude") exclude)
+              (map (sleaf "exclude") exclude)
-              (leaf "open-on-workspace" name)
+              (sleaf "open-on-workspace" name)
-              (leaf "open-maximized" true)
+              (sleaf "open-maximized" true)
              windowRuleExtra
-            ]))
+            ])))
          ) cfg.scratchspaces)
          (plain "window-rule" [
-            (leaf "match" { app-id = "^emacs$"; })
+            (sleaf "match" { app-id = "^emacs$"; })
-            (leaf "match" { app-id = "^firefox$"; })
+            (sleaf "match" { app-id = "^firefox$"; })
-            (plain "default-column-width" [(leaf "proportion" (2. / 3.))])
+            (plain "default-column-width" [(sleaf "proportion" (2. / 3.))])
          ])
          (plain "window-rule" [
-            (leaf "match" { app-id = "^kitty$"; })
+            (sleaf "match" { app-id = "^kitty$"; })
-            (leaf "match" { app-id = "^kitty-play$"; })
+            (sleaf "match" { app-id = "^kitty-play$"; })
-            (plain "default-column-width" [(leaf "proportion" (1. / 3.))])
+            (plain "default-column-width" [(sleaf "proportion" (1. / 3.))])
          ])
          (plain "window-rule" [
-            (leaf "match" { app-id = "^thunderbird$"; })
+            (sleaf "match" { app-id = "^thunderbird$"; })
-            (leaf "match" { app-id = "^Element$"; })
+            (sleaf "match" { app-id = "^Element$"; })
-            (leaf "match" { app-id = "^Rainbow$"; })
+            (sleaf "match" { app-id = "^chrome-web\.openrainbow\.com__-Default$"; })
-            (leaf "open-on-workspace" "comm")
+            (sleaf "open-on-workspace" "comm")
          ])
          (plain "window-rule" [
-            (leaf "match" { app-id = "^firefox$"; })
+            (sleaf "match" { app-id = "^firefox$"; })
-            (leaf "open-on-workspace" "web")
+            (sleaf "open-on-workspace" "web")
-            (leaf "open-maximized" true)
+            (sleaf "open-maximized" true)
          ])
          (plain "window-rule" [
-            (leaf "match" { app-id = "^mpv$"; })
+            (sleaf "match" { app-id = "^mpv$"; })
-            (leaf "open-on-workspace" "vid")
+            (sleaf "open-on-workspace" "vid")
-            (plain "default-column-width" [(leaf "proportion" 1.)])
+            (plain "default-column-width" [(sleaf "proportion" 1.)])
          ])
          (plain "window-rule" [
-            (leaf "match" { app-id = "^kitty-play$"; })
+            (sleaf "match" { app-id = "^kitty-play$"; })
-            (leaf "open-on-workspace" "vid")
+            (sleaf "open-on-workspace" "vid")
-            (leaf "open-focused" false)
+            (sleaf "open-focused" false)
          ])
          (plain "window-rule" [
-            (leaf "match" { app-id = "^pdfpc$"; })
+            (sleaf "match" { app-id = "^chrome-audiobookshelf\.yggdrasil\.li__-Default$"; })
-            (plain "default-column-width" [(leaf "proportion" 1.)])
+            (sleaf "match" { app-id = "^YouTube Music Desktop App$"; })
+            (sleaf "open-on-workspace" "vid")
          ])
          (plain "window-rule" [
-            (leaf "match" { app-id = "^pdfpc$"; title = "^pdfpc - presentation$"; })
+            (sleaf "match" { app-id = "^pdfpc$"; })
-            (plain "default-column-width" [(leaf "proportion" 1.)])
+            (plain "default-column-width" [(sleaf "proportion" 1.)])
-            (leaf "open-fullscreen" true)
-            (leaf "open-on-workspace" "bmr")
-            (leaf "open-focused" false)
          ])
          (plain "window-rule" [
-            (map (leaf "match") [
+            (sleaf "match" { app-id = "^pdfpc$"; title = "^.*presentation.*$"; })
+            (plain "default-column-width" [(sleaf "proportion" 1.)])
+            (sleaf "open-fullscreen" true)
+            (sleaf "open-on-workspace" "bmr")
+            (sleaf "open-focused" false)
+          ])
+          (plain "window-rule" (normalize-nodes [
+            (map (sleaf "match") [
              { app-id = "^Gimp-"; title = "^Quit GIMP$"; }
              { app-id = "^org\\.kde\\.polkit-kde-authentication-agent-1$"; }
              { app-id = "^xdg-desktop-portal-gtk$"; }
            ])
-            (leaf "open-floating" true)
+            (sleaf "open-floating" true)
-          ])
+          ]))
          (plain "window-rule" [
-            (leaf "match" { app-id = "^org\\.pwmt\\.zathura$"; })
+            (sleaf "match" { app-id = "^org\\.pwmt\\.zathura$"; })
-            (leaf "match" { app-id = "^evince$"; })
+            (sleaf "match" { app-id = "^evince$"; })
-            (leaf "default-column-display" "tabbed")
+            (sleaf "match" { app-id = "^org\\.gnome\\.Papers$"; })
+            (sleaf "default-column-display" "tabbed")
          ])
          (plain "layer-rule" [
-            (leaf "match" { namespace = "^notifications$"; })
+            (sleaf "match" { namespace = "^notifications$"; })
-            (leaf "match" { namespace = "^waybar$"; })
+            (sleaf "match" { namespace = "^bar$"; })
-            (leaf "match" { namespace = "^launcher$"; })
+            (sleaf "match" { namespace = "^launcher$"; })
-            (leaf "block-out-from" "screencast")
+            (sleaf "block-out-from" "screencast")
          ])
          (plain "binds"
            (let
-              bind = name: cfg: node name (opt-props {
+              bind = name: cfg: node name [(lib.removeAttrs cfg ["action"])] (lib.mapAttrsToList leaf (lib.removeAttrs cfg.action ["__functor"]));
-                cooldown-ms = cfg.cooldown-ms or null;
-              }
-              // (lib.optionalAttrs (!(cfg.repeat or true)) {
-                repeat = false;
-              })
-              // (lib.optionalAttrs (cfg.allow-when-locked or false) {
-                allow-when-locked = true;
-              })) (lib.mapAttrsToList leaf (lib.removeAttrs cfg.action ["__functor"]));
            in
-              [
+              normalize-nodes [
                (lib.mapAttrsToList bind (with config.lib.niri.actions; {
                  "Mod+Slash".action = show-hotkey-overlay;
                  "Mod+Return".action = spawn terminal;
+                  "Mod+Shift+Return".action =
+                    let
+                      nushellKitty = pkgs.symlinkJoin {
+                        name = "nushell-kitty";
+                        paths = [ config.programs.kitty.package ];
+                        buildInputs = [ pkgs.makeWrapper ];
+                        postBuild = ''
+                          wrapProgram $out/bin/kitty \
+                            --add-flags "--config ${pkgs.writeText "kitty.conf" ''
+                              include $HOME/${config.xdg.configFile."kitty/kitty.conf".target}
+                              shell ${lib.getExe config.programs.nushell.package}
+                            ''}"
+                        '';
+                      };
+                    in spawn (lib.getExe' nushellKitty "kitty");
                  "Mod+Q".action = close-window;
                  "Mod+O".action = spawn (lib.getExe config.programs.fuzzel.package);
                  "Mod+Shift+O".action = spawn (lib.getExe config.programs.fuzzel.package) "--list-executables-in-path";
@@ -671,12 +772,12 @@ in {
                        done < <(export LC_ALL=C.UTF-8; echo; find "$RESULTS_DIR" -type f -printf $'%T@ %p\n' | sort -n | cut -d' ' -f2- | xargs -r cat)
                        $FOUND || echo
                      }
-                      FUZZEL_RES=$(prev | fuzzel --dmenu --prompt "qalc> ") || exit $?
+                      FUZZEL_RES=$(prev | fuzzel --dmenu --prompt "qalc> " --width=60) || exit $?
                      if [[ "$FUZZEL_RES" =~ .*\ =\ .* ]]; then
                        QALC_RES="$FUZZEL_RES"
                        QALC_RET=0
                      else
-                        QALC_RES=$(qalc "$FUZZEL_RES" 2>&1)
+                        QALC_RES=$(qalc -set "autocalc off" "$FUZZEL_RES" 2>&1)
                        QALC_RET=$?
                      fi
                      [[ -n "$QALC_RES" ]] || exit 1
@@ -696,18 +797,33 @@ in {
                      notify-send "$QALC_RES"
                    '';
                  }));
+                  "Mod+Shift+U".action =
+                    let
+                      qalcKitty = pkgs.symlinkJoin {
+                        name = "qalc-kitty";
+                        paths = [ config.programs.kitty.package ];
+                        buildInputs = [ pkgs.makeWrapper ];
+                        postBuild = ''
+                          wrapProgram $out/bin/kitty \
+                            --add-flags "--config ${pkgs.writeText "kitty.conf" ''
+                              include $HOME/${config.xdg.configFile."kitty/kitty.conf".target}
+                              shell ${lib.getExe pkgs.libqalculate}
+                            ''}"
+                        '';
+                      };
+                    in spawn (lib.getExe' qalcKitty "kitty");
                  "Mod+E".action = spawn (lib.getExe (pkgs.writeShellApplication {
                    name = "emoji-fuzzel";
                    runtimeInputs = with pkgs; [ config.programs.fuzzel.package wtype wl-clipboard-rs ];
                    text = ''
-                      FUZZEL_RES=$(fuzzel --dmenu --prompt "emoji> " <"$HOME"/.local/share/emoji-data/list.txt) || exit $?
+                      FUZZEL_RES=$(fuzzel --dmenu --prompt "emoji> " --cache "$HOME"/.cache/fuzzel-emoji --width=60 <"$HOME"/.local/share/emoji-data/list.txt) || exit $?
                      [[ -n "$FUZZEL_RES" ]] || exit 1
                      wl-copy "$(cut -d ':' -f 1 <<<"$FUZZEL_RES" | tr -d '\n')" && wtype -k XF86Paste
                    '';
                  }));
                  "Print".action = screenshot;
                  "Control+Print".action = screenshot-window;
-                  # "Shift+Print".action = screenshot-screen;
+                  "Shift+Print".action = kdl.magic-leaf "screenshot-screen";
                  "Mod+B".action = with-select-window-action ".workspace_id == ($active_workspace | tonumber)" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
                  "Mod+Shift+B".action = with-select-window-action "true" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
@@ -746,22 +862,22 @@ in {
                  "Mod+Shift+Control+C".action = move-workspace-up;
                  "Mod+ParenLeft".action = focus-workspace "comm";
-                  "Mod+Shift+ParenLeft".action = move-column-to-workspace "comm";
+                  "Mod+Shift+ParenLeft".action = kdl.magic-leaf "move-column-to-workspace" "comm";
                  "Mod+ParenRight".action = focus-workspace "web";
-                  "Mod+Shift+ParenRight".action = move-column-to-workspace "web";
+                  "Mod+Shift+ParenRight".action = kdl.magic-leaf "move-column-to-workspace" "web";
                  "Mod+BraceRight".action = focus-workspace "read";
-                  "Mod+Shift+BraceRight".action = move-column-to-workspace "read";
+                  "Mod+Shift+BraceRight".action = kdl.magic-leaf "move-column-to-workspace" "read";
                  "Mod+BraceLeft".action = focus-workspace "mon";
-                  "Mod+Shift+BraceLeft".action = move-column-to-workspace "mon";
+                  "Mod+Shift+BraceLeft".action = kdl.magic-leaf "move-column-to-workspace" "mon";
                  "Mod+Asterisk".action = focus-workspace "vid";
-                  "Mod+Shift+Asterisk".action = move-column-to-workspace "vid";
+                  "Mod+Shift+Asterisk".action = kdl.magic-leaf "move-column-to-workspace" "vid";
                  "Mod+Plus".action = with-unnamed-workspace-action ''{"Action":{"FocusWorkspace":{"reference":{"Id": .id}}}}'';
-                  "Mod+Shift+Plus".action = with-unnamed-workspace-action ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}}}}'';
+                  "Mod+Shift+Plus".action = with-unnamed-workspace-action ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}, "focus": true}}}'';
                  "Mod+M".action = consume-or-expel-window-left;
                  "Mod+W".action = consume-or-expel-window-right;
@@ -769,10 +885,11 @@ in {
                  "Mod+Shift+M".action = toggle-column-tabbed-display;
                  "Mod+R".action = switch-preset-column-width;
-                  "Mod+Shift+R".action = switch-preset-window-height;
+                  "Mod+Shift+R".action = maximize-column;
+                  "Mod+Shift+Ctrl+R".action = switch-preset-window-height;
                  "Mod+F".action = center-column;
-                  "Mod+Shift+F".action = maximize-column;
+                  "Mod+Shift+F".action = toggle-windowed-fullscreen;
-                  "Mod+Shift+Ctrl+F".action = fullscreen-window;
+                  "Mod+Ctrl+Shift+F".action = fullscreen-window;
                  "Mod+V".action = switch-focus-between-floating-and-tiling;
                  "Mod+Shift+V".action = toggle-window-floating;
@@ -783,58 +900,77 @@ in {
                  "Mod+Right".action = set-column-width "+10%";
                  "Mod+Shift+Z" = {
-                    action = spawn (lib.getExe niri) "msg" "action" "power-off-monitors";
+                    action = power-off-monitors;
                    allow-when-locked = true;
                  };
-                  "Mod+Shift+L".action = spawn loginctl "lock-session";
                  "Mod+Shift+E".action = quit;
-                  "Mod+Shift+Minus" = {
-                    action = spawn systemctl "suspend";
+                  # "Mod+Semicolon".action = spawn makoctl "dismiss" "--group";
+                  # "Mod+Shift+Semicolon".action = spawn makoctl "dismiss" "--all";
+                  # "Mod+Period".action = spawn makoctl "menu" "--" (lib.getExe config.programs.fuzzel.package) "--dmenu";
+                  # "Mod+Comma".action = spawn makoctl "restore";
+                  "Mod+Control+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"FocusWorkspace\":{\"reference\":{\"Id\": $workspace_id}}}}";
+                  "Mod+Control+Shift+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"MoveColumnToWorkspace\":{\"reference\":{\"Id\": $workspace_id}, \"focus\": true}}}";
+                  "Mod+X".action = set-dynamic-cast-window;
+                  "Mod+Shift+X".action = set-dynamic-cast-monitor;
+                  "Mod+Control+Shift+X".action = clear-dynamic-cast-target;
+                  "Mod+D".action = with-urgent-window-action "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
+                  "Mod+Shift+D".action = with-focused-window-action "{\"Action\":{\"UnsetUrgent\":{\"id\": .id}}}";
+                  "Mod+K".action = spawn (lib.getExe' pkgs.worktime "worktime-ui");
+                  "Mod+Shift+K".action = spawn (lib.getExe' pkgs.worktime "worktime-stop");
+                }))
+                (lib.mapAttrsToList (name: cfg: node name [(lib.removeAttrs cfg ["action"])] [cfg.action]) (let
+                  shell = obj: leaf "send-unix" [
+                    { path = ''''${XDG_RUNTIME_DIR}/shell.sock''; }
+                    (builtins.toJSON obj + "\n")
+                  ];
+                in {
+                  "XF86AudioRaiseVolume" = {
                    allow-when-locked = true;
+                    action = shell { Volume.volume = "up"; };
                  };
-                  "Mod+Shift+Control+Minus" = {
+                  "XF86AudioLowerVolume" = {
-                    action = spawn systemctl "hibernate";
                    allow-when-locked = true;
+                    action = shell { Volume.volume = "down"; };
                  };
-                  "Mod+Shift+P" = {
+                  "XF86AudioMute" = {
-                    action = spawn (lib.getExe pkgs.playerctl) "-a" "pause";
                    allow-when-locked = true;
+                    action = shell { Volume.muted = "toggle"; };
                  };
+                  "XF86AudioMicMute" = {
-                  "XF86MonBrightnessUp" = {
-                    action = spawn swayosd-client "--brightness" "raise";
                    allow-when-locked = true;
+                    action = shell { Volume."mic-muted" = "toggle"; };
                  };
-                  "XF86MonBrightnessDown" = {
+                  "XF86MonBrightnessUp" = {
-                    action = spawn swayosd-client "--brightness" "lower";
+                    action = shell { Brightness = "up"; };
                    allow-when-locked = true;
                  };
-                  "XF86AudioRaiseVolume" = {
+                  "XF86MonBrightnessDown" = {
-                    action = spawn swayosd-client "--output-volume" "raise";
+                    action = shell { Brightness = "down"; };
                    allow-when-locked = true;
                  };
-                  "XF86AudioLowerVolume" = {
+                  "Mod+Shift+L".action = shell { LockSession = {}; };
-                    action = spawn swayosd-client "--output-volume" "lower";
+                  "Mod+Shift+Minus" = {
+                    action = shell { Suspend = {}; };
                    allow-when-locked = true;
                  };
-                  "XF86AudioMute" = {
+                  "Mod+Shift+Control+Minus" = {
-                    action = spawn swayosd-client "--output-volume" "mute-toggle";
+                    action = shell { Hibernate = {}; };
                    allow-when-locked = true;
                  };
-                  "XF86AudioMicMute" = {
+                  "Mod+Shift+P" = {
-                    action = spawn swayosd-client "--input-volume" "mute-toggle";
+                    action = shell { Mpris = { PauseAll = {}; }; };
                    allow-when-locked = true;
                  };
+                  "Mod+Semicolon".action = shell { Notifications = { DismissGroup = {}; }; };
-                  "Mod+Semicolon".action = spawn makoctl "dismiss" "--group";
+                  "Mod+Shift+Semicolon".action = shell { Notifications = { DismissAll = {}; }; };
-                  "Mod+Shift+Semicolon".action = spawn makoctl "dismiss" "--all";
-                  "Mod+Period".action = spawn makoctl "menu" (lib.getExe config.programs.fuzzel.package) "--dmenu";
-                  "Mod+Comma".action = spawn makoctl "restore";
-                  "Mod+Control+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"FocusWorkspace\":{\"reference\":{\"Id\": $workspace_id}}}}";
-                  "Mod+Control+Shift+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"MoveColumnToWorkspace\":{\"reference\":{\"Id\": $workspace_id}}}}";
                }))
                (map ({ name, selector, spawn, key, ...}: if key != null && selector != null && spawn != null then bind key { action = focus-or-spawn-action selector name spawn; } else null) cfg.scratchspaces)
+                (map ({ name, moveKey, ...}: if moveKey != null then bind moveKey { action = kdl.magic-leaf "move-column-to-workspace" name; } else null) cfg.scratchspaces)
              ]
            ))
        ];
diff --git a/accounts/gkleen@sif/niri/mako.nix b/accounts/gkleen@sif/niri/mako.nix
index 2788fb82..3d246d96 100644
--- a/accounts/gkleen@sif/niri/mako.nix
+++ b/accounts/gkleen@sif/niri/mako.nix
@@ -1,39 +1,32 @@
 { config, lib, pkgs, ... }:
 {
-  config = {
+  config = lib.mkIf false {
    services.mako = {
      enable = true;
-      font = "Fira Sans 10";
+      settings = {
-      format = "<i>%s</i>\\n%b";
+        font = "Fira Sans 10";
-      margin = "2";
+        format = "<i>%s</i>\\n%b";
-      maxVisible = -1;
+        margin = "2";
-      backgroundColor = "#000000dd";
+        max-visible = -1;
-      progressColor = "source #223544ff";
+        background-color = "#000000dd";
-      width = 384;
+        progress-color = "source #223544ff";
-      extraConfig = ''
+        width = 384;
-        outer-margin=1
+        outer-margin = 1;
-        max-history=100
+        max-history = 100;
-        max-icon-size=48
+        max-icon-size = 48;
-        [grouped]
+        grouped.format = "<b>(%g)</b> <i>%s</i>\\n%b";
-        format=<b>(%g)</b> <i>%s</i>\n%b
+        "urgency=low".text-color = "#999999ff";
+        "urgency=critical".background-color = "#900000dd";
-        [urgency=low]
+        "app-name=Element".group-by = "summary";
-        text-color=#999999ff
+        "app-name=poweralertd" = {
+          history = false;
-        [urgency=critical]
+          ignore-timeout = true;
-        background-color=#900000dd
+          default-timeout = 2000;
+        };
-        [app-name=Element]
+        "app-name=worktime".history = false;
-        group-by=summary
+        "mode=silent".invisible = true;
+      };
-        [app-name=poweralertd]
-        ignore-timeout=1
-        default-timeout=2000
-        [mode=silent]
-        invisible=1
-      '';
      package = pkgs.symlinkJoin {
        name = "${pkgs.mako.name}-wrapped";
        paths = with pkgs; [ mako ];
diff --git a/accounts/gkleen@sif/niri/swayosd.nix b/accounts/gkleen@sif/niri/swayosd.nix
deleted file mode 100644
index 984927c2..00000000
--- a/accounts/gkleen@sif/niri/swayosd.nix
+++ /dev/null
@@ -1,65 +0,0 @@
-{ pkgs, ... }:
-{
-  config = {
-    services.swayosd = {
-      enable = true;
-      topMargin = 0.946154;
-      stylePath = pkgs.runCommand "style.css" {
-        src = pkgs.writeText "style.scss" ''
-          window#osd {
-            padding: 12px 20px;
-            border-radius: 999px;
-            border: none;
-            background: rgba(0, 0, 0, 0.87);
-            #container {
-              margin: 16px;
-            }
-            image,
-            label {
-              color: rgb(255, 255, 255);
-              &:disabled {
-                opacity: 1;
-                color: rgb(84, 84, 84);
-              }
-            }
-            progressbar {
-              min-height: 6px;
-              border-radius: 999px;
-              background: transparent;
-              border: none;
-              trough, progress {
-                min-height: inherit;
-                border-radius: inherit;
-                border: none;
-              }
-              trough {
-                background: rgb(127, 127, 127);
-              }
-              progress {
-                background: rgb(255, 255, 255);
-              }
-              &:disabled {
-                opacity: 1;
-                trough {
-                  background: rgb(19, 19, 19);
-                }
-                progress {
-                  background: rgb(38, 38, 38);
-                }
-              }
-            }
-          }
-        '';
-        buildInputs = with pkgs; [sass];
-      } "scss -C --sourcemap=none --style=compact $src $out";
-    };
-  };
-}
diff --git a/accounts/gkleen@sif/niri/waybar.nix b/accounts/gkleen@sif/niri/waybar.nix
deleted file mode 100644
index bae818f6..00000000
--- a/accounts/gkleen@sif/niri/waybar.nix
+++ /dev/null
@@ -1,347 +0,0 @@
-{ lib, config, pkgs, ... }:
-let
-  swayosd-client = lib.getExe' config.services.swayosd.package "swayosd-client";
-in {
-  config = {
-    programs.waybar = {
-      enable = true;
-      systemd = {
-        enable = true;
-        target = "graphical-session.target";
-      };
-      settings = let
-        windowRewrites = {
-          "(.*) — Mozilla Firefox" = "$1";
-          "(.*) - Mozilla Thunderbird" = "$1";
-          "(.*) - mpv" = "$1";
-        };
-        iconSize = 11;
-      in [
-        {
-          layer = "top";
-          position = "top";
-          height = 14;
-          output = [ "eDP-1" "DP-2" "DP-3" ];
-          modules-left = [ "niri/workspaces" ];
-          modules-center = [ "niri/window" ];
-          modules-right = [ "custom/worktime" "custom/worktime-today"
-            "custom/weather"
-            "custom/keymap"
-            "privacy" "tray" "wireplumber" "backlight" "battery" "idle_inhibitor" "custom/mako" "clock" ];
-          "custom/mako" = {
-            format = "{}";
-            return-type = "json";
-            exec = pkgs.writers.writePython3 "mako-silent" { libraries = [ pkgs.python3Packages.dbus-next ]; } ''
-              from dbus_next.aio import MessageBus
-              import asyncio
-              import json
-              loop = asyncio.new_event_loop()
-              asyncio.set_event_loop(loop)
-              async def main():
-                  bus = await MessageBus().connect()
-                  # the introspection xml would normally be included in your project, but
-                  # this is convenient for development
-                  introspection = await bus.introspect('org.freedesktop.Notifications', '/fr/emersion/Mako')  # noqa: E501
-                  obj = bus.get_proxy_object('org.freedesktop.Notifications', '/fr/emersion/Mako', introspection)  # noqa: E501
-                  mako = obj.get_interface('fr.emersion.Mako')
-                  properties = obj.get_interface('org.freedesktop.DBus.Properties')
-                  async def print_mode():
-                      modes = await mako.get_modes()
-                      is_silent = "silent" in modes
-                      icon = "&#xf009b;" if is_silent else "&#xf009a;"
-                      text = f"<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>"  # noqa: E501
-                      if is_silent:
-                          text = f"<span color=\"#ffffff\">{text}</span>"
-                      print(json.dumps({'text': text, 'tooltip': ', '.join(modes)}, separators=(',', ':')), flush=True)  # noqa: E501
-                  async def on_properties_changed(interface_name, changed_properties, invalidated_properties):  # noqa: E501
-                      if "Modes" not in invalidated_properties:
-                          return
-                      await print_mode()
-                  properties.on_properties_changed(on_properties_changed)
-                  await print_mode()
-                  await loop.create_future()
-              loop.run_until_complete(main())
-            '';
-            on-click = "makoctl mode -t silent";
-          };
-          "custom/weather" = {
-            format = "{}";
-            tooltip = true;
-            interval = 3600;
-            exec = "${lib.getExe pkgs.wttrbar} --hide-conditions --nerd --custom-indicator \"<span font=\\\"Symbols Nerd Font Mono\\\" size=\\\"100%\\\">{ICON}</span> {FeelsLikeC}°\"";
-            return-type = "json";
-          };
-          "custom/keymap" = {
-            format = "{}";
-            tooltip = true;
-            return-type = "json";
-            exec = pkgs.writers.writePython3 "keymap" {} ''
-              import os
-              import socket
-              import json
-              def output(keymap):
-                  short = keymap
-                  if keymap == "English (programmer Dvorak)":
-                      short = "dvp"
-                  elif keymap == "English (US)":
-                      short = "<span color=\"#ffffff\">us</span>"
-                  print(json.dumps({'text': short, 'tooltip': keymap}, separators=(',', ':')), flush=True)  # noqa: E501
-              keyboard_layouts = []
-              sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-              sock.connect(os.environ["NIRI_SOCKET"])
-              sock.send(b"\"EventStream\"\n")
-              for line in sock.makefile(buffering=1, encoding='utf-8'):
-                  if line_json := json.loads(line):
-                      if "KeyboardLayoutsChanged" in line_json:
-                          keyboard_layouts = line_json["KeyboardLayoutsChanged"]["keyboard_layouts"]["names"]  # noqa: E501
-                          output(keyboard_layouts[line_json["KeyboardLayoutsChanged"]["keyboard_layouts"]["current_idx"]])  # noqa: E501
-                      if "KeyboardLayoutSwitched" in line_json:
-                          output(keyboard_layouts[line_json["KeyboardLayoutSwitched"]["idx"]])  # noqa: E501
-            '';
-            on-click = "niri msg action switch-layout next";
-          };
-          "custom/worktime" = {
-            interval = 60;
-            exec = "${lib.getExe pkgs.worktime} time --waybar";
-            return-type = "json";
-          };
-          "custom/worktime-today" = {
-            interval = 60;
-            exec = "${lib.getExe pkgs.worktime} today --waybar";
-            return-type = "json";
-          };
-          "niri/workspaces" = {
-            ignore = map ({ name, ... }: name) config.programs.niri.scratchspaces;
-          };
-          "niri/window" = {
-            separate-outputs = true;
-            icon = true;
-            icon-size = 14;
-            rewrite = windowRewrites;
-          };
-          clock = {
-              interval = 1;
-              # timezone = "Europe/Berlin";
-              format = "W{:%V-%u %F %H:%M:%S%Ez}";
-              tooltip-format = "<tt><small>{calendar}</small></tt>";
-              calendar = {
-                mode = "year";
-                mode-mon-col = 3;
-                weeks-pos = "left";
-                on-scroll = 1;
-                format = {
-                  months = "<span color='#ffead3'><b>{}</b></span>";
-                  days = "{}";
-                  weeks = "<span color='#99ffdd'><b>{}</b></span>";
-                  weekdays = "<span color='#ffcc66'><b>{}</b></span>";
-                  today = "<span color='#ff6699'><b>{}</b></span>";
-                };
-              };
-          };
-          battery = {
-            format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
-            icon-size = iconSize - 2;
-            states = { warning = 30; critical = 15; };
-            format-icons = ["&#xf008e;" "&#xf007a;" "&#xf007b;" "&#xf007c;" "&#xf007d;" "&#xf007e;" "&#xf007f;" "&#xf0080;" "&#xf0081;" "&#xf0082;" "&#xf0079;" ];
-            format-charging = "&#xf0084;";
-            format-plugged = "&#xf06a5;";
-            tooltip-format = "{capacity}% {timeTo}";
-            interval = 20;
-          };
-          tray = {
-            icon-size = 16;
-            # show-passive-items = true;
-            spacing = 1;
-          };
-          privacy = {
-            icon-spacing = 7;
-            icon-size = iconSize;
-            modules = [
-              { type = "screenshare"; }
-              { type = "audio-in"; }
-            ];
-          };
-          idle_inhibitor = {
-            format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
-            icon-size = iconSize;
-            format-icons = { activated = "&#xf0208;"; deactivated = "&#xf0209;"; };
-            timeout = 120;
-          };
-          backlight = {
-            format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
-            icon-size = iconSize;
-            tooltip-format = "{percent}%";
-            format-icons = ["&#xf00da;" "&#xf00db;" "&#xf00dc;" "&#xf00dd;" "&#xf00de;" "&#xf00df;" "&#xf00e0;"];
-            on-scroll-up = "${swayosd-client} --brightness raise";
-            on-scroll-down = "${swayosd-client} --brightness lower";
-          };
-          wireplumber = {
-            format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
-            icon-size = iconSize;
-            tooltip-format = "{volume}% {node_name}";
-            format-icons = ["&#xf057f;" "&#xf0580;" "&#xf057e;"];
-            format-muted = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">&#xf075f;</span>";
-            # ignored-sinks = ["Easy Effects Sink"];
-            on-scroll-up = "${swayosd-client} --output-volume raise";
-            on-scroll-down = "${swayosd-client} --output-volume lower";
-            on-click = "${swayosd-client} --output-volume mute-toggle";
-          };
-        }
-        {
-          layer = "top";
-          position = "top";
-          height = 14;
-          output = [ "!eDP-1" "!DP-2" "!DP-3" ];
-          modules-left = [ "niri/workspaces" ];
-          modules-center = [ "niri/window" ];
-          modules-right = [ "clock" ];
-          "niri/workspaces" = {
-            ignore = map ({ name, ... }: name) config.programs.niri.scratchspaces;
-          };
-          "niri/window" = {
-            separate-outputs = true;
-            icon = true;
-            icon-size = 14;
-            rewrite = windowRewrites;
-          };
-          clock = {
-              interval = 1;
-              # timezone = "Europe/Berlin";
-              format = "{:%H:%M}";
-              tooltip-format = "W{:%V-%u %F %H:%M:%S%Ez}";
-          };
-        }
-      ];
-      style = ''
-        @define-color white #ffffff;
-        @define-color grey #555555;
-        @define-color blue #1a8fff;
-        @define-color green #23fd00;
-        @define-color orange #f28a21;
-        @define-color red #f2201f;
-        * {
-          border: none;
-          font-family: "Fira Sans";
-          font-size: 10pt;
-          min-height: 0;
-        }
-        window#waybar {
-          background-color: rgba(0, 0, 0, 0.66);
-          color: @white;
-        }
-        .modules-left {
-          margin-left: 12px;
-        }
-        .modules-right {
-          margin-right: 12px;
-        }
-        .module {
-          margin: 0 5px;
-        }
-        #workspaces button {
-          color: @white;
-          padding: 2px 5px;
-        }
-        #workspaces button.empty {
-          color: @grey;
-        }
-        #workspaces button.active {
-          color: @green;
-        }
-        #workspaces button.urgent {
-          color: @red;
-        }
-        #custom-weather, #custom-keymap, #custom-worktime, #custom-worktime-today {
-          color: @grey;
-          margin: 0 5px;
-        }
-        #custom-weather {
-          margin-right: 3px;
-        }
-        #custom-keymap {
-          margin-left: 3px;
-          margin-right: 3px;
-        }
-        #tray {
-          margin: 0;
-        }
-        #battery, #idle_inhibitor, #backlight, #wireplumber, #custom-mako {
-          color: @grey;
-          margin: 0 5px 0 2px;
-        }
-        #idle_inhibitor {
-          margin-right: 4px;
-          margin-left: 6px;
-        }
-        #custom-mako {
-          margin-right: 2px;
-          margin-left: 3px;
-        }
-        #battery {
-          margin-right: 3px;
-        }
-        #battery.discharging {
-          color: @white;
-        }
-        #battery.warning {
-          color: @orange;
-        }
-        #battery.critical {
-          color: @red;
-        }
-        #battery.charging {
-          color: @white;
-        }
-        #idle_inhibitor.activated {
-          color: @white;
-        }
-        #custom-worktime.running, #custom-worktime-today.running {
-          color: @white;
-        }
-        #custom-worktime.over, #custom-worktime-today.over {
-          color: @orange;
-        }
-        #idle_inhibitor {
-          padding-top: 1px;
-        }
-        #privacy {
-          color: @red;
-          margin: -1px 4px 0px 3px;
-        }
-        #clock {
-          /* margin-right: 5px; */
-        }
-      '';
-    };
-  };
-}
diff --git a/accounts/gkleen@sif/shell/default.nix b/accounts/gkleen@sif/shell/default.nix
new file mode 100644
index 00000000..44462865
--- /dev/null
+++ b/accounts/gkleen@sif/shell/default.nix
@@ -0,0 +1,115 @@
+{ config, pkgs, lib, ... }:
+{
+  config = {
+    programs.quickshell = {
+      enable = true;
+      package = pkgs.symlinkJoin {
+        pname = pkgs.quickshell.pname + "-wrapped";
+        inherit (pkgs.quickshell) version meta;
+        paths = [ pkgs.quickshell ];
+        buildInputs = [ pkgs.makeWrapper ];
+        postBuild = ''
+          for binary in quickshell qs; do
+            wrapProgram $out/bin/$binary \
+              --prefix QML_IMPORT_PATH : ${pkgs.qt6Packages.callPackage ./quickshell-plugins {}}/${pkgs.qt6.qtbase.qtQmlPrefix}
+          done
+        '';
+      };
+      config = {
+        src = ./quickshell;
+        replacements = {
+          ignore_workspaces = builtins.toJSON (map ({ name, ... }: name) config.programs.niri.scratchspaces);
+          wallpapers = builtins.toJSON (pkgs.stdenvNoCC.mkDerivation {
+            name = "wallpapers";
+            srcs = [
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/publicationtiff10k/carinanebula3.tif";
+                hash = "sha256-YxZEweDKJfvfrdxb/QFmgJhcZDEJYxotoHrG+RRn1tw=";
+              })
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/original/pillarsofcreation_composite.tif";
+                hash = "sha256-qRiODxR0lZWdxgYXna0fNRFFDErpBJDwOJuQl6sNjRc=";
+              })
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/publicationtiff10k/weic2212a.tif";
+                hash = "sha256-l2fqE/z//C1a0xkvZwsnwPbTSb+WuA11h+SUl3E1dhw=";
+              })
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/publicationtiff10k/weic2415a.tif";
+                hash = "sha256-onBy7cPoUpDuzQStbY2E+qmlGgSLXPwFCLX53ukAb4c=";
+              })
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/publicationtiff10k/weic2330a.tif";
+                hash = "sha256-nn0ZtjZIrPcpj3YcLTsrL7XiXvyh3QYgCSmdDMD+3OM=";
+              })
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/original/weic2426a.tif";
+                hash = "sha256-EDnfPn3GE9jt6XPqiGInP7E2F3Az7d25NqATSWltDv0=";
+              })
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/original/weic2503a.tif";
+                hash = "sha256-3/RX6RQp8naELcgReHPd5/zhJkoCjnA10w5BEnNo+qI=";
+              })
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/original/weic2506a.tif";
+                hash = "sha256-aDld0aoY1owRxDVf7Jcyw71TH42M1foYotxn2thyFYw=";
+              })
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/original/weic2514a.tif";
+                hash = "sha256-jTi1G1Ofo5xsF6ggrbtYJHxqLaCQ7edM5B3uORiVQtg=";
+              })
+              (pkgs.fetchurl {
+                url = "https://esawebb.org/media/archives/images/original/weic2425c.tif";
+                hash = "sha256-oaEOexSJHEGj090dJF3ct5HAoR+Y5gRiPrUlxdvnTRo=";
+              })
+            ];
+            dontUnpack = true;
+            buildInputs = [ pkgs.imagemagick ];
+            buildPhase = ''
+              runHook preBuild
+              typeset sources=($srcs)
+              mkdir -p $out
+              magick ''${sources[0]} -crop 10000x5625+0+79 +repage -define jpeg:extent=10MB $out/carinanebula3.jpeg
+              magick ''${sources[1]} -crop 6716x3778+329+80 +repage -define jpeg:extent=10MB $out/pillarsofcreation_composite.jpeg
+              magick ''${sources[2]} -crop 10000x5625+0+79 +repage -define jpeg:extent=10MB $out/weic2212a.jpeg
+              magick ''${sources[3]} -crop 7650x4302+1166+389 +repage -define jpeg:extent=10MB $out/weic2415a.jpeg
+              magick ''${sources[4]} -crop 8732x4912+0+434 +repage -define jpeg:extent=10MB $out/weic2330a.jpeg
+              magick ''${sources[5]} -crop 5302x2982+636+0 +repage -define jpeg:extent=10MB $out/weic2426a.jpeg
+              magick ''${sources[6]} -crop 4328x2434+0+906 +repage -define jpeg:extent=10MB $out/weic2503a.jpeg
+              magick ''${sources[7]} -crop 4152x2335+0+666 +repage -define jpeg:extent=10MB $out/weic2506a.jpeg
+              magick ''${sources[8]} -crop 4320x2430+0+0 +repage -define jpeg:extent=10MB $out/weic2514a.jpeg
+              magick ''${sources[9]} -crop 5863x3298+0+477 +repage -define jpeg:extent=10MB $out/weic2425c.jpeg
+              runHook postBuild
+            '';
+          });
+          niri_session = builtins.toJSON [
+            (pkgs.writeShellScript "niri-session" ''
+              exec ${lib.getExe pkgs.dex} -w ${config.programs.niri.package}/share/wayland-sessions/niri.desktop &>/tmp/niri-session-$$.log
+            '')
+            # (lib.getExe pkgs.dex)
+            # "${config.programs.niri.package}/share/wayland-sessions/niri.desktop"
+          ];
+          username = builtins.toJSON config.home.username;
+          mdi = builtins.toJSON (pkgs.fetchFromGitHub {
+            owner = "Templarian";
+            repo = "MaterialDesign";
+            rev = "2424e748e0cc63ab7b9c095a099b9fe239b737c0";
+            hash = "sha256-QMGl7soAhErrrnY3aKOZpt49yebkSNzy10p/v5OaqQ0=";
+          });
+          worktime = builtins.toJSON (lib.getExe pkgs.worktime);
+        };
+      };
+    };
+    systemd.user.services.quickshell = {
+      Service = {
+        RuntimeDirectory = "quickshell";
+      };
+    };
+  };
+}
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/CMakeLists.txt b/accounts/gkleen@sif/shell/quickshell-plugins/CMakeLists.txt
new file mode 100644
index 00000000..020c0515
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/CMakeLists.txt
@@ -0,0 +1,168 @@
+set(INSTALL_QMLDIR "" CACHE STRING "QML install dir")
+set(INSTALL_QML_PREFIX "" CACHE STRING "QML install prefix")
+# There doesn't seem to be a standard cross-distro qml install path.
+if ("${INSTALL_QMLDIR}" STREQUAL "" AND "${INSTALL_QML_PREFIX}" STREQUAL "")
+        message(WARNING "Neither INSTALL_QMLDIR nor INSTALL_QML_PREFIX is set. QML modules will not be installed.")
+else()
+        if ("${INSTALL_QMLDIR}" STREQUAL "")
+                set(QML_FULL_INSTALLDIR "${CMAKE_INSTALL_PREFIX}/${INSTALL_QML_PREFIX}")
+        else()
+                set(QML_FULL_INSTALLDIR "${INSTALL_QMLDIR}")
+        endif()
+        message(STATUS "QML install dir: ${QML_FULL_INSTALLDIR}")
+endif()
+# Install a given target as a QML module. This is mostly pulled from ECM, as there does not seem
+# to be an official way to do it.
+# see https://github.com/KDE/extra-cmake-modules/blob/fe0f606bf7f222e36f7560fd7a2c33ef993e23bb/modules/ECMQmlModule6.cmake#L160
+function(install_qml_module arg_TARGET)
+        if (NOT DEFINED QML_FULL_INSTALLDIR)
+                return()
+        endif()
+        qt_query_qml_module(${arg_TARGET}
+                URI module_uri
+                VERSION module_version
+                PLUGIN_TARGET module_plugin_target
+                TARGET_PATH module_target_path
+                QMLDIR module_qmldir
+                TYPEINFO module_typeinfo
+                QML_FILES module_qml_files
+                RESOURCES module_resources
+        )
+  set(module_dir "${QML_FULL_INSTALLDIR}/${module_target_path}")
+  if (NOT TARGET "${module_plugin_target}")
+    message(FATAL_ERROR "install_qml_modules called for a target without a plugin")
+  endif()
+        get_target_property(target_type "${arg_TARGET}" TYPE)
+        if (NOT "${target_type}" STREQUAL "STATIC_LIBRARY")
+                install(
+                        TARGETS "${arg_TARGET}"
+                        LIBRARY DESTINATION "${module_dir}"
+                        RUNTIME DESTINATION "${module_dir}"
+                )
+                install(
+                        TARGETS "${module_plugin_target}"
+                        LIBRARY DESTINATION "${module_dir}"
+                        RUNTIME DESTINATION "${module_dir}"
+                )
+        endif()
+  install(FILES "${module_qmldir}" DESTINATION "${module_dir}")
+  install(FILES "${module_typeinfo}" DESTINATION "${module_dir}")
+  # Install QML files
+  list(LENGTH module_qml_files num_files)
+  if (NOT "${module_qml_files}" MATCHES "NOTFOUND" AND ${num_files} GREATER 0)
+    qt_query_qml_module(${arg_TARGET} QML_FILES_DEPLOY_PATHS qml_files_deploy_paths)
+    math(EXPR last_index "${num_files} - 1")
+    foreach(i RANGE 0 ${last_index})
+      list(GET module_qml_files       ${i} src_file)
+      list(GET qml_files_deploy_paths ${i} deploy_path)
+      get_filename_component(dst_name "${deploy_path}" NAME)
+      get_filename_component(dest_dir "${deploy_path}" DIRECTORY)
+      install(FILES "${src_file}" DESTINATION "${module_dir}/${dest_dir}" RENAME "${dst_name}")
+    endforeach()
+  endif()
+  # Install resources
+  list(LENGTH module_resources num_files)
+  if (NOT "${module_resources}" MATCHES "NOTFOUND" AND ${num_files} GREATER 0)
+    qt_query_qml_module(${arg_TARGET} RESOURCES_DEPLOY_PATHS resources_deploy_paths)
+    math(EXPR last_index "${num_files} - 1")
+    foreach(i RANGE 0 ${last_index})
+      list(GET module_resources       ${i} src_file)
+      list(GET resources_deploy_paths ${i} deploy_path)
+      get_filename_component(dst_name "${deploy_path}" NAME)
+      get_filename_component(dest_dir "${deploy_path}" DIRECTORY)
+      install(FILES "${src_file}" DESTINATION "${module_dir}/${dest_dir}" RENAME "${dst_name}")
+    endforeach()
+  endif()
+endfunction()
+cmake_minimum_required(VERSION 3.20)
+project(custom LANGUAGES CXX)
+find_package(Qt6 REQUIRED COMPONENTS Core Qml DBus)
+qt_standard_project_setup(REQUIRES 6.6)
+qt6_policy(SET QTP0001 NEW)
+qt6_add_qml_module(customplugin
+    URI "Custom"
+    PLUGIN_TARGET customplugin
+)
+set_source_files_properties(org.keepassxc.KeePassXC.MainWindow.xml PROPERTIES
+        CLASSNAME DBusKeePassXC
+        NO_NAMESPACE TRUE
+)
+qt_add_dbus_interface(DBUS_INTERFACES
+        org.keepassxc.KeePassXC.MainWindow.xml
+        dbus_keepassxc
+)
+set_source_files_properties(org.freedesktop.systemd1.Manager.xml PROPERTIES
+        CLASSNAME DBusSystemdManager
+        NO_NAMESPACE TRUE
+)
+qt_add_dbus_interface(DBUS_INTERFACES
+        org.freedesktop.systemd1.Manager.xml
+        dbus_systemd_manager
+)
+set_source_files_properties(org.freedesktop.login1.Manager.xml PROPERTIES
+        CLASSNAME DBusLogindManager
+        NO_NAMESPACE TRUE
+)
+qt_add_dbus_interface(DBUS_INTERFACES
+        org.freedesktop.login1.Manager.xml
+        dbus_logind_manager
+)
+set_source_files_properties(org.freedesktop.login1.Session.xml PROPERTIES
+        CLASSNAME DBusLogindSession
+        NO_NAMESPACE TRUE
+)
+qt_add_dbus_interface(DBUS_INTERFACES
+        org.freedesktop.login1.Session.xml
+        dbus_logind_session
+)
+set_source_files_properties(org.freedesktop.DBus.Properties.xml PROPERTIES
+        CLASSNAME DBusProperties
+        NO_NAMESPACE TRUE
+)
+qt_add_dbus_interface(DBUS_INTERFACES
+        org.freedesktop.DBus.Properties.xml
+        dbus_properties
+)
+include_directories(${CMAKE_SOURCE_DIR}/build)
+target_compile_features(customplugin PUBLIC cxx_std_26)
+target_link_libraries(customplugin PRIVATE
+    Qt6::Core
+    Qt6::Qml
+    Qt6::DBus
+)
+target_sources(customplugin PRIVATE
+    Chrono.cpp Chrono.hpp
+    FileSelector.cpp FileSelector.hpp
+    KeePassXC.cpp KeePassXC.hpp
+    Systemd.cpp Systemd.hpp
+    ${DBUS_INTERFACES}
+)
+install_qml_module(customplugin)
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/Chrono.cpp b/accounts/gkleen@sif/shell/quickshell-plugins/Chrono.cpp
new file mode 100644
index 00000000..22b3469b
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/Chrono.cpp
@@ -0,0 +1,83 @@
+#include "Chrono.hpp"
+#include <format>
+#include <iostream>
+#include <cmath>
+Chrono::Chrono(QObject* parent): QObject(parent) {
+  QObject::connect(&this->timer, &QTimer::timeout, this, &Chrono::onTimeout);
+  this->update();
+}
+bool Chrono::enabled() const { return this->mEnabled; }
+void Chrono::setEnabled(bool enabled) {
+  if (enabled == this->mEnabled) return;
+  this->mEnabled = enabled;
+  emit this->enabledChanged();
+  this->update();
+}
+Chrono::Precision Chrono::precision() const { return this->mPrecision; }
+void Chrono::setPrecision(Chrono::Precision precision) {
+  if (precision == this->mPrecision) return;
+  this->mPrecision = precision;
+  emit this->precisionChanged();
+  this->update();
+}
+void Chrono::onTimeout() {
+  this->setTime(this->targetTime);
+  this->schedule(this->targetTime);
+}
+void Chrono::update() {
+  if (this->mEnabled) {
+    this->setTime(std::chrono::time_point<std::chrono::system_clock>());
+    this->schedule(std::chrono::time_point<std::chrono::system_clock>());
+  } else {
+    this->timer.stop();
+  }
+}
+void Chrono::setTime(const std::chrono::time_point<std::chrono::system_clock>& targetTime) {
+  using namespace std::chrono_literals;
+  auto currentTime = std::chrono::system_clock::now();
+  auto offset = std::chrono::duration_cast<std::chrono::milliseconds>(targetTime - currentTime);
+  this->currentTime = abs(offset) < 500ms ? targetTime : currentTime;
+  switch (this->mPrecision) {
+  case Chrono::Hours: this->currentTime = std::chrono::time_point_cast<std::chrono::hours>(this->currentTime);
+  case Chrono::Minutes: this->currentTime = std::chrono::time_point_cast<std::chrono::minutes>(this->currentTime);
+  case Chrono::Seconds: this->currentTime = std::chrono::time_point_cast<std::chrono::seconds>(this->currentTime);
+  }
+  emit this->dateChanged();
+}
+void Chrono::schedule(const std::chrono::time_point<std::chrono::system_clock>& targetTime) {
+  using namespace std::chrono_literals;
+  auto currentTime = std::chrono::system_clock::now();
+  auto offset = std::chrono::duration_cast<std::chrono::milliseconds>(targetTime - currentTime);
+  auto nextTime = abs(offset) < 500ms ? targetTime : currentTime;
+  switch (this->mPrecision) {
+  case Chrono::Hours: nextTime = std::chrono::time_point_cast<std::chrono::hours>(nextTime) + 1h;
+  case Chrono::Minutes: nextTime = std::chrono::time_point_cast<std::chrono::minutes>(nextTime) + 1min;
+  case Chrono::Seconds: nextTime = std::chrono::time_point_cast<std::chrono::seconds>(nextTime) + 1s;
+  }
+  this->targetTime = nextTime;
+  this->timer.start(std::chrono::duration_cast<std::chrono::milliseconds>(nextTime - currentTime));
+}
+QString Chrono::format(const QString& fmt) const {
+  return QString::fromStdString(std::format(std::runtime_format(fmt.toStdString()), std::chrono::zoned_time(std::chrono::current_zone(), std::chrono::time_point_cast<std::chrono::seconds>(this->currentTime))));
+}
+QDateTime Chrono::date() const {
+  return QDateTime::fromStdTimePoint(std::chrono::time_point_cast<std::chrono::milliseconds>(this->currentTime));
+}
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/Chrono.hpp b/accounts/gkleen@sif/shell/quickshell-plugins/Chrono.hpp
new file mode 100644
index 00000000..04080187
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/Chrono.hpp
@@ -0,0 +1,55 @@
+#pragma once
+#include <chrono>
+#include <QDateTime>
+#include <QObject>
+#include <QTimer>
+#include <qqmlintegration.h>
+class Chrono : public QObject {
+  Q_OBJECT;
+  Q_PROPERTY(bool enabled READ enabled WRITE setEnabled NOTIFY enabledChanged);
+  Q_PROPERTY(Chrono::Precision precision READ precision WRITE setPrecision NOTIFY precisionChanged);
+  Q_PROPERTY(QDateTime date READ date NOTIFY dateChanged)
+  QML_ELEMENT;
+public:
+  enum Precision : quint8 {
+    Hours = 1,
+    Minutes = 2,
+    Seconds = 3,
+  };
+  Q_ENUM(Precision);
+  explicit Chrono(QObject* parent = nullptr);
+  bool enabled() const;
+  void setEnabled(bool enabled);
+  Chrono::Precision precision() const;
+  void setPrecision(Chrono::Precision precision);
+  Q_INVOKABLE QString format(const QString& fmt) const;
+  QDateTime date() const;
+signals:
+  void enabledChanged();
+  void precisionChanged();
+  void dateChanged();
+private slots:
+  void onTimeout();
+private:
+  bool mEnabled = true;
+  Chrono::Precision mPrecision = Chrono::Seconds;
+  QTimer timer;
+  std::chrono::time_point<std::chrono::system_clock> currentTime, targetTime;
+  void update();
+  void setTime(const std::chrono::time_point<std::chrono::system_clock>& targetTime);
+  void schedule(const std::chrono::time_point<std::chrono::system_clock>& targetTime);
+};
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/FileSelector.cpp b/accounts/gkleen@sif/shell/quickshell-plugins/FileSelector.cpp
new file mode 100644
index 00000000..d7051d2a
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/FileSelector.cpp
@@ -0,0 +1,102 @@
+#include "FileSelector.hpp"
+#include <sstream>
+#include <vector>
+#include <random>
+#include <algorithm>
+#include <iostream>
+#include <format>
+namespace fs = std::filesystem;
+FileSelector::FileSelector(QObject* parent): QObject(parent) {
+  QObject::connect(&this->timer, &QTimer::timeout, this, &FileSelector::onTimeout);
+  this->timer.setTimerType(Qt::PreciseTimer);
+}
+QString FileSelector::directory() const {
+  return QString::fromStdString(this->mDirectory->string());
+}
+void FileSelector::setDirectory(QString directory) {
+  this->mDirectory = directory.toStdString();
+  if (this->mDirectory && this->mEpoch)
+    this->update();
+  emit this->directoryChanged();
+}
+unsigned int FileSelector::epoch() const {
+  return std::chrono::duration_cast<std::chrono::milliseconds>(*this->mEpoch).count();
+}
+void FileSelector::setEpoch(unsigned int epoch) {
+  this->mEpoch = std::chrono::milliseconds{epoch};
+  if (this->mDirectory && this->mEpoch)
+    this->update();
+  emit this->epochChanged();
+}
+QString FileSelector::seed() const {
+  return this->mSeed;
+}
+void FileSelector::setSeed(QString seed) {
+  this->mSeed = seed;
+  emit this->seedChanged();
+  if (this->mDirectory && this->mEpoch)
+    emit this->selectedChanged();
+}
+QString FileSelector::selected() const {
+  if (!this->mDirectory || !this->mEpoch)
+    return QString();
+  std::vector<fs::path> shuffled(this->mFiles.begin(), this->mFiles.end());
+  std::sort(shuffled.begin(), shuffled.end());
+  auto currentTime = std::chrono::system_clock::now();
+  uint64_t currentEpoch = currentTime.time_since_epoch() / *this->mEpoch;
+  std::chrono::milliseconds timeInEpoch = std::chrono::duration_cast<std::chrono::milliseconds>(currentTime.time_since_epoch()) % *this->mEpoch;
+  std::ostringstream seed;
+  seed << this->mSeed.size() << ";" << this->mSeed.toStdString() << ";";
+  seed << *this->mEpoch << ";";
+  seed << currentEpoch << ";";
+  seed << this->mDirectory->string().size() << ";" << *this->mDirectory << ";";
+  seed << this->mFiles.size() << ";";
+  for (const fs::path& p: this->mFiles)
+    seed << p.string().size() << ";" << p << ";";
+  std::vector<std::seed_seq::result_type> v;
+  v.reserve(seed.str().size());
+  for (const char& c: seed.str())
+    v.push_back(c);
+  std::seed_seq engine_seed(v.begin(), v.end());
+  std::mt19937 g(engine_seed);
+  std::shuffle(shuffled.begin(), shuffled.end(), g);
+  std::vector<fs::path>::size_type ix = shuffled.size() * timeInEpoch / *this->mEpoch;
+  return QString::fromStdString((*this->mDirectory / shuffled[ix]).string());
+}
+void FileSelector::onTimeout() {
+  if (!this->mFiles.size())
+    return;
+  auto currentTime = std::chrono::system_clock::now();
+  uint64_t currentMinorEpoch = currentTime.time_since_epoch() / (*this->mEpoch / this->mFiles.size());
+  auto nextTime = std::chrono::time_point<std::chrono::system_clock>((currentMinorEpoch + 1) * (*this->mEpoch / this->mFiles.size()));
+  this->timer.start(std::chrono::duration_cast<std::chrono::milliseconds>(nextTime - currentTime));
+  emit this->selectedChanged();
+}
+void FileSelector::update() {
+  this->mFiles = std::set<fs::path>{};
+  for (const fs::directory_entry& entry:
+         fs::recursive_directory_iterator(*this->mDirectory, fs::directory_options::follow_directory_symlink))
+    {
+      this->mFiles.insert(fs::relative(entry, *this->mDirectory));
+    }
+  this->onTimeout();
+}
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/FileSelector.hpp b/accounts/gkleen@sif/shell/quickshell-plugins/FileSelector.hpp
new file mode 100644
index 00000000..72c4f2a7
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/FileSelector.hpp
@@ -0,0 +1,52 @@
+#pragma once
+#include <filesystem>
+#include <chrono>
+#include <set>
+#include <optional>
+#include <QObject>
+#include <QTimer>
+#include <qqmlintegration.h>
+class FileSelector : public QObject {
+  Q_OBJECT;
+  Q_PROPERTY(QString directory READ directory WRITE setDirectory NOTIFY directoryChanged REQUIRED);
+  Q_PROPERTY(unsigned int epoch READ epoch WRITE setEpoch NOTIFY epochChanged REQUIRED);
+  Q_PROPERTY(QString seed READ seed WRITE setSeed NOTIFY seedChanged);
+  Q_PROPERTY(QString selected READ selected NOTIFY selectedChanged);
+  QML_ELEMENT;
+public:
+  explicit FileSelector(QObject* parent = nullptr);
+  QString directory() const;
+  void setDirectory(QString directory);
+  unsigned int epoch() const;
+  void setEpoch(unsigned int epoch);
+  QString seed() const;
+  void setSeed(QString seed);
+  QString selected() const;
+signals:
+  void directoryChanged();
+  void epochChanged();
+  void seedChanged();
+  void selectedChanged();
+private slots:
+  void onTimeout();
+private:
+  std::optional<std::filesystem::path> mDirectory;
+  std::optional<std::chrono::milliseconds> mEpoch;
+  std::set<std::filesystem::path> mFiles;
+  QString mSeed;
+  QTimer timer;
+  void update();
+};
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/KeePassXC.cpp b/accounts/gkleen@sif/shell/quickshell-plugins/KeePassXC.cpp
new file mode 100644
index 00000000..f6e4dd6e
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/KeePassXC.cpp
@@ -0,0 +1,18 @@
+#include "KeePassXC.hpp"
+#include <QDBusConnection>
+KeePassXC::KeePassXC() {
+  this->service = new DBusKeePassXC(DBusKeePassXC::staticInterfaceName(), "/keepassxc", QDBusConnection::sessionBus(), this);
+}
+KeePassXC::~KeePassXC() {
+  if (this->service)
+    delete this->service;
+}
+void KeePassXC::lockAllDatabases() {
+  if (!this->service)
+    return;
+  this->service->lockAllDatabases();
+}
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/KeePassXC.hpp b/accounts/gkleen@sif/shell/quickshell-plugins/KeePassXC.hpp
new file mode 100644
index 00000000..c4cd71e0
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/KeePassXC.hpp
@@ -0,0 +1,21 @@
+#pragma once
+#include "dbus_keepassxc.h"
+#include <QObject>
+#include <QtQmlIntegration/qqmlintegration.h>
+class KeePassXC : public QObject {
+  Q_OBJECT;
+  QML_SINGLETON;
+  QML_ELEMENT;
+public:
+  explicit KeePassXC();
+  ~KeePassXC();
+  Q_INVOKABLE void lockAllDatabases();
+private:
+  DBusKeePassXC* service = nullptr;
+};
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/Systemd.cpp b/accounts/gkleen@sif/shell/quickshell-plugins/Systemd.cpp
new file mode 100644
index 00000000..308659e9
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/Systemd.cpp
@@ -0,0 +1,198 @@
+#include "Systemd.hpp"
+#include <sstream>
+#include <QDBusConnection>
+#include <QDBusReply>
+#include <QDebug>
+#include <QDBusUnixFileDescriptor>
+#include <QDBusObjectPath>
+Systemd::Systemd(QObject* parent) : QObject(parent) {
+  this->systemdManager = new DBusSystemdManager(
+    "org.freedesktop.systemd1",
+    "/org/freedesktop/systemd1",
+    QDBusConnection::sessionBus(),
+    this
+  );
+  this->logindManager = new DBusLogindManager(
+    "org.freedesktop.login1",
+    "/org/freedesktop/login1",
+    QDBusConnection::systemBus(),
+    this
+  );
+  QDBusReply<QDBusObjectPath> sessionPath = this->logindManager->GetSession("auto");
+  qDebug() << sessionPath;
+  this->logindSession = new DBusLogindSession(
+    "org.freedesktop.login1",
+    sessionPath.value().path(),
+    QDBusConnection::systemBus(),
+    this
+  );
+  this->logindSessionProperties = new DBusProperties(
+    "org.freedesktop.login1",
+    sessionPath.value().path(),
+    QDBusConnection::systemBus(),
+    this
+  );
+  QObject::connect(this->logindManager, &DBusLogindManager::PrepareForShutdown, this, &Systemd::shutdown);
+  QObject::connect(this->logindManager, &DBusLogindManager::PrepareForSleep, this, &Systemd::sleep);
+  QObject::connect(this->logindSession, &DBusLogindSession::Lock, this, &Systemd::lock);
+  QObject::connect(this->logindSession, &DBusLogindSession::Unlock, this, &Systemd::unlock);
+  QObject::connect(this->logindSessionProperties, &DBusProperties::PropertiesChanged, this, &Systemd::onLogindSessionPropertiesChanged);
+}
+void Systemd::onLogindSessionPropertiesChanged(const QString& interface_name, const QVariantMap& changed_properties, const QStringList& invalidated_properties) {
+  if (changed_properties.contains("IdleHint") || invalidated_properties.contains("IdleHint"))
+    emit this->idleHintChanged();
+  if (changed_properties.contains("LockedHint") || invalidated_properties.contains("LockedHint"))
+    emit this->lockedHintChanged();
+}
+void Systemd::stopUserUnit(const QString& unit, const QString& mode) { this->systemdManager->StopUnit(unit, mode); }
+void Systemd::setBrightness(const QString& subsystem, const QString& name, quint32 brightness) { this->logindSession->SetBrightness(subsystem, name, brightness); }
+bool Systemd::idleHint() { return this->logindSession->idleHint(); }
+void Systemd::setIdleHint(bool idle) { this->logindSession->SetIdleHint(idle); }
+bool Systemd::lockedHint() { return this->logindSession->lockedHint(); }
+void Systemd::setLockedHint(bool locked) { this->logindSession->SetLockedHint(locked); }
+void Systemd::lockSession() { this->logindSession->call("Lock"); }
+void Systemd::suspend() { this->logindManager->Suspend(true); }
+void Systemd::hibernate() { this->logindManager->Hibernate(true); }
+std::string SystemdInhibitorParams::toString(SystemdInhibitorParams::WhatItem what) {
+  if (what == SystemdInhibitorParams::Shutdown)
+    return "shutdown";
+  else if (what == SystemdInhibitorParams::Sleep)
+    return "sleep";
+  else if (what == SystemdInhibitorParams::Idle)
+    return "idle";
+  else if (what == SystemdInhibitorParams::HandlePowerKey)
+    return "handle-power-key";
+  else if (what == SystemdInhibitorParams::HandleSuspendKey)
+    return "handle-suspend-key";
+  else if (what == SystemdInhibitorParams::HandleHibernateKey)
+    return "handle-hibernate-key";
+  else if (what == SystemdInhibitorParams::HandleLidSwitch)
+    return "handle-lid-switch";
+  return "";
+}
+std::string SystemdInhibitorParams::toString(SystemdInhibitorParams::What what) {
+  std::ostringstream res;
+  bool first = true;
+  for (const WhatItem& item: SystemdInhibitorParams::allWhatItems) {
+    if (!(what & item))
+      continue;
+    if (!first)
+      res << ":";
+    else
+      first = false;
+    res << SystemdInhibitorParams::toString(item);
+  }
+  return res.str();
+}
+std::string SystemdInhibitorParams::toString(SystemdInhibitorParams::Mode mode) {
+  if (mode == SystemdInhibitorParams::Block)
+    return "block";
+  else if (mode == SystemdInhibitorParams::BlockWeak)
+    return "block-weak";
+  else if (mode == SystemdInhibitorParams::Delay)
+    return "delay";
+  return "";
+}
+bool SystemdInhibitor::enabled() const { return static_cast<bool>(this->activeInhibitor); }
+void SystemdInhibitor::setEnabled(bool enabled) {
+  this->mEnabled = enabled;
+  if (enabled)
+    this->update();
+  else
+    this->release();
+}
+SystemdInhibitorParams::What SystemdInhibitor::what() const { return this->mWhat; }
+void SystemdInhibitor::setWhat(SystemdInhibitorParams::What what) {
+  this->mWhat = what;
+  this->update();
+}
+QString SystemdInhibitor::who() const { return this->mWho; }
+void SystemdInhibitor::setWho(QString who) {
+  this->mWho = who;
+  this->update();
+}
+QString SystemdInhibitor::why() const { return this->mWhy; }
+void SystemdInhibitor::setWhy(QString why) {
+  this->mWhy = why;
+  this->update();
+}
+SystemdInhibitorParams::Mode SystemdInhibitor::mode() const { return this->mMode; }
+void SystemdInhibitor::setMode(SystemdInhibitorParams::Mode mode) {
+  this->mMode = mode;
+  this->update();
+}
+SystemdInhibitor::ActiveSystemdInhibitor::ActiveSystemdInhibitor(SystemdInhibitorParams::What what_, QString who_, QString why_, SystemdInhibitorParams::Mode mode_): what(what_), who(who_), why(why_), mode(mode_) {
+  DBusLogindManager logindManager(
+    "org.freedesktop.login1",
+    "/org/freedesktop/login1",
+    QDBusConnection::systemBus()
+  );
+  QDBusReply<QDBusUnixFileDescriptor> fd_ = logindManager.Inhibit(QString::fromStdString(SystemdInhibitorParams::toString(what)), who, why, QString::fromStdString(SystemdInhibitorParams::toString(mode)));
+  if (fd_.error().isValid())
+    throw fd_.error();
+  this->fd = ::dup(fd_.value().fileDescriptor());
+}
+SystemdInhibitor::ActiveSystemdInhibitor::~ActiveSystemdInhibitor() {
+  if (this->fd != -1)
+    ::close(this->fd);
+}
+void SystemdInhibitor::release() {
+  if (!this->activeInhibitor)
+    return;
+  this->activeInhibitor.reset();
+  emit this->enabledChanged();
+}
+void SystemdInhibitor::update() {
+  if (!this->mWhat || this->mWho.isEmpty() || this->mWhy.isEmpty() || !this->mMode || !this->mEnabled)
+    if (this->activeInhibitor)
+      this->release();
+    else
+      return;
+  if (this->activeInhibitor && this->mWhat == this->activeInhibitor->what && this->mWho == this->activeInhibitor->who && this->mWhy == this->activeInhibitor->why && this->mMode == this->activeInhibitor->mode)
+    return;
+  std::unique_ptr<ActiveSystemdInhibitor> otherInhibitor;
+  try {
+    otherInhibitor.reset(new SystemdInhibitor::ActiveSystemdInhibitor(this->mWhat, this->mWho, this->mWhy, this->mMode));
+  } catch (const QDBusError& err) {
+    qCritical().noquote()
+      << err.name().toStdString() << " " << err.message().toStdString();
+    return;
+  }
+  this->activeInhibitor.swap(otherInhibitor);
+  if (!otherInhibitor && this->activeInhibitor)
+    emit this->enabledChanged();
+  if (otherInhibitor && otherInhibitor->what != this->activeInhibitor->what)
+    emit this->whatChanged();
+  if (otherInhibitor && otherInhibitor->who != this->activeInhibitor->who)
+    emit this->whoChanged();
+  if (otherInhibitor && otherInhibitor->why != this->activeInhibitor->why)
+    emit this->whyChanged();
+  if (otherInhibitor && otherInhibitor->mode != this->activeInhibitor->mode)
+    emit this->modeChanged();
+}
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/Systemd.hpp b/accounts/gkleen@sif/shell/quickshell-plugins/Systemd.hpp
new file mode 100644
index 00000000..615024d2
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/Systemd.hpp
@@ -0,0 +1,147 @@
+#pragma once
+#include <cstdint>
+#include <memory>
+#include <string>
+#include <QObject>
+#include <QDBusInterface>
+#include <QtQmlIntegration/qqmlintegration.h>
+#include "dbus_systemd_manager.h"
+#include "dbus_logind_manager.h"
+#include "dbus_logind_session.h"
+#include "dbus_properties.h"
+class Systemd : public QObject {
+  Q_OBJECT;
+  QML_SINGLETON;
+  QML_ELEMENT;
+public:
+  explicit Systemd(QObject* parent = nullptr);
+  Q_PROPERTY(bool idleHint READ idleHint WRITE setIdleHint NOTIFY idleHintChanged)
+  Q_PROPERTY(bool lockedHint READ lockedHint WRITE setLockedHint NOTIFY lockedHintChanged)
+  Q_INVOKABLE void stopUserUnit(const QString& unit, const QString& mode);
+  Q_INVOKABLE void setBrightness(const QString& subsystem, const QString& name, quint32 brightness);
+  Q_INVOKABLE void setIdleHint(bool idle);
+  Q_INVOKABLE void setLockedHint(bool locked);
+  Q_INVOKABLE void lockSession();
+  Q_INVOKABLE void suspend();
+  Q_INVOKABLE void hibernate();
+  bool idleHint();
+  bool lockedHint();
+signals:
+  void shutdown(bool before);
+  void sleep(bool before);
+  void lock();
+  void unlock();
+  void idleHintChanged();
+  void lockedHintChanged();
+private slots:
+  void onLogindSessionPropertiesChanged(const QString& interface_name, const QVariantMap& changed_properties, const QStringList& invalidated_properties);
+private:
+  DBusSystemdManager* systemdManager;
+  DBusLogindManager* logindManager;
+  DBusLogindSession* logindSession;
+  DBusProperties* logindSessionProperties;
+};
+class SystemdInhibitorParams : public QObject {
+  Q_OBJECT;
+  QML_ELEMENT;
+  QML_SINGLETON;
+public:
+  enum WhatItem : uint8_t {
+    Shutdown = 0b1,
+    Sleep = 0b10,
+    Idle = 0b100,
+    HandlePowerKey = 0b1000,
+    HandleSuspendKey = 0b10000,
+    HandleHibernateKey = 0b100000,
+    HandleLidSwitch = 0b1000000,
+  };
+  Q_ENUM(WhatItem);
+  Q_DECLARE_FLAGS(What, WhatItem);
+  enum Mode : uint8_t {
+    Block = 1,
+    BlockWeak = 2,
+    Delay = 3,
+  };
+  Q_ENUM(Mode);
+  Q_INVOKABLE static std::string toString(WhatItem what);
+  Q_INVOKABLE static std::string toString(What what);
+  Q_INVOKABLE static std::string toString(Mode mode);
+  static constexpr WhatItem allWhatItems[] = { Shutdown, Sleep, Idle, HandlePowerKey, HandleSuspendKey, HandleHibernateKey, HandleLidSwitch };
+};
+Q_DECLARE_OPERATORS_FOR_FLAGS(SystemdInhibitorParams::What)
+class SystemdInhibitor : public QObject {
+  Q_OBJECT;
+  Q_PROPERTY(bool enabled READ enabled WRITE setEnabled NOTIFY enabledChanged);
+  Q_PROPERTY(SystemdInhibitorParams::What what READ what WRITE setWhat NOTIFY whatChanged);
+  Q_PROPERTY(QString who READ who WRITE setWho NOTIFY whoChanged);
+  Q_PROPERTY(QString why READ why WRITE setWhy NOTIFY whyChanged);
+  Q_PROPERTY(SystemdInhibitorParams::Mode mode READ mode WRITE setMode NOTIFY modeChanged);
+  QML_ELEMENT;
+public:
+  explicit SystemdInhibitor(QObject* parent = nullptr): QObject(parent) {}
+  bool enabled() const;
+  void setEnabled(bool enabled);
+  SystemdInhibitorParams::What what() const;
+  void setWhat(SystemdInhibitorParams::What what);
+  QString who() const;
+  void setWho(QString who);
+  QString why() const;
+  void setWhy(QString why);
+  SystemdInhibitorParams::Mode mode() const;
+  void setMode(SystemdInhibitorParams::Mode mode);
+  Q_INVOKABLE void release();
+signals:
+  void enabledChanged();
+  void whatChanged();
+  void whoChanged();
+  void whyChanged();
+  void modeChanged();
+private:
+  class ActiveSystemdInhibitor {
+  public:
+    uint32_t fd = -1;
+    SystemdInhibitorParams::What what;
+    QString who;
+    QString why;
+    SystemdInhibitorParams::Mode mode;
+    ActiveSystemdInhibitor(SystemdInhibitorParams::What what_, QString who_, QString why_, SystemdInhibitorParams::Mode mode_);
+    ~ActiveSystemdInhibitor();
+  };
+  void update();
+  bool mEnabled = true;
+  std::unique_ptr<ActiveSystemdInhibitor> activeInhibitor;
+  SystemdInhibitorParams::What mWhat = static_cast<SystemdInhibitorParams::What>(0);
+  QString mWho;
+  QString mWhy;
+  SystemdInhibitorParams::Mode mMode = static_cast<SystemdInhibitorParams::Mode>(0);
+};
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/customplugin.h b/accounts/gkleen@sif/shell/quickshell-plugins/customplugin.h
new file mode 100644
index 00000000..e66ba9e3
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/customplugin.h
@@ -0,0 +1,7 @@
+#include <QQmlEngineExtensionPlugin>
+class CustomPlugin : public QQmlEngineExtensionPlugin
+{
+    Q_OBJECT
+    Q_PLUGIN_METADATA(IID QQmlEngineExtensionInterface_iid)
+};
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/default.nix b/accounts/gkleen@sif/shell/quickshell-plugins/default.nix
new file mode 100644
index 00000000..20a195eb
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, stdenv
+, cmake
+, qt6
+, fmt
+, keepassxc
+, systemd
+}:
+stdenv.mkDerivation rec {
+  name = "quickshell-custom";
+  src = ./.;
+  prePatch = ''
+    cp ${keepassxc.src}/src/gui/org.keepassxc.KeePassXC.MainWindow.xml .
+  '';
+  nativeBuildInputs = [ cmake qt6.wrapQtAppsHook ];
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtdeclarative
+  ];
+  cmakeFlags = [
+    (lib.cmakeFeature "INSTALL_QML_PREFIX" qt6.qtbase.qtQmlPrefix)
+  ];
+  LC_ALL = "C.UTF-8";
+}
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.DBus.Properties.xml b/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.DBus.Properties.xml
new file mode 100644
index 00000000..7588e7a5
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.DBus.Properties.xml
@@ -0,0 +1,28 @@
+<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
+"https://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
+<node>
+ <interface name="org.freedesktop.DBus.Properties">
+  <method name="Get">
+   <arg name="interface_name" direction="in" type="s"/>
+   <arg name="property_name" direction="in" type="s"/>
+   <arg name="value" direction="out" type="v"/>
+  </method>
+  <method name="GetAll">
+   <arg name="interface_name" direction="in" type="s"/>
+   <arg name="props" direction="out" type="a{sv}"/>
+   <annotation name="org.qtproject.QtDBus.QtTypeName.Out0" value="QVariantMap"/>
+  </method>
+  <method name="Set">
+   <arg name="interface_name" direction="in" type="s"/>
+   <arg name="property_name" direction="in" type="s"/>
+   <arg name="value" direction="in" type="v"/>
+  </method>
+  <signal name="PropertiesChanged">
+   <arg type="s" name="interface_name"/>
+   <arg type="a{sv}" name="changed_properties"/>
+   <annotation name="org.qtproject.QtDBus.QtTypeName.Out1" value="QVariantMap"/>
+   <arg type="as" name="invalidated_properties"/>
+  </signal>
+ </interface>
+</node>
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.login1.Manager.xml b/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.login1.Manager.xml
new file mode 100644
index 00000000..120a06d9
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.login1.Manager.xml
@@ -0,0 +1,445 @@
+<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
+"https://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
+<node>
+ <interface name="org.freedesktop.login1.Manager">
+  <property name="EnableWallMessages" type="b" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="WallMessage" type="s" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="NAutoVTs" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="KillOnlyUsers" type="as" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="KillExcludeUsers" type="as" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="KillUserProcesses" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="RebootParameter" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="RebootToFirmwareSetup" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="RebootToBootLoaderMenu" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="RebootToBootLoaderEntry" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="BootLoaderEntries" type="as" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="IdleHint" type="b" access="read">
+  </property>
+  <property name="IdleSinceHint" type="t" access="read">
+  </property>
+  <property name="IdleSinceHintMonotonic" type="t" access="read">
+  </property>
+  <property name="BlockInhibited" type="s" access="read">
+  </property>
+  <property name="BlockWeakInhibited" type="s" access="read">
+  </property>
+  <property name="DelayInhibited" type="s" access="read">
+  </property>
+  <property name="InhibitDelayMaxUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="UserStopDelayUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="SleepOperation" type="as" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandlePowerKey" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandlePowerKeyLongPress" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleRebootKey" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleRebootKeyLongPress" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleSuspendKey" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleSuspendKeyLongPress" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleHibernateKey" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleHibernateKeyLongPress" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleLidSwitch" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleLidSwitchExternalPower" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleLidSwitchDocked" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HandleSecureAttentionKey" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="HoldoffTimeoutUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="IdleAction" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="IdleActionUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="PreparingForShutdown" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="PreparingForShutdownWithMetadata" type="a{sv}" access="read">
+    <annotation name="org.qtproject.QtDBus.QtTypeName" value="QVariantMap"/>
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="PreparingForSleep" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <!-- <property name="ScheduledShutdown" type="(st)" access="read"> -->
+  <!-- </property> -->
+  <property name="DesignatedMaintenanceTime" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Docked" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="LidClosed" type="b" access="read">
+  </property>
+  <property name="OnExternalPower" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="RemoveIPC" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="RuntimeDirectorySize" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="RuntimeDirectoryInodesMax" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InhibitorsMax" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="NCurrentInhibitors" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="SessionsMax" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="NCurrentSessions" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="StopIdleSessionUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <method name="GetSession">
+   <arg type="s" name="session_id" direction="in"/>
+   <arg type="o" name="object_path" direction="out"/>
+  </method>
+  <method name="GetSessionByPID">
+   <arg type="u" name="pid" direction="in"/>
+   <arg type="o" name="object_path" direction="out"/>
+  </method>
+  <method name="GetUser">
+   <arg type="u" name="uid" direction="in"/>
+   <arg type="o" name="object_path" direction="out"/>
+  </method>
+  <method name="GetUserByPID">
+   <arg type="u" name="pid" direction="in"/>
+   <arg type="o" name="object_path" direction="out"/>
+  </method>
+  <method name="GetSeat">
+   <arg type="s" name="seat_id" direction="in"/>
+   <arg type="o" name="object_path" direction="out"/>
+  </method>
+  <!-- <method name="ListSessions"> -->
+  <!--  <arg type="a(susso)" name="sessions" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ListSessionsEx"> -->
+  <!--  <arg type="a(sussussbto)" name="sessions" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ListUsers"> -->
+  <!--  <arg type="a(uso)" name="users" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ListSeats"> -->
+  <!--  <arg type="a(so)" name="seats" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ListInhibitors"> -->
+  <!--  <arg type="a(ssssuu)" name="inhibitors" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="CreateSession"> -->
+  <!--  <arg type="u" name="uid" direction="in"/> -->
+  <!--  <arg type="u" name="pid" direction="in"/> -->
+  <!--  <arg type="s" name="service" direction="in"/> -->
+  <!--  <arg type="s" name="type" direction="in"/> -->
+  <!--  <arg type="s" name="class" direction="in"/> -->
+  <!--  <arg type="s" name="desktop" direction="in"/> -->
+  <!--  <arg type="s" name="seat_id" direction="in"/> -->
+  <!--  <arg type="u" name="vtnr" direction="in"/> -->
+  <!--  <arg type="s" name="tty" direction="in"/> -->
+  <!--  <arg type="s" name="display" direction="in"/> -->
+  <!--  <arg type="b" name="remote" direction="in"/> -->
+  <!--  <arg type="s" name="remote_user" direction="in"/> -->
+  <!--  <arg type="s" name="remote_host" direction="in"/> -->
+  <!--  <arg type="a(sv)" name="properties" direction="in"/> -->
+  <!--  <arg type="s" name="session_id" direction="out"/> -->
+  <!--  <arg type="o" name="object_path" direction="out"/> -->
+  <!--  <arg type="s" name="runtime_path" direction="out"/> -->
+  <!--  <arg type="h" name="fifo_fd" direction="out"/> -->
+  <!--  <arg type="u" name="uid" direction="out"/> -->
+  <!--  <arg type="s" name="seat_id" direction="out"/> -->
+  <!--  <arg type="u" name="vtnr" direction="out"/> -->
+  <!--  <arg type="b" name="existing" direction="out"/> -->
+  <!--  <annotation name="org.freedesktop.systemd1.Privileged" value="true"/> -->
+  <!-- </method> -->
+  <!-- <method name="CreateSessionWithPIDFD"> -->
+  <!--  <arg type="u" name="uid" direction="in"/> -->
+  <!--  <arg type="h" name="pidfd" direction="in"/> -->
+  <!--  <arg type="s" name="service" direction="in"/> -->
+  <!--  <arg type="s" name="type" direction="in"/> -->
+  <!--  <arg type="s" name="class" direction="in"/> -->
+  <!--  <arg type="s" name="desktop" direction="in"/> -->
+  <!--  <arg type="s" name="seat_id" direction="in"/> -->
+  <!--  <arg type="u" name="vtnr" direction="in"/> -->
+  <!--  <arg type="s" name="tty" direction="in"/> -->
+  <!--  <arg type="s" name="display" direction="in"/> -->
+  <!--  <arg type="b" name="remote" direction="in"/> -->
+  <!--  <arg type="s" name="remote_user" direction="in"/> -->
+  <!--  <arg type="s" name="remote_host" direction="in"/> -->
+  <!--  <arg type="t" name="flags" direction="in"/> -->
+  <!--  <arg type="a(sv)" name="properties" direction="in"/> -->
+  <!--  <arg type="s" name="session_id" direction="out"/> -->
+  <!--  <arg type="o" name="object_path" direction="out"/> -->
+  <!--  <arg type="s" name="runtime_path" direction="out"/> -->
+  <!--  <arg type="h" name="fifo_fd" direction="out"/> -->
+  <!--  <arg type="u" name="uid" direction="out"/> -->
+  <!--  <arg type="s" name="seat_id" direction="out"/> -->
+  <!--  <arg type="u" name="vtnr" direction="out"/> -->
+  <!--  <arg type="b" name="existing" direction="out"/> -->
+  <!--  <annotation name="org.freedesktop.systemd1.Privileged" value="true"/> -->
+  <!-- </method> -->
+  <method name="ReleaseSession">
+   <arg type="s" name="session_id" direction="in"/>
+  </method>
+  <method name="ActivateSession">
+   <arg type="s" name="session_id" direction="in"/>
+  </method>
+  <method name="ActivateSessionOnSeat">
+   <arg type="s" name="session_id" direction="in"/>
+   <arg type="s" name="seat_id" direction="in"/>
+  </method>
+  <method name="LockSession">
+   <arg type="s" name="session_id" direction="in"/>
+  </method>
+  <method name="UnlockSession">
+   <arg type="s" name="session_id" direction="in"/>
+  </method>
+  <method name="LockSessions">
+  </method>
+  <method name="UnlockSessions">
+  </method>
+  <method name="KillSession">
+   <arg type="s" name="session_id" direction="in"/>
+   <arg type="s" name="whom" direction="in"/>
+   <arg type="i" name="signal_number" direction="in"/>
+  </method>
+  <method name="KillUser">
+   <arg type="u" name="uid" direction="in"/>
+   <arg type="i" name="signal_number" direction="in"/>
+  </method>
+  <method name="TerminateSession">
+   <arg type="s" name="session_id" direction="in"/>
+  </method>
+  <method name="TerminateUser">
+   <arg type="u" name="uid" direction="in"/>
+  </method>
+  <method name="TerminateSeat">
+   <arg type="s" name="seat_id" direction="in"/>
+  </method>
+  <method name="SetUserLinger">
+   <arg type="u" name="uid" direction="in"/>
+   <arg type="b" name="enable" direction="in"/>
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="AttachDevice">
+   <arg type="s" name="seat_id" direction="in"/>
+   <arg type="s" name="sysfs_path" direction="in"/>
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="FlushDevices">
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="PowerOff">
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="PowerOffWithFlags">
+   <arg type="t" name="flags" direction="in"/>
+  </method>
+  <method name="Reboot">
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="RebootWithFlags">
+   <arg type="t" name="flags" direction="in"/>
+  </method>
+  <method name="Halt">
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="HaltWithFlags">
+   <arg type="t" name="flags" direction="in"/>
+  </method>
+  <method name="Suspend">
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="SuspendWithFlags">
+   <arg type="t" name="flags" direction="in"/>
+  </method>
+  <method name="Hibernate">
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="HibernateWithFlags">
+   <arg type="t" name="flags" direction="in"/>
+  </method>
+  <method name="HybridSleep">
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="HybridSleepWithFlags">
+   <arg type="t" name="flags" direction="in"/>
+  </method>
+  <method name="SuspendThenHibernate">
+   <arg type="b" name="interactive" direction="in"/>
+  </method>
+  <method name="SuspendThenHibernateWithFlags">
+   <arg type="t" name="flags" direction="in"/>
+  </method>
+  <method name="Sleep">
+   <arg type="t" name="flags" direction="in"/>
+  </method>
+  <method name="CanPowerOff">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="CanReboot">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="CanHalt">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="CanSuspend">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="CanHibernate">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="CanHybridSleep">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="CanSuspendThenHibernate">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="CanSleep">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="ScheduleShutdown">
+   <arg type="s" name="type" direction="in"/>
+   <arg type="t" name="usec" direction="in"/>
+  </method>
+  <method name="CancelScheduledShutdown">
+   <arg type="b" name="cancelled" direction="out"/>
+  </method>
+  <method name="Inhibit">
+   <arg type="s" name="what" direction="in"/>
+   <arg type="s" name="who" direction="in"/>
+   <arg type="s" name="why" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="h" name="pipe_fd" direction="out"/>
+  </method>
+  <method name="CanRebootParameter">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="SetRebootParameter">
+   <arg type="s" name="parameter" direction="in"/>
+  </method>
+  <method name="CanRebootToFirmwareSetup">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="SetRebootToFirmwareSetup">
+   <arg type="b" name="enable" direction="in"/>
+  </method>
+  <method name="CanRebootToBootLoaderMenu">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="SetRebootToBootLoaderMenu">
+   <arg type="t" name="timeout" direction="in"/>
+  </method>
+  <method name="CanRebootToBootLoaderEntry">
+   <arg type="s" name="result" direction="out"/>
+  </method>
+  <method name="SetRebootToBootLoaderEntry">
+   <arg type="s" name="boot_loader_entry" direction="in"/>
+  </method>
+  <method name="SetWallMessage">
+   <arg type="s" name="wall_message" direction="in"/>
+   <arg type="b" name="enable" direction="in"/>
+  </method>
+  <signal name="SecureAttentionKey">
+   <arg type="s" name="seat_id"/>
+   <arg type="o" name="object_path"/>
+  </signal>
+  <signal name="SessionNew">
+   <arg type="s" name="session_id"/>
+   <arg type="o" name="object_path"/>
+  </signal>
+  <signal name="SessionRemoved">
+   <arg type="s" name="session_id"/>
+   <arg type="o" name="object_path"/>
+  </signal>
+  <signal name="UserNew">
+   <arg type="u" name="uid"/>
+   <arg type="o" name="object_path"/>
+  </signal>
+  <signal name="UserRemoved">
+   <arg type="u" name="uid"/>
+   <arg type="o" name="object_path"/>
+  </signal>
+  <signal name="SeatNew">
+   <arg type="s" name="seat_id"/>
+   <arg type="o" name="object_path"/>
+  </signal>
+  <signal name="SeatRemoved">
+   <arg type="s" name="seat_id"/>
+   <arg type="o" name="object_path"/>
+  </signal>
+  <signal name="PrepareForShutdown">
+   <arg type="b" name="start"/>
+  </signal>
+  <signal name="PrepareForShutdownWithMetadata">
+   <arg type="b" name="start"/>
+   <arg type="a{sv}" name="metadata"/>
+   <annotation name="org.qtproject.QtDBus.QtTypeName.Out1" value="QVariantMap"/>
+  </signal>
+  <signal name="PrepareForSleep">
+   <arg type="b" name="start"/>
+  </signal>
+ </interface>
+ <node name="user"/>
+ <node name="session"/>
+ <node name="seat"/>
+</node>
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.login1.Session.xml b/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.login1.Session.xml
new file mode 100644
index 00000000..7d6fc8ee
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.login1.Session.xml
@@ -0,0 +1,146 @@
+<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
+"https://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
+<node>
+ <interface name="org.freedesktop.login1.Session">
+  <property name="Id" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="User" type="o" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Name" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Timestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="TimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="VTNr" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Seat" type="o" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="TTY" type="s" access="read">
+  </property>
+  <property name="Display" type="s" access="read">
+  </property>
+  <property name="Remote" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="RemoteHost" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="RemoteUser" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Service" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Desktop" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Scope" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Leader" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Audit" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Type" type="s" access="read">
+  </property>
+  <!-- <property name="Class" type="s" access="read"> -->
+  <!-- </property> -->
+  <property name="Active" type="b" access="read">
+  </property>
+  <property name="State" type="s" access="read">
+  </property>
+  <property name="IdleHint" type="b" access="read">
+  </property>
+  <property name="IdleSinceHint" type="t" access="read">
+  </property>
+  <property name="IdleSinceHintMonotonic" type="t" access="read">
+  </property>
+  <property name="CanIdle" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="CanLock" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="LockedHint" type="b" access="read">
+  </property>
+  <method name="Terminate">
+  </method>
+  <method name="Activate">
+  </method>
+  <!-- <method name="Lock"> -->
+  <!-- </method> -->
+  <!-- <method name="Unlock"> -->
+  <!-- </method> -->
+  <method name="SetIdleHint">
+   <arg type="b" name="idle" direction="in"/>
+  </method>
+  <method name="SetLockedHint">
+   <arg type="b" name="locked" direction="in"/>
+  </method>
+  <method name="Kill">
+   <arg type="s" name="whom" direction="in"/>
+   <arg type="i" name="signal_number" direction="in"/>
+  </method>
+  <method name="TakeControl">
+   <arg type="b" name="force" direction="in"/>
+  </method>
+  <method name="ReleaseControl">
+  </method>
+  <method name="SetType">
+   <arg type="s" name="type" direction="in"/>
+  </method>
+  <!-- <method name="SetClass"> -->
+  <!--  <arg type="s" name="class" direction="in"/> -->
+  <!-- </method> -->
+  <method name="SetDisplay">
+   <arg type="s" name="display" direction="in"/>
+  </method>
+  <method name="SetTTY">
+   <arg type="h" name="tty_fd" direction="in"/>
+  </method>
+  <method name="TakeDevice">
+   <arg type="u" name="major" direction="in"/>
+   <arg type="u" name="minor" direction="in"/>
+   <arg type="h" name="fd" direction="out"/>
+   <arg type="b" name="inactive" direction="out"/>
+  </method>
+  <method name="ReleaseDevice">
+   <arg type="u" name="major" direction="in"/>
+   <arg type="u" name="minor" direction="in"/>
+  </method>
+  <method name="PauseDeviceComplete">
+   <arg type="u" name="major" direction="in"/>
+   <arg type="u" name="minor" direction="in"/>
+  </method>
+  <method name="SetBrightness">
+   <arg type="s" name="subsystem" direction="in"/>
+   <arg type="s" name="name" direction="in"/>
+   <arg type="u" name="brightness" direction="in"/>
+  </method>
+  <signal name="PauseDevice">
+   <arg type="u" name="major"/>
+   <arg type="u" name="minor"/>
+   <arg type="s" name="type"/>
+  </signal>
+  <signal name="ResumeDevice">
+   <arg type="u" name="major"/>
+   <arg type="u" name="minor"/>
+   <arg type="h" name="fd"/>
+  </signal>
+  <signal name="Lock">
+  </signal>
+  <signal name="Unlock">
+  </signal>
+ </interface>
+</node>
diff --git a/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.systemd1.Manager.xml b/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.systemd1.Manager.xml
new file mode 100644
index 00000000..b4f84a13
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell-plugins/org.freedesktop.systemd1.Manager.xml
@@ -0,0 +1,817 @@
+<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
+"https://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
+<node>
+ <interface name="org.freedesktop.systemd1.Manager">
+  <property name="Version" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Features" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Virtualization" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="ConfidentialVirtualization" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Architecture" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="Tainted" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="FirmwareTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="FirmwareTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="LoaderTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="LoaderTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="KernelTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="KernelTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="UserspaceTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="UserspaceTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="FinishTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="FinishTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="ShutdownStartTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="ShutdownStartTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="SecurityStartTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="SecurityStartTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="SecurityFinishTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="SecurityFinishTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="GeneratorsStartTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="GeneratorsStartTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="GeneratorsFinishTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="GeneratorsFinishTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="UnitsLoadStartTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="UnitsLoadStartTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="UnitsLoadFinishTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="UnitsLoadFinishTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="UnitsLoadTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="UnitsLoadTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDSecurityStartTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDSecurityStartTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDSecurityFinishTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDSecurityFinishTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDGeneratorsStartTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDGeneratorsStartTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDGeneratorsFinishTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDGeneratorsFinishTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDUnitsLoadStartTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDUnitsLoadStartTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDUnitsLoadFinishTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="InitRDUnitsLoadFinishTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="LogLevel" type="s" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="LogTarget" type="s" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="NNames" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="NFailedUnits" type="u" access="read">
+  </property>
+  <property name="NJobs" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="NInstalledJobs" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="NFailedJobs" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="Progress" type="d" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="Environment" type="as" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="ConfirmSpawn" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="ShowStatus" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="UnitPath" type="as" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultStandardOutput" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultStandardError" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="WatchdogDevice" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="WatchdogLastPingTimestamp" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="WatchdogLastPingTimestampMonotonic" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="RuntimeWatchdogUSec" type="t" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="RuntimeWatchdogPreUSec" type="t" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="RuntimeWatchdogPreGovernor" type="s" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="RebootWatchdogUSec" type="t" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="KExecWatchdogUSec" type="t" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="ServiceWatchdogs" type="b" access="readwrite">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </property>
+  <property name="ControlGroup" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="SystemState" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="ExitCode" type="y" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="DefaultTimerAccuracyUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultTimeoutStartUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultTimeoutStopUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultTimeoutAbortUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="DefaultDeviceTimeoutUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultRestartUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultStartLimitIntervalUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultStartLimitBurst" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultCPUAccounting" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultBlockIOAccounting" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultIOAccounting" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultIPAccounting" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultMemoryAccounting" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultTasksAccounting" type="b" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitCPU" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitCPUSoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitFSIZE" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitFSIZESoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitDATA" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitDATASoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitSTACK" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitSTACKSoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitCORE" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitCORESoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitRSS" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitRSSSoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitNOFILE" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitNOFILESoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitAS" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitASSoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitNPROC" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitNPROCSoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitMEMLOCK" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitMEMLOCKSoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitLOCKS" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitLOCKSSoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitSIGPENDING" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitSIGPENDINGSoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitMSGQUEUE" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitMSGQUEUESoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitNICE" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitNICESoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitRTPRIO" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitRTPRIOSoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitRTTIME" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultLimitRTTIMESoft" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultTasksMax" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="DefaultMemoryPressureThresholdUSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="DefaultMemoryPressureWatch" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="false"/>
+  </property>
+  <property name="TimerSlackNSec" type="t" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultOOMPolicy" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="DefaultOOMScoreAdjust" type="i" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="CtrlAltDelBurstAction" type="s" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <property name="SoftRebootsCount" type="u" access="read">
+   <annotation name="org.freedesktop.DBus.Property.EmitsChangedSignal" value="const"/>
+  </property>
+  <method name="GetUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="o" name="unit" direction="out"/>
+  </method>
+  <method name="GetUnitByPID">
+   <arg type="u" name="pid" direction="in"/>
+   <arg type="o" name="unit" direction="out"/>
+  </method>
+  <method name="GetUnitByInvocationID">
+   <arg type="ay" name="invocation_id" direction="in"/>
+   <arg type="o" name="unit" direction="out"/>
+  </method>
+  <method name="GetUnitByControlGroup">
+   <arg type="s" name="cgroup" direction="in"/>
+   <arg type="o" name="unit" direction="out"/>
+  </method>
+  <method name="GetUnitByPIDFD">
+   <arg type="h" name="pidfd" direction="in"/>
+   <arg type="o" name="unit" direction="out"/>
+   <arg type="s" name="unit_id" direction="out"/>
+   <arg type="ay" name="invocation_id" direction="out"/>
+  </method>
+  <method name="LoadUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="o" name="unit" direction="out"/>
+  </method>
+  <method name="StartUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <method name="StartUnitWithFlags">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="t" name="flags" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <method name="StartUnitReplace">
+   <arg type="s" name="old_unit" direction="in"/>
+   <arg type="s" name="new_unit" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <method name="StopUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <method name="ReloadUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <method name="RestartUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <method name="TryRestartUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <method name="ReloadOrRestartUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <method name="ReloadOrTryRestartUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="mode" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <!-- <method name="EnqueueUnitJob"> -->
+  <!--  <arg type="s" name="name" direction="in"/> -->
+  <!--  <arg type="s" name="job_type" direction="in"/> -->
+  <!--  <arg type="s" name="job_mode" direction="in"/> -->
+  <!--  <arg type="u" name="job_id" direction="out"/> -->
+  <!--  <arg type="o" name="job_path" direction="out"/> -->
+  <!--  <arg type="s" name="unit_id" direction="out"/> -->
+  <!--  <arg type="o" name="unit_path" direction="out"/> -->
+  <!--  <arg type="s" name="job_type" direction="out"/> -->
+  <!--  <arg type="a(uosos)" name="affected_jobs" direction="out"/> -->
+  <!-- </method> -->
+  <method name="KillUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="whom" direction="in"/>
+   <arg type="i" name="signal" direction="in"/>
+  </method>
+  <method name="QueueSignalUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="whom" direction="in"/>
+   <arg type="i" name="signal" direction="in"/>
+   <arg type="i" name="value" direction="in"/>
+  </method>
+  <method name="CleanUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="as" name="mask" direction="in"/>
+  </method>
+  <method name="FreezeUnit">
+   <arg type="s" name="name" direction="in"/>
+  </method>
+  <method name="ThawUnit">
+   <arg type="s" name="name" direction="in"/>
+  </method>
+  <method name="ResetFailedUnit">
+   <arg type="s" name="name" direction="in"/>
+  </method>
+  <!-- <method name="SetUnitProperties"> -->
+  <!--  <arg type="s" name="name" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="a(sv)" name="properties" direction="in"/> -->
+  <!-- </method> -->
+  <method name="BindMountUnit">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="s" name="source" direction="in"/>
+   <arg type="s" name="destination" direction="in"/>
+   <arg type="b" name="read_only" direction="in"/>
+   <arg type="b" name="mkdir" direction="in"/>
+  </method>
+  <!-- <method name="MountImageUnit"> -->
+  <!--  <arg type="s" name="name" direction="in"/> -->
+  <!--  <arg type="s" name="source" direction="in"/> -->
+  <!--  <arg type="s" name="destination" direction="in"/> -->
+  <!--  <arg type="b" name="read_only" direction="in"/> -->
+  <!--  <arg type="b" name="mkdir" direction="in"/> -->
+  <!--  <arg type="a(ss)" name="options" direction="in"/> -->
+  <!-- </method> -->
+  <method name="RefUnit">
+   <arg type="s" name="name" direction="in"/>
+  </method>
+  <method name="UnrefUnit">
+   <arg type="s" name="name" direction="in"/>
+  </method>
+  <!-- <method name="StartTransientUnit"> -->
+  <!--  <arg type="s" name="name" direction="in"/> -->
+  <!--  <arg type="s" name="mode" direction="in"/> -->
+  <!--  <arg type="a(sv)" name="properties" direction="in"/> -->
+  <!--  <arg type="a(sa(sv))" name="aux" direction="in"/> -->
+  <!--  <arg type="o" name="job" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="GetUnitProcesses"> -->
+  <!--  <arg type="s" name="name" direction="in"/> -->
+  <!--  <arg type="a(sus)" name="processes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="AttachProcessesToUnit"> -->
+  <!--  <arg type="s" name="unit_name" direction="in"/> -->
+  <!--  <arg type="s" name="subcgroup" direction="in"/> -->
+  <!--  <arg type="au" name="pids" direction="in"/> -->
+  <!-- </method> -->
+  <method name="AbandonScope">
+   <arg type="s" name="name" direction="in"/>
+  </method>
+  <method name="GetJob">
+   <arg type="u" name="id" direction="in"/>
+   <arg type="o" name="job" direction="out"/>
+  </method>
+  <!-- <method name="GetJobAfter"> -->
+  <!--  <arg type="u" name="id" direction="in"/> -->
+  <!--  <arg type="a(usssoo)" name="jobs" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="GetJobBefore"> -->
+  <!--  <arg type="u" name="id" direction="in"/> -->
+  <!--  <arg type="a(usssoo)" name="jobs" direction="out"/> -->
+  <!-- </method> -->
+  <method name="CancelJob">
+   <arg type="u" name="id" direction="in"/>
+  </method>
+  <method name="ClearJobs">
+  </method>
+  <method name="ResetFailed">
+  </method>
+  <method name="SetShowStatus">
+   <arg type="s" name="mode" direction="in"/>
+  </method>
+  <!-- <method name="ListUnits"> -->
+  <!--  <arg type="a(ssssssouso)" name="units" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ListUnitsFiltered"> -->
+  <!--  <arg type="as" name="states" direction="in"/> -->
+  <!--  <arg type="a(ssssssouso)" name="units" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ListUnitsByPatterns"> -->
+  <!--  <arg type="as" name="states" direction="in"/> -->
+  <!--  <arg type="as" name="patterns" direction="in"/> -->
+  <!--  <arg type="a(ssssssouso)" name="units" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ListUnitsByNames"> -->
+  <!--  <arg type="as" name="names" direction="in"/> -->
+  <!--  <arg type="a(ssssssouso)" name="units" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ListJobs"> -->
+  <!--  <arg type="a(usssoo)" name="jobs" direction="out"/> -->
+  <!-- </method> -->
+  <method name="Subscribe">
+  </method>
+  <method name="Unsubscribe">
+  </method>
+  <method name="Dump">
+   <arg type="s" name="output" direction="out"/>
+  </method>
+  <method name="DumpUnitsMatchingPatterns">
+   <arg type="as" name="patterns" direction="in"/>
+   <arg type="s" name="output" direction="out"/>
+  </method>
+  <method name="DumpByFileDescriptor">
+   <arg type="h" name="fd" direction="out"/>
+  </method>
+  <method name="DumpUnitsMatchingPatternsByFileDescriptor">
+   <arg type="as" name="patterns" direction="in"/>
+   <arg type="h" name="fd" direction="out"/>
+  </method>
+  <method name="Reload">
+  </method>
+  <method name="Reexecute">
+   <annotation name="org.freedesktop.DBus.Method.NoReply" value="true"/>
+  </method>
+  <method name="Exit">
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </method>
+  <method name="Reboot">
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </method>
+  <method name="SoftReboot">
+   <arg type="s" name="new_root" direction="in"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </method>
+  <method name="PowerOff">
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </method>
+  <method name="Halt">
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </method>
+  <method name="KExec">
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </method>
+  <method name="SwitchRoot">
+   <arg type="s" name="new_root" direction="in"/>
+   <arg type="s" name="init" direction="in"/>
+   <annotation name="org.freedesktop.systemd1.Privileged" value="true"/>
+  </method>
+  <method name="SetEnvironment">
+   <arg type="as" name="assignments" direction="in"/>
+  </method>
+  <method name="UnsetEnvironment">
+   <arg type="as" name="names" direction="in"/>
+  </method>
+  <method name="UnsetAndSetEnvironment">
+   <arg type="as" name="names" direction="in"/>
+   <arg type="as" name="assignments" direction="in"/>
+  </method>
+  <method name="EnqueueMarkedJobs">
+   <arg type="ao" name="jobs" direction="out"/>
+  </method>
+  <!-- <method name="ListUnitFiles"> -->
+  <!--  <arg type="a(ss)" name="unit_files" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ListUnitFilesByPatterns"> -->
+  <!--  <arg type="as" name="states" direction="in"/> -->
+  <!--  <arg type="as" name="patterns" direction="in"/> -->
+  <!--  <arg type="a(ss)" name="unit_files" direction="out"/> -->
+  <!-- </method> -->
+  <method name="GetUnitFileState">
+   <arg type="s" name="file" direction="in"/>
+   <arg type="s" name="state" direction="out"/>
+  </method>
+  <!-- <method name="EnableUnitFiles"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="b" name="force" direction="in"/> -->
+  <!--  <arg type="b" name="carries_install_info" direction="out"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="DisableUnitFiles"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="EnableUnitFilesWithFlags"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="t" name="flags" direction="in"/> -->
+  <!--  <arg type="b" name="carries_install_info" direction="out"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="DisableUnitFilesWithFlags"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="t" name="flags" direction="in"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="DisableUnitFilesWithFlagsAndInstallInfo"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="t" name="flags" direction="in"/> -->
+  <!--  <arg type="b" name="carries_install_info" direction="out"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="ReenableUnitFiles"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="b" name="force" direction="in"/> -->
+  <!--  <arg type="b" name="carries_install_info" direction="out"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="LinkUnitFiles"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="b" name="force" direction="in"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="PresetUnitFiles"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="b" name="force" direction="in"/> -->
+  <!--  <arg type="b" name="carries_install_info" direction="out"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="PresetUnitFilesWithMode"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="s" name="mode" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="b" name="force" direction="in"/> -->
+  <!--  <arg type="b" name="carries_install_info" direction="out"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="MaskUnitFiles"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="b" name="force" direction="in"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="UnmaskUnitFiles"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="RevertUnitFiles"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="SetDefaultTarget"> -->
+  <!--  <arg type="s" name="name" direction="in"/> -->
+  <!--  <arg type="b" name="force" direction="in"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <method name="GetDefaultTarget">
+   <arg type="s" name="name" direction="out"/>
+  </method>
+  <!-- <method name="PresetAllUnitFiles"> -->
+  <!--  <arg type="s" name="mode" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="b" name="force" direction="in"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="AddDependencyUnitFiles"> -->
+  <!--  <arg type="as" name="files" direction="in"/> -->
+  <!--  <arg type="s" name="target" direction="in"/> -->
+  <!--  <arg type="s" name="type" direction="in"/> -->
+  <!--  <arg type="b" name="runtime" direction="in"/> -->
+  <!--  <arg type="b" name="force" direction="in"/> -->
+  <!--  <arg type="a(sss)" name="changes" direction="out"/> -->
+  <!-- </method> -->
+  <method name="GetUnitFileLinks">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="b" name="runtime" direction="in"/>
+   <arg type="as" name="links" direction="out"/>
+  </method>
+  <method name="SetExitCode">
+   <arg type="y" name="number" direction="in"/>
+  </method>
+  <method name="LookupDynamicUserByName">
+   <arg type="s" name="name" direction="in"/>
+   <arg type="u" name="uid" direction="out"/>
+  </method>
+  <method name="LookupDynamicUserByUID">
+   <arg type="u" name="uid" direction="in"/>
+   <arg type="s" name="name" direction="out"/>
+  </method>
+  <!-- <method name="GetDynamicUsers"> -->
+  <!--  <arg type="a(us)" name="users" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="DumpUnitFileDescriptorStore"> -->
+  <!--  <arg type="s" name="name" direction="in"/> -->
+  <!--  <arg type="a(suuutuusu)" name="entries" direction="out"/> -->
+  <!-- </method> -->
+  <!-- <method name="StartAuxiliaryScope"> -->
+  <!--  <arg type="s" name="name" direction="in"/> -->
+  <!--  <arg type="ah" name="pidfds" direction="in"/> -->
+  <!--  <arg type="t" name="flags" direction="in"/> -->
+  <!--  <arg type="a(sv)" name="properties" direction="in"/> -->
+  <!--  <arg type="o" name="job" direction="out"/> -->
+  <!--  <annotation name="org.freedesktop.DBus.Deprecated" value="true"/> -->
+  <!-- </method> -->
+  <signal name="UnitNew">
+   <arg type="s" name="id"/>
+   <arg type="o" name="unit"/>
+  </signal>
+  <signal name="UnitRemoved">
+   <arg type="s" name="id"/>
+   <arg type="o" name="unit"/>
+  </signal>
+  <signal name="JobNew">
+   <arg type="u" name="id"/>
+   <arg type="o" name="job"/>
+   <arg type="s" name="unit"/>
+  </signal>
+  <signal name="JobRemoved">
+   <arg type="u" name="id"/>
+   <arg type="o" name="job"/>
+   <arg type="s" name="unit"/>
+   <arg type="s" name="result"/>
+  </signal>
+  <signal name="StartupFinished">
+   <arg type="t" name="firmware"/>
+   <arg type="t" name="loader"/>
+   <arg type="t" name="kernel"/>
+   <arg type="t" name="initrd"/>
+   <arg type="t" name="userspace"/>
+   <arg type="t" name="total"/>
+  </signal>
+  <signal name="UnitFilesChanged">
+  </signal>
+  <signal name="Reloading">
+   <arg type="b" name="active"/>
+  </signal>
+ </interface>
+ <node name="unit"/>
+ <node name="job"/>
+</node>
diff --git a/accounts/gkleen@sif/shell/quickshell/ActiveWindowDisplay.qml b/accounts/gkleen@sif/shell/quickshell/ActiveWindowDisplay.qml
new file mode 100644
index 00000000..dcc23279
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/ActiveWindowDisplay.qml
@@ -0,0 +1,172 @@
+import QtQuick
+import qs.Services
+import Quickshell
+import Quickshell.Widgets
+Item {
+  id: activeWindowDisplay
+  required property int maxWidth
+  required property var screen
+  property var activeWindow: {
+    let currWindowId = Array.from(NiriService.workspaces).find(ws => {
+      return ws.output === screen.name && ws.is_active;
+    })?.active_window_id;
+    return currWindowId ? Array.from(NiriService.windows).find(win => win.id == currWindowId) : null;
+  }
+  property var windowEntry: activeWindow ? DesktopEntries.heuristicLookup(activeWindow.app_id) : null
+  anchors.verticalCenter: parent.verticalCenter
+  width: activeWindowDisplayContent.width
+  height: parent.height
+  WrapperMouseArea {
+    id: widgetMouseArea
+    anchors.fill: parent
+    hoverEnabled: true
+    Item {
+      anchors.fill: parent
+      Row {
+        id: activeWindowDisplayContent
+        width: childrenRect.width
+        height: parent.height
+        anchors.verticalCenter: parent.verticalCenter
+        spacing: 8
+        IconImage {
+          id: activeWindowIcon
+          implicitSize: 14
+          anchors.verticalCenter: parent.verticalCenter
+          source: {
+            let icon = activeWindowDisplay.windowEntry?.icon
+            if (typeof icon === 'string' || icon instanceof String) {
+              if (icon.includes("?path=")) {
+                const split = icon.split("?path=")
+                if (split.length !== 2)
+                  return icon
+                const name = split[0]
+                const path = split[1]
+                const fileName = name.substring(
+                                 name.lastIndexOf("/") + 1)
+                return `file://${path}/${fileName}`
+              } else
+                icon = Quickshell.iconPath(icon);
+              return icon
+            }
+            return ""
+          }
+          asynchronous: true
+          smooth: true
+          mipmap: true
+        }
+        Text {
+          id: windowTitle
+          width: Math.min(implicitWidth, activeWindowDisplay.maxWidth - activeWindowIcon.width - activeWindowDisplayContent.spacing)
+          property var appAliases: { "Firefox": "Mozilla Firefox", "mpv Media Player": "mpv", "Thunderbird": "Mozilla Thunderbird", "Thunderbird (LMU)": "Mozilla Thunderbird" }
+          elide: Text.ElideRight
+          maximumLineCount: 1
+          color: "white"
+          anchors.verticalCenter: parent.verticalCenter
+          text: {
+            if (!activeWindowDisplay.activeWindow)
+              return "";
+            var title = activeWindowDisplay.activeWindow.title;
+            var appName = activeWindowDisplay.windowEntry?.name;
+            if (appAliases[appName])
+              appName = appAliases[appName];
+            if (appName && title.endsWith(appName)) {
+              const oldTitle = title;
+              title = title.substring(0, title.length - appName.length);
+              title = title.replace(/\s*(—|-)\s*$/, "");
+              if (!title)
+                title = oldTitle;
+            }
+            return title;
+          }
+        }
+      }
+    }
+  }
+  Loader {
+    id: tooltipLoader
+    active: false
+    Connections {
+      target: widgetMouseArea
+      function onContainsMouseChanged() {
+       if (widgetMouseArea.containsMouse)
+         tooltipLoader.active = true;
+      }
+    }
+    PopupWindow {
+      id: tooltip
+      property bool nextVisible: widgetMouseArea.containsMouse || tooltipMouseArea.containsMouse
+      anchor {
+        item: widgetMouseArea
+        edges: Edges.Bottom | Edges.Left
+      }
+      visible: false
+      onNextVisibleChanged: hangTimer.restart()
+      Timer {
+        id: hangTimer
+        interval: tooltip.visible ? 100 : 500
+        onTriggered: {
+          tooltip.visible = tooltip.nextVisible;
+          if (!tooltip.visible)
+            tooltipLoader.active = false;
+        }
+      }
+      implicitWidth: widgetTooltipText.contentWidth + 16
+      implicitHeight: widgetTooltipText.contentHeight + 16
+      color: "black"
+      WrapperMouseArea {
+        id: tooltipMouseArea
+        hoverEnabled: true
+        enabled: true
+        anchors.fill: parent
+        Item {
+          anchors.fill: parent
+          Text {
+            id: widgetTooltipText
+            anchors.centerIn: parent
+            font.pointSize: 10
+            font.family: "Fira Mono"
+            color: "white"
+            text: JSON.stringify(Object.assign({}, activeWindowDisplay.activeWindow), null, 2)
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Bar.qml b/accounts/gkleen@sif/shell/quickshell/Bar.qml
new file mode 100644
index 00000000..9210066c
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Bar.qml
@@ -0,0 +1,117 @@
+import Quickshell
+import Quickshell.Wayland
+import QtQuick
+PanelWindow {
+  id: bar
+  required property var modelData
+  screen: modelData
+  WlrLayershell.namespace: "bar"
+  anchors {
+    top: true
+    left: true
+    right: true
+  }
+  margins {
+    left: 26 + 8
+    right: 26 + 8
+  }
+  implicitHeight: 21
+  color: "transparent"
+  Rectangle {
+    color: Qt.rgba(0, 0, 0, 0.75)
+    anchors.fill: parent
+    // bottomLeftRadius: 8
+    // bottomRightRadius: 8
+  }
+  Row {
+    id: left
+    height: parent.height
+    width: childrenRect.width
+    anchors.left: parent.left
+    anchors.leftMargin: 8
+    anchors.verticalCenter: parent.verticalCenter
+    spacing: 8
+    WorkspaceSwitcher {
+      screen: bar.screen
+    }
+  }
+  Row {
+    id: center
+    height: parent.height
+    width: childrenRect.width
+    anchors.centerIn: parent
+    spacing: 5
+    ActiveWindowDisplay {
+      screen: bar.screen
+      maxWidth: bar.width - 2*Math.max(left.width, right.width) - 2*8
+    }
+  }
+  Row {
+    id: right
+    height: parent.height
+    width: childrenRect.width
+    anchors.right: parent.right
+    anchors.rightMargin: 8
+    anchors.verticalCenter: parent.verticalCenter
+    spacing: 0
+    // WorktimeWidget { command: "time"; }
+    // WorktimeWidget { command: "today"; }
+    KeyboardLayout {}
+    Item {
+      visible: privacy.visible
+      height: parent.height
+      width: 8 - 4
+    }
+    PrivacyWidget {
+      id: privacy
+    }
+    Item {
+      visible: privacy.visible
+      height: parent.height
+      width: 8 - 4
+    }
+    SystemTray {}
+    PipewireWidget {}
+    BrightnessWidget {}
+    BatteryWidget {}
+    WaylandInhibitorWidget {
+      window: bar
+    }
+    NotificationInhibitorWidget {}
+    LidSwitchInhibitorWidget {}
+    Item {
+      height: parent.height
+      width: 8 - 4
+    }
+    Clock {}
+  }
+}
+\ No newline at end of file
diff --git a/accounts/gkleen@sif/shell/quickshell/BatteryWidget.qml b/accounts/gkleen@sif/shell/quickshell/BatteryWidget.qml
new file mode 100644
index 00000000..da17df2a
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/BatteryWidget.qml
@@ -0,0 +1,136 @@
+import QtQuick
+import Quickshell
+import Quickshell.Widgets
+import Quickshell.Services.UPower
+Item {
+  id: root
+  height: parent.height
+  width: batteryIcon.width + 8
+  anchors.verticalCenter: parent.verticalCenter
+  property var batteryDevice: Array.from(UPower.devices.values).find(dev => dev.isLaptopBattery)
+  WrapperMouseArea {
+    id: widgetMouseArea
+    anchors.fill: parent
+    hoverEnabled: true
+    Item {
+      anchors.fill: parent
+      MaterialDesignIcon {
+        id: batteryIcon
+        implicitSize: 14
+        anchors.centerIn: parent
+        icon: {
+          if (!root.batteryDevice?.ready)
+            return "battery-unknown";
+          if (root.batteryDevice.state == UPowerDeviceState.FullyCharged)
+            return "power-plug-battery";
+          const perdec = 10 * Math.max(1, Math.ceil(root.batteryDevice.percentage * 10));
+          if (root.batteryDevice.state == UPowerDeviceState.Charging)
+            return `battery-charging-${perdec}`;
+          if (perdec == 100)
+            return "battery";
+          return `battery-${perdec}`;
+        }
+        color: {
+          if (!root.batteryDevice?.ready)
+            return "#555";
+          if (root.batteryDevice.state != UPowerDeviceState.FullyCharged && root.batteryDevice.state != UPowerDeviceState.Charging && root.batteryDevice.timeToEmpty < 20 * 60)
+            return "#f2201f";
+          if (root.batteryDevice.state != UPowerDeviceState.FullyCharged && root.batteryDevice.state != UPowerDeviceState.Charging && root.batteryDevice.timeToEmpty < 40 * 60)
+            return "#f28a21";
+          if (root.batteryDevice.state != UPowerDeviceState.FullyCharged)
+            return "#fff";
+          return "#555";
+        }
+      }
+    }
+  }
+  PopupWindow {
+    id: tooltip
+    property bool nextVisible: widgetMouseArea.containsMouse || tooltipMouseArea.containsMouse
+    anchor {
+      item: widgetMouseArea
+      edges: Edges.Bottom | Edges.Left
+    }
+    visible: false
+    onNextVisibleChanged: hangTimer.restart()
+    Timer {
+      id: hangTimer
+      interval: 100
+      onTriggered: tooltip.visible = tooltip.nextVisible
+    }
+    implicitWidth: widgetTooltipText.contentWidth + 16
+    implicitHeight: widgetTooltipText.contentHeight + 16
+    color: "black"
+    WrapperMouseArea {
+      id: tooltipMouseArea
+      hoverEnabled: true
+      enabled: true
+      anchors.fill: parent
+      Item {
+        anchors.fill: parent
+        Text {
+          id: widgetTooltipText
+          anchors.centerIn: parent
+          font.pointSize: 10
+          font.family: "Fira Sans"
+          color: "white"
+          text: {
+            const stateStr = UPowerDeviceState.toString(root.batteryDevice.state);
+            var outStr = stateStr;
+            if (root.batteryDevice.state != UPowerDeviceState.FullyCharged)
+              outStr += ` ${Math.round(root.batteryDevice.percentage * 100)}%`;
+            function formatTime(t) {
+              var res = "";
+              for (const unit of [{ "s": "h", "v": 3600 }, { "s": "m", "v": 60 }, { "s": "s", "v": 1 }]) {
+                if (t < unit.v)
+                  continue;
+                res += Math.floor(t / unit.v) + unit.s;
+                t %= unit.v;
+              }
+              return res;
+            }
+            if (root.batteryDevice.timeToEmpty != 0) {
+              const tStr = formatTime(Math.floor(root.batteryDevice.timeToEmpty / 60) * 60);
+              if (tStr)
+                outStr += " " + tStr;
+            } else if (root.batteryDevice.timeToFull != 0) {
+              const tStr = formatTime(Math.ceil(root.batteryDevice.timeToFull / 60) * 60);
+              if (tStr)
+                outStr += " " + tStr;
+            }
+            return outStr;
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/BrightnessOSD.qml b/accounts/gkleen@sif/shell/quickshell/BrightnessOSD.qml
new file mode 100644
index 00000000..a432179e
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/BrightnessOSD.qml
@@ -0,0 +1,117 @@
+import QtQuick
+import QtQuick.Layouts
+import Quickshell
+import Quickshell.Widgets
+import qs.Services
+Scope {
+  id: root
+  property bool show: false
+  property bool inhibited: true
+  Connections {
+    target: Brightness
+    function onCurrBrightnessChanged() {
+      root.show = true;
+      hideTimer.restart();
+    }
+  }
+  onShowChanged: {
+    if (show)
+      hideTimer.restart();
+  }
+  Timer {
+    id: hideTimer
+    interval: 1000
+    onTriggered: root.show = false
+  }
+  Timer {
+    id: startInhibit
+    interval: 100
+    running: true
+    onTriggered: {
+      root.show = false;
+      root.inhibited = false;
+    }
+  }
+  LazyLoader {
+    active: root.show && !root.inhibited
+    Variants {
+      model: Quickshell.screens
+      delegate: Scope {
+        id: screenScope
+        required property var modelData
+        PanelWindow {
+          id: window
+          screen: screenScope.modelData
+          anchors.top: true
+          margins.top: screen.height / 2 - 50 + 3.5
+          exclusiveZone: 0
+          exclusionMode: ExclusionMode.Ignore
+          implicitWidth: 400
+          implicitHeight: 50
+          mask: Region {}
+          color: "transparent"
+          Rectangle {
+            anchors.fill: parent
+            color: Qt.rgba(0, 0, 0, 0.75)
+          }
+          RowLayout {
+            id: layout
+            anchors.centerIn: parent
+            height: 50 - 8*2
+            width: 400 - 8*2
+            MaterialDesignIcon {
+              id: volumeIcon
+              implicitWidth: parent.height
+              implicitHeight: parent.height
+              icon: `brightness-${Math.min(7, Math.floor(Brightness.currBrightness * 7) + 1)}`
+            }
+            Rectangle {
+              Layout.fillWidth: true
+              implicitHeight: 10
+              color: "#50ffffff"
+              Rectangle {
+                anchors {
+                  left: parent.left
+                  top: parent.top
+                  bottom: parent.bottom
+                }
+                color: "white"
+                implicitWidth: parent.width * Brightness.currBrightness
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/BrightnessWidget.qml b/accounts/gkleen@sif/shell/quickshell/BrightnessWidget.qml
new file mode 100644
index 00000000..3bb5a80e
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/BrightnessWidget.qml
@@ -0,0 +1,84 @@
+import QtQuick
+import Quickshell
+import Quickshell.Widgets
+import qs.Services
+Item {
+  height: parent.height
+  width: brightnessIcon.width + 8
+  anchors.verticalCenter: parent.verticalCenter
+  WrapperMouseArea {
+    id: widgetMouseArea
+    anchors.fill: parent
+    hoverEnabled: true
+    property real sensitivity: (1 / 50) / 120
+    onWheel: event => Brightness.currBrightness += event.angleDelta.y * sensitivity
+    Item {
+      anchors.fill: parent
+      MaterialDesignIcon {
+        id: brightnessIcon
+        implicitSize: 14
+        anchors.centerIn: parent
+        icon: `brightness-${Math.min(7, Math.floor(Brightness.currBrightness * 7) + 1)}`
+        color: "#555"
+      }
+    }
+  }
+  PopupWindow {
+    id: tooltip
+    property bool nextVisible: widgetMouseArea.containsMouse || tooltipMouseArea.containsMouse
+    anchor {
+      item: widgetMouseArea
+      edges: Edges.Bottom | Edges.Left
+    }
+    visible: false
+    onNextVisibleChanged: hangTimer.restart()
+    Timer {
+      id: hangTimer
+      interval: 100
+      onTriggered: tooltip.visible = tooltip.nextVisible
+    }
+    implicitWidth: widgetTooltipText.contentWidth + 16
+    implicitHeight: widgetTooltipText.contentHeight + 16
+    color: "black"
+    WrapperMouseArea {
+      id: tooltipMouseArea
+      hoverEnabled: true
+      enabled: true
+      anchors.fill: parent
+      Item {
+        anchors.fill: parent
+        Text {
+          id: widgetTooltipText
+          anchors.centerIn: parent
+          font.pointSize: 10
+          font.family: "Fira Sans"
+          color: "white"
+          text: `${Math.round(Brightness.currBrightness * 100)}%`
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Clock.qml b/accounts/gkleen@sif/shell/quickshell/Clock.qml
new file mode 100644
index 00000000..b7004528
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Clock.qml
@@ -0,0 +1,295 @@
+import QtQml
+import QtQuick
+import Quickshell
+import Custom as Custom
+import QtQuick.Controls
+import QtQuick.Layouts
+import Quickshell.Widgets
+Item {
+  id: clockItem
+  property bool calendarPopup: true
+  width: clock.contentWidth
+  height: parent.height
+  anchors.verticalCenter: parent.verticalCenter
+  WrapperMouseArea {
+    id: clockMouseArea
+    anchors.fill: parent
+    hoverEnabled: true
+    enabled: clockItem.calendarPopup
+    Item {
+      anchors.fill: parent
+      Text {
+        id: clock
+        color: "white"
+        anchors.verticalCenter: parent.verticalCenter
+        Custom.Chrono {
+          id: chrono
+          onDateChanged: clock.text = format("W{0:%V-%u} {0:%F} {0:%H:%M:%S%Ez}")
+        }
+        font.pointSize: 10
+        font.family: "Fira Sans"
+        font.features: { "tnum": 1 }
+      }
+    }
+  }
+  Loader {
+    id: tooltipLoader
+    active: false
+    Connections {
+      target: clockMouseArea
+      function onContainsMouseChanged() {
+       if (clockMouseArea.containsMouse)
+         tooltipLoader.active = true;
+      }
+    }
+    sourceComponent: PopupWindow {
+      id: tooltip
+      property bool nextVisible: clockMouseArea.containsMouse || tooltipMouseArea.containsMouse
+      anchor {
+        item: clockMouseArea
+        edges: Edges.Bottom | Edges.Left
+      }
+      visible: false
+      onNextVisibleChanged: hangTimer.restart()
+      Timer {
+        id: hangTimer
+        interval: 100
+        onTriggered: {
+          tooltip.visible = tooltip.nextVisible;
+          if (!tooltip.visible)
+            tooltipLoader.active = false;
+        }
+      }
+      implicitWidth: tooltipLayout.childrenRect.width + 16
+      implicitHeight: tooltipLayout.childrenRect.height + 16
+      color: "black"
+      onVisibleChanged: {
+        yearCalendar.year = chrono.date.getFullYear();
+        yearCalendar.angleRem = 0;
+      }
+      WrapperMouseArea {
+        id: tooltipMouseArea
+        hoverEnabled: true
+        enabled: true
+        onWheel: event => yearCalendar.scrollYear(event)
+        anchors.fill: parent
+        Item {
+          id: clockTooltipContent
+          anchors.fill: parent
+          ColumnLayout {
+            id: tooltipLayout
+            anchors {
+              left: parent.left
+              top: parent.top
+              leftMargin: 8
+              topMargin: 8
+            }
+            Text {
+              id: yearLabel
+              horizontalAlignment: Text.AlignHCenter
+              font.pointSize: 14
+              font.family: "Fira Sans"
+              font.features: { "tnum": 1 }
+              color: "white"
+              text: yearCalendar.year
+              Layout.fillWidth: true
+              Layout.bottomMargin: 8
+            }
+            GridLayout {
+              property int year: chrono.date.getFullYear()
+              id: yearCalendar
+              columns: 3
+              columnSpacing: 16
+              rowSpacing: 16
+              Layout.alignment: Qt.AlignHCenter
+              Layout.fillWidth: false
+              property real angleRem: 0
+              property real sensitivity: 1 / 120
+              function scrollYear(event) {
+                angleRem += event.angleDelta.y;
+                const d = Math.round(angleRem * sensitivity);
+                yearCalendar.year += d;
+                angleRem -= d / sensitivity;
+              }
+              Connections {
+                target: clockMouseArea
+                function onWheel(event) { yearCalendar.scrollYear(event); }
+              }
+              Repeater {
+                model: 12
+                GridLayout {
+                  columns: 2
+                  required property int index
+                  property int month: index
+                  id: monthCalendar
+                  Layout.alignment: Qt.AlignTop | Qt.AlignRight
+                  Layout.fillWidth: false
+                  Text {
+                    Layout.column: 1
+                    Layout.fillWidth: true
+                    horizontalAlignment: Text.AlignHCenter
+                    font.pointSize: 10
+                    font.family: "Fira Sans"
+                    text: new Date(yearCalendar.year, monthCalendar.month, 1).toLocaleString(Qt.locale("en_DK"), "MMMM")
+                    color: "#ffead3"
+                  }
+                  DayOfWeekRow {
+                    locale: grid.locale
+                    Layout.row: 1
+                    Layout.column: 1
+                    Layout.fillWidth: true
+                    delegate: WrapperItem {
+                      required property string shortName
+                      width: dowLabel.contentWidth + 6
+                      Text {
+                        id: dowLabel
+                        anchors.fill: parent
+                        font.pointSize: 10
+                        font.family: "Fira Sans"
+                        text: parent.shortName
+                        color: "#ffcc66"
+                        horizontalAlignment: Text.AlignHCenter
+                        verticalAlignment: Text.AlignVCenter
+                      }
+                    }
+                  }
+                  WeekNumberColumn {
+                    month: grid.month
+                    year: grid.year
+                    locale: grid.locale
+                    Layout.fillHeight: true
+                    delegate: Text {
+                      required property int weekNumber
+                      opacity: {
+                        const simple = new Date(weekNumber == 1 && monthCalendar.month == 12 ? yearCalendar.year + 1 : yearCalendar.year, 0, 1 + (weekNumber - 1) * 7);
+                        const dayOfWeek = simple.getDay();
+                        const isoWeekStart = simple;
+                        isoWeekStart.setDate(simple.getDate() - dayOfWeek + 1);
+                        if (dayOfWeek > 4) {
+                            isoWeekStart.setDate(isoWeekStart.getDate() + 7);
+                        }
+                        for (let i = 0; i < 7; i++) {
+                          const dayInWeek = new Date(isoWeekStart);
+                          dayInWeek.setDate(dayInWeek.getDate() + i);
+                          if (dayInWeek.getMonth() == monthCalendar.month)
+                            return 1;
+                        }
+                        return 0;
+                      }
+                      font.pointSize: 10
+                      font.family: "Fira Sans"
+                      font.features: { "tnum": 1 }
+                      text: weekNumber
+                      color: "#99ffdd"
+                      horizontalAlignment: Text.AlignRight
+                      verticalAlignment: Text.AlignVCenter
+                    }
+                  }
+                  MonthGrid {
+                    id: grid
+                    year: yearCalendar.year
+                    month: monthCalendar.month
+                    locale: Qt.locale("en_DK")
+                    Layout.fillWidth: true
+                    Layout.fillHeight: true
+                    delegate: Text {
+                        required property var model
+                        opacity: model.month === monthCalendar.month ? 1 : 0
+                        font.pointSize: 10
+                        font.family: "Fira Sans"
+                        font.features: { "tnum": 1 }
+                        property bool today: chrono.date.getFullYear() == model.year && chrono.date.getMonth() == model.month && chrono.date.getDate() == model.day
+                        text: model.day
+                        color: today ? "#ff6699" : "white"
+                        horizontalAlignment: Text.AlignRight
+                        verticalAlignment: Text.AlignVCenter
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/KeyboardLayout.qml b/accounts/gkleen@sif/shell/quickshell/KeyboardLayout.qml
new file mode 100644
index 00000000..46302e54
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/KeyboardLayout.qml
@@ -0,0 +1,112 @@
+import Quickshell
+import QtQuick
+import qs.Services
+import Quickshell.Widgets
+Item {
+  width: kbdLabel.contentWidth + 8
+  height: parent.height
+  anchors.verticalCenter: parent.verticalCenter
+  WrapperMouseArea {
+    id: kbdMouseArea
+    anchors.fill: parent
+    hoverEnabled: true
+    cursorShape: Qt.PointingHandCursor
+    enabled: true
+    onClicked: {
+      NiriService.sendCommand({ "Action": { "SwitchLayout": { "layout": "Next" } } }, _ => {})
+    }
+    onWheel: event => {
+      NiriService.sendCommand({ "Action": { "SwitchLayout": { "layout": event.angleDelta > 0 ? "Next" : "Prev" } } }, _ => {})
+    }
+    Rectangle {
+      id: kbdWidget
+      property var keyboardAbbrev: { "English (programmer Dvorak)": "dvp", "English (US)": "us" }
+      anchors.fill: parent
+      color: {
+        if (kbdMouseArea.containsMouse) {
+          return "#33808080";
+        }
+        return "transparent";
+      }
+      Text {
+        id: kbdLabel
+        font.pointSize: 10
+        font.family: "Fira Sans"
+        color: {
+          if (NiriService.keyboardLayouts?.current_idx === 0)
+            return "#555";
+          return "white";
+        }
+        anchors.centerIn: parent
+        text: {
+          const currentLayout = NiriService.keyboardLayouts?.names?.[NiriService.keyboardLayouts.current_idx];
+          if (!currentLayout)
+            return "";
+          return kbdWidget.keyboardAbbrev[currentLayout] ? kbdWidget.keyboardAbbrev[currentLayout] : currentLayout;
+        }
+      }
+    }
+  }
+  PopupWindow {
+    id: tooltip
+    property bool nextVisible: kbdMouseArea.containsMouse || tooltipMouseArea.containsMouse
+    anchor {
+      item: kbdMouseArea
+      edges: Edges.Bottom | Edges.Left
+    }
+    visible: false
+    onNextVisibleChanged: hangTimer.restart()
+    Timer {
+      id: hangTimer
+      interval: 100
+      onTriggered: tooltip.visible = tooltip.nextVisible
+    }
+    implicitWidth: kbdTooltipText.contentWidth + 16
+    implicitHeight: kbdTooltipText.contentHeight + 16
+    color: "black"
+    WrapperMouseArea {
+      id: tooltipMouseArea
+      hoverEnabled: true
+      enabled: true
+      anchors.fill: parent
+      Item {
+        anchors.fill: parent
+        Text {
+          id: kbdTooltipText
+          anchors.centerIn: parent
+          font.pointSize: 10
+          font.family: "Fira Sans"
+          color: "white"
+          text: {
+            const currentLayout = NiriService.keyboardLayouts?.names?.[NiriService.keyboardLayouts.current_idx];
+            return currentLayout || "";
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/LidSwitchInhibitorWidget.qml b/accounts/gkleen@sif/shell/quickshell/LidSwitchInhibitorWidget.qml
new file mode 100644
index 00000000..8410dcda
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/LidSwitchInhibitorWidget.qml
@@ -0,0 +1,47 @@
+import Quickshell
+import QtQuick
+import Quickshell.Widgets
+import qs.Services
+Item {
+  id: root
+  width: icon.width + 8
+  height: parent.height
+  anchors.verticalCenter: parent.verticalCenter
+  WrapperMouseArea {
+    id: widgetMouseArea
+    anchors.fill: parent
+    hoverEnabled: true
+    cursorShape: Qt.PointingHandCursor
+    onClicked: InhibitorState.lidSwitchInhibited = !InhibitorState.lidSwitchInhibited
+    Rectangle {
+      anchors.fill: parent
+      color: {
+        if (widgetMouseArea.containsMouse) {
+          return "#33808080";
+        }
+        return "transparent";
+      }
+      Item {
+        anchors.fill: parent
+        MaterialDesignIcon {
+          id: icon
+          implicitSize: 14
+          anchors.centerIn: parent
+          icon: InhibitorState.lidSwitchInhibited ? "laptop-off" : "laptop"
+          color: InhibitorState.lidSwitchInhibited ? "#f28a21" : "#555"
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/LockSurface.qml b/accounts/gkleen@sif/shell/quickshell/LockSurface.qml
new file mode 100644
index 00000000..f4f8f0cd
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/LockSurface.qml
@@ -0,0 +1,227 @@
+import Quickshell.Widgets
+import QtQuick.Effects
+import QtQuick.Layouts
+import QtQuick
+import QtQuick.Controls
+import QtQuick.Controls.Fusion
+import qs.Services
+import QtQml
+Item {
+  id: lockSurface
+  property var screen
+  property list<var> messages: []
+  property bool responseRequired: false
+  property bool responseVisible: false
+  property string currentText: ""
+  property bool authRunning: false
+  signal response(string responseText)
+  anchors.fill: parent
+  Item {
+    id: background
+    anchors.fill: parent
+    property Img current: one
+    property string source: selector.selected
+    WallpaperSelector {
+      id: selector
+      seed: lockSurface.screen?.name || ""
+    }
+    onSourceChanged: {
+      if (!source)
+        current = null;
+      else if (current === one)
+        two.update()
+      else
+        one.update()
+    }
+    Img { id: one }
+    Img { id: two }
+    component Img: Item {
+      id: img
+      property string source
+      function update() {
+        source = background.source || ""
+      }
+      anchors.fill: parent
+      Image {
+        id: imageSource
+        source: img.source
+        sourceSize: Qt.size(parent.width, parent.height)
+        fillMode: Image.PreserveAspectCrop
+        smooth: true
+        visible: false
+        asynchronous: true
+        cache: false
+        onStatusChanged: {
+          if (status === Image.Ready) {
+            background.current = img
+          }
+        }
+      }
+      MultiEffect {
+        id: imageEffect
+        source: imageSource
+        anchors.fill: parent
+        blurEnabled: true
+        blur: 1
+        blurMax: 64
+        blurMultiplier: 2
+        opacity: 0
+        states: State {
+          name: "visible"
+          when: background.current === img
+          PropertyChanges {
+            imageEffect.opacity: 1
+          }
+          StateChangeScript {
+            name: "unloadOther"
+            script: {
+              if (img === one)
+                two.source = ""
+              if (img === two)
+                one.source = ""
+            }
+          }
+        }
+        transitions: Transition {
+          SequentialAnimation {
+            NumberAnimation {
+              target: imageEffect
+              properties: "opacity"
+              duration: {
+                if (img === one && two.source == "" || img === two && one.source == "")
+                  return 0;
+                return 5000;
+              }
+              easing.type: Easing.OutCubic
+            }
+            ScriptAction {
+              scriptName: "unloadOther"
+            }
+          }
+        }
+      }
+    }
+  }
+  Item {
+    anchors {
+      top: lockSurface.top
+      left: lockSurface.left
+      right: lockSurface.right
+    }
+    implicitWidth: lockSurface.width
+    implicitHeight: 21
+    Rectangle {
+      anchors.fill: parent
+      color: Qt.rgba(0, 0, 0, 0.75)
+    }
+    Clock {
+      anchors.centerIn: parent
+      calendarPopup: false
+    }
+  }
+  WrapperRectangle {
+    id: unlockUi
+    Keys.onPressed: event => {
+      if (!lockSurface.authRunning) {
+        event.accepted = true;
+        lockSurface.authRunning = true;
+      }
+    }
+    focus: !passwordBox.visible
+    visible: lockSurface.authRunning
+    color: Qt.rgba(0, 0, 0, 0.75)
+    margin: 8
+    anchors.centerIn: parent
+    ColumnLayout {
+      spacing: 4
+      BusyIndicator {
+        visible: running
+        running: !Array.from(lockSurface.messages).length && !lockSurface.responseRequired
+      }
+      Repeater {
+        model: lockSurface.messages
+        Text {
+          required property var modelData
+          font.pointSize: 10
+          font.family: "Fira Sans"
+          color: modelData.error ? "#f28a21" : "#ffffff"
+          text: String(modelData.text).trim()
+          Layout.fillWidth: true
+          horizontalAlignment: Text.AlignHCenter
+        }
+      }
+      TextField {
+        id: passwordBox
+        visible: lockSurface.responseRequired
+        echoMode: lockSurface.responseVisible ? TextInput.Normal : TextInput.Password
+        inputMethodHints: Qt.ImhSensitiveData
+        onTextChanged: lockSurface.currentText = passwordBox.text
+        onAccepted: {
+          passwordBox.readOnly = true;
+          lockSurface.response(lockSurface.currentText);
+        }
+        Connections {
+          target: lockSurface
+          function onCurrentTextChanged() {
+            passwordBox.text = lockSurface.currentText
+          }
+        }
+        Connections {
+          target: lockSurface
+          function onResponseRequiredChanged() {
+            if (lockSurface.responseRequired)
+              passwordBox.readOnly = false;
+              passwordBox.focus = true;
+              passwordBox.selectAll();
+          }
+        }
+        Layout.topMargin: 4
+        Layout.fillWidth: true
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Lockscreen.qml b/accounts/gkleen@sif/shell/quickshell/Lockscreen.qml
new file mode 100644
index 00000000..996fd41b
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Lockscreen.qml
@@ -0,0 +1,132 @@
+import Quickshell
+import Quickshell.Wayland
+import Quickshell.Io
+import Quickshell.Services.Pam
+import Quickshell.Services.Mpris
+import Custom as Custom
+import qs.Services
+import QtQml
+Scope {
+  id: lockscreen
+  property string currentText: ""
+  PamContext {
+    id: pam
+    property list<var> messages: []
+    config: "quickshell"
+    onCompleted: result => {
+      if (result === PamResult.Success) {
+        lock.locked = false;
+      }
+    }
+    onPamMessage: {
+      messages = Array.from(messages).concat([{ "text": pam.message, "error": pam.messageIsError }])
+    }
+    onActiveChanged: {
+      messages = [];
+    }
+  }
+  IpcHandler {
+    target: "Lockscreen"
+    function setLocked(locked: bool): void { lock.locked = locked; }
+    function getLocked(): bool { return lock.locked; }
+  }
+  Connections {
+    target: Custom.Systemd
+    function onSleep(before: bool) {
+      console.log(`received prepare for sleep ${before}`);
+      if (before)
+        lock.locked = true;
+    }
+    function onLock() { lock.locked = true; }
+    function onUnlock() { lock.locked = false; }
+  }
+  IdleMonitor {
+    id: idleMonitor
+    enabled: !lock.secure
+    timeout: 600
+    respectInhibitors: true
+    onIsIdleChanged: {
+      if (idleMonitor.isIdle)
+        lock.locked = true;
+    }
+  }
+  Custom.SystemdInhibitor {
+    enabled: !lock.secure
+    what: Custom.SystemdInhibitorParams.Sleep
+    who: "quickshell"
+    why: "Lock session"
+    mode: Custom.SystemdInhibitorParams.Delay
+  }
+  Binding {
+    target: NotificationManager
+    property: "lockscreenActive"
+    value: lock.locked
+  }
+  WlSessionLock {
+    id: lock
+    onLockStateChanged: {
+      if (!locked && pam.active)
+        pam.abort();
+      if (locked) {
+        NiriService.sendCommand({ "Action": { "PowerOffMonitors": {} } }, _ => {});
+        Custom.KeePassXC.lockAllDatabases();
+        Array.from(MprisProxy.players).forEach(player => {
+          if (player.canPause && player.isPlaying)
+            player.pause();
+        });
+        // Custom.Systemd.stopUserUnit("gpg-agent.service", "replace");
+        GpgAgent.reloadAgent();
+      }
+    }
+    Component.onCompleted: { (_ => {})(MprisProxy.players); }
+    onSecureStateChanged: Custom.Systemd.lockedHint = lock.secure
+    WlSessionLockSurface {
+      id: lockSurface
+      color: "black"
+      LockSurface {
+        id: surfaceContent
+        onResponse: responseText => pam.respond(responseText)
+        onAuthRunningChanged: {
+          if (authRunning)
+            pam.start();
+        }
+        Connections {
+          target: pam
+          function onMessagesChanged() { surfaceContent.messages = pam.messages; }
+          function onResponseRequiredChanged() { surfaceContent.responseRequired = pam.responseRequired; }
+          function onActiveChanged() { surfaceContent.authRunning = pam.active; }
+        }
+        onCurrentTextChanged: lockscreen.currentText = currentText
+        Connections {
+          target: lockscreen
+          function onCurrentTextChanged() { surfaceContent.currentText = lockscreen.currentText; }
+        }
+        Connections {
+          target: lockSurface
+          function onScreenChanged() { surfaceContent.screen = lockSurface.screen; }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/MaterialDesignIcon.qml b/accounts/gkleen@sif/shell/quickshell/MaterialDesignIcon.qml
new file mode 100644
index 00000000..155a009e
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/MaterialDesignIcon.qml
@@ -0,0 +1,35 @@
+import QtQuick
+import QtQuick.Effects
+Item {
+  id: root
+  required property string icon
+  property color color: "white"
+  property real implicitSize: 0
+  readonly property real actualSize: Math.min(root.width, root.height)
+  implicitWidth: root.implicitSize
+  implicitHeight: root.implicitSize
+  Image {
+    id: sourceImage
+    source: "file://" + @mdi@ + "/svg/" + root.icon + ".svg"
+    anchors.fill: parent
+    fillMode: Image.PreserveAspectFit
+    sourceSize.width: root.actualSize
+    sourceSize.height: root.actualSize
+    layer.enabled: true
+    layer.effect: MultiEffect {
+      id: effect
+      brightness: 1
+      colorization: 1
+      colorizationColor: root.color
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/NiriIdle.qml b/accounts/gkleen@sif/shell/quickshell/NiriIdle.qml
new file mode 100644
index 00000000..beff205c
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/NiriIdle.qml
@@ -0,0 +1,30 @@
+import QtQml
+import Quickshell
+import Quickshell.Wayland
+import qs.Services
+import Custom as Custom
+Scope {
+  IdleMonitor {
+    id: idleMonitor30
+    timeout: 30
+    onIsIdleChanged: Custom.Systemd.setIdleHint(idleMonitor30.isIdle)
+  }
+  IdleMonitor {
+    id: idleMonitor540
+    timeout: 540
+    onIsIdleChanged: {
+      if (idleMonitor540.isIdle)
+        NiriService.sendCommand({ "Action": { "PowerOffMonitors": {} } }, _ => {});
+    }
+  }
+  Connections {
+    target: Custom.Systemd
+    function onSleep(before: bool) {
+      if (!before)
+        NiriService.sendCommand({ "Action": { "PowerOnMonitors": {} } }, _ => {});
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/NotificationDisplay.qml b/accounts/gkleen@sif/shell/quickshell/NotificationDisplay.qml
new file mode 100644
index 00000000..cc0e49b1
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/NotificationDisplay.qml
@@ -0,0 +1,340 @@
+import QtQml
+import QtQml.Models
+import QtQuick
+import Quickshell
+import Quickshell.Widgets
+import Quickshell.Wayland
+import qs.Services
+import QtQuick.Layouts
+import Quickshell.Services.Notifications
+Scope {
+  id: root
+  property var activeScreen: Array.from(Quickshell.screens).find(screen => screen.name === Array.from(NiriService.workspaces).find(ws => ws.is_focused)?.output) ?? null
+  Instantiator {
+    id: notifsRepeater
+    model: ScriptModel {
+      values: NotificationManager.groups
+    }
+    delegate: PanelWindow {
+      id: notifWindow
+      visible: NotificationManager.active
+      screen: root.activeScreen
+      WlrLayershell.namespace: "notifications"
+      required property var modelData
+      required property var index
+      property int activeIx: modelData.length - 1
+      onModelDataChanged: {
+        notifWindow.activeIx = modelData.length - 1;
+      }
+      property color textColor: {
+        if (notifWindow.modelData?.[notifWindow.activeIx]?.urgency == NotificationUrgency.Low)
+          return "#ff999999";
+        return "white";
+      }
+      property color backgroundColor: {
+        if (notifWindow.modelData?.[notifWindow.activeIx]?.urgency == NotificationUrgency.Critical)
+          return "#dd900000";
+        return "black";
+      }
+      anchors {
+        right: true
+        top: true
+      }
+      readonly property real spaceAbove: {
+        var res = 0;
+        for (let i = 0; i < notifWindow.index; i++) {
+          (_ => {})(notifsRepeater.objectAt(i).modelData);
+          res += notifsRepeater.objectAt(i).height + 8;
+        }
+        return res;
+      }
+      margins {
+        right: 26 + 8
+        top: 8 + spaceAbove
+      }
+      color: "transparent"
+      implicitHeight: Math.max(notifCount.visible ? notifCount.contentHeight : 0, notifSummary.contentHeight) + (notifBody.visible ? 8 + notifBody.contentHeight : 0) + (notifActions.visible ? 8 + notifActions.height : 0) + (notifTime.visible ? 8 + notifTime.contentHeight : 0) + 16
+      implicitWidth: 400
+      WrapperMouseArea {
+        enabled: true
+        anchors.fill: parent
+        cursorShape: Qt.PointingHandCursor
+        onClicked: {
+          for (const notif of notifWindow.modelData)
+            notif.dismiss();
+        }
+        property real angleRem: 0
+        property real sensitivity: 1 / 120
+        onWheel: event => {
+          angleRem += event.angleDelta.y;
+          const d = Math.round(angleRem * sensitivity);
+          angleRem -= d / sensitivity;
+          notifWindow.activeIx = ((notifWindow.modelData?.length ?? 1) + notifWindow.activeIx - d) % (notifWindow.modelData?.length ?? 1);
+        }
+        Rectangle {
+          color: notifWindow.backgroundColor
+          anchors.fill: parent
+          border {
+            color: Qt.hsla(195/360, 1, 0.45, 1)
+            width: 2
+          }
+          GridLayout {
+            id: notifLayout
+            width: 400 - 16
+            anchors.fill: parent
+            anchors.margins: 8
+            columnSpacing: 8
+            rowSpacing: 8
+            columns: notifImage.visible ? 3 : 2
+            rows: {
+              var res = 1;
+              if (notifBody.visible)
+                res += 1;
+              if (notifActions.visible)
+                res += 1;
+              if (notifTime.visible)
+                res += 1;
+              return res;
+            }
+            Text {
+              id: notifCount
+              visible: notifWindow.modelData?.length > 1 ?? false
+              text: `${notifWindow.activeIx + 1}/${notifWindow.modelData?.length ?? ""}`
+              font.pointSize: 10
+              font.family: "Fira Sans"
+              font.bold: true
+              font.features: { "tnum": 1 }
+              color: notifWindow.textColor
+              maximumLineCount: 1
+              Layout.fillWidth: false
+              Layout.row: 0
+              Layout.column: notifImage.visible ? 1 : 0
+            }
+            Text {
+              id: notifSummary
+              text: notifWindow.modelData?.[notifWindow.activeIx]?.summary ?? ""
+              font.pointSize: 10
+              font.family: "Fira Sans"
+              font.italic: true
+              color: notifWindow.textColor
+              maximumLineCount: 1
+              elide: Text.ElideRight
+              Layout.fillWidth: true
+              Layout.row: 0
+              Layout.column: (notifCount.visible ? 1 : 0) + (notifImage.visible ? 1 : 0)
+              Layout.columnSpan: notifCount.visible ? 1 : 2
+            }
+            Image {
+              id: notifImage
+              visible: (notifWindow.modelData?.[notifWindow.activeIx]?.image || notifWindow.modelData?.[notifWindow.activeIx]?.appIcon) ?? false
+              onStatusChanged: {
+                if (notifImage.status == Image.Error)
+                  notifImage.visible = false;
+              }
+              source: (notifWindow.modelData?.[notifWindow.activeIx]?.image || notifWindow.modelData?.[notifWindow.activeIx]?.appIcon) ?? ""
+              fillMode: Image.PreserveAspectFit
+              asynchronous: true
+              smooth: true
+              mipmap: true
+              Layout.maximumWidth: 50
+              Layout.column: 0
+              Layout.row: 0
+              Layout.fillHeight: true
+              Layout.rowSpan: 1 + (notifBody.visible ? 1 : 0) + (notifTime.visible ? 1 : 0)
+            }
+            Text {
+              id: notifBody
+              visible: notifWindow.modelData?.[notifWindow.activeIx]?.body ?? false
+              text: notifWindow.modelData?.[notifWindow.activeIx]?.body ?? ""
+              textFormat: Text.RichText
+              wrapMode: Text.Wrap
+              font.pointSize: 10
+              font.family: "Fira Sans"
+              color: notifWindow.textColor
+              Layout.fillWidth: true
+              Layout.row: 1
+              Layout.column: notifImage.visible ? 1 : 0
+              Layout.columnSpan: notifCount.visible ? 2 : 1
+            }
+            Text {
+              id: notifTime
+              Connections {
+                target: NotificationManager.clock
+                function onDateChanged() {
+                  notifTime.text = NotificationManager.formatTime(notifWindow.modelData?.[notifWindow.activeIx]?.receivedTime);
+                }
+              }
+              visible: notifTime.text && notifTime.text !== "now"
+              text: NotificationManager.formatTime(notifWindow.modelData?.[notifWindow.activeIx]?.receivedTime)
+              font.pointSize: 8
+              font.family: "Fira Sans"
+              font.italic: true
+              color: "#555"
+              maximumLineCount: 1
+              horizontalAlignment: Text.AlignRight
+              Layout.fillWidth: true
+              Layout.row: notifBody.visible ? 2 : 1
+              Layout.column: notifImage.visible ? 1 : 0
+              Layout.columnSpan: 2
+            }
+            RowLayout {
+              id: notifActions
+              visible: notifWindow.modelData?.[notifWindow.activeIx]?.actions.length > 0 ?? false
+              spacing: 8
+              uniformCellSizes: true
+              width: 400 - 16
+              Layout.row: 1 + (notifBody.visible ? 1 : 0) + (notifTime.visible ? 1 : 0)
+              Layout.column: 0
+              Layout.columnSpan: 2 + (notifImage.visible ? 1 : 0)
+              Repeater {
+                model: ScriptModel {
+                  values: notifWindow.modelData?.[notifWindow.activeIx]?.actions
+                }
+                delegate: WrapperMouseArea {
+                  id: actionMouseArea
+                  required property var modelData
+                  height: actionLabelWrapper.implicitHeight
+                  Layout.fillWidth: true
+                  Layout.horizontalStretchFactor: 1
+                  hoverEnabled: true
+                  cursorShape: Qt.PointingHandCursor
+                  onClicked: actionMouseArea.modelData?.invoke()
+                  Rectangle {
+                    anchors.fill: parent
+                    color: actionMouseArea.containsMouse ? "#20ffffff" : "transparent"
+                    border {
+                      width: 2
+                      color: "#20ffffff"
+                    }
+                    WrapperItem {
+                      id: actionLabelWrapper
+                      margin: 8
+                      anchors.centerIn: parent
+                      RowLayout {
+                        id: actionLabelLayout
+                        spacing: 8
+                        IconImage {
+                          id: actionIcon
+                          visible: notifWindow.modelData?.[notifWindow.activeIx]?.hasActionIcons
+                          onStatusChanged: {
+                            if (actionIcon.status == Image.Error)
+                              actionIcon.visible = false;
+                          }
+                          implicitSize: 16
+                          source: {
+                            if (!actionIcon.visible)
+                              return "";
+                            let icon = actionMouseArea.modelData?.identifier ?? ""
+                            if (icon.includes("?path=")) {
+                              const split = icon.split("?path=")
+                              if (split.length !== 2)
+                                return icon
+                              const name = split[0]
+                              const path = split[1]
+                              const fileName = name.substring(
+                                               name.lastIndexOf("/") + 1)
+                              return `file://${path}/${fileName}`
+                            }
+                            return icon
+                          }
+                          asynchronous: true
+                          smooth: true
+                          mipmap: true
+                          Layout.alignment: Qt.AlignVCenter | Qt.AlignHCenter
+                        }
+                        Text {
+                          id: actionLabel
+                          visible: actionMouseArea.modelData?.text ?? false
+                          text: actionMouseArea.modelData?.text ?? ""
+                          font.pointSize: 10
+                          font.family: "Fira Sans"
+                          color: notifWindow.textColor
+                          maximumLineCount: 1
+                          elide: Text.ElideRight
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/NotificationInhibitorWidget.qml b/accounts/gkleen@sif/shell/quickshell/NotificationInhibitorWidget.qml
new file mode 100644
index 00000000..b58467b3
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/NotificationInhibitorWidget.qml
@@ -0,0 +1,266 @@
+import Quickshell
+import QtQuick
+import Quickshell.Widgets
+import qs.Services
+import QtQuick.Controls
+import QtQuick.Layouts
+import QtQuick.Shapes
+Item {
+  id: root
+  width: icon.width + 8
+  height: parent.height
+  anchors.verticalCenter: parent.verticalCenter
+  WrapperMouseArea {
+    id: widgetMouseArea
+    anchors.fill: parent
+    hoverEnabled: true
+    cursorShape: Qt.PointingHandCursor
+    onClicked: NotificationManager.displayInhibited = !NotificationManager.displayInhibited
+    Rectangle {
+      anchors.fill: parent
+      color: {
+        if (widgetMouseArea.containsMouse) {
+          return "#33808080";
+        }
+        return "transparent";
+      }
+      Item {
+        anchors.fill: parent
+        MaterialDesignIcon {
+          id: icon
+          implicitSize: 14
+          anchors.centerIn: parent
+          icon: NotificationManager.active ? "message" : "message-off"
+          color: {
+            if (!NotificationManager.active && !NotificationManager.displayInhibited)
+              return "#f28a21";
+            if (NotificationManager.displayInhibited)
+              return "white";
+            return "#555";
+          }
+        }
+      }
+    }
+  }
+  Loader {
+    id: tooltipLoader
+    active: false
+    Connections {
+      target: widgetMouseArea
+      function onContainsMouseChanged() {
+       if (widgetMouseArea.containsMouse)
+         tooltipLoader.active = true;
+      }
+    }
+    sourceComponent: PopupWindow {
+      id: tooltip
+      property bool nextVisible: NotificationManager.active && (widgetMouseArea.containsMouse || tooltipMouseArea.containsMouse)
+      anchor {
+        item: widgetMouseArea
+        edges: Edges.Bottom | Edges.Left
+      }
+      visible: false
+      onNextVisibleChanged: hangTimer.restart()
+      Timer {
+        id: hangTimer
+        interval: tooltip.visible ? 100 : 500
+        onTriggered: {
+          tooltip.visible = tooltip.nextVisible;
+          if (!tooltip.visible)
+            tooltipLoader.active = false;
+        }
+      }
+      implicitWidth: 400
+      implicitHeight: Math.min(tooltip.screen.height * 0.66, Math.max(100, scroll.contentHeight + 16))
+      color: "black"
+      WrapperMouseArea {
+        id: tooltipMouseArea
+        hoverEnabled: true
+        enabled: true
+        anchors.fill: parent
+        WrapperItem {
+          margin: 8
+          ScrollView {
+            id: scroll
+            contentWidth: availableWidth
+            // ScrollBar.vertical.policy: ScrollBar.AlwaysOn
+            ColumnLayout {
+              id: historyLayout
+              anchors {
+                left: parent.left
+                right: parent.right
+              }
+              spacing: 8
+              Repeater {
+                model: ScriptModel {
+                  values: [...NotificationManager.history].reverse().map(o => o.notification)
+                }
+                delegate: GridLayout {
+                  id: notif
+                  Layout.fillWidth: true
+                  Layout.preferredHeight: notifSummary.contentHeight + (notifBody.visible ? notifBody.contentHeight + 8 : 0) + (notifSep.visible ? notifSep.height + 8 : 0) + notifTime.contentHeight + 8
+                  required property var modelData
+                  required property int index
+                  columnSpacing: 8
+                  rowSpacing: 8
+                  columns: notifImage.visible ? 2 : 1
+                  rows: {
+                    var res = 2;
+                    if (notifBody.visible)
+                      res += 1;
+                    if (notifSep.visible)
+                      res += 1;
+                    return res;
+                  }
+                  Shape {
+                    id: notifSep
+                    visible: notif.index != 0
+                    height: 2
+                    width: 400 - 32
+                    ShapePath {
+                      strokeWidth: 2
+                      strokeColor: "#20ffffff"
+                      startX: 0; startY: 0;
+                      PathLine { x: 400 - 32; y: 0; }
+                    }
+                    Layout.row: 0
+                    Layout.column: 0
+                    Layout.columnSpan: notifImage.visible ? 2 : 1
+                    Layout.alignment: Qt.AlignHCenter
+                  }
+                  Text {
+                    id: notifSummary
+                    text: notif.modelData?.summary ?? ""
+                    font.pointSize: 10
+                    font.family: "Fira Sans"
+                    font.italic: true
+                    color: "white"
+                    maximumLineCount: 1
+                    elide: Text.ElideRight
+                    Layout.fillWidth: true
+                    Layout.row: notifSep.visible ? 1 : 0
+                    Layout.column: notifImage.visible ? 1 : 0
+                  }
+                  Image {
+                    id: notifImage
+                    visible: (notif.modelData?.image || notif.modelData?.appIcon) ?? false
+                    onStatusChanged: {
+                      if (notifImage.status == Image.Error)
+                        notifImage.visible = false;
+                    }
+                    source: (notif.modelData?.image || notif.modelData?.appIcon) ?? ""
+                    fillMode: Image.PreserveAspectFit
+                    asynchronous: true
+                    smooth: true
+                    mipmap: true
+                    Layout.maximumWidth: 50
+                    Layout.column: 0
+                    Layout.row: notifSep.visible ? 1 : 0
+                    Layout.fillHeight: true
+                    Layout.rowSpan: notifBody.visible ? 3 : 2
+                  }
+                  Text {
+                    id: notifBody
+                    visible: notif.modelData?.body ?? false
+                    text: notif.modelData?.body ?? ""
+                    textFormat: Text.RichText
+                    wrapMode: Text.Wrap
+                    font.pointSize: 10
+                    font.family: "Fira Sans"
+                    color: "white"
+                    Layout.fillWidth: true
+                    Layout.row: notifSep.visible ? 2 : 1
+                    Layout.column: notifImage.visible ? 1 : 0
+                  }
+                  Text {
+                    id: notifTime
+                    Connections {
+                      target: NotificationManager.clock
+                      function onDateChanged() {
+                        notifTime.text = NotificationManager.formatTime(notif.modelData?.receivedTime);
+                      }
+                    }
+                    text: NotificationManager.formatTime(notif.modelData?.receivedTime)
+                    font.pointSize: 8
+                    font.family: "Fira Sans"
+                    font.italic: true
+                    color: "#555"
+                    maximumLineCount: 1
+                    horizontalAlignment: Text.AlignRight
+                    Layout.fillWidth: true
+                    Layout.row: {
+                      var res = 1;
+                      if (notifSep.visible)
+                        res += 1;
+                      if (notifBody.visible)
+                        res += 1;
+                      return res;
+                    }
+                    Layout.column: notifImage.visible ? 1 : 0
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/PipewireWidget.qml b/accounts/gkleen@sif/shell/quickshell/PipewireWidget.qml
new file mode 100644
index 00000000..9c6b65a4
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/PipewireWidget.qml
@@ -0,0 +1,483 @@
+import QtQuick
+import QtQuick.Layouts
+import QtQuick.Controls.Fusion
+import Quickshell
+import Quickshell.Services.Pipewire
+import Quickshell.Widgets
+Item {
+  height: parent.height
+  width: volumeIcon.width + 8
+  anchors.verticalCenter: parent.verticalCenter
+  PwObjectTracker {
+    objects: [Pipewire.defaultAudioSink]
+  }
+  WrapperMouseArea {
+    id: widgetMouseArea
+    anchors.fill: parent
+    hoverEnabled: true
+    cursorShape: Qt.PointingHandCursor
+    onClicked: {
+      if (!Pipewire.defaultAudioSink)
+        return;
+      Pipewire.defaultAudioSink.audio.muted = !Pipewire.defaultAudioSink.audio.muted;
+    }
+    property real sensitivity: (1 / 40) / 120
+    onWheel: event => {
+      if (!Pipewire.defaultAudioSink)
+        return;
+      Pipewire.defaultAudioSink.audio.volume += event.angleDelta.y * sensitivity;
+    }
+    Rectangle {
+      id: volumeWidget
+      anchors.fill: parent
+      color: {
+        if (widgetMouseArea.containsMouse)
+          return "#33808080";
+        return "transparent";
+      }
+      Item {
+        anchors.fill: parent
+        MaterialDesignIcon {
+          id: volumeIcon
+          implicitSize: 14
+          anchors.centerIn: parent
+          icon: {
+            if (!Pipewire.defaultAudioSink || Pipewire.defaultAudioSink.audio.muted)
+              return "volume-off";
+            if (Pipewire.defaultAudioSink.audio.volume <= 0.33)
+              return "volume-low";
+            if (Pipewire.defaultAudioSink.audio.volume <= 0.67)
+              return "volume-medium";
+            return "volume-high";
+          }
+          color: "#555"
+        }
+      }
+    }
+  }
+  Loader {
+    id: tooltipLoader
+    active: false
+    Connections {
+      target: widgetMouseArea
+      function onContainsMouseChanged() {
+        if (widgetMouseArea.containsMouse)
+          tooltipLoader.active = true;
+      }
+    }
+    PwObjectTracker {
+      objects: Pipewire.devices
+    }
+    PwObjectTracker {
+      objects: Pipewire.nodes
+    }
+    sourceComponent: PopupWindow {
+      id: tooltip
+      property bool openPopup: false
+      property bool nextVisible: widgetMouseArea.containsMouse || tooltipMouseArea.containsMouse || openPopup
+      anchor {
+        item: widgetMouseArea
+        edges: Edges.Bottom | Edges.Left
+      }
+      visible: false
+      onNextVisibleChanged: hangTimer.restart()
+      Timer {
+        id: hangTimer
+        interval: 100
+        onTriggered: {
+          tooltip.visible = tooltip.nextVisible;
+          if (!tooltip.visible)
+            tooltipLoader.active = false;
+        }
+      }
+      implicitWidth: tooltipContent.width
+      implicitHeight: tooltipContent.height
+      color: "transparent"
+      Rectangle {
+        width: tooltip.width
+        height: tooltipLayout.childrenRect.height + 16
+        color: "black"
+      }
+      WrapperItem {
+        id: tooltipContent
+        bottomMargin: Math.max(0, 200 - tooltipLayout.implicitHeight)
+        WrapperMouseArea {
+          id: tooltipMouseArea
+          hoverEnabled: true
+          enabled: true
+          WrapperItem {
+            margin: 8
+            bottomMargin: 8
+            GridLayout {
+              id: tooltipLayout
+              columns: 4
+              Repeater {
+                model: Array.from(Pipewire.devices.values).filter(dev => dev.type == "Audio/Device")
+                Item {
+                  id: descItem
+                  required property var modelData
+                  required property int index
+                  Layout.column: 0
+                  Layout.row: index
+                  implicitWidth: descText.contentWidth
+                  implicitHeight: descText.contentHeight
+                  Text {
+                    id: descText
+                    color: "white"
+                    font.pointSize: 10
+                    font.family: "Fira Sans"
+                    text: descItem.modelData.description
+                  }
+                }
+              }
+              Repeater {
+                id: defaultSinkRepeater
+                model: {
+                  Array.from(Pipewire.devices.values)
+                    .filter(dev => dev.type == "Audio/Device")
+                    .map(device => Array.from(Pipewire.nodes.values).find(node => node.type == PwNodeType.AudioSink && node.device?.id == device.id ));
+                }
+                Item {
+                  id: defaultSinkItem
+                  required property var modelData
+                  required property int index
+                  visible: Boolean(modelData)
+                  PwObjectTracker {
+                    objects: [defaultSinkItem.modelData]
+                  }
+                  Layout.column: 1
+                  Layout.row: index
+                  Layout.fillHeight: true
+                  implicitWidth: 16 + 8
+                  WrapperMouseArea {
+                    id: defaultSinkMouseArea
+                    anchors.fill: parent
+                    hoverEnabled: true
+                    cursorShape: Qt.PointingHandCursor
+                    onClicked: {
+                      Pipewire.preferredDefaultAudioSink = defaultSinkItem.modelData
+                    }
+                    onWheel: event => scrollVolume(event);
+                    property real sensitivity: (1 / 40) / 120
+                    function scrollVolume(event) {
+                      defaultSinkItem.modelData.audio.volume += event.angleDelta.y * sensitivity;
+                    }
+                    Rectangle {
+                      id: defaultSinkWidget
+                      anchors.fill: parent
+                      color: {
+                        if (defaultSinkMouseArea.containsMouse)
+                          return "#33808080";
+                        return "transparent";
+                      }
+                      MaterialDesignIcon {
+                        width: 16
+                        height: 16
+                        anchors.centerIn: parent
+                        icon: {
+                          if (defaultSinkItem.modelData?.id == Pipewire.defaultAudioSink?.id)
+                            return "speaker";
+                          return "speaker-off";
+                        }
+                        color: icon == "speaker" ? "white" : "#555"
+                      }
+                    }
+                  }
+                  PopupWindow {
+                    id: volumeTooltip
+                    property bool nextVisible: defaultSinkMouseArea.containsMouse || volumeTooltipMouseArea.containsMouse
+                    anchor {
+                      item: defaultSinkMouseArea
+                      edges: Edges.Bottom | Edges.Left
+                    }
+                    visible: false
+                    onNextVisibleChanged: volumeHangTimer.restart()
+                    onVisibleChanged: tooltip.openPopup = volumeTooltip.visible
+                    Timer {
+                      id: volumeHangTimer
+                      interval: 100
+                      onTriggered: volumeTooltip.visible = volumeTooltip.nextVisible
+                    }
+                    implicitWidth: volumeTooltipText.contentWidth + 16
+                    implicitHeight: volumeTooltipText.contentHeight + 16
+                    color: "black"
+                    WrapperMouseArea {
+                      id: volumeTooltipMouseArea
+                      hoverEnabled: true
+                      enabled: true
+                      onWheel: event => defaultSinkMouseArea.scrollVolume(event);
+                      anchors.fill: parent
+                      Item {
+                        anchors.fill: parent
+                        Text {
+                          id: volumeTooltipText
+                          anchors.centerIn: parent
+                          font.pointSize: 10
+                          font.family: "Fira Sans"
+                          color: "white"
+                          text: `${Math.round(defaultSinkItem.modelData?.audio?.volume * 100)}%`
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+              Repeater {
+                id: defaultSourceRepeater
+                model: {
+                  Array.from(Pipewire.devices.values)
+                    .filter(dev => dev.type == "Audio/Device")
+                    .map(device => Array.from(Pipewire.nodes.values).find(node => node.type == PwNodeType.AudioSource && node.device?.id == device.id ));
+                }
+                Item {
+                  id: defaultSourceItem
+                  required property var modelData
+                  required property int index
+                  visible: Boolean(modelData)
+                  PwObjectTracker {
+                    objects: [defaultSourceItem.modelData]
+                  }
+                  Layout.column: 2
+                  Layout.row: index
+                  Layout.fillHeight: true
+                  implicitWidth: 16 + 8
+                  WrapperMouseArea {
+                    id: defaultSourceMouseArea
+                    anchors.fill: parent
+                    hoverEnabled: true
+                    cursorShape: Qt.PointingHandCursor
+                    onClicked: {
+                      Pipewire.preferredDefaultAudioSource = defaultSourceItem.modelData
+                    }
+                    onWheel: event => scrollVolume(event);
+                    property real sensitivity: (1 / 40) / 120
+                    function scrollVolume(event) {
+                      defaultSourceItem.modelData.audio.volume += event.angleDelta.y * sensitivity;
+                    }
+                    Rectangle {
+                      id: defaultSourceWidget
+                      anchors.fill: parent
+                      color: {
+                        if (defaultSourceMouseArea.containsMouse)
+                          return "#33808080";
+                        return "transparent";
+                      }
+                      MaterialDesignIcon {
+                        width: 16
+                        height: 16
+                        anchors.centerIn: parent
+                        icon: {
+                          if (defaultSourceItem.modelData?.id == Pipewire.defaultAudioSource?.id)
+                            return "microphone";
+                          return "microphone-off";
+                        }
+                        color: icon == "microphone" ? "white" : "#555"
+                      }
+                    }
+                  }
+                  PopupWindow {
+                    id: volumeTooltip
+                    property bool nextVisible: defaultSourceMouseArea.containsMouse || volumeTooltipMouseArea.containsMouse
+                    anchor {
+                      item: defaultSourceMouseArea
+                      edges: Edges.Bottom | Edges.Left
+                    }
+                    visible: false
+                    onNextVisibleChanged: volumeHangTimer.restart()
+                    onVisibleChanged: tooltip.openPopup = volumeTooltip.visible
+                    Timer {
+                      id: volumeHangTimer
+                      interval: 100
+                      onTriggered: volumeTooltip.visible = volumeTooltip.nextVisible
+                    }
+                    implicitWidth: volumeTooltipText.contentWidth + 16
+                    implicitHeight: volumeTooltipText.contentHeight + 16
+                    color: "black"
+                    WrapperMouseArea {
+                      id: volumeTooltipMouseArea
+                      hoverEnabled: true
+                      enabled: true
+                      onWheel: event => defaultSourceMouseArea.scrollVolume(event);
+                      anchors.fill: parent
+                      Item {
+                        anchors.fill: parent
+                        Text {
+                          id: volumeTooltipText
+                          anchors.centerIn: parent
+                          font.pointSize: 10
+                          font.family: "Fira Sans"
+                          color: "white"
+                          text: `${Math.round(defaultSourceItem.modelData?.audio?.volume * 100)}%`
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+              Repeater {
+                id: profileRepeater
+                model: Array.from(Pipewire.devices.values).filter(dev => dev.type == "Audio/Device")
+                Item {
+                  id: profileItem
+                  required property var modelData
+                  required property int index
+                  PwObjectTracker {
+                    objects: [profileItem.modelData]
+                  }
+                  Layout.column: 3
+                  Layout.row: index
+                  Layout.fillWidth: true
+                  implicitWidth: Math.max(profileBox.implicitWidth, 300)
+                  implicitHeight: profileBox.height
+                  ComboBox {
+                    id: profileBox
+                    model: profileItem.modelData.profiles
+                    textRole: "description"
+                    valueRole: "index"
+                    onActivated: profileItem.modelData.setProfile(currentValue)
+                    anchors.fill: parent
+                    implicitContentWidthPolicy: ComboBox.WidestText
+                    Connections {
+                      target: profileItem.modelData
+                      function onCurrentProfileChanged() {
+                        profileBox.currentIndex = Array.from(profileItem.modelData.profiles).findIndex(profile => profile.index == profileItem.modelData.currentProfile);
+                      }
+                    }
+                    Component.onCompleted: {
+                      profileBox.currentIndex = Array.from(profileItem.modelData.profiles).findIndex(profile => profile.index == profileItem.modelData.currentProfile);
+                    }
+                    Connections {
+                      target: profileBox.popup
+                      function onVisibleChanged() {
+                        tooltip.openPopup = profileBox.popup.visible
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/PrivacyWidget.qml b/accounts/gkleen@sif/shell/quickshell/PrivacyWidget.qml
new file mode 100644
index 00000000..d7ffadfe
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/PrivacyWidget.qml
@@ -0,0 +1,49 @@
+import QtQuick
+import QtQuick.Layouts
+import Quickshell
+import Quickshell.Widgets
+import qs.Services
+Item {
+  height: parent.height
+  width: layout.childrenRect.width
+  anchors.verticalCenter: parent.verticalCenter
+  visible: Array.from(Privacy.activeItems).length > 0
+  RowLayout {
+    id: layout
+    anchors.fill: parent
+    spacing: 8
+    Repeater {
+      model: Privacy.activeItems
+      Item {
+        id: privacyItem
+        required property var modelData;
+        height: parent.height
+        width: icon.width
+        MaterialDesignIcon {
+          id: icon
+          implicitSize: 14
+          anchors.centerIn: parent
+          icon: {
+            if (privacyItem.modelData == Privacy.Item.Microphone)
+             return "microphone";
+            if (privacyItem.modelData == Privacy.Item.Screensharing)
+             return "monitor-share";
+           }
+          color: "#f2201f"
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Services/Brightness.qml b/accounts/gkleen@sif/shell/quickshell/Services/Brightness.qml
new file mode 100644
index 00000000..8318df50
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Services/Brightness.qml
@@ -0,0 +1,75 @@
+pragma Singleton
+import QtQml
+import Quickshell
+import Quickshell.Io
+import Custom as Custom
+Singleton {
+  id: root
+  property string subsystem: "backlight"
+  property string device: "intel_backlight"
+  property real currBrightness
+  property real exponent: 4
+  function calcCurrBrightness() {
+    if (!currFile.loaded || !maxFile.loaded)
+      return undefined;
+    const curr = Number(currFile.text());
+    const max = Number(maxFile.text());
+    const val = Math.pow(curr / max, 1 / root.exponent);
+    return val;
+  }
+  Connections {
+    target: currFile
+    function onLoaded() {
+      const b = root.calcCurrBrightness();
+      if (typeof b !== 'undefined')
+        root.currBrightness = b;
+    }
+  }
+  Connections {
+    target: maxFile
+    function onLoaded() {
+      const b = root.calcCurrBrightness();
+      if (typeof b !== 'undefined')
+        root.currBrightness = b;
+    }
+  }
+  onCurrBrightnessChanged: {
+    root.currBrightness = Math.max(0, Math.min(1, root.currBrightness));
+    const prev = root.calcCurrBrightness();
+    if (typeof prev === 'undefined' || Math.abs(root.currBrightness - prev) < 0.01)
+      return;
+    const max = Number(maxFile.text());
+    const actual = Number(currFile.text());
+    let curr = Math.max(0, Math.min(max, Math.pow(root.currBrightness, root.exponent) * max));
+    if (Math.round(curr) == actual && curr < actual)
+      curr = Math.max(0, actual - 1);
+    else if (Math.round(curr) == actual && curr > actual)
+      curr = Math.min(max, actual + 1);
+    // root.currBrightness = Math.pow(curr / max, 1 / root.exponent);
+    Custom.Systemd.setBrightness(root.subsystem, root.device, Math.round(curr));
+  }
+  FileView {
+    id: currFile
+    path: `/sys/class/${root.subsystem}/${root.device}/brightness`
+    blockAllReads: true
+    watchChanges: true
+    onFileChanged: reload()
+  }
+  FileView {
+    id: maxFile
+    path: `/sys/class/${root.subsystem}/${root.device}/max_brightness`
+    blockAllReads: true
+    watchChanges: true
+    onFileChanged: reload()
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Services/GpgAgent.qml b/accounts/gkleen@sif/shell/quickshell/Services/GpgAgent.qml
new file mode 100644
index 00000000..3de69535
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Services/GpgAgent.qml
@@ -0,0 +1,18 @@
+pragma Singleton
+import Quickshell
+import Quickshell.Io
+Singleton {
+  id: root
+  Socket {
+    id: agentSocket
+    connected: true
+    path: `${Quickshell.env("XDG_RUNTIME_DIR")}/gnupg/S.gpg-agent`
+  }
+  function reloadAgent() {
+    agentSocket.write("RELOADAGENT\n")
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Services/InhibitorState.qml b/accounts/gkleen@sif/shell/quickshell/Services/InhibitorState.qml
new file mode 100644
index 00000000..fe48fd7f
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Services/InhibitorState.qml
@@ -0,0 +1,22 @@
+pragma Singleton
+import Quickshell
+import Custom as Custom
+Singleton {
+  id: inhibitorState
+  property bool waylandIdleInhibited: false
+  property alias lidSwitchInhibited: lidSwitchInhibitor.enabled
+  Custom.SystemdInhibitor {
+    id: lidSwitchInhibitor
+    enabled: false
+    what: Custom.SystemdInhibitorParams.HandleLidSwitch
+    who: "quickshell"
+    why: "User request"
+    mode: Custom.SystemdInhibitorParams.BlockWeak
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Services/MprisProxy.qml b/accounts/gkleen@sif/shell/quickshell/Services/MprisProxy.qml
new file mode 100644
index 00000000..e3ab9755
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Services/MprisProxy.qml
@@ -0,0 +1,8 @@
+pragma Singleton
+import Quickshell
+import Quickshell.Services.Mpris
+Scope {
+  property list<var> players: Mpris.players.values
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Services/NiriService.qml b/accounts/gkleen@sif/shell/quickshell/Services/NiriService.qml
new file mode 100644
index 00000000..cce614eb
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Services/NiriService.qml
@@ -0,0 +1,194 @@
+pragma Singleton
+import Quickshell
+import Quickshell.Io
+import QtQuick
+Singleton {
+  id: root
+  property var workspaces: []
+  property var outputs: {}
+  property var keyboardLayouts: {}
+  property var windows: []
+  readonly property string socketPath: Quickshell.env("NIRI_SOCKET")
+  function refreshOutputs() {
+    commandSocket.sendCommand("Outputs", data => {
+      outputs = data.Ok.Outputs;
+    });
+  }
+  function sendCommand(command, callback) {
+    commandSocket.sendCommand(command, callback);
+  }
+  Socket {
+    id: eventStreamSocket
+    path: root.socketPath
+    connected: true
+    property bool acked: false
+    onConnectionStateChanged: {
+      if (connected) {
+        acked = false;
+        write('"EventStream"\n');
+      }
+    }
+    parser: SplitParser {
+      onRead: line => {
+        try {
+          const event = JSON.parse(line)
+          // console.log(JSON.stringify(event))
+          if (event.WorkspacesChanged) {
+            root.workspaces = event.WorkspacesChanged.workspaces
+            root.refreshOutputs();
+          } else if (event.WorkspaceActivated)
+            eventWorkspaceActivated(event.WorkspaceActivated);
+          else if (event.WorkspaceUrgencyChanged)
+            eventWorkspaceUrgencyChanged(event.WorkspaceUrgencyChanged);
+          else if (event.WorkspaceActiveWindowChanged)
+            eventWorkspaceActiveWindowChanged(event.WorkspaceActiveWindowChanged);
+          else if (event.KeyboardLayoutsChanged)
+            root.keyboardLayouts = event.KeyboardLayoutsChanged.keyboard_layouts;
+          else if (event.KeyboardLayoutSwitched)
+            root.keyboardLayouts = Object.assign({}, root.keyboardLayouts, {"current_idx": event.KeyboardLayoutSwitched.idx });
+          else if (event.WindowsChanged)
+            root.windows = event.WindowsChanged.windows
+          else if (event.WindowOpenedOrChanged)
+            eventWindowOpenedOrChanged(event.WindowOpenedOrChanged);
+          else if (event.WindowClosed)
+            eventWindowClosed(event.WindowClosed);
+          else if (event.WindowFocusChanged)
+            eventWindowFocusChanged(event.WindowFocusChanged);
+          else if (event.WindowUrgencyChanged)
+            eventWindowUrgencyChanged(event.WindowUrgencyChanged);
+          else if (event.WindowLayoutsChanged)
+            eventWindowLayoutsChanged(event.WindowLayoutsChanged);
+          else if (event.Ok && !eventStreamSocket.acked) { eventStreamSocket.acked = true; }
+          else if (event.OverviewOpenedOrClosed) {}
+          else if (event.ConfigLoaded) {}
+          else
+            console.log(JSON.stringify(event));
+        } catch (e) {
+          console.warn("NiriService: Failed to parse event:", line, e)
+        }
+      }
+    }
+  }
+  Socket {
+    id: commandSocket
+    path: root.socketPath
+    connected: true
+    property var awaitingAnswer: null
+    property var cmdQueue: []
+    parser: SplitParser {
+      onRead: line => {
+        if (commandSocket.awaitingAnswer === null)
+          return;
+        try {
+          const response = JSON.parse(line);
+          commandSocket.awaitingAnswer.callback(response);
+          commandSocket.awaitingAnswer = null;
+        } catch (e) {
+          console.warn("NiriService: Failed to parse response:", line, e)
+        }
+        commandSocket._handleQueue();
+      }
+    }
+    onCmdQueueChanged: {
+      _handleQueue();
+    }
+    onAwaitingAnswerChanged: {
+      _handleQueue();
+    }
+    function _handleQueue() {
+      if (cmdQueue.length <= 0 || awaitingAnswer !== null)
+        return;
+      let localQueue = Array.from(cmdQueue);
+      awaitingAnswer = localQueue.shift();
+      cmdQueue = localQueue;
+      write(JSON.stringify(awaitingAnswer.command) + '\n');
+    }
+    function sendCommand(command, callback) {
+      cmdQueue = Array.from(cmdQueue).concat([{ "command": command, "callback": callback }])
+    }
+  }
+  function eventWorkspaceActivated(data) {
+    let relevant_output = null;
+    Array.from(root.workspaces).forEach(ws => {
+      if (data.id === ws.id)
+        relevant_output = ws.output;
+    });
+    root.workspaces = Array.from(root.workspaces).map(ws => {
+      if (data.focused)
+        ws.is_focused = false;
+      if (ws.output === relevant_output)
+        ws.is_active = false;
+      if (data.id === ws.id) {
+        ws.is_active = true;
+        ws.is_focused = data.focused;
+      }
+      return ws;
+    });
+  }
+  function eventWorkspaceUrgencyChanged(data) {
+    root.workspaces = Array.from(root.workspaces).map(ws => {
+      if (data.id == ws.id)
+        ws.is_urgent = data.urgent;
+      return ws;
+    });
+  }
+  function eventWorkspaceActiveWindowChanged(data) {
+    root.workspaces = Array.from(root.workspaces).map(ws => {
+      if (data.workspace_id === ws.id)
+        ws.active_window_id = data.active_window_id;
+      return ws;
+    });
+  }
+  function eventWindowOpenedOrChanged(data) {
+    root.windows = Array.from(root.windows).map(win => {
+      if (data.window.is_focused)
+        win.is_focused = false;
+      return win;
+    }).filter(win => win.id !== data.window.id).concat([data.window]);
+  }
+  function eventWindowClosed(data) {
+    root.windows = Array.from(root.windows).filter(win => win.id !== data.id);
+  }
+  function eventWindowFocusChanged(data) {
+    root.windows = Array.from(root.windows).map(win => {
+      win.is_focused = win.id === data.id;
+      return win;
+    });
+  }
+  function eventWindowUrgencyChanged(data) {
+    root.windows = Array.from(root.windows).map(win => {
+      if (win.id === data.id)
+        win.is_urgent = data.urgent;
+      return win;
+    });
+  }
+  function eventWindowLayoutsChanged(data) {
+    root.windows = Array.from(root.windows).map(win => {
+      Array.from(data.changes).forEach(change => {
+        if (win.id === change[0])
+          win.layout = change[1];
+      });
+      return win;
+    });
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Services/NotificationManager.qml b/accounts/gkleen@sif/shell/quickshell/Services/NotificationManager.qml
new file mode 100644
index 00000000..f02d1695
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Services/NotificationManager.qml
@@ -0,0 +1,162 @@
+pragma Singleton
+import QtQml
+import Quickshell
+import Quickshell.Services.Notifications
+Singleton {
+  id: root
+  readonly property bool active: !root.lockscreenActive && !root.displayInhibited
+  property bool lockscreenActive: false
+  property bool displayInhibited: false
+  property alias trackedNotifications: server.trackedNotifications
+  readonly property var groups: {
+    function matchesGroupKey(notif, groupKey) {
+      var matches = true;
+      for (const prop in groupKey.test) {
+        if (notif[prop] !== groupKey.test[prop]) {
+          matches = false;
+          break;
+        }
+      }
+      return matches;
+    }
+    var groups = new Map();
+    var notifs = new Array();
+    for (const [ix, notif] of server.trackedNotifications.values.entries()) {
+      var didGroup = false;
+      for (const groupKey of root.groupKeys) {
+        if (!matchesGroupKey(notif, groupKey))
+          continue;
+        const key = JSON.stringify({
+          "key": groupKey,
+          "values": Object.assign({}, ...(Array.from(groupKey["group-by"]).map(prop => {
+            var res = {};
+            res[prop] = notif[prop];
+            return res;
+          })))
+        });
+        if (!groups.has(key))
+          groups.set(key, new Array());
+        groups.get(key).push({ "ix": ix, "notif": notif });
+        didGroup = true;
+        break;
+      }
+      if (!didGroup)
+        notifs.push([{ "ix": ix, "notif": notif }]);
+    }
+    notifs.push(...groups.values());
+    notifs.sort((as, bs) => Math.min(...(as.map(o => o.ix))) - Math.min(...(bs.map(o => o.ix))));
+    return notifs.map(ns => ns.map(n => n.notif));
+  }
+  property var groupKeys: [
+    { "test": { "appName": "Element" }, "group-by": [ "summary" ] }
+  ];
+  property int historyLimit: 100
+  property var history: []
+  Component {
+    id: expirationTimer
+    QtObject {
+      id: timer
+      required property QtObject parent
+      required property int expirationTime
+      property list<QtObject> data: [
+        Timer {
+          running: root.active && !timer.expired
+          interval: timer.expirationTime
+          onTriggered: {
+            timer.parent.expirationTimer.destroy();
+            timer.parent.expirationTimer = null;
+            timer.parent.expire();
+          }
+        }
+      ]
+    }
+  }
+  Component {
+    id: notificationLock
+    RetainableLock {}
+  }
+  readonly property SystemClock clock: SystemClock {
+    precision: SystemClock.Minutes
+  }
+  function formatTime(time) {
+    const now = root.clock.date;
+    const diff = now - time;
+    const minutes = Math.ceil(diff / 60000);
+    const hours = Math.floor(minutes / 60);
+    if (hours < 1) {
+      if (minutes < 1)
+        return "now";
+      if (minutes == 1)
+        return "1 minute";
+      return `${minutes} minutes`;
+    }
+    const nowDate = new Date(now.getFullYear(), now.getMonth(), now.getDate())
+    const timeDate = new Date(time.getFullYear(), time.getMonth(), time.getDate())
+    const days = Math.floor((nowDate - timeDate) / (1000 * 86400))
+    const timeStr = time.toLocaleTimeString(Qt.locale(), "HH:mm");
+    if (days === 0)
+      return timeStr;
+    if (days === 1)
+      return `yesterday ${timeStr}`;
+    const dateStr = time.toLocaleTimeString(Qt.locale(), "YYYY-MM-DD");
+    return `${dateStr} ${timeStr}`;
+  }
+  NotificationServer {
+    id: server
+    bodySupported: true
+    actionsSupported: true
+    actionIconsSupported: true
+    imageSupported: true
+    bodyMarkupSupported: true
+    bodyImagesSupported: true
+    onNotification: notification => {
+      var timeout = notification.expireTimeout * 1000;
+      if (notification.appName == "poweralertd")
+        timeout = 2000;
+      if (timeout > 0) {
+        Object.defineProperty(notification, "expirationTimer", { configurable: true, enumerable: true, writable: true });
+        notification.expirationTimer = expirationTimer.createObject(notification, { parent: notification, expirationTime: timeout });
+      }
+      Object.defineProperty(notification, "receivedTime", { configurable: true, enumerable: true, writable: true });
+      notification.receivedTime = root.clock.date;
+      notification.closed.connect((reason) => server.onNotificationClosed(notification, reason));
+      notification.tracked = true;
+    }
+    function onNotificationClosed(notification, reason) {
+      while (root.history.length >= root.historyLimit) {
+        root.history[0].lock.locked = false;
+        root.history.shift();
+      }
+      root.history.push({
+        lock: notificationLock.createObject(root, { locked: true, object: notification }),
+        notification: notification
+      });
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Services/Privacy.qml b/accounts/gkleen@sif/shell/quickshell/Services/Privacy.qml
new file mode 100644
index 00000000..9c813e49
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Services/Privacy.qml
@@ -0,0 +1,63 @@
+pragma Singleton
+import QtQml
+import Quickshell
+import Quickshell.Services.Pipewire
+Singleton {
+  id: root
+  PwObjectTracker {
+    objects: Pipewire.nodes.values
+  }
+  enum Item {
+    Microphone,
+    Screensharing
+  }
+  readonly property list<var> activeItems: {
+    var items = [];
+    if (microphoneActive)
+      items.push(Privacy.Item.Microphone);
+    if (screensharingActive)
+      items.push(Privacy.Item.Screensharing);
+    return items;
+  }
+  readonly property bool microphoneActive: {
+    if (!Pipewire.ready || !Pipewire.nodes?.values) {
+      return false
+    }
+    for (const node of Pipewire.nodes.values) {
+      if (!node || (node.type & PwNodeType.AudioInStream) != PwNodeType.AudioInStream)
+        continue;
+      if (node.properties?.["stream.monitor"] === "true")
+        continue;
+      if (node.audio?.muted)
+        continue;
+      return true;
+    }
+    return false;
+  }
+  readonly property bool screensharingActive: {
+    if (!Pipewire.ready || !Pipewire.nodes?.values) {
+      return false
+    }
+    for (const node of Pipewire.nodes.values) {
+      if (!node || (node.type & PwNodeType.VideoInStream) != PwNodeType.VideoInStream)
+        continue;
+      return true;
+    }
+    return false;
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/Services/WallpaperSelector.qml b/accounts/gkleen@sif/shell/quickshell/Services/WallpaperSelector.qml
new file mode 100644
index 00000000..3c524955
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/Services/WallpaperSelector.qml
@@ -0,0 +1,8 @@
+import Custom as Custom
+Custom.FileSelector {
+  id: root
+  directory: @wallpapers@
+  epoch: 72000000
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/SystemTray.qml b/accounts/gkleen@sif/shell/quickshell/SystemTray.qml
new file mode 100644
index 00000000..f7b4ed96
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/SystemTray.qml
@@ -0,0 +1,201 @@
+import QtQuick
+import QtQuick.Effects
+import Quickshell
+import Quickshell.Widgets
+import Quickshell.Services.SystemTray
+Item {
+  anchors.verticalCenter: parent.verticalCenter
+  width: systemTrayRow.childrenRect.width
+  height: parent.height
+  clip: true
+  Row {
+    id: systemTrayRow
+    anchors.centerIn: parent
+    width: childrenRect.width
+    height: parent.height
+    spacing: 0
+    Repeater {
+      model: ScriptModel {
+        values: {
+          var trayItems = Array.from(SystemTray.items.values).filter(item => item.status !== Status.Passive);
+          trayItems.sort((a, b) => a.category !== b.category ? b.category - a.category : a.id.localeCompare(b.id))
+          return trayItems;
+        }
+      }
+      delegate: Item {
+        id: trayItemWrapper
+        required property var modelData
+        required property int index
+        property var trayItem: modelData
+        property string iconSource: {
+          let icon = trayItem && trayItem.icon
+          if (typeof icon === 'string' || icon instanceof String) {
+            if (icon.includes("?path=")) {
+              const split = icon.split("?path=")
+              if (split.length !== 2)
+                return icon
+              const name = split[0]
+              const path = split[1]
+              const fileName = name.substring(
+                               name.lastIndexOf("/") + 1)
+              return `file://${path}/${fileName}`
+            }
+            return icon
+          }
+          return ""
+        }
+        width: icon.width + 6
+        height: parent.height
+        anchors.verticalCenter: parent.verticalCenter
+        WrapperMouseArea {
+          id: trayItemArea
+          anchors.fill: parent
+          acceptedButtons: Qt.LeftButton | Qt.RightButton
+          hoverEnabled: true
+          cursorShape: trayItem.onlyMenu ? Qt.ArrowCursor : Qt.PointingHandCursor
+          onClicked: mouse => {
+            if (!trayItem)
+              return
+            if (mouse.button === Qt.LeftButton
+              && !trayItem.onlyMenu) {
+              trayItem.activate()
+              return
+            }
+            if (trayItem.hasMenu) {
+              var globalPos = mapToGlobal(0, 0)
+              var currentScreen = screen || Screen
+              var screenX = currentScreen.x || 0
+              var relativeX = globalPos.x - screenX
+              menuAnchor.menu = trayItem.menu
+              menuAnchor.anchor.window = bar
+              menuAnchor.anchor.rect = Qt.rect(
+                  relativeX,
+                  21,
+                  parent.width, 1)
+              menuAnchor.open()
+            }
+          }
+          Rectangle {
+            anchors.fill: parent
+            color: {
+              if (trayItemArea.containsMouse)
+                return "#33808080";
+              return "transparent";
+            }
+            Item {
+              anchors.fill: parent
+              layer.enabled: true
+              layer.effect: MultiEffect {
+                colorization: 1
+                colorizationColor: "#555"
+              }
+              IconImage {
+                id: icon
+                anchors.centerIn: parent
+                implicitSize: 16
+                source: trayItemWrapper.iconSource
+                asynchronous: true
+                smooth: true
+                mipmap: true
+                layer.enabled: true
+                layer.effect: MultiEffect {
+                  id: effect
+                  brightness: 1
+                }
+              }
+            }
+          }
+        }
+        PopupWindow {
+          id: tooltip
+          property bool nextVisible: (trayItem.tooltipTitle || trayItem.tooltipDescription) && (trayItemArea.containsMouse || tooltipMouseArea.containsMouse) && !menuAnchor.visible
+          anchor {
+            item: trayItemArea
+            edges: Edges.Bottom
+          }
+          visible: false
+          onNextVisibleChanged: hangTimer.restart()
+          Timer {
+            id: hangTimer
+            interval: 100
+            onTriggered: tooltip.visible = tooltip.nextVisible
+          }
+          color: "black"
+          implicitWidth: Math.max(tooltipTitle.contentWidth, tooltipDescription.contentWidth) + 16
+          implicitHeight: (trayItem.tooltipTitle ? tooltipTitle.contentHeight : 0) + (trayItem.tooltipDescription ? tooltipDescription.contentHeight : 0) + 16
+          WrapperMouseArea {
+            id: tooltipMouseArea
+            hoverEnabled: true
+            enabled: true
+            margin: 4
+            anchors.fill: parent
+            Item {
+              anchors.fill: parent
+              Column {
+                anchors.centerIn: parent
+                Text {
+                  id: tooltipTitle
+                  enabled: trayItem.tooltipTitle
+                  font.pointSize: 10
+                  font.family: "Fira Sans"
+                  font.bold: true
+                  color: "white"
+                  text: trayItem.tooltipTitle
+                }
+                Text {
+                  id: tooltipDescription
+                  enabled: trayItem.tooltipDescription
+                  font.pointSize: 10
+                  font.family: "Fira Sans"
+                  color: "white"
+                  text: trayItem.tooltipDescription
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  QsMenuAnchor {
+    id: menuAnchor
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/UnixIPC.qml b/accounts/gkleen@sif/shell/quickshell/UnixIPC.qml
new file mode 100644
index 00000000..05a40dbc
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/UnixIPC.qml
@@ -0,0 +1,97 @@
+import Quickshell
+import Quickshell.Io
+import Quickshell.Services.Pipewire
+import Quickshell.Services.Mpris
+import qs.Services
+import Custom as Custom
+import QtQml
+Scope {
+  id: root
+  SocketServer {
+    active: true
+    path: `${Quickshell.env("XDG_RUNTIME_DIR")}/shell.sock`
+    handler: Socket {
+      parser: SplitParser {
+        onRead: line => {
+          const command = (() => {
+            try {
+              return JSON.parse(line);
+            } catch (e) {
+              console.warn("UnixIPC: Failed to parse command:", line, e);
+            }
+          })();
+          if (!command)
+            return;
+          if (command.Volume)
+            root.onCommandVolume(command.Volume);
+          else if (command.Brightness)
+            root.onCommandBrightness(command.Brightness);
+          else if (command.LockSession)
+            Custom.Systemd.lockSession();
+          else if (command.Suspend)
+            Custom.Systemd.suspend();
+          else if (command.Hibernate)
+            Custom.Systemd.hibernate();
+          else if (command.Mpris)
+            root.onCommandMpris(command.Mpris);
+          else if (command.Notifications)
+            root.onCommandNotifications(command.Notifications);
+          else
+            console.warn("UnixIPC: Command not handled:", JSON.stringify(command));
+        }
+      }
+      onError: e => {
+        if (e == 1)
+          return;
+        console.warn("QLocalSocket::LocalSocketError", e);
+      }
+    }
+  }
+  PwObjectTracker {
+    objects: [ Pipewire.defaultAudioSink, Pipewire.defaultAudioSource ]
+  }
+  function onCommandVolume(command) {
+    if (command.muted === "toggle")
+      Pipewire.defaultAudioSink.audio.muted = !Pipewire.defaultAudioSink.audio.muted;
+    if (command.volume === "up")
+      Pipewire.defaultAudioSink.audio.volume += 0.02;
+    if (command.volume === "down")
+      Pipewire.defaultAudioSink.audio.volume -= 0.02;
+    if (command["mic-muted"] === "toggle")
+      Pipewire.defaultAudioSource.audio.muted = !Pipewire.defaultAudioSource.audio.muted;
+  }
+  function onCommandBrightness(command) {
+    if (command === "up")
+      Brightness.currBrightness += 0.02
+    if (command === "down")
+      Brightness.currBrightness -= 0.02
+  }
+  function onCommandMpris(command) {
+    if (command.PauseAll)
+      Array.from(MprisProxy.players).forEach(player => {
+        if (player.canPause && player.isPlaying)
+          player.pause();
+      });
+  }
+  Component.onCompleted: { (_ => {})(MprisProxy.players); }
+  function onCommandNotifications(command) {
+    if (command.DismissGroup && NotificationManager.active) {
+      if (NotificationManager.groups.length > 0)
+        for (const notif of [...NotificationManager.groups[0]])
+          notif.dismiss();
+    }
+    if (command.DismissAll && NotificationManager.active) {
+      for (const notif of [...NotificationManager.trackedNotifications.values])
+        notif.dismiss();
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/VolumeOSD.qml b/accounts/gkleen@sif/shell/quickshell/VolumeOSD.qml
new file mode 100644
index 00000000..653f4763
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/VolumeOSD.qml
@@ -0,0 +1,163 @@
+import QtQuick
+import QtQuick.Layouts
+import Quickshell
+import Quickshell.Services.Pipewire
+import Quickshell.Widgets
+Scope {
+  id: root
+  property string show: ""
+  property bool inhibited: true
+  PwObjectTracker {
+    objects: [ Pipewire.defaultAudioSink, Pipewire.defaultAudioSource ]
+  }
+  Connections {
+    enabled: Pipewire.defaultAudioSink
+    target: Pipewire.defaultAudioSink?.audio
+    function onVolumeChanged() {
+      root.show = "sink";
+      hideTimer.restart();
+    }
+    function onMutedChanged() {
+      root.show = "sink";
+      hideTimer.restart();
+    }
+  }
+  Connections {
+    enabled: Pipewire.defaultAudioSource
+    target: Pipewire.defaultAudioSource?.audio
+    function onVolumeChanged() {
+      root.show = "source";
+      hideTimer.restart();
+    }
+    function onMutedChanged() {
+      root.show = "source";
+      hideTimer.restart();
+    }
+  }
+  onShowChanged: {
+    if (show)
+      hideTimer.restart();
+  }
+  Timer {
+    id: hideTimer
+    interval: 1000
+    onTriggered: root.show = ""
+  }
+  Timer {
+    id: startInhibit
+    interval: 100
+    running: true
+    onTriggered: {
+      root.show = "";
+      root.inhibited = false;
+    }
+  }
+  LazyLoader {
+    active: root.show && !root.inhibited
+    Variants {
+      model: Quickshell.screens
+      delegate: Scope {
+        id: screenScope
+        required property var modelData
+        PanelWindow {
+          id: window
+          screen: screenScope.modelData
+          anchors.top: true
+          margins.top: screen.height / 2 - 50 + 3.5
+          exclusiveZone: 0
+          exclusionMode: ExclusionMode.Ignore
+          implicitWidth: 400
+          implicitHeight: 50
+          mask: Region {}
+          color: "transparent"
+          Rectangle {
+            anchors.fill: parent
+            color: Qt.rgba(0, 0, 0, 0.75)
+          }
+          RowLayout {
+            id: layout
+            anchors.centerIn: parent
+            height: 50 - 8*2
+            width: 400 - 8*2
+            MaterialDesignIcon {
+              id: volumeIcon
+              implicitWidth: parent.height
+              implicitHeight: parent.height
+              icon: {
+                if (root.show == "sink") {
+                  if (!Pipewire.defaultAudioSink || Pipewire.defaultAudioSink.audio.muted)
+                    return "volume-off";
+                  if (Pipewire.defaultAudioSink.audio.volume <= 0.33)
+                    return "volume-low";
+                  if (Pipewire.defaultAudioSink.audio.volume <= 0.67)
+                    return "volume-medium";
+                  return "volume-high";
+                } else if (root.show == "source") {
+                  if (!Pipewire.defaultAudioSource || Pipewire.defaultAudioSource.audio.muted)
+                    return "microphone-off";
+                  if (Pipewire.defaultAudioSource.audio.volume > 1)
+                    return "microphone-plus";
+                  return "microphone";
+                }
+              return "volume-high";
+              }
+            }
+            Rectangle {
+              Layout.fillWidth: true
+              implicitHeight: 10
+              color: "#50ffffff"
+              Rectangle {
+                anchors {
+                  left: parent.left
+                  top: parent.top
+                  bottom: parent.bottom
+                }
+                color: Pipewire.defaultAudioSink?.audio.muted ? "#70ffffff" : "white"
+                implicitWidth: {
+                  if (root.show == "sink")
+                    return parent.width * (Pipewire.defaultAudioSink?.audio.volume ?? 0);
+                  else if (root.show == "source")
+                    return parent.width * Math.min(1, (Pipewire.defaultAudioSource?.audio.volume ?? 0));
+                  return 0;
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/WallpaperBackground.qml b/accounts/gkleen@sif/shell/quickshell/WallpaperBackground.qml
new file mode 100644
index 00000000..4f85a900
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/WallpaperBackground.qml
@@ -0,0 +1,89 @@
+import QtQuick
+import Quickshell
+import qs.Services
+Item {
+  id: root
+  anchors.fill: parent
+  required property string screen
+  property Img current: one
+  property string source: selector.selected
+  WallpaperSelector {
+    id: selector
+    seed: screen
+  }
+  onSourceChanged: {
+    if (!source)
+      current = null;
+    else if (current === one)
+      two.update()
+    else
+      one.update()
+  }
+  Img { id: one }
+  Img { id: two }
+  component Img: Image {
+    id: img
+    function update() {
+      source = root.source || ""
+    }
+    anchors.fill: parent
+    fillMode: Image.PreserveAspectCrop
+    smooth: true
+    asynchronous: true
+    cache: false
+    opacity: 0
+    onStatusChanged: {
+      if (status === Image.Ready) {
+        root.current = this
+      }
+    }
+    states: State {
+      name: "visible"
+      when: root.current === img
+      PropertyChanges {
+        img.opacity: 1
+      }
+      StateChangeScript {
+        name: "unloadOther"
+        script: {
+          if (img === one)
+            two.source = ""
+          if (img === two)
+            one.source = ""
+        }
+      }
+    }
+    transitions: Transition {
+      SequentialAnimation {
+        NumberAnimation {
+          target: img
+          properties: "opacity"
+          duration: {
+            if (img === one && two.source == "" || img === two && one.source == "")
+              return 0;
+            return 5000;
+          }
+          easing.type: Easing.OutCubic
+        }
+        ScriptAction {
+          scriptName: "unloadOther"
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/WaylandInhibitorWidget.qml b/accounts/gkleen@sif/shell/quickshell/WaylandInhibitorWidget.qml
new file mode 100644
index 00000000..0512ff51
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/WaylandInhibitorWidget.qml
@@ -0,0 +1,56 @@
+import Quickshell
+import QtQuick
+import Quickshell.Widgets
+import Quickshell.Wayland
+import qs.Services
+Item {
+  id: root
+  required property var window
+  width: icon.width + 8
+  height: parent.height
+  anchors.verticalCenter: parent.verticalCenter
+  IdleInhibitor {
+    id: inhibitor
+    enabled: InhibitorState.waylandIdleInhibited
+    window: root.window
+  }
+  WrapperMouseArea {
+    id: widgetMouseArea
+    anchors.fill: parent
+    hoverEnabled: true
+    cursorShape: Qt.PointingHandCursor
+    onClicked: InhibitorState.waylandIdleInhibited = !InhibitorState.waylandIdleInhibited
+    Rectangle {
+      anchors.fill: parent
+      color: {
+        if (widgetMouseArea.containsMouse) {
+          return "#33808080";
+        }
+        return "transparent";
+      }
+      Item {
+        anchors.fill: parent
+        MaterialDesignIcon {
+          id: icon
+          implicitSize: 14
+          anchors.centerIn: parent
+          icon: inhibitor.enabled ? "eye" : "eye-off"
+          color: inhibitor.enabled ? "white" : "#555"
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/WorkspaceSwitcher.qml b/accounts/gkleen@sif/shell/quickshell/WorkspaceSwitcher.qml
new file mode 100644
index 00000000..3ae94346
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/WorkspaceSwitcher.qml
@@ -0,0 +1,204 @@
+import Quickshell
+import QtQuick
+import qs.Services
+import Quickshell.Widgets
+import QtQuick.Layouts
+Row {
+  id: workspaces
+  required property var screen
+  property var ignoreWorkspaces: @ignore_workspaces@
+  height: parent.height
+  anchors.verticalCenter: parent.verticalCenter
+  spacing: 0
+  Repeater {
+    model: ScriptModel {
+      values: {
+        let currWorkspaces = NiriService.workspaces;
+        const ignoreWorkspaces = Array.from(workspaces.ignoreWorkspaces);
+        currWorkspaces = currWorkspaces.filter(ws => ws.output == workspaces.screen.name).filter(ws => ws.is_active || ignoreWorkspaces.every(iws => iws !== ws.name));
+        currWorkspaces.sort((a, b) => {
+          if (NiriService.outputs?.[a.output]?.logical?.x !== NiriService.outputs?.[b.output]?.logical?.x)
+            return NiriService.outputs?.[a.output]?.logical?.x - NiriService.outputs?.[b.output]?.logical?.x
+          if (NiriService.outputs?.[a.output]?.logical?.y !== NiriService.outputs?.[b.output]?.logical?.y)
+            return NiriService.outputs?.[a.output]?.logical?.y - NiriService.outputs?.[b.output]?.logical?.y
+          return a.idx - b.idx;
+        });
+        return currWorkspaces;
+      }
+    }
+    Item {
+      id: wsItem
+      property var workspaceData: modelData
+      width: wsLabel.contentWidth + 8
+      height: parent.height
+      anchors.verticalCenter: parent.verticalCenter
+      WrapperMouseArea {
+        id: mouseArea
+        anchors.fill: parent
+        hoverEnabled: true
+        cursorShape: Qt.PointingHandCursor
+        enabled: true
+        onClicked: {
+          NiriService.sendCommand({ "Action": { "FocusWorkspace": { "reference": { "Id": workspaceData.id } } } }, _ => {});
+        }
+        Rectangle {
+          anchors.fill: parent
+          color: {
+            if (mouseArea.containsMouse) {
+              return "#33808080";
+            }
+            return "transparent";
+          }
+          Text {
+            id: wsLabel
+            anchors.centerIn: parent
+            font.pointSize: 10
+            font.family: "Fira Sans"
+            color: {
+              if (workspaceData.is_active)
+                return "#23fd00";
+              if (workspaceData.active_window_id === null)
+                return "#555";
+              return "white";
+            }
+            text: workspaceData.name ? workspaceData.name : workspaceData.idx
+          }
+        }
+      }
+      PopupWindow {
+        id: tooltip
+        property bool nextVisible: (mouseArea.containsMouse || tooltipMouseArea.containsMouse) && [...windowsModel.values].length > 0
+        anchor {
+          item: mouseArea
+          edges: Edges.Bottom | Edges.Left
+        }
+        visible: false
+        onNextVisibleChanged: hangTimer.restart()
+        Timer {
+          id: hangTimer
+          interval: 100
+          onTriggered: tooltip.visible = tooltip.nextVisible
+        }
+        implicitWidth: tooltipContent.implicitWidth
+        implicitHeight: tooltipContent.implicitHeight
+        color: "black"
+        WrapperMouseArea {
+          id: tooltipMouseArea
+          hoverEnabled: true
+          enabled: true
+          anchors.fill: parent
+          WrapperItem {
+            id: tooltipContent
+            margin: 0
+            ColumnLayout  {
+              spacing: 0
+              Repeater {
+                model: ScriptModel {
+                  id: windowsModel
+                  values: {
+                    let currWindows = Array.from(NiriService.windows).filter(win => win.workspace_id == wsItem.workspaceData.id);
+                    currWindows.sort((a, b) => {
+                      if (a.is_floating !== b.is_floating)
+                        return b.is_floating - a.is_floating;
+                      if (a.layout.tile_pos_in_workspace_view?.[0] !== b.layout.tile_pos_in_workspace_view?.[0])
+                        return a.layout.tile_pos_in_workspace_view?.[0] - b.layout.tile_pos_in_workspace_view?.[0]
+                      if (a.layout.tile_pos_in_workspace_view?.[1] !== b.layout.tile_pos_in_workspace_view?.[1])
+                        return a.layout.tile_pos_in_workspace_view?.[1] - b.layout.tile_pos_in_workspace_view?.[1]
+                      if (a.layout.pos_in_scrolling_layout?.[0] !== b.layout.pos_in_scrolling_layout?.[0])
+                        return a.layout.pos_in_scrolling_layout?.[0] - b.layout.pos_in_scrolling_layout?.[0]
+                      if (a.layout.pos_in_scrolling_layout?.[1] !== b.layout.pos_in_scrolling_layout?.[1])
+                        return a.layout.pos_in_scrolling_layout?.[1] - b.layout.pos_in_scrolling_layout?.[1]
+                      if (a.app_id !== b.app_id)
+                        return a.app_id.localeCompare(b.app_id);
+                      return a.title.localeCompare(b.title);
+                    });
+                    return currWindows;
+                  }
+                }
+                WrapperMouseArea {
+                  id: windowMouseArea
+                  required property int index
+                  required property var modelData
+                  property var windowData: modelData
+                  hoverEnabled: true
+                  cursorShape: Qt.PointingHandCursor
+                  enabled: true
+                  Layout.fillWidth: true
+                  onClicked: {
+                    NiriService.sendCommand({ "Action": { "FocusWindow": { "id": windowData.id } } }, _ => {})
+                  }
+                  WrapperRectangle {
+                    color: windowMouseArea.containsMouse ? "#33808080" : "transparent";
+                    WrapperItem {
+                      rightMargin: 8
+                      leftMargin: 8
+                      topMargin: windowMouseArea.index == 0 ? 8 : 4
+                      bottomMargin: windowMouseArea.index == windowsModel.values.length - 1 ? 8 : 4
+                      Text {
+                        id: windowLabel
+                        font.pointSize: 10
+                        font.family: "Fira Sans"
+                        color: {
+                          if (windowData.is_focused)
+                            return "#23fd00";
+                          if (NiriService.workspaces.find(ws => ws.id == windowData.workspace_id)?.active_window_id == windowData.id)
+                            return "white";
+                          return "#555";
+                        }
+                        text: windowData.title
+                        horizontalAlignment: Text.AlignLeft
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/WorktimeWidget.qml b/accounts/gkleen@sif/shell/quickshell/WorktimeWidget.qml
new file mode 100644
index 00000000..04bcc581
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/WorktimeWidget.qml
@@ -0,0 +1,120 @@
+import QtQml
+import Quickshell
+import Quickshell.Io
+import QtQuick
+import Quickshell.Widgets
+Item {
+  id: root
+  required property string command
+  property var state: null
+  height: parent.height
+  width: label.contentWidth + 8
+  anchors.verticalCenter: parent.verticalCenter
+  Process {
+    id: process
+    running: true
+    command: [ @worktime@, root.command, "--waybar" ]
+    stdout: StdioCollector {
+      id: processCollector
+      onStreamFinished: {
+        try {
+          root.state = JSON.parse(processCollector.text);
+        } catch (e) {
+          console.warn("Worktime: Failed to parse output:", processCollector.text, e);
+        }
+      }
+    }
+  }
+  Timer {
+    running: true
+    interval: 60
+    repeat: true
+    onTriggered: process.running = true
+  }
+  WrapperMouseArea {
+    id: mouseArea
+    anchors.fill: parent
+    enabled: true
+    hoverEnabled: true
+    Item {
+      anchors.fill: parent
+      Text {
+        id: label
+        anchors.centerIn: parent
+        visible: root.state?.text ?? false
+        text: root.state?.text ?? ""
+        font.pointSize: 10
+        font.family: "Fira Sans"
+        color: {
+          if (root.state?.class == "running")
+            return "white";
+          if (root.state?.class == "over")
+            return "#f28a21";
+          return "#555";
+        }
+      }
+    }
+  }
+  PopupWindow {
+    id: tooltip
+    property bool nextVisible: Boolean(root.state?.tooltip ?? false) && (mouseArea.containsMouse || tooltipMouseArea.containsMouse)
+    anchor {
+      item: mouseArea
+      edges: Edges.Bottom | Edges.Left
+    }
+    visible: false
+    onNextVisibleChanged: hangTimer.restart()
+    Timer {
+      id: hangTimer
+      interval: 100
+      onTriggered: tooltip.visible = tooltip.nextVisible
+    }
+    implicitWidth: tooltipText.contentWidth + 16
+    implicitHeight: tooltipText.contentHeight + 16
+    color: "black"
+    WrapperMouseArea {
+      id: tooltipMouseArea
+      enabled: true
+      hoverEnabled: true
+      anchors.fill: parent
+      Item {
+        anchors.fill: parent
+        Text {
+          id: tooltipText
+          anchors.centerIn: parent
+          font.pointSize: 10
+          font.family: "Fira Sans"
+          color: "white"
+          text: root.state?.tooltip ?? ""
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/displaymanager.qml b/accounts/gkleen@sif/shell/quickshell/displaymanager.qml
new file mode 100644
index 00000000..b452c03d
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/displaymanager.qml
@@ -0,0 +1,115 @@
+//@ pragma UseQApplication
+import Quickshell
+import Quickshell.Wayland
+import Quickshell.Io
+import Quickshell.Services.Greetd
+import QtQml
+ShellRoot {
+  id: displaymanager
+  settings.watchFiles: false
+  property string currentText: ""
+  property string username: @username@
+  property list<string> command: @niri_session@
+  property list<var> messages: []
+  property bool responseRequired: false
+  property bool responseVisible: false
+  signal startAuth()
+  onStartAuth: {
+    if (Greetd.state !== GreetdState.Inactive)
+      Greetd.cancelSession();
+    displaymanager.messages = [];
+    Greetd.createSession(displaymanager.username);
+  }
+  Connections {
+    target: Greetd
+    function onStateChanged() {
+      console.log("greetd state: ", GreetdState.toString(Greetd.state));
+      if (Greetd.state === GreetdState.ReadyToLaunch)
+        Greetd.launch(displaymanager.command);
+    }
+    function onAuthMessage(message: string, error: bool, responseRequired: bool, echoResponse: bool) {
+      displaymanager.responseVisible = echoResponse;
+      displaymanager.responseRequired = responseRequired;
+      displaymanager.messages = Array.from(displaymanager.messages).concat([{ "text": message, "error": error }]);
+    }
+    function onAuthFailure(message: string) {
+      displaymanager.responseRequired = false;
+      displaymanager.messages = Array.from(displaymanager.messages).concat([{ "text": message, "error": true }]);
+    }
+  }
+  Component.onCompleted: {
+    if (Greetd.state !== GreetdState.Inactive)
+      Greetd.cancelSession();
+  }
+  Variants {
+    model: Quickshell.screens
+    delegate: Scope {
+      id: screenScope
+      required property var modelData
+      PanelWindow {
+        color: "black"
+        screen: screenScope.modelData
+        WlrLayershell.keyboardFocus: WlrKeyboardFocus.Exclusive
+        anchors.top: true
+        anchors.bottom: true
+        anchors.left: true
+        anchors.right: true
+        LockSurface {
+          id: surfaceContent
+          screen: screenScope.modelData
+          onCurrentTextChanged: displaymanager.currentText = currentText
+          Connections {
+            target: displaymanager
+            function onCurrentTextChanged() { surfaceContent.currentText = displaymanager.currentText; }
+            function onMessagesChanged() { surfaceContent.messages = Array.from(displaymanager.messages); }
+            function onResponseRequiredChanged() { surfaceContent.responseRequired = displaymanager.responseRequired; }
+            function onResponseVisibleChanged() { surfaceContent.responseVisible = displaymanager.responseVisible; }
+          }
+          onResponse: responseText => Greetd.respond(responseText);
+          Connections {
+            target: Greetd
+            function onStateChanged() {
+              if (Greetd.state === GreetdState.Authenticating) {
+                surfaceContent.authRunning = true;
+              } else {
+                surfaceContent.authRunning = false;
+              }
+            }
+          }
+          onAuthRunningChanged: {
+            if (surfaceContent.authRunning && Greetd.state !== GreetdState.Authenticating)
+              displaymanager.startAuth();
+          }
+          Component.onCompleted: {
+            surfaceContent.authRunning = Greetd.state === GreetdState.Authenticating
+            surfaceContent.messages = Array.from(displaymanager.messages);
+            surfaceContent.responseVisible = displaymanager.responseVisible;
+            surfaceContent.responseRequired = displaymanager.responseRequired;
+            surfaceContent.currentText = displaymanager.currentText;
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/accounts/gkleen@sif/shell/quickshell/shell.qml b/accounts/gkleen@sif/shell/quickshell/shell.qml
new file mode 100644
index 00000000..fb8b16dc
--- /dev/null
+++ b/accounts/gkleen@sif/shell/quickshell/shell.qml
@@ -0,0 +1,53 @@
+//@ pragma UseQApplication
+import Quickshell
+import Quickshell.Wayland
+ShellRoot {
+  settings.watchFiles: false
+  Variants {
+    model: Quickshell.screens
+    delegate: Scope {
+      id: screenScope
+      required property var modelData
+      PanelWindow {
+        id: bgWindow
+        screen: screenScope.modelData
+        WlrLayershell.layer: WlrLayer.Background
+        WlrLayershell.namespace: "background"
+        exclusionMode: ExclusionMode.Ignore
+        anchors.top: true
+        anchors.bottom: true
+        anchors.left: true
+        anchors.right: true
+        color: "black"
+        WallpaperBackground {
+          screen: bgWindow.screen.name
+        }
+      }
+      Bar {
+        modelData: screenScope.modelData
+      }
+    }
+  }
+  Lockscreen {}
+  NiriIdle {}
+  VolumeOSD {}
+  BrightnessOSD {}
+  NotificationDisplay {}
+  UnixIPC {}
+}
diff --git a/accounts/gkleen@sif/synadm/default.nix b/accounts/gkleen@sif/synadm/default.nix
new file mode 100644
index 00000000..0a8e0d4c
--- /dev/null
+++ b/accounts/gkleen@sif/synadm/default.nix
@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  home.packages = with pkgs; [ synadm ];
+  sops.secrets."synadm.yaml" = {
+    format = "binary";
+    sopsFile = ./synadm_yaml;
+    path = config.xdg.configHome + "/synadm.yaml";
+  };
+}
diff --git a/accounts/gkleen@sif/synadm/synadm_yaml b/accounts/gkleen@sif/synadm/synadm_yaml
new file mode 100644
index 00000000..8d951ccc
--- /dev/null
+++ b/accounts/gkleen@sif/synadm/synadm_yaml
@@ -0,0 +1,15 @@
+{
+        "data": "ENC[AES256_GCM,data:qJy4Pmbbxja4jmW7OaHsD0mQZ7anZwLhiVmAgkavb+CqwWGDnUBXdz22/MHCbxng5NshcFSpBoCBhgY6B9V2bUiES6bH9AtMlDcs9ebKGMArBTUTnQ2MjWQGfQTqraWdNgy+n327uj9swwCH8EZXdYH/Hlv0t/re470W+VOHeXhGghQ3Y9IGz2sgfvMGr8QxaJNydZz85rgs5QUP/PglCwWIOw2mY1EX2vYwnmiAo49LmIEaxWvRi++KHaeBveDt0nlkJwzUlipL2VOKWxkgpK3yGucQn2mz+FRe1btp+4KGm8H17eUI9FO9sBwq,iv:kgM921ovwCgDYHQj3c5Rupy/8JxHehxUD2jb1k9Ik2Y=,tag:3TLQkJbv679VWy8V2TMugw==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bzVHUGNxZTF2WC9MYmZr\neGdVVzJXN3lGdEk3cTBER3J6UTFtcUJna2d3CjdNQmRXd2haZW1MYlJzNkk1dWVD\nVTFQc2gvS0JrejJ6SFh2MXpPWDZpRE0KLS0tIE0wTC85bEpvSnlGdGFkZVFhNjFZ\nbzRiZkxMWUg2ODNVUlBmNFlPNGRrZlkK1VXLJWcssv3ETyZSSM/Hhn5VIaI9iov9\nzShZA9Zx/FX6PYTuUMC29pJ57gKourcIxa/7HwSv/xYn1A6WcYfgSg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-18T11:03:42Z",
+                "mac": "ENC[AES256_GCM,data:yonJC68PhilAgEHNNJQ8nO53Qo3rx/LnfiOWfuMm24bOUIH9QM3WZZxpigd7bHI4eC4TqRb4LvcSi0nEURTRAhwiTqGNrWbpw2Iv3n5dhLEN9aTcetG5ZuhaXqfVUoML45/ovdBZG/0l8+XIHqxN2M/g/h4JwKoR/6lqzcrVhgo=,iv:xvxBJwy+E5zUdjhGPdZPdy7tnBIEj50hfiDJFsS3wNg=,tag:L4Fas36ZOg4h0QQwC4gjNA==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/accounts/gkleen@sif/systemd.nix b/accounts/gkleen@sif/systemd.nix
index 2237b708..e601b49c 100644
--- a/accounts/gkleen@sif/systemd.nix
+++ b/accounts/gkleen@sif/systemd.nix
@@ -205,11 +205,6 @@ in {
        StartLimitBurst = 7;
      };
    };
-    swayidle = {
-      Service = {
-        RuntimeDirectory = "swayidle";
-      };
-    };
    psi-notify = {
      Install = {
        WantedBy = ["graphical-session.target"];
@@ -242,7 +237,7 @@ in {
          "-${lib.getExe pkgs.playerctl} -a pause"
          "-${lib.getExe (pkgs.writeShellApplication {
            name = "generate-css";
-            runtimeInputs = with pkgs; [cfg.programs.wpaperd.package jq coreutils imagemagick findutils];
+            runtimeInputs = with pkgs; [cfg.services.wpaperd.package jq coreutils imagemagick findutils];
            text = ''
              declare -A monitors
              monitors=()
@@ -333,26 +328,24 @@ in {
        ExecStopPost = "${pkgs.coreutils}/bin/rm -rfv \"$CACHE_DIRECTORY\"";
      };
    };
-    wpaperd = {
+    # wpaperd = {
-      Install = {
+    #   Install = {
-        WantedBy = ["graphical-session.target"];
+    #     WantedBy = ["graphical-session.target"];
-      };
+    #   };
-      Unit = {
+    #   Unit = {
-        After = [ "graphical-session.target" ];
+    #     After = [ "graphical-session.target" ];
-        PartOf = [ "graphical-session.target" ];
+    #     PartOf = [ "graphical-session.target" ];
-      };
+    #   };
-      Service = {
+    #   Service = {
-        ExecStart = lib.getExe cfg.programs.wpaperd.package;
+    #     ExecStart = lib.getExe cfg.services.wpaperd.package;
-        Type = "simple";
+    #     Type = "simple";
-        Restart = "always";
+    #     Restart = "always";
-        RestartSec = "2s";
+    #     RestartSec = "2s";
-      };
+    #   };
-    };
+    # };
    xembed-sni-proxy = {
      Unit = {
        PartOf = lib.mkForce ["tray.target"];
-        BindsTo = ["xwayland-satellite.service"];
-        After = ["xwayland-satellite.service"];
      };
    };
    poweralertd = {
@@ -385,6 +378,8 @@ in {
      };
      Service = {
        ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd --exit-idle-time=60s 127.0.0.1:${toString (port + 1)}";
+        Restart = "always";
+        RestartSec = "23s";
      };
  }) [{ host = "proxy.ssh.math.lmu.de"; port = 8118; } { host = "proxy.vidhar"; port = 8120; } { host = "proxy.mathw0h"; port = 8122; } { host = "proxy.mathw0e"; port = 8124; }]);
  sockets = listToAttrs (map (port: nameValuePair "proxy-to-autossh-socks@${toString port}" {
@@ -439,8 +434,8 @@ in {
    tray = {
      Unit = {
        PartOf = [ "graphical-session.target" ];
-        Requires = [ "waybar.service" ];
+        # Requires = [ "waybar.service" ];
-        After = [ "graphical-session.target" "waybar.service" ];
+        After = [ "graphical-session.target" ]; # "waybar.service" ];
        Wants = ["blueman-applet.service" "udiskie.service" "network-manager-applet.service"];
      };
    };
diff --git a/accounts/gkleen@sif/utils/async-yt-dlp.nix b/accounts/gkleen@sif/utils/async-yt-dlp.nix
new file mode 100644
index 00000000..c3b82ec5
--- /dev/null
+++ b/accounts/gkleen@sif/utils/async-yt-dlp.nix
@@ -0,0 +1,57 @@
+{ writers, python3Packages, ... }:
+writers.writePython3Bin "async-yt-dlp" {
+  libraries = with python3Packages; [ yt-dlp ];
+  flakeIgnore = ["E501"];
+} ''
+import sys
+import os
+import yt_dlp
+import yt_dlp.options
+from collections import namedtuple
+import socket
+from pathlib import Path
+import json
+create_parser = yt_dlp.options.create_parser
+def parse_patched_options(opts):
+    patched_parser = create_parser()
+    patched_parser.defaults.update({
+        'ignoreerrors': False,
+        'retries': 0,
+        'fragment_retries': 0,
+        'extract_flat': False,
+        'concat_playlist': 'never',
+    })
+    yt_dlp.options.create_parser = lambda: patched_parser
+    try:
+        return yt_dlp.parse_options(opts)
+    finally:
+        yt_dlp.options.create_parser = create_parser
+default_opts = parse_patched_options([]).ydl_opts
+def cli_to_api(opts):
+    opts = parse_patched_options(opts)
+    urls = opts.urls
+    opts = opts.ydl_opts
+    diff = {k: v for k, v in opts.items() if default_opts[k] != v}
+    if 'postprocessors' in diff:
+        diff['postprocessors'] = [pp for pp in diff['postprocessors']
+                                  if pp not in default_opts['postprocessors']]
+    return namedtuple('Options', ('params', 'urls'))(diff, urls)
+if __name__ == '__main__':
+    opts = cli_to_api(sys.argv[1:])
+    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
+        sock.connect(str(Path(os.environ["XDG_RUNTIME_DIR"]) / "yt-dlp.sock").encode('utf-8'))
+        with sock.makefile(mode='w', buffering=1, encoding='utf-8') as fh:
+            json.dump(opts._asdict(), fh)
+''
diff --git a/accounts/gkleen@sif/utils/pdf2pdf.nix b/accounts/gkleen@sif/utils/pdf2pdf.nix
new file mode 100644
index 00000000..9f4cbc3e
--- /dev/null
+++ b/accounts/gkleen@sif/utils/pdf2pdf.nix
@@ -0,0 +1,8 @@
+pkgs@{ lib, resholve, zsh, ghostscript_headless, ... }:
+resholve.writeScriptBin "pdf2pdf" {
+  inputs = with pkgs; [ghostscript_headless];
+  interpreter = lib.getExe zsh;
+} ''
+  exec gs -dPDFSETTINGS=/prepress -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -dSAFER -dPreserveAnnots=false "-sOutputFile=''${2}" "''${1}"
+''
diff --git a/accounts/gkleen@sif/utils/sieve-edit.nix b/accounts/gkleen@sif/utils/sieve-edit.nix
new file mode 100644
index 00000000..f985a3f6
--- /dev/null
+++ b/accounts/gkleen@sif/utils/sieve-edit.nix
@@ -0,0 +1,24 @@
+pkgs@{ lib, resholve, zsh, sieve-connect, sops, ... }:
+resholve.writeScriptBin "sieve-edit" {
+  inputs = with pkgs; [sieve-connect sops];
+  interpreter = lib.getExe zsh;
+  execer = with pkgs; [
+    "cannot:${lib.getExe sieve-connect}"
+    "cannot:${lib.getExe sops}"
+  ];
+} ''
+  host=$1; shift
+  case "$host" in
+    surtr)
+      sieve-connect -s surtr.yggdrasil.li -m EXTERNAL --clientkey <(sops decrypt $HOME/projects/machines/hosts/surtr/email/ca/gkleen@sif.key) --clientcert $HOME/projects/machines/hosts/surtr/email/ca/gkleen@sif.crt --edit --remotesieve sieve
+      ;;
+    ymir)
+      sieve-connect -s ymir.yggdrasil.li -u gkleen --edit --remotesieve sieve
+      ;;
+    *)
+      echo "Unknown host: ‘$host’" >&2
+      return 2
+      ;;
+  esac
+''
diff --git a/accounts/gkleen@sif/zshrc b/accounts/gkleen@sif/zshrc
index c628e2e9..702990c3 100644
--- a/accounts/gkleen@sif/zshrc
+++ b/accounts/gkleen@sif/zshrc
@@ -2,17 +2,14 @@ dir() {
    curlArchive=false
    templateArchive=""
    repoUrl=""
-    nixShell=""
-    findNix=false
    dir=""
    forceShell=false
    wormhole=false
    gitWorktree=""
-    # notmuchMsg=""
-    quickserve=false
    modifyPDF=""
+    miniserve=false
-    while getopts ':t:a:s:Sd:ir:wqg:p:' arg; do
+    while getopts ':t:a:d:ir:wg:p:m' arg; do
        case $arg in
            "t") ;;
            "a")
@@ -23,16 +20,13 @@ dir() {
                    templateArchive=${OPTARG:a}
                fi
                ;;
-            "s") nixShell=${OPTARG:a} ;;
-            "S") findNix=true ;;
            "d") dir=${OPTARG} ;;
            "i") forceShell=true ;;
            "r") repoUrl=${OPTARG} ;;
            "w") wormhole=true ;;
            "g") gitWorktree=${OPTARG} ;;
-            # "n") notmuchMsg=${OPTARG} ;;
-            "q") quickserve=true ;;
            "p") modifyPDF=${OPTARG:a} ;;
+            "m") miniserve=true ;;
            *) printf "Invalid option: %s\n" $arg >&2; exit 2 ;;
        esac
    done
@@ -56,20 +50,34 @@ dir() {
        gitWorktree=""
    fi
+    miniservePIDFile=""
+    if [[ ${miniserve} = "true" ]]; then
+      miniservePIDFile=$(mktemp --tmpdir --suffix=.pid)
+    fi
    cleanup()
    {
-        cd ${modifyPDF:h}
+        if [[ -n ${modifyPDF} ]]; then
-        [[ -n ${modifyPDF} ]] && nix shell 'nixos#imagemagick' -c convert -verbose ${dir}/${modifyPDF:t:r}_*.png(on) ${modifyPDF}
+           cd ${modifyPDF:h}
+           typeset -a pages
+           eval 'pages=(${dir}/${modifyPDF:t:r}_*.png(on))'
+           magick -verbose "$pages" ${modifyPDF}
+           modifyPDF=""
+        fi
+        if [[ -n ${miniservePIDFile} ]]; then
+           command kill --verbose -- $(cat ${miniservePIDFile}) && wait $(cat ${miniservePIDFile})
+           miniservePIDFile=""
+        fi
    }
    (
+        set -o localoptions -o localtraps
+        trap 'return 1' INT TERM
        trap cleanup EXIT
        cd ${dir}
        export dir;
-        ${findNix} && { nixShell=$(findNix) || return $? }
        [[ -n ${repoUrl} ]] && git clone -- ${repoUrl} .
        [[ -n ${modifyPDF} ]] && templateArchive=${modifyPDF}
@@ -82,23 +90,23 @@ dir() {
                }
                trap cleanup EXIT
-                if ${curlArchive}; then
+                if [[ $curlArchive = "true" ]]; then
                    archiveFile=$(mktemp -t "archive.XXXXXXXXXX.${templateArchive:t}")
-                    curl -L -o ${archiveFile} ${templateArchive}
+                    curl -SfL -o ${archiveFile} ${templateArchive}
                    templateArchive=${archiveFile}
                fi
                unpack=true
-                while ${unpack}; do
+                while [[ $unpack = "true" ]]; do
                    case $(file --brief --mime-type --dereference ${templateArchive}) in
                        application/zip)
                            unzip ${templateArchive}
                            unpack=false
                        ;;
                        application/vnd.debian.binary-package)
-                            nix shell 'nixos#binutils' --command ar x ${templateArchive}
+                            ar x ${templateArchive}
                            mkdir control data
                            tar -C control -xvaf control.*
                            tar -C data -xvaf data.*
@@ -106,7 +114,7 @@ dir() {
                        ;;
                        application/x-rpm)
                            cpioArchive=$(mktemp -t "archive.XXXXXXXXXX.${templateArchive:t:r}.cpio")
-                            nix shell 'nixos#busybox' --command rpm2cpio ${templateArchive} > ${cpioArchive}
+                            rpm2cpio ${templateArchive} > ${cpioArchive}
                            templateArchive=${cpioArchive}
                            unpack=true
                        ;;
@@ -115,15 +123,19 @@ dir() {
                            unpack=false
                        ;;
                        application/pdf)
-                            nix shell 'nixos#ghostscript' 'nixos#imagemagick' -c convert -verbose -density 400 ${templateArchive} ${modifyPDF:t:r}_%0d.png
+                            magick -verbose -density 400 ${templateArchive} ${modifyPDF:t:r}_%0d.png
                            unpack=false
                        ;;
                        application/octet-stream)
-                            if [[ $(file --brief --dereferenc ${templateArchive}) =~ Squashfs ]]; then
+                            if [[ $(file --brief --dereference ${templateArchive}) =~ Squashfs ]]; then
-                               nix shell 'nixos#squashfsTools' -c unsquashfs -d . ${templateArchive}
+                               unsquashfs -d . ${templateArchive}
                               unpack=false
                            fi
                        ;;
+                        application/x-iso9660-image)
+                          7z x ${templateArchive}
+                          unpack=false
+                        ;;
                        *)
                            tar -xvaf ${templateArchive}
                            unpack=false
@@ -134,25 +146,21 @@ dir() {
        fi
-        ${wormhole} && wormhole receive --accept-file
+        [[ $wormhole = "true" ]] && wormhole receive --accept-file
-        if ${quickserve}; then
+        if [[ ${#@} -gt 0 ]]; then
-          quickserve --root . --upload . --show-hidden --tar gz
+            ${@}
        fi
+        cd $(pwd) # Needed for mounting to work
-        if [[ ${#@} -eq 0 ]] || ${forceShell}; then
+        if [[ ${miniserve} = "true" ]]; then
-            if [[ ${#@} -gt 0 ]]; then
+           miniserve --random-route --hidden --enable-tar-gz --enable-zip . &
-                if [[ -z ${nixShell} ]]; then
+           echo $! > "${miniservePIDFile}"
-                    ${@}
+        fi
-                else
-                    nix-shell ${nixShell} --run "${@}"
-                fi
-            fi
-            cd $(pwd) # Needed for mounting to work
+        if [[ ${#@} -eq 0 ]] && [[ ${miniserve} != "true" ]] || [[ $forceShell = "true" ]]; then
            isSingleDir() {
                typeset -a contents
                contents=(*(N) .*(N))
@@ -166,18 +174,9 @@ dir() {
            }
            while d=$(isSingleDir); do cd ${d}; done
+            zsh
-            if [[ -z ${nixShell} ]]; then
+        elif [[ ${miniserve} == "true" ]]; then
-                zsh
+            wait $(cat "${miniservePIDFile}")
-            else
-                nix-shell ${nixShell} --run zsh
-            fi
-        else
-            if [[ -z ${nixShell} ]]; then
-                ${@}
-            else
-                nix-shell ${nixShell} --run "${@}"
-            fi
        fi
    )
 }
@@ -185,27 +184,30 @@ dir() {
 tmpdir() {
    cleanup()
    {
-      cd /
+        cd /
        unmount() {
            printf "Unmounting %s\n" ${1} >&2
            fusermount -u ${1} || umount ${1} || sudo umount ${1}
        }
-        if mountpoint -q -- ${dir}; then
+        if [[ -n ${dir} ]]; then
-            unmount ${dir} || return $?
+            if mountpoint -q -- ${dir}; then
-        else
+                unmount ${dir} || return $?
-            while read -d $'\0' subDir; do
+            else
-                mountpoint -q -- ${subDir} || continue
+                while read -d $'\0' subDir; do
-                unmount ${subDir} || return $?
+                    mountpoint -q -- ${subDir} || continue
-            done <<<$(find ${dir} -xdev -type d -print0 | sort -zr)
+                    unmount ${subDir} || return $?
-        fi
+                done <<<$(find ${dir} -xdev -type d -print0 | sort -zr)
+            fi
-        rm -rfv --one-file-system -- ${dir}
+            rm -rfv --one-file-system -- ${dir}
+            dir=""
+        fi
    }
    local tmpdir=""
-    while getopts ':t:a:s:Sd:ir:wqg:p:' arg; do
+    while getopts ':t:a:d:ir:wg:p:m' arg; do
        case $arg in
            "t") tmpdir="=${OPTARG}" ;;
            "?"|":") printf "Invalid option: %s\n" $arg >&2; exit 2 ;;
@@ -213,6 +215,8 @@ tmpdir() {
    done
    (
+        set -o localoptions -o localtraps
+        trap 'return 1' INT TERM
        trap cleanup EXIT
@@ -231,17 +235,7 @@ clock() {
 }
 public-ip() {
-    curl -s -H 'Accept: application/json' $@ ifconfig.co | jq -r '.ip'
+    curl -sSf -H 'Accept: application/json' $@ ifconfig.co | jq -r '.ip'
-}
-nix-ghci() {
-    pkgExpr=""
-    if [[ ${#@} -gt 0 ]]; then
-        pkgExpr="${1}"
-        shift
-    fi
-    nix-shell -p "with (import <nixpkgs> {}); pkgs.haskellPackages.ghcWithPackages (p: with p; [${pkgExpr}])" --run "ghci ${@}"
 }
 swap() {
@@ -271,14 +265,6 @@ l() {
  ls --long --binary --git --time-style=iso --header $@
 }
-re() {
-  systemctl restart $@
-}
-ure() {
-  systemctl --user restart $@
-}
 ssh-installer() {
  ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityFile=~/.ssh/gkleen@sif.midgard.yggdrasil $@
 }
diff --git a/accounts/gkleen@surtr.nix b/accounts/gkleen@surtr.nix
index 58c4f21d..8f678ac9 100644
--- a/accounts/gkleen@surtr.nix
+++ b/accounts/gkleen@surtr.nix
@@ -1,3 +1,7 @@
-{ userName, ... }: {
+{ flake, userName, ... }: {
-  home-manager.users.${userName}.home.stateVersion = "20.09";
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName}.home.stateVersion = "20.09";
 }
diff --git a/accounts/gkleen@vidhar.nix b/accounts/gkleen@vidhar.nix
index 8509c2f4..3a37c4bd 100644
--- a/accounts/gkleen@vidhar.nix
+++ b/accounts/gkleen@vidhar.nix
@@ -1,4 +1,8 @@
 { flake, pkgs, userName, config, ... }: {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
  config = {
    users.users.${userName} = {
      uid = 1000;
diff --git a/accounts/mherold@eostre.nix b/accounts/mherold@eostre.nix
index 51e4529a..0e2f37aa 100644
--- a/accounts/mherold@eostre.nix
+++ b/accounts/mherold@eostre.nix
@@ -7,9 +7,9 @@
    home-manager.users.${userName} = {
      home.stateVersion = "20.09";
-      nixpkgs.config = {
+      # nixpkgs.config = {
-        allowUnfree = true;
+      #   allowUnfree = true;
-      };
+      # };
      home.packages = with pkgs; [
        thunderbird libreoffice element-desktop keepassxc vlc
diff --git a/accounts/root@installer.nix b/accounts/root@installer.nix
index c7a418f8..5fe1db38 100644
--- a/accounts/root@installer.nix
+++ b/accounts/root@installer.nix
@@ -1,7 +1,11 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 {
-  home-manager.users.${userName} = { config, ... } : {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName} = { config, ... } : {
    home.stateVersion = config.home.version.release;
  };
 }
diff --git a/accounts/root@sif.nix b/accounts/root@sif.nix
index c9e129a0..bb816230 100644
--- a/accounts/root@sif.nix
+++ b/accounts/root@sif.nix
@@ -1,6 +1,10 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 {
-  home-manager.users.${userName} = {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName} = {
    home.stateVersion = "20.09";
    programs.ssh.matchBlocks = {
diff --git a/accounts/root@surtr.nix b/accounts/root@surtr.nix
index 58c4f21d..8f678ac9 100644
--- a/accounts/root@surtr.nix
+++ b/accounts/root@surtr.nix
@@ -1,3 +1,7 @@
-{ userName, ... }: {
+{ flake, userName, ... }: {
-  home-manager.users.${userName}.home.stateVersion = "20.09";
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName}.home.stateVersion = "20.09";
 }
diff --git a/accounts/root@vidhar.nix b/accounts/root@vidhar.nix
index e82414a8..0fc56633 100644
--- a/accounts/root@vidhar.nix
+++ b/accounts/root@vidhar.nix
@@ -1,6 +1,11 @@
-{ config, userName, ... }:
+{ flake, config, userName, ... }:
 {
-  home-manager.users.${userName} = {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName} = {
    home.stateVersion = "20.09";
    programs.ssh.matchBlocks = {
diff --git a/flake.lock b/flake.lock
index 55213878..b99d27a9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -6,22 +6,28 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "poetry2nix": [
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
-          "poetry2nix"
+        "pyproject-build-systems": [
+          "pyproject-build-systems"
        ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix"
+        "pyproject-nix": [
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "uv2nix"
+        ]
      },
      "locked": {
-        "lastModified": 1723124245,
+        "lastModified": 1749560907,
-        "narHash": "sha256-ThDq7vOXo6G4+C5FHqUc64CeX2c5n36tln4ZlDao6s4=",
+        "narHash": "sha256-zvAxxnJ5dcnjbuog0W6UvlthD1dLm5t4ZQI25jzNDW4=",
        "owner": "gkleen",
        "repo": "backup-utils",
-        "rev": "74e65090de63fc99f056098677cc490754e2708f",
+        "rev": "8ed6a1d7c2e337cb2e35ed68f6d852f0d1049908",
        "type": "gitlab"
      },
      "original": {
        "owner": "gkleen",
-        "ref": "v0.1.6",
+        "ref": "v0.1.7",
        "repo": "backup-utils",
        "type": "gitlab"
      }
@@ -33,26 +39,45 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "poetry2nix": [
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix_2",
-          "poetry2nix"
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": [
+          "pyproject-nix"
        ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix_2"
+        "uv2nix": [
+          "uv2nix"
+        ]
      },
      "locked": {
-        "lastModified": 1734281899,
+        "lastModified": 1750599403,
-        "narHash": "sha256-9QdIl3sjHY4Xij9KrBUkW1KpLB+jyxlI12UHPitlawI=",
+        "narHash": "sha256-MLQ7CISl00w1xq88TL2wukNq3ukzID4u7BVT4okbUik=",
        "owner": "gkleen",
        "repo": "ca",
-        "rev": "1e4ee9d25a5282ef7bc6774072229784fa0036f3",
+        "rev": "505a29233ada969b2eca76d616b0d7a8767dfb71",
        "type": "gitlab"
      },
      "original": {
        "owner": "gkleen",
-        "ref": "v3.1.3",
+        "ref": "v3.1.5",
        "repo": "ca",
        "type": "gitlab"
      }
    },
+    "crane": {
+      "locked": {
+        "lastModified": 1731098351,
+        "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
    "deploy-rs": {
      "inputs": {
        "flake-compat": [
@@ -66,11 +91,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1727447169,
+        "lastModified": 1749105467,
-        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
+        "narHash": "sha256-hXh76y/wDl15almBcqvjryB50B0BaiXJKk20f314RoE=",
        "owner": "serokell",
        "repo": "deploy-rs",
-        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
+        "rev": "6bc76b872374845ba9d645a2f012b764fecd765f",
        "type": "github"
      },
      "original": {
@@ -115,11 +140,11 @@
    "flake-compat_3": {
      "flake": false,
      "locked": {
-        "lastModified": 1733328505,
+        "lastModified": 1747046372,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
        "owner": "edolstra",
        "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
        "type": "github"
      },
      "original": {
@@ -132,6 +157,22 @@
    "flake-compat_4": {
      "flake": false,
      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_5": {
+      "flake": false,
+      "locked": {
        "lastModified": 1673956053,
        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
        "owner": "edolstra",
@@ -168,11 +209,11 @@
        "nixpkgs-lib": "nixpkgs-lib_2"
      },
      "locked": {
-        "lastModified": 1733312601,
+        "lastModified": 1749398372,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
        "type": "github"
      },
      "original": {
@@ -183,6 +224,27 @@
    },
    "flake-parts_3": {
      "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
+      "inputs": {
        "nixpkgs-lib": "nixpkgs-lib_3"
      },
      "locked": {
@@ -202,11 +264,11 @@
    "flake-registry": {
      "flake": false,
      "locked": {
-        "lastModified": 1734450202,
+        "lastModified": 1744623129,
-        "narHash": "sha256-/3gigrEBFORQs6a8LL5twoHs7biu08y/8Xc5aQmk3b0=",
+        "narHash": "sha256-nlQTQrHqM+ywXN0evDXnYEV6z6WWZB5BFQ2TkXsduKw=",
        "owner": "NixOS",
        "repo": "flake-registry",
-        "rev": "02fe640c9e117dd9d6a34efc7bcb8bd09c08111d",
+        "rev": "1322f33d5836ae757d2e6190239252cf8402acf6",
        "type": "github"
      },
      "original": {
@@ -296,6 +358,28 @@
    "gitignore_3": {
      "inputs": {
        "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_4": {
+      "inputs": {
+        "nixpkgs": [
          "prometheus-borg-exporter",
          "pre-commit-hooks-nix",
          "nixpkgs"
@@ -322,11 +406,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1738691953,
+        "lastModified": 1753177987,
-        "narHash": "sha256-JY/w2Xyrj3mhUhLJkSgk8t7MSf3LGZjewPTQ7QtCbHE=",
+        "narHash": "sha256-PkCc+YTrl0A/H6EV09DCr5yZpvQZ9DkuFXj/NNaEvHs=",
        "owner": "gkleen",
        "repo": "home-manager",
-        "rev": "c077fc8684289ab1b1c2231bab1566879e099c97",
+        "rev": "b493410fc6e427129a1caee8f50970d152a27daa",
        "type": "github"
      },
      "original": {
@@ -343,16 +427,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1710245356,
+        "lastModified": 1749562430,
-        "narHash": "sha256-8cQGUn+N1dTgklMWMejSLN2q8Oz+7Rnqsfaw2rt3bU4=",
+        "narHash": "sha256-M5MqsIsf+o7yngakVUW4poBGZaghB6sUpw7SsWA55kU=",
        "owner": "gkleen",
        "repo": "home-manager",
-        "rev": "a14fe0c27d04dfa3d80abe2db743e9a7f4f2a33d",
+        "rev": "dca5a2df9f8a00cc34bea6ead249a8446f5f069e",
        "type": "github"
      },
      "original": {
        "owner": "gkleen",
-        "ref": "nixos-late-start-23.11",
+        "ref": "nixos-late-start-25.05",
        "repo": "home-manager",
        "type": "github"
      }
@@ -373,10 +457,36 @@
        "type": "github"
      }
    },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat_4",
+        "flake-parts": "flake-parts_3",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix_3",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1737639419,
+        "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.4.2",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
    "leapseconds": {
      "flake": false,
      "locked": {
-        "narHash": "sha256-5ZaoY/bScQS7EGJRHu6vj9XWhbObmxNEaGugaGU7+lg=",
+        "narHash": "sha256-FJgbafPB48+5sT+7ZB8pajSsfJoISEOoaJ0d/2Ya7o8=",
        "type": "file",
        "url": "https://data.iana.org/time-zones/tzdb/leap-seconds.list"
      },
@@ -392,16 +502,16 @@
        "nixpkgs": [
          "nixpkgs"
        ],
-        "nixpkgs-stable": "nixpkgs-stable_2",
+        "nixpkgs-stable": "nixpkgs-stable_3",
        "xwayland-satellite-stable": "xwayland-satellite-stable",
        "xwayland-satellite-unstable": "xwayland-satellite-unstable"
      },
      "locked": {
-        "lastModified": 1743186084,
+        "lastModified": 1757437545,
-        "narHash": "sha256-zEPpazywKQLIRWxeTBFnSnacSnGIqM2Qr1iJ5qB94IQ=",
+        "narHash": "sha256-7ssbrFnmSrqtCtOySiu5ncyOBxPrR6p2nhNHrg6D+fo=",
        "owner": "sodiboo",
        "repo": "niri-flake",
-        "rev": "111a3afc23fdf64fd76115df48c2e6571fee51b7",
+        "rev": "ef694b996daeeb8684c0adfaa9b7067a6e709054",
        "type": "github"
      },
      "original": {
@@ -414,16 +524,16 @@
    "niri-stable": {
      "flake": false,
      "locked": {
-        "lastModified": 1740117926,
+        "lastModified": 1756556321,
-        "narHash": "sha256-mTTHA0RAaQcdYe+9A3Jx77cmmyLFHmRoZdd8RpWa+m8=",
+        "narHash": "sha256-RLD89dfjN0RVO86C/Mot0T7aduCygPGaYbog566F0Qo=",
        "owner": "YaLTeR",
        "repo": "niri",
-        "rev": "b94a5db8790339cf9134873d8b490be69e02ac71",
+        "rev": "01be0e65f4eb91a9cd624ac0b76aaeab765c7294",
        "type": "github"
      },
      "original": {
        "owner": "YaLTeR",
-        "ref": "v25.02",
+        "ref": "v25.08",
        "repo": "niri",
        "type": "github"
      }
@@ -431,15 +541,16 @@
    "niri-unstable": {
      "flake": false,
      "locked": {
-        "lastModified": 1743017820,
+        "lastModified": 1757671534,
-        "narHash": "sha256-EYq2NfWSSO87O7hLrJLPPt0VbgvSjgPzru+58LQ29WI=",
+        "narHash": "sha256-7tfypHWNtR+wZS9K9XrvcUwyvZ3h8CxInQ2mVsjUU9A=",
-        "owner": "YaLTeR",
+        "owner": "gkleen",
        "repo": "niri",
-        "rev": "7cfecf4b1b9b8c11c80061fb31926f888228499d",
+        "rev": "5e3611a3c5f8c819e5517d0b3f795f161579a0db",
        "type": "github"
      },
      "original": {
-        "owner": "YaLTeR",
+        "owner": "gkleen",
+        "ref": "fix/locked-monitor-control",
        "repo": "niri",
        "type": "github"
      }
@@ -472,11 +583,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1743306489,
+        "lastModified": 1755404379,
-        "narHash": "sha256-LROaIjSLo347cwcHRfSpqzEOa2FoLSeJwU4dOrGm55E=",
+        "narHash": "sha256-Q6ZxZDBmD/B988Jjbx7/NchxOKIpOKBBrx9Yb0zMzpQ=",
        "owner": "Mic92",
        "repo": "nix-index-database",
-        "rev": "b3696bfb6c24aa61428839a99e8b40c53ac3a82d",
+        "rev": "ebbc1c05f786ae39bb5e04e57bf2c10c44a649e3",
        "type": "github"
      },
      "original": {
@@ -486,6 +597,27 @@
        "type": "github"
      }
    },
+    "nix-monitored": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745680380,
+        "narHash": "sha256-Z8PknjkmIr/8ZCH+dmc2Pc+UltiOr7/oKg37PXuVvuU=",
+        "owner": "ners",
+        "repo": "nix-monitored",
+        "rev": "60f3baa4701d58eab86c2d1d9c3d7e820074d461",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ners",
+        "ref": "master",
+        "repo": "nix-monitored",
+        "type": "github"
+      }
+    },
    "nixVirt": {
      "inputs": {
        "nixpkgs": [
@@ -493,11 +625,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1741549407,
+        "lastModified": 1748140003,
-        "narHash": "sha256-f9SXK+/rvlryDNlc++Eva/hYjbkf7OCalWwmwifRhtI=",
+        "narHash": "sha256-DNBZmuk1YRM2PmwbHzVdXumRjCUzQkMarg4iI/37rOQ=",
        "owner": "AshleyYakeley",
        "repo": "NixVirt",
-        "rev": "9950b932dce4ae6b9bda7c83d41705c1a14e10f0",
+        "rev": "5dfe108fd859b122f9a96981cb6bc12297653d6c",
        "type": "github"
      },
      "original": {
@@ -508,11 +640,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1743167577,
+        "lastModified": 1755330281,
-        "narHash": "sha256-I09SrXIO0UdyBFfh0fxDq5WnCDg8XKmZ1HQbaXzMA1k=",
+        "narHash": "sha256-aJHFJWP9AuI8jUGzI77LYcSlkA9wJnOIg4ZqftwNGXA=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "0ed819e708af17bfc4bbc63ee080ef308a24aa42",
+        "rev": "3dac8a872557e0ca8c083cdcfc2f218d18e113b0",
        "type": "github"
      },
      "original": {
@@ -540,16 +672,16 @@
    },
    "nixpkgs-eostre": {
      "locked": {
-        "lastModified": 1701282334,
+        "lastModified": 1748026580,
-        "narHash": "sha256-MxCVrXY6v4QmfTwIysjjaX0XUhqBbxTWWB4HXtDYsdk=",
+        "narHash": "sha256-rWtXrcIzU5wm/C8F9LWvUfBGu5U5E7cFzPYT1pHIJaQ=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "057f9aecfb71c4437d2b27d3323df7f93c010b7e",
+        "rev": "11cb3517b3af6af300dd6c055aeda73c9bf52c48",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "23.11",
+        "ref": "25.05",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -568,14 +700,17 @@
    },
    "nixpkgs-lib_2": {
      "locked": {
-        "lastModified": 1733096140,
+        "lastModified": 1748740939,
-        "narHash": "sha256-1qRH7uAUsyQI7R1Uwl4T+XvdNv778H0Nb5njNrqvylY=",
+        "narHash": "sha256-rQaysilft1aVMwF14xIdGS3sj1yHlI6oKQNBRTF40cc=",
-        "type": "tarball",
+        "owner": "nix-community",
-        "url": "https://github.com/NixOS/nixpkgs/archive/5487e69da40cbd611ab2cadee0b4637225f7cfae.tar.gz"
+        "repo": "nixpkgs.lib",
+        "rev": "656a64127e9d791a334452c6b6606d17539476e2",
+        "type": "github"
      },
      "original": {
-        "type": "tarball",
+        "owner": "nix-community",
-        "url": "https://github.com/NixOS/nixpkgs/archive/5487e69da40cbd611ab2cadee0b4637225f7cfae.tar.gz"
+        "repo": "nixpkgs.lib",
+        "type": "github"
      }
    },
    "nixpkgs-lib_3": {
@@ -630,38 +765,54 @@
    },
    "nixpkgs-stable_2": {
      "locked": {
-        "lastModified": 1742937945,
+        "lastModified": 1730741070,
-        "narHash": "sha256-lWc+79eZRyvHp/SqMhHTMzZVhpxkRvthsP1Qx6UCq0E=",
+        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "d02d88f8de5b882ccdde0465d8fa2db3aa1169f7",
+        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-24.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-stable_3": {
      "locked": {
-        "lastModified": 1717179513,
+        "lastModified": 1757408970,
-        "narHash": "sha256-vboIEwIQojofItm2xGCdZCzW96U85l9nDW3ifMuAIdM=",
+        "narHash": "sha256-aSgK4BLNFFGvDTNKPeB28lVXYqVn8RdyXDNAvgGq+k0=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "63dacb46bf939521bdc93981b4cbb7ecb58427a0",
+        "rev": "d179d77c139e0a3f5c416477f7747e9d6b7ec315",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "24.05",
+        "ref": "nixos-25.05",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-stable_4": {
      "locked": {
+        "lastModified": 1748026580,
+        "narHash": "sha256-rWtXrcIzU5wm/C8F9LWvUfBGu5U5E7cFzPYT1pHIJaQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "11cb3517b3af6af300dd6c055aeda73c9bf52c48",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable_5": {
+      "locked": {
        "lastModified": 1678872516,
        "narHash": "sha256-/E1YwtMtFAu2KUQKV/1+KFuReYPANM2Rzehk84VxVoc=",
        "owner": "NixOS",
@@ -678,11 +829,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1743095683,
+        "lastModified": 1755615617,
-        "narHash": "sha256-gWd4urRoLRe8GLVC/3rYRae1h+xfQzt09xOfb0PaHSk=",
+        "narHash": "sha256-HMwfAJBdrr8wXAkbGhtcby1zGFvs+StOp19xNsbqdOg=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "5e5402ecbcb27af32284d4a62553c019a3a49ea6",
+        "rev": "20075955deac2583bb12f07151c2df830ef346b4",
        "type": "github"
      },
      "original": {
@@ -748,11 +899,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1742397518,
+        "lastModified": 1743690424,
-        "narHash": "sha256-nzgO/ZCSBzWjbMkYDxG+yl9Z2eGbCgQu06Oku3ir5D4=",
+        "narHash": "sha256-cX98bUuKuihOaRp8dNV1Mq7u6/CQZWTPth2IJPATBXc=",
        "owner": "nix-community",
        "repo": "poetry2nix",
-        "rev": "b9a98080beff0903a5e5fe431f42cde1e3e50d6b",
+        "rev": "ce2369db77f45688172384bbeb962bc6c2ea6f94",
        "type": "github"
      },
      "original": {
@@ -790,18 +941,14 @@
        "nixpkgs": [
          "ca-util",
          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "ca-util",
-          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1734261738,
+        "lastModified": 1749636823,
-        "narHash": "sha256-3Lzk+7QyX8v60+km26D3dln7NMSA13vW+KYTkMkds6Q=",
+        "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=",
        "owner": "cachix",
        "repo": "pre-commit-hooks.nix",
-        "rev": "4c8e75efbbdcc6f9203f64b1f21f8a55d2285264",
+        "rev": "623c56286de5a3193aa38891a6991b28f9bab056",
        "type": "github"
      },
      "original": {
@@ -812,11 +959,38 @@
    },
    "pre-commit-hooks-nix_3": {
      "inputs": {
-        "flake-compat": "flake-compat_4",
+        "flake-compat": [
-        "flake-utils": "flake-utils_2",
+          "lanzaboote",
+          "flake-compat"
+        ],
        "gitignore": "gitignore_3",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable_2"
+      },
+      "locked": {
+        "lastModified": 1731363552,
+        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks-nix_4": {
+      "inputs": {
+        "flake-compat": "flake-compat_5",
+        "flake-utils": "flake-utils_2",
+        "gitignore": "gitignore_4",
        "nixpkgs": "nixpkgs_3",
-        "nixpkgs-stable": "nixpkgs-stable_4"
+        "nixpkgs-stable": "nixpkgs-stable_5"
      },
      "locked": {
        "lastModified": 1685361114,
@@ -834,14 +1008,14 @@
    },
    "prometheus-borg-exporter": {
      "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
        "nixpkgs": [
          "nixpkgs"
        ],
        "poetry2nix": [
          "poetry2nix"
        ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix_3"
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix_4"
      },
      "locked": {
        "lastModified": 1722088088,
@@ -858,6 +1032,81 @@
        "type": "gitlab"
      }
    },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "ca-util",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "ca-util",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "ca-util",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1749519371,
+        "narHash": "sha256-UJONN7mA2stweZCoRcry2aa1XTTBL0AfUOY84Lmqhos=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "7c06967eca687f3482624250428cc12f43c92523",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-build-systems_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755484659,
+        "narHash": "sha256-2FfbqsaHVQd12XFFUAinIMAuGO3853LONmva1gT3vKw=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "9778e87c2361810ff15e287ca5895c9da4a0e900",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1754923840,
+        "narHash": "sha256-QSKpYg+Ts9HYF155ltlj40iBex39c05cpOF8gjoE2EM=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "023cd4be230eacae52635be09eef100c37ef78da",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
        "backup-utils": "backup-utils",
@@ -869,21 +1118,47 @@
        "home-manager": "home-manager",
        "home-manager-eostre": "home-manager-eostre",
        "impermanence": "impermanence",
+        "lanzaboote": "lanzaboote",
        "niri-flake": "niri-flake",
        "nix-index-database": "nix-index-database",
+        "nix-monitored": "nix-monitored",
        "nixVirt": "nixVirt",
        "nixos-hardware": "nixos-hardware",
        "nixpkgs": "nixpkgs_2",
        "nixpkgs-eostre": "nixpkgs-eostre",
        "nixpkgs-pgbackrest": "nixpkgs-pgbackrest",
-        "nixpkgs-stable": "nixpkgs-stable_3",
+        "nixpkgs-stable": "nixpkgs-stable_4",
        "nvfetcher": "nvfetcher",
        "poetry2nix": "poetry2nix",
        "prometheus-borg-exporter": "prometheus-borg-exporter",
+        "pyproject-build-systems": "pyproject-build-systems_2",
+        "pyproject-nix": "pyproject-nix",
        "sops-nix": "sops-nix",
+        "uv2nix": "uv2nix",
        "waybar": "waybar"
      }
    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731897198,
+        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
    "sops-nix": {
      "inputs": {
        "nixpkgs": [
@@ -891,11 +1166,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1743305778,
+        "lastModified": 1754988908,
-        "narHash": "sha256-Ux/UohNtnM5mn9SFjaHp6IZe2aAnUCzklMluNtV6zFo=",
+        "narHash": "sha256-t+voe2961vCgrzPFtZxha0/kmFSHFobzF00sT8p9h0U=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "8e873886bbfc32163fe027b8676c75637b7da114",
+        "rev": "3223c7a92724b5d804e9988c6b447a0d09017d48",
        "type": "github"
      },
      "original": {
@@ -956,6 +1231,29 @@
        "type": "github"
      }
    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755485731,
+        "narHash": "sha256-k8kxwVs8Oze6q/jAaRa3RvZbb50I/K0b5uptlsh0HXI=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "bebbd80bf56110fcd20b425589814af28f1939eb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
    "waybar": {
      "inputs": {
        "flake-compat": [
@@ -966,16 +1264,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1742140394,
+        "lastModified": 1752562190,
-        "narHash": "sha256-U1Lp5HZbpnWQRetOLzQl3dURplY2BRfAZYkjBawYrVM=",
+        "narHash": "sha256-zWOMCNe56H2PHUd3rJZ6tklZUZBLgRo85jd9IlK1g9o=",
        "owner": "gkleen",
        "repo": "Waybar",
-        "rev": "f310667db199c570b599a08152d49b7f80db93f2",
+        "rev": "d008cd998369c40f2344a856caf39cdbbd7bd068",
        "type": "github"
      },
      "original": {
        "owner": "gkleen",
-        "ref": "feat/niri-workspaces-hide",
+        "ref": "feat/niri-urgency",
        "repo": "Waybar",
        "type": "github"
      }
@@ -983,16 +1281,16 @@
    "xwayland-satellite-stable": {
      "flake": false,
      "locked": {
-        "lastModified": 1739246919,
+        "lastModified": 1755491097,
-        "narHash": "sha256-/hBM43/Gd0/tW+egrhlWgOIISeJxEs2uAOIYVpfDKeU=",
+        "narHash": "sha256-m+9tUfsmBeF2Gn4HWa6vSITZ4Gz1eA1F5Kh62B0N4oE=",
        "owner": "Supreeeme",
        "repo": "xwayland-satellite",
-        "rev": "44590a416d4a3e8220e19e29e0b6efe64a80315d",
+        "rev": "388d291e82ffbc73be18169d39470f340707edaa",
        "type": "github"
      },
      "original": {
        "owner": "Supreeeme",
-        "ref": "v0.5.1",
+        "ref": "v0.7",
        "repo": "xwayland-satellite",
        "type": "github"
      }
@@ -1000,11 +1298,11 @@
    "xwayland-satellite-unstable": {
      "flake": false,
      "locked": {
-        "lastModified": 1742773235,
+        "lastModified": 1757179758,
-        "narHash": "sha256-YhJex62HHVF6EfdGLIC01uM6jH8XJu5ryZ+LlhG7wMs=",
+        "narHash": "sha256-TIvyWzRt1miQj6Cf5Wy8Qz43XIZX7c4vTVwRLAT5S4Y=",
        "owner": "Supreeeme",
        "repo": "xwayland-satellite",
-        "rev": "b2613aec05f9e3f8488ef924203d62cafb712642",
+        "rev": "970728d0d9d1eada342bb8860af214b601139e58",
        "type": "github"
      },
      "original": {
diff --git a/flake.nix b/flake.nix
index 1cc9782c..b93a1f2e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -29,13 +29,13 @@
      type = "github";
      owner = "NixOS";
      repo = "nixpkgs";
-      ref = "24.05";
+      ref = "25.05";
    };
    nixpkgs-eostre = {
      type = "github";
      owner = "NixOS";
      repo = "nixpkgs";
-      ref = "23.11";
+      ref = "25.05";
    };
    home-manager = {
      type = "github";
@@ -53,7 +53,7 @@
      type = "github";
      owner = "gkleen";
      repo = "home-manager";
-      ref = "nixos-late-start-23.11";
+      ref = "nixos-late-start-25.05";
      inputs = {
        nixpkgs.follows = "nixpkgs-eostre";
      };
@@ -125,25 +125,43 @@
        nixpkgs.follows = "nixpkgs";
      };
    };
+    pyproject-nix = {
+      url = "github:pyproject-nix/pyproject.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    uv2nix = {
+      url = "github:pyproject-nix/uv2nix";
+      inputs.pyproject-nix.follows = "pyproject-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    pyproject-build-systems = {
+      url = "github:pyproject-nix/build-system-pkgs";
+      inputs.pyproject-nix.follows = "pyproject-nix";
+      inputs.uv2nix.follows = "uv2nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
    ca-util = {
      type = "gitlab";
      owner = "gkleen";
      repo = "ca";
-      ref = "v3.1.3";
+      ref = "v3.1.5";
      inputs = {
+        pyproject-nix.follows = "pyproject-nix";
+        uv2nix.follows = "uv2nix";
        nixpkgs.follows = "nixpkgs";
-        poetry2nix.follows = "poetry2nix";
      };
    };
    backup-utils = {
      type = "gitlab";
      owner = "gkleen";
      repo = "backup-utils";
-      ref = "v0.1.6";
+      ref = "v0.1.7";
      inputs = {
        nixpkgs.follows = "nixpkgs";
-        poetry2nix.follows = "poetry2nix";
+        pyproject-nix.follows = "pyproject-nix";
+        uv2nix.follows = "uv2nix";
+        pyproject-build-systems.follows = "pyproject-build-systems";
      };
    };
    prometheus-borg-exporter = {
@@ -172,7 +190,7 @@
      type = "github";
      owner = "gkleen";
      repo = "Waybar";
-      ref = "feat/niri-workspaces-hide";
+      ref = "feat/niri-urgency";
      inputs = {
        nixpkgs.follows = "nixpkgs";
        flake-compat.follows = "flake-compat";
@@ -191,9 +209,31 @@
      ref = "main";
      inputs = {
        nixpkgs.follows = "nixpkgs";
-        # niri-unstable.url = "github:gkleen/niri";
+        niri-unstable = {
+          type = "github";
+          owner = "gkleen";
+          repo = "niri";
+          ref = "fix/locked-monitor-control";
+        };
      };
    };
+    nix-monitored = {
+      type = "github";
+      owner = "ners";
+      repo = "nix-monitored";
+      ref = "master";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
+    lanzaboote = {
+      type = "github";
+      owner = "nix-community";
+      repo = "lanzaboote";
+      ref = "v0.4.2";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
  };
  outputs = { self, nixpkgs, home-manager, sops-nix, deploy-rs, nvfetcher, niri-flake, ... }@inputs:
@@ -339,7 +379,7 @@
        overlays = mapAttrs (_name: path: mkOverlay path) overlayPaths;
-        packages = forAllSystems (system: systemPkgs: nixImport rec { dir = ./tools; _import = _path: name: import "${toString dir}/${name}" ({ inherit system; } // inputs); });
+        packages = forAllSystems (system: systemPkgs: nixImport rec { dir = ./tools; _import = name: _base: import (dir + "/${name}") ({ inherit system; } // inputs); });
        # packages = mapAttrs (_name: filterAttrs (_name: isDerivation)) packages;
        # packages' = mapAttrs (_name: filterAttrs (_name: value: !(isDerivation value))) packages;
@@ -351,6 +391,8 @@
          activateNixosConfigurations activateHomeManagerConfigurations
        ];
+        lib = nixImport rec { dir = ./lib; _import = name: _base: import (dir + "/${name}") inputs; };
        devShells = forAllSystems (system: systemPkgs: { default = import ./shell.nix ({ inherit system; } // inputs); } // installerShells system systemPkgs);
        templates.default = {
@@ -374,10 +416,10 @@
            #   path = activateHomeManager (self.nixosConfigurations.${hostname}.config.nixpkgs.system) usercfg.home;
            # }) self.nixosConfigurations.${hostname}.config.home-manager.users);
          }) (nixImport { dir = ./hosts; _import = (_path: name: name); });
-          overrides = if pathExists ./deploy then nixImport { dir = ./deploy; _import = path: _name: import (./deploy + "/${path}") inputs; } else {};
+          overrides = if pathExists ./deploy then nixImport rec { dir = ./deploy; _import = path: _name: import (dir + "/${path}") inputs; } else {};
          filterEnabled = attrs: mapAttrs (_n: v: filterAttrs (n: _v: n != "enabled") v) (filterAttrs (_n: v: v.enabled or true) attrs);
        in mapAttrs (_n: v: if v ? "profiles" then v // { profiles = filterEnabled v.profiles; } else v) (filterEnabled (recursiveUpdate defaults overrides));
-        checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+        # checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
      };
 }
diff --git a/home-modules/nixpkgs-release-check.nix b/home-modules/nixpkgs-release-check.nix
new file mode 100644
index 00000000..baf2713a
--- /dev/null
+++ b/home-modules/nixpkgs-release-check.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  config.home.enableNixpkgsReleaseCheck = false;
+}
diff --git a/home-modules/quickshell.nix b/home-modules/quickshell.nix
new file mode 100644
index 00000000..dac7089f
--- /dev/null
+++ b/home-modules/quickshell.nix
@@ -0,0 +1,68 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.programs.quickshell;
+in {
+  disabledModules = ["programs/quickshell.nix"];
+  options = {
+    programs.quickshell = {
+      enable = lib.mkEnableOption "quickshell";
+      package = lib.mkPackageOption pkgs "quickshell" { nullable = true; };
+      config.src = lib.mkOption {
+        type = lib.types.path;
+      };
+      config.replacements = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = {};
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    home.packages = [ cfg.package ];
+    xdg.configFile."quickshell".source = pkgs.stdenvNoCC.mkDerivation {
+      name = "quickshell";
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+      dontUnpack = true;
+      inherit (cfg.config) src;
+      buildPhase = ''
+        runHook preBuild
+        while IFS= read -r -d $'\0' file <&3; do
+          [[ -z $file ]] && continue
+          mkdir -p "$out"/"$(dirname "$file")"
+          substitute "$src"/"$file" "$out"/"$file" \
+            ${lib.concatStringsSep " " (
+              lib.concatLists (lib.mapAttrsToList (name: value: [
+                "--replace-quiet" (lib.escapeShellArg "@${name}@") (lib.escapeShellArg value)
+              ]) cfg.config.replacements)
+            )}
+        done 3< <(find "$src" -type f -printf '%P\0')
+        runHook postBuild
+      '';
+    };
+    systemd.user.services.quickshell = {
+      Unit = {
+        Description = "quickshell";
+        Documentation = "https://quickshell.org/docs/v${cfg.package.version}";
+        PartOf = [ "graphical-session.target" ];
+        After = [ "graphical-session-pre.target" ];
+      };
+      Service = {
+        ExecStart = lib.getExe cfg.package;
+        Restart = "always";
+      };
+      Install = {
+        WantedBy = [ "graphical-session.target" ];
+      };
+    };
+  };
+}
diff --git a/hosts/eostre/default.nix b/hosts/eostre/default.nix
index fd4b15f2..d4113024 100644
--- a/hosts/eostre/default.nix
+++ b/hosts/eostre/default.nix
@@ -37,14 +37,10 @@ with lib;
        powerManagement.enable = true;
      };
-      opengl.enable = true;
+      graphics.enable = true;
    };
-    environment.etc."machine-id".text = "f457b21333f1491e916521151ff5d468";
    networking = {
-      hostId = "f457b213";
      domain = "lan.yggdrasil";
      search = [ "lan.yggdrasil" "yggdrasil" ];
@@ -83,19 +79,14 @@ with lib;
      ];
    };
+    services.displayManager.sddm = {
-    services.xserver = {
      enable = true;
-      displayManager.sddm = {
+      wayland.enable = true;
-        enable = true;
+      settings = {
-        settings = {
+        Users.HideUsers = "gkleen";
-          Users.HideUsers = "gkleen";
-        };
      };
-      desktopManager.plasma5.enable = true;
-      videoDrivers = [ "nvidia" ];
    };
+    services.desktopManager.plasma6.enable = true;
    services.openssh = {
diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix
index 9208e391..fb2dddc6 100644
--- a/hosts/sif/default.nix
+++ b/hosts/sif/default.nix
@@ -12,10 +12,9 @@ let
 in {
  imports = with flake.nixosModules.systemProfiles; [
    ./hw.nix
-    ./mail ./libvirt ./greetd
+    ./email ./libvirt ./greetd
-    tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines niri-unstable networkmanager
+    tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines niri-unstable networkmanager lanzaboote
    flakeInputs.nixos-hardware.nixosModules.lenovo-thinkpad-p1
-    flakeInputs.impermanence.nixosModules.impermanence
    flakeInputs.nixVirt.nixosModules.default
  ];
@@ -34,6 +33,10 @@ in {
      initrd = {
        systemd = {
          emergencyAccess = config.users.users.root.hashedPassword;
+          extraBin = {
+            "vim" = lib.getExe pkgs.vim;
+            "grep" = lib.getExe pkgs.gnugrep;
+          };
        };
        luks.devices = {
          nvm0 = { device = "/dev/disk/by-uuid/bef17e86-d929-4a60-97cb-6bfa133face7"; bypassWorkqueues = true; };
@@ -47,12 +50,8 @@ in {
      blacklistedKernelModules = [ "nouveau" ];
-      # Use the systemd-boot EFI boot loader.
+      lanzaboote.configurationLimit = 15;
      loader = {
-        systemd-boot = {
-          enable = true;
-          configurationLimit = 15;
-        };
        efi.canTouchEfiVariables = true;
        timeout = null;
      };
@@ -63,19 +62,27 @@ in {
      kernelPatches = [
        { name = "edac-config";
          patch = null;
-          extraStructuredConfig = with lib.kernel; {
+          structuredExtraConfig = with lib.kernel; {
            EDAC = yes;
            EDAC_IE31200 = yes;
          };
        }
        { name = "zswap-default";
          patch = null;
-          extraStructuredConfig = with lib.kernel; {
+          structuredExtraConfig = with lib.kernel; {
            ZSWAP_DEFAULT_ON = yes;
            ZSWAP_SHRINKER_DEFAULT_ON = yes;
          };
        }
      ];
+      consoleLogLevel = 3;
+      kernelParams = [
+        "quiet"
+        "boot.shell_on_fail"
+        "udev.log_priority=3"
+        "rd.systemd.show_status=auto"
+        "plymouth.use-simpledrm"
+      ];
      tmp.useTmpfs = true;
@@ -97,6 +104,8 @@ in {
        server ptbtime2.ptb.de prefer iburst nts
        server ptbtime3.ptb.de prefer iburst nts
        server ptbtime4.ptb.de prefer iburst nts
+        pool ntppool1.time.nl prefer iburst nts
+        pool ntppool2.time.nl prefer iburst nts
        authselectmode require
        minsources 3
@@ -125,40 +134,16 @@ in {
        rulesetFile = ./ruleset.nft;
      };
-      # firewall = {
-      #   enable = true;
-      #   allowedTCPPorts = [ 22 # ssh
-      #                       8000 # quickserve
-      #                     ];
-      # };
-      # wlanInterfaces = {
-      #   wlan0 = {
-      #     device = "wlp82s0";
-      #   };
-      # };
-      # bonds = {
-      #   "lan" = {
-      #     interfaces = [ "wlan0" "enp0s31f6" "dock0" ];
-      #     driverOptions = {
-      #       miimon = "1000";
-      #       mode = "active-backup";
-      #       primary_reselect = "always";
-      #     };
-      #   };
-      # };
      useDHCP = false;
      useNetworkd = true;
-      # interfaces."tinc.yggdrasil" = {
-      #   virtual = true;
-      #   virtualType = config.services.tinc.networks.yggdrasil.interfaceType;
-      #   macAddress = "5c:93:21:c3:61:39";
-      # };
    };
+    environment.etc."NetworkManager/dnsmasq.d/dnssec.conf" = {
+      text = ''
+        conf-file=${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf
+        dnssec
+      '';
+    };
    environment.etc."NetworkManager/dnsmasq.d/libvirt_dnsmasq.conf" = {
      text = ''
        except-interface=virbr0
@@ -401,19 +386,6 @@ in {
    ];
    services = {
-      uucp = {
-        enable = true;
-        nodeName = "sif";
-        remoteNodes = {
-          "ymir" = {
-            publicKeys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6KNtsCOl5fsZ4rV7udTulGMphJweLBoKapzerWNoLY root@ymir"];
-            hostnames = ["ymir.yggdrasil.li" "ymir.niflheim.yggdrasil"];
-          };
-        };
-        defaultCommands = lib.mkForce [];
-      };
      avahi.enable = true;
      fwupd.enable = true;
@@ -432,8 +404,8 @@ in {
      logind = {
        lidSwitch = "suspend";
-        lidSwitchDocked = "lock";
+        lidSwitchDocked = "ignore";
-        lidSwitchExternalPower = "lock";
+        lidSwitchExternalPower = "ignore";
      };
      atd = {
@@ -475,11 +447,6 @@ in {
    systemd.tmpfiles.settings = {
      "10-localtime"."/etc/localtime".L.argument = "/.bcachefs/etc/localtime";
-      # "10-regreet"."/var/cache/regreet/cache.toml".C.argument = toString ((pkgs.formats.toml {}).generate "cache.toml" {
-      #   last_user = "gkleen";
-      #   user_to_last_sess.gkleen = "Niri";
-      # });
    };
    users = {
@@ -639,25 +606,6 @@ in {
    environment.etc."X11/xorg.conf.d/50-wacom.conf".source = lib.mkForce ./wacom.conf;
-    systemd.services."ac-plugged" = {
-      description = "Inhibit handling of lid-switch and sleep";
-      path = with pkgs; [ systemd coreutils ];
-      script = ''
-        exec systemd-inhibit --what=handle-lid-switch --why="AC is connected" --mode=block sleep infinity
-      '';
-      serviceConfig = {
-        Type = "simple";
-      };
-    };
-    services.udev.extraRules = with pkgs; lib.mkAfter ''
-      SUBSYSTEM=="power_supply", ENV{POWER_SUPPLY_ONLINE}=="0", RUN+="${systemd}/bin/systemctl --no-block stop ac-plugged.service"
-      SUBSYSTEM=="power_supply", ENV{POWER_SUPPLY_ONLINE}=="1", RUN+="${systemd}/bin/systemctl --no-block start ac-plugged.service"
-    '';
    systemd.services."nix-daemon".serviceConfig = {
      MemoryAccounting = true;
      MemoryHigh = "50%";
@@ -681,6 +629,10 @@ in {
      dconf.enable = true;
      niri.enable = true;
      fuse.userAllowOther = true;
+      captive-browser = {
+        enable = true;
+        interface = "wlp82s0";
+      };
    };
    services.pcscd.enable = true;
@@ -707,7 +659,7 @@ in {
        "org.freedesktop.impl.portal.OpenFile" = ["gtk"];
        "org.freedesktop.impl.portal.Access" = ["gtk"];
        "org.freedesktop.impl.portal.Notification" = ["gtk"];
-        "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
+        "org.freedesktop.impl.portal.Secret" = ["none"];
        "org.freedesktop.impl.portal.Inhibit" = ["none"];
      };
    };
@@ -717,7 +669,7 @@ in {
      directories = [
        "/nix"
        "/root"
-        "/home"
+        "/home"
        "/var/log"
        "/var/lib/sops-nix"
        "/var/lib/nixos"
@@ -727,33 +679,19 @@ in {
        "/var/lib/bluetooth"
        "/var/lib/upower"
        "/var/lib/postfix"
+        "/var/lib/regreet"
        "/etc/NetworkManager/system-connections"
-        { directory = "/var/uucp"; user = "uucp"; group = "uucp"; mode = "0700"; }
+        config.boot.lanzaboote.pkiBundle
-        { directory = "/var/spool/uucp"; user = "uucp"; group = "uucp"; mode = "0750"; }
      ];
      files = [
      ];
+      timezone = true;
    };
-    systemd.services.timezone = {
+    security.pam.services.quickshell = {};
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = "${pkgs.coreutils}/bin/cp -vP /.bcachefs/etc/localtime /etc/localtime";
-        ExecStop = "${pkgs.coreutils}/bin/cp -vP /etc/localtime /.bcachefs/etc/localtime";
-      };
-    };
-    services.tzupdate.enable = true;
-    security.pam.services.gtklock = {};
    home-manager.sharedModules = [ flakeInputs.nixVirt.homeModules.default ];
-    environment.pathsToLink = [
-      "share/zsh"
-    ];
    system.stateVersion = "24.11";
  };
 }
diff --git a/hosts/sif/email/default.nix b/hosts/sif/email/default.nix
new file mode 100644
index 00000000..bebf7980
--- /dev/null
+++ b/hosts/sif/email/default.nix
@@ -0,0 +1,111 @@
+{ config, lib, pkgs, ... }:
+{
+  services.postfix = {
+    enable = true;
+    enableSmtp = false;
+    enableSubmission = false;
+    setSendmail = true;
+    # networksStyle = "host";
+    settings.main = {
+      recpipient_delimiter = "+";
+      mydestination = [];
+      myhostname = "sif.midgard.yggdrasil";
+      mydomain = "yggdrasil.li";
+      local_transport = "error:5.1.1 No local delivery";
+      alias_database = [];
+      alias_maps = [];
+      local_recipient_maps = [];
+      inet_interfaces = "loopback-only";
+      message_size_limit = 0;
+      authorized_submit_users = "inline:{ gkleen= }";
+      authorized_flush_users = "inline:{ gkleen= }";
+      authorized_mailq_users = "inline:{ gkleen= }";
+      smtp_generic_maps = "inline:{ root=root+sif }";
+      mynetworks = ["127.0.0.0/8" "[::1]/128"];
+      smtpd_client_restrictions = ["permit_mynetworks" "reject"];
+      smtpd_relay_restrictions = ["permit_mynetworks" "reject"];
+      sender_dependent_default_transport_maps = ''regexp:${pkgs.writeText "sender_relay" ''
+        /@(cip|stud)\.ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtp.ifi.lmu.de
+        /@ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtpin1.ifi.lmu.de:587
+        /@math(ematik)?\.(lmu|uni-muenchen)\.de$/ smtps:smtp.math.lmu.de:465
+        /@(campus\.)?lmu\.de$/ smtp:postout.lrz.de
+      ''}'';
+      sender_bcc_maps = ''regexp:${pkgs.writeText "sender_bcc" ''
+        /^uni2work(-[^@]*)?@ifi\.lmu\.de$/ uni2work@ifi.lmu.de
+        /@ifi\.lmu\.de$/ gregor.kleen@ifi.lmu.de
+      ''}'';
+      relayhost = ["[surtr.yggdrasil.li]:465"];
+      default_transport = "relay";
+      smtp_sasl_auth_enable = true;
+      smtp_sender_dependent_authentication = true;
+      smtp_sasl_tls_security_options = "noanonymous";
+      smtp_sasl_mechanism_filter = ["plain"];
+      smtp_sasl_password_maps = "regexp:/run/credentials/postfix.service/sasl_passwd";
+      smtp_cname_overrides_servername = false;
+      smtp_always_send_ehlo = true;
+      smtp_tls_security_level = "dane";
+      smtp_tls_loglevel = "1";
+      smtp_dns_support_level = "dnssec";
+    };
+    settings.master = {
+      submission = {
+        type = "inet";
+        private = false;
+        command = "smtpd";
+        args = [
+          "-o" "syslog_name=postfix/$service_name"
+        ];
+      };
+      smtp = { };
+      smtps = {
+        type = "unix";
+        private = true;
+        privileged = true;
+        chroot = false;
+        command = "smtp";
+        args = [
+          "-o" "smtp_tls_wrappermode=yes"
+          "-o" "smtp_tls_security_level=encrypt"
+        ];
+      };
+      relay = {
+        command = "smtp";
+        args = [
+          "-o" "smtp_fallback_relay="
+          "-o" "smtp_tls_security_level=verify"
+          "-o" "smtp_tls_wrappermode=yes"
+          "-o" "smtp_tls_cert_file=${./relay.crt}"
+          "-o" "smtp_tls_key_file=/run/credentials/postfix.service/relay.key"
+        ];
+      };
+    };
+  };
+  systemd.services.postfix = {
+    serviceConfig.LoadCredential = [
+      "sasl_passwd:${config.sops.secrets."postfix-sasl-passwd".path}"
+      "relay.key:${config.sops.secrets."relay-key".path}"
+    ];
+  };
+  sops.secrets = {
+    postfix-sasl-passwd = {
+      key = "sasl-passwd";
+      sopsFile = ./secrets.yaml;
+    };
+    relay-key = {
+      format = "binary";
+      sopsFile = ./relay.key;
+    };
+  };
+}
diff --git a/hosts/sif/email/relay.crt b/hosts/sif/email/relay.crt
new file mode 100644
index 00000000..ac13e7cb
--- /dev/null
+++ b/hosts/sif/email/relay.crt
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBjDCCAQygAwIBAgIPQAAAAGgLfNoL/PSMAsutMAUGAytlcTAXMRUwEwYDVQQD
+DAx5Z2dkcmFzaWwubGkwHhcNMjUwNDI1MTIwOTQ1WhcNMzUwNDI2MTIxNDQ1WjAR
+MQ8wDQYDVQQDDAZna2xlZW4wKjAFBgMrZXADIQB3outi3/3F4YO7Q97WAAaMHW0a
+m+Blldrgee+EZnWnD6N1MHMwHwYDVR0jBBgwFoAUTtn+VjMw6Ge1f68KD8dT1CWn
+l3YwHQYDVR0OBBYEFFOa4rYZYMbXUVdKv98NB504GUhjMA4GA1UdDwEB/wQEAwID
+6DAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAUGAytlcQNzABC0
+0UgIt7gLZrU1TmzGoqPBris8R1DbKOJacicF5CU0MIIjHcX7mPFW8KtB4qm6KcPq
+kF6IaEPmgKpX3Nubk8HJik9vhIy9ysfINcVTvzXx8pO1bxbvREJRyA/apj10nzav
+yauId0cXHvN6g5RLAMsMAA==
+-----END CERTIFICATE-----
diff --git a/hosts/sif/email/relay.key b/hosts/sif/email/relay.key
new file mode 100644
index 00000000..412a44e0
--- /dev/null
+++ b/hosts/sif/email/relay.key
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:lBlTuzOS75pvRmcTKT4KhHMH44RlE2SvCFAUP+GfsXws1Uai7DZ1MmbhvxxCa+pcLW19+sQYxrXLRNZWby1yOeKBJ2UQeYV5LOk9LSL/WIE3FZkCo5Dv0O0gSFKjjb61WN22a4JnHbLWADf/mLT3GZv91XfvFDo=,iv:ho8wQH3UNzX9JPW5gVcUGtxZzdVwsMFus0Z4KYe5t48=,tag:dAgZyHOva2xVVhE1nTl+lg==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eTVRSUdFNUZGZmcxSUlT\nWmlsOGNyWXIzMGNTZjlKbXlhcEdZUXFRVkR3Cll0T0RMd0h2UW16QkR3SHlhYmNZ\nNDFrYXh3Rkp5NWsvcWc3UFJJaHVwT1UKLS0tIHhXVEI0VHBZVkpDQ1FzWENjMmJH\nb1FQWXVUUTBiZ1pKWG00MTNqVEo2SjAKK3VOU+QgRuxWYWEcrJiVMRFCprBICz4F\ngD+9zuPUzPezyJkYwTs+M+wX5GYkXppqm5W58yQLS2UDD38sr+SRjg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1fj65apkhfkrwyv5tx6zcs9nkjg8267fy733qph30sc7zfn7vapjqkd5kne",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWmJmZDVFazN2bDY1TkNG\nNXpJN2twMFFjZUxMTVdSNzJwQTFiYktrcGdrCjk4eFVHTko0bFVMSlFFWm9tbjMr\nbWNHMEQ1Rm1qUVhodlB1RGw2aDc4TUEKLS0tIERBK0J5NkN4OXJEZ1ZOZXhNc1Jm\naWNnUmZGbTIxdmNkYi9TZ2h2bGs3MVEKPQGaEf7M/5/xvSOfawpIp50fB3QfFSuz\nPgkrPMneaBeUx+uBYMyEFX4rpzLIBR3pnYMjAfoc+bjWaOtGQuEqyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-04-25T12:14:44Z",
+                "mac": "ENC[AES256_GCM,data:pObl2bJA93az9E3Ya+hA3ekI8TKKZ9NNTi0KzmWZBOiQwi9FuQYtpnmmT80L1KXWyOKJV6wGdAri3mNe/ue2S0TziSbQ/4+Dj4ubFKgkH7thb5q2dFyxw5FzhYzRQiXFqD/pxcNN9uL0lQI2Al0Eci0zX8Kcd1rAQ6RzLEoSmco=,iv:zo/3QFKTUEDxLy1k5yyU7Z1JMZ7cKdYUc6GHjaTTZKQ=,tag:f63Eja3lBfwJCYAOyEt56g==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/sif/mail/secrets.yaml b/hosts/sif/email/secrets.yaml
index 3c74b710..3c74b710 100644
--- a/hosts/sif/mail/secrets.yaml
+++ b/hosts/sif/email/secrets.yaml
diff --git a/hosts/sif/greetd/default.nix b/hosts/sif/greetd/default.nix
index 37ca13c5..081b6346 100644
--- a/hosts/sif/greetd/default.nix
+++ b/hosts/sif/greetd/default.nix
@@ -1,49 +1,92 @@
-{ pkgs, ... }:
+{ config, pkgs, lib, flakeInputs, ... }:
-{
+let
+  gkleenConfig = config.home-manager.users."gkleen";
+  toIni = lib.generators.toINI {
+    mkKeyValue =
+      key: value:
+      let
+        value' = if lib.isBool value then lib.boolToString value else toString value;
+      in
+      "${lib.escape [ "=" ] key}=${value'}";
+  };
+  toDconfIni = let
+    gvariant = import (flakeInputs.home-manager + "/modules/lib/gvariant.nix") { inherit lib; };
+    mkIniKeyValue = key: value: "${key}=${toString (gvariant.mkValue value)}";
+  in lib.generators.toINI { mkKeyValue = mkIniKeyValue; };
+in {
  config = {
    services.greetd = {
      enable = true;
-    #   settings.default_session.command = let
+      settings.default_session.command = lib.getExe (pkgs.writeShellApplication {
-    #     cfg = config.programs.regreet;
+        name = "sway";
-    #   in pkgs.writeShellScript "greeter" ''
+        runtimeInputs = [ pkgs.sway pkgs.fontconfig ];
-    #       modprobe -r nvidia_drm
+        runtimeEnv = {
+          XDG_DATA_DIRS = lib.makeSearchPath "share" [
+            pkgs.equilux-theme pkgs.paper-icon-theme pkgs.fira
+          ];
+          QT_PLUGIN_PATH = lib.makeSearchPath (pkgs.qt6.qtbase.qtPluginPrefix) [
+            pkgs.qt6Packages.qtbase
+          ];
+          QML2_IMPORT_PATH = lib.makeSearchPath (pkgs.qt6.qtbase.qtQmlPrefix) [
+            pkgs.qt6Packages.qtbase
+          ];
+          QT_QPA_PLATFORMTHEME = "gtk3";
+          XDG_CONFIG_DIR = pkgs.symlinkJoin {
+            name = "config";
+            paths = [
+              (pkgs.writeTextDir "gtk-3.0/settings.ini" (toIni {
+                Settings = {
+                  gtk-font-name = "Fira Sans 10";
+                  gtk-theme-name = "Equilux-compact";
+                  gtk-icon-theme-name = "Paper-Mono-Dark";
+                };
+              }))
+            ];
+          };
+          # XDG_CACHE_HOME = "/var/cache/greetd/greeter";
+          # XDG_CONFIG_HOME = "/var/cache/greetd/greeter/config";
+        };
+        text = ''
+          exec &>/tmp/sway-$$.log
+          unset MANAGERPID SYSTEMD_EXEC_PID
+          # ${lib.getExe' pkgs.coreutils "mkdir"} -p ''${XDG_CONFIG_HOME}/dconf
+          ${lib.getExe pkgs.dconf} load / < ${pkgs.writeText "dconf.ini" (toDconfIni {
+            "org/gnome/desktop/interface" = {
+              "color-scheme" = "prefer-dark";
+              "font-name" = "Fira Sans 10";
+              "gtk-theme" = "Equilux-compact";
+              "icon-theme" = "Paper-Mono-Dark";
+            };
+          })}
+          exec sway --unsupported-gpu --config ${pkgs.writeText "sway-config" ''
+            exec "${lib.getExe' config.systemd.package "systemctl"} --user import-environment {,WAYLAND_}DISPLAY SWAYSOCK; ${lib.getExe gkleenConfig.programs.quickshell.package} --path ${gkleenConfig.xdg.configFile."quickshell".source}/displaymanager.qml; swaymsg exit"
-    #       exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}
+            input type:keyboard {
-    #     '';
+              xkb_layout "us,us"
+              xkb_variant "dvp,"
+              xkb_options "compose:caps,grp:win_space_toggle"
+            }
+            output eDP-1 scale 1.5
+          ''}
+        '';
+      });
    };
-    systemd.services.greetd.environment = {
-      XKB_DEFAULT_LAYOUT = "us,us";
+    # security.pam.services.greetd.fprintAuth = false;
-      XKB_DEFAULT_VARIANT = "dvp,";
-      XKB_DEFAULT_OPTIONS = "compose:caps,grp:win_space_toggle";
+    systemd.services.greetd.serviceConfig = {
+      ExecStartPre = ''${lib.getExe' pkgs.coreutils "install"} -d -o greeter -g greeter -m 0700 ''${CACHE_DIRECTORY}/greeter'';
+      # CacheDirectory = "greetd";
    };
-    programs.regreet = {
-      enable = true;
+    users.users.greeter = {
-      theme = {
+      home = "/var/lib/greeter";
-        package = pkgs.equilux-theme;
+      createHome = true;
-        name = "Equilux-compact";
-      };
-      iconTheme = {
-        package = pkgs.paper-icon-theme;
-        name = "Paper-Mono-Dark";
-      };
-      font = {
-        package = pkgs.fira;
-        name = "Fira Sans";
-        # size = 6;
-      };
-      cageArgs = [ "-s" "-m" "last" ];
-      settings = {
-        GTK.application_prefer_dark_theme = true;
-        widget.clock.format = "%F %H:%M:%S%:z";
-        background = {
-          path = pkgs.runCommand "wallpaper.png" {
-            buildInputs = with pkgs; [ imagemagick ];
-          } ''
-            magick ${./wallpaper.png} -filter Gaussian -resize 6.25% -define filter:sigma=2.5 -resize 1600% "$out"
-          '';
-          fit = "Cover";
-        };
-      };
    };
  };
 }
diff --git a/hosts/sif/greetd/wallpaper.png b/hosts/sif/greetd/wallpaper.png
deleted file mode 100644
index 20fc761a..00000000
--- a/hosts/sif/greetd/wallpaper.png
+++ /dev/null
Binary files differ
diff --git a/hosts/sif/hw.nix b/hosts/sif/hw.nix
index 1bcf0261..e567c37d 100644
--- a/hosts/sif/hw.nix
+++ b/hosts/sif/hw.nix
@@ -25,7 +25,7 @@
  # system.etc.overlay.enable = false;
  boot.initrd.systemd.packages = [
-    (pkgs.writeTextDir "/etc/systemd/system/\\x2ebcachefs.mount.d/block_scan.conf" ''
+    (pkgs.writeTextDir "/etc/systemd/system/sysroot-.bcachefs.mount.d/block_scan.conf" ''
      [Mount]
      Environment=BCACHEFS_BLOCK_SCAN=1
    '')
diff --git a/hosts/sif/mail/default.nix b/hosts/sif/mail/default.nix
deleted file mode 100644
index 8d6cd705..00000000
--- a/hosts/sif/mail/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  services.postfix = {
-    enable = true;
-    enableSmtp = true;
-    enableSubmission = false;
-    setSendmail = true;
-    networksStyle = "host";
-    hostname = "sif.midgard.yggdrasil";
-    destination = [];
-    relayHost = "uucp:ymir";
-    recipientDelimiter = "+";
-    masterConfig = {
-      uucp = {
-        type = "unix";
-        private = true;
-        privileged = true;
-        chroot = false;
-        command = "pipe";
-        args = [ "flags=Fqhu" "user=uucp" ''argv=${config.security.wrapperDir}/uux -z -a $sender - $nexthop!rmail ($recipient)'' ];
-      };
-      smtps = {
-        type = "unix";
-        private = true;
-        privileged = true;
-        chroot = false;
-        command = "smtp";
-        args = [ "-o" "smtp_tls_wrappermode=yes" "-o" "smtp_tls_security_level=encrypt" ];
-      };
-    };
-    config = {
-      default_transport = "uucp:ymir";
-      inet_interfaces = "loopback-only";
-      authorized_submit_users = ["!uucp" "static:anyone"];
-      message_size_limit = "0";
-      sender_dependent_default_transport_maps = ''regexp:${pkgs.writeText "sender_relay" ''
-        /@(cip|stud)\.ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtp.ifi.lmu.de
-        /@ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtpin1.ifi.lmu.de:587
-        /@math(ematik)?\.(lmu|uni-muenchen)\.de$/ smtps:smtp.math.lmu.de:465
-        /@(campus\.)?lmu\.de$/ smtp:postout.lrz.de
-      ''}'';
-      sender_bcc_maps = ''regexp:${pkgs.writeText "sender_bcc" ''
-        /^uni2work(-[^@]*)?@ifi\.lmu\.de$/ uni2work@ifi.lmu.de
-        /@ifi\.lmu\.de$/ gregor.kleen@ifi.lmu.de
-      ''}'';
-      smtp_sasl_auth_enable = true;
-      smtp_sender_dependent_authentication = true;
-      smtp_sasl_tls_security_options = "noanonymous";
-      smtp_sasl_mechanism_filter = ["plain"];
-      smtp_sasl_password_maps = "regexp:/var/db/postfix/sasl_passwd";
-      smtp_cname_overrides_servername = false;
-      smtp_always_send_ehlo = true;
-      smtp_tls_security_level = "dane";
-      smtp_tls_loglevel = "1";
-      smtp_dns_support_level = "dnssec";
-    };
-  };
-  sops.secrets.postfix-sasl-passwd = {
-    key = "sasl-passwd";
-    path = "/var/db/postfix/sasl_passwd";
-    owner = "postfix";
-    sopsFile = ./secrets.yaml;
-  };
-}
diff --git a/hosts/sif/ruleset.nft b/hosts/sif/ruleset.nft
index 2af8b2ee..62339f69 100644
--- a/hosts/sif/ruleset.nft
+++ b/hosts/sif/ruleset.nft
@@ -61,7 +61,7 @@ table inet filter {
  counter mosh-rx {}
  counter wg-rx {}
  counter yggdrasil-gre-rx {}
-  counter quickserve-rx {}
+  counter miniserve-rx {}
  counter ausweisapp2-rx {}
  counter established-rx {}
@@ -81,7 +81,7 @@ table inet filter {
  counter mosh-tx {}
  counter wg-tx {}
  counter yggdrasil-gre-tx {}
-  counter quickserve-tx {}
+  counter miniserve-tx {}
  counter tx {}
@@ -134,7 +134,7 @@ table inet filter {
    tcp dport 22 counter name ssh-rx accept
    udp dport 60000-61000 counter name mosh-rx accept
-    tcp dport 8000 counter name quickserve-rx accept
+    tcp dport 8080 counter name miniserve-rx accept
    udp dport 24727 counter name ausweisapp2-rx accept
    udp dport 51820-51822 counter name wg-rx accept
@@ -173,7 +173,7 @@ table inet filter {
    udp sport 51820-51822 counter name wg-tx
    iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-tx
-    tcp sport 8000 counter name quickserve-tx accept
+    tcp sport 8080 counter name miniserve-tx accept
    oifname virbr0 udp sport 67 counter name libvirt-dhcp accept
    oifname virbr0 udp sport 547 counter name libvirt-dhcp accept
diff --git a/hosts/surtr/audiobookshelf.nix b/hosts/surtr/audiobookshelf.nix
new file mode 100644
index 00000000..728851a4
--- /dev/null
+++ b/hosts/surtr/audiobookshelf.nix
@@ -0,0 +1,66 @@
+{ config, ... }:
+{
+  config = {
+    security.acme.rfc2136Domains = {
+      "audiobookshelf.yggdrasil.li" = {
+        restartUnits = ["nginx.service"];
+      };
+    };
+    services.nginx = {
+      upstreams."audiobookshelf" = {
+        servers = {
+          "[2a03:4000:52:ada:4:1::]:28982" = {};
+        };
+        extraConfig = ''
+          keepalive 8;
+        '';
+      };
+      virtualHosts = {
+        "audiobookshelf.yggdrasil.li" = {
+          kTLS = true;
+          http3 = true;
+          forceSSL = true;
+          sslCertificate = "/run/credentials/nginx.service/audiobookshelf.yggdrasil.li.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/audiobookshelf.yggdrasil.li.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/audiobookshelf.yggdrasil.li.chain.pem";
+          extraConfig = ''
+            charset utf-8;
+          '';
+          locations = {
+            "/".extraConfig = ''
+              proxy_pass http://audiobookshelf;
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+              proxy_redirect off;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Host $server_name;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              client_max_body_size 0;
+              proxy_request_buffering off;
+              proxy_buffering off;
+            '';
+          };
+        };
+      };
+    };
+    systemd.services.nginx = {
+      serviceConfig = {
+        LoadCredential = [
+          "audiobookshelf.yggdrasil.li.key.pem:${config.security.acme.certs."audiobookshelf.yggdrasil.li".directory}/key.pem"
+          "audiobookshelf.yggdrasil.li.pem:${config.security.acme.certs."audiobookshelf.yggdrasil.li".directory}/fullchain.pem"
+          "audiobookshelf.yggdrasil.li.chain.pem:${config.security.acme.certs."audiobookshelf.yggdrasil.li".directory}/chain.pem"
+        ];
+      };
+    };
+  };
+}
diff --git a/hosts/surtr/bifrost/default.nix b/hosts/surtr/bifrost/default.nix
index fbfde757..52ab43f5 100644
--- a/hosts/surtr/bifrost/default.nix
+++ b/hosts/surtr/bifrost/default.nix
@@ -18,7 +18,7 @@ in {
            ListenPort = 51822;
          };
          wireguardPeers = [
-            { AllowedIPs = [ "2a03:4000:52:ada:4:1::/96" ];
+            { AllowedIPs = [ "2a03:4000:52:ada:4:1::/96" "2a03:4000:52:ada:6::/80" ];
              PublicKey = trim (readFile ../../vidhar/network/bifrost/vidhar.pub);
            }
          ];
@@ -34,6 +34,8 @@ in {
          routes = [
            { Destination = "2a03:4000:52:ada:4::/80";
            }
+            { Destination = "2a03:4000:52:ada:6::/80";
+            }
          ];
          linkConfig = {
            RequiredForOnline = false;
diff --git a/hosts/surtr/default.nix b/hosts/surtr/default.nix
index 0a79d047..1c66df2b 100644
--- a/hosts/surtr/default.nix
+++ b/hosts/surtr/default.nix
@@ -7,7 +7,7 @@ with lib;
    tmpfs-root qemu-guest openssh rebuild-machines zfs
    ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql
    ./prometheus ./email ./vpn ./borg.nix ./etebase ./immich.nix
-    ./paperless.nix ./hledger.nix
+    ./paperless.nix ./hledger.nix ./audiobookshelf.nix ./kimai.nix
  ];
  config = {
@@ -22,7 +22,6 @@ with lib;
        device = "/dev/vda";
      };
      tmp.useTmpfs = true;
      zfs.devNodes = "/dev"; # /dev/vda2 does not show up in /dev/disk/by-id
@@ -31,7 +30,7 @@ with lib;
      kernelPatches = [
        { name = "zswap-default";
          patch = null;
-          extraStructuredConfig = with lib.kernel; {
+          structuredExtraConfig = with lib.kernel; {
            ZSWAP_DEFAULT_ON = yes;
            ZSWAP_SHRINKER_DEFAULT_ON = yes;
          };
diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 5dd60190..8aca2b97 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -157,7 +157,7 @@ in {
        ${concatMapStringsSep "\n" mkZone [
          { domain = "yggdrasil.li";
            addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; };
-            acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li" "paperless.yggdrasil.li" "hledger.yggdrasil.li"];
+            acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li" "paperless.yggdrasil.li" "hledger.yggdrasil.li" "audiobookshelf.yggdrasil.li" "kimai.yggdrasil.li"];
          }
          { domain = "nights.email";
            addACLs = { "nights.email" = ["ymir_acme_acl"]; };
@@ -169,15 +169,9 @@ in {
          { domain = "kleen.li";
            addACLs = { "kleen.li" = ["ymir_acme_acl"]; };
          }
-          { domain = "xmpp.li";
-            addACLs = { "xmpp.li" = ["ymir_acme_acl"]; };
-          }
          { domain = "synapse.li";
            acmeDomains = ["element.synapse.li" "turn.synapse.li" "synapse.li"];
          }
-          { domain = "dirty-haskell.org";
-            addACLs = { "dirty-haskell.org" = ["ymir_acme_acl"]; };
-          }
          { domain = "praseodym.org";
            addACLs = { "praseodym.org" = ["ymir_acme_acl"]; };
          }
diff --git a/hosts/surtr/dns/keys/audiobookshelf.yggdrasil.li_acme b/hosts/surtr/dns/keys/audiobookshelf.yggdrasil.li_acme
new file mode 100644
index 00000000..e3af9966
--- /dev/null
+++ b/hosts/surtr/dns/keys/audiobookshelf.yggdrasil.li_acme
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:5BLk/MZtQsLjpdKGiZjtOH1soIXB05MkEoPWyr5m27ho7H5udDjRZE0/OjvSlMzQNjFNJc+OwbeHwaJ8sPLCnXqoFHJXikAmi0gpdFC0uN0JGYCBT1EaK7j6yVHyiqFXo6xwVSCO/zP/fbjItiuqU+B4llGx5N2I4HQqRLFoW/35PZazkR15xI1zo8LeC8T+jm16apFQw2Ih/RqsJK7XlHqnXq9SzeA2qhgkCbJf6aJ6zDS7eQVFt7qHh2mVtV7Al++bZiIkJiNJ5SJO1ck18w2t9HwXBhfMFKXvfFW0I6kKur1qSJk=,iv:rxm5PwOzXDaK+nj2k3bUqlYbIFFA49ispyfamtQqU/A=,tag:7dOua39f+0JsLldLRLr1NQ==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwV1hIcWNNRVJXOG1xYlFK\nb1VxWG03dGVmS3dmQTltUTR0VmEzYjRFanlBCnE1M1BTZjNCQnpsNkU5ZlR5T3BR\nOHliWUV2bXMrK0w1K3JXbUE0dEhKdzgKLS0tIDdkUEZ4QUE0NUN2TXFYcklybjBS\nRVpxV2J6U1BnUng1dytWTGRkd0FrRGcKVaMCzcrX+BQqbmh95JEk3lRdfnv9uO8n\nwotKxp/+xX7GEF42BOzJ/mWcgyVjABlnWeVyaRxfpbCUrmNuFYO6XA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkZmRFR0gwc1pjVVorK0t6\nVHU4U0xob09Dd2J5QUJXbndZdWp3cytpYWhRCnFnMlZ0cjNGdXN1RWEvQlVHSE1M\nMEdzSjlEb2NkaE1zMEJJOTlCMC9FVFEKLS0tIGJiTEJSRVZZbVUzZVFGeXQwYm1w\ndWVYQVdoVlJnRENTYzhnQm1BcWVRdW8K0ECfLVQBQuZWFFFjdHLcJBz+CDzsOOwh\nOA38qxHD4EWfXR1c3G8RDbow7nB2MGc1Zohc7qhtuTj2wL0qhVKWqA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-09T17:07:16Z",
+                "mac": "ENC[AES256_GCM,data:K5I6YXQXCUPHFBNVlXIdLLKqiNPVZh95KoHni2m16SdAvTyBab79SZ5xNvotrtKXp0iISCogEgdMm+OWbxYywEiZ+sUsxgx6RE5nAXruZOiAwzuyUr88qgCHTBZnKzgaDZlbYOgWB+LCzr8s5JbcTD4G6/RaXYyqmx7igygubHA=,iv:Zbij4eoDqoP5XYhAsDGBGqlcP5ACQAY/QngTmrJYRzs=,tag:WYxhUEZwmXkQmnpyOuP2Bg==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/surtr/dns/keys/kimai.yggdrasil.li_acme b/hosts/surtr/dns/keys/kimai.yggdrasil.li_acme
new file mode 100644
index 00000000..bdfb135a
--- /dev/null
+++ b/hosts/surtr/dns/keys/kimai.yggdrasil.li_acme
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:sKFt4pH0Xn7Qm6JFMg/2N7Ht7jtMJukfN+U3dQaoYXPbhRJ+heEtDpXV/WP4AlfbfpIOgTPW3mcmQCwKFNhS00vEsQA4728FfXZzDDmZCa3hwg51wDbL7XUOr0OePgzi86lt0Q193K6CkGqEAa1vFIb//ElEfBYIwdATbmcoAsM3mHhz58X7c1qf8LNuB93o/1N2xXXZI3NWOhOjlviTc2DAhffXDwlMJSYUhldnwtDKmLM1mooJzLgm2p9w7gRD7WPqEqZFq9uFDK69P9uX5T9hFHg=,iv:rAE4sYxxLou4tyD4RWTp3LjQP0cya95coy1MvwfEK/U=,tag:u4SSk8SZFlj0ks7d6tDocw==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2KzdNUWhEcDB6QmtUTnVh\nNS9Nc2I4UjAzekxhRXo1UmY3SklPejV1TURJCm9NY2lVOERoMDFKTU56Mmh1NHEr\naGV4M1RoVldHV0xyc3Z0MnVqakpjMFUKLS0tIEYxSk9OUm9kMkdtcG5POWRGQVkx\nY1FEaXYwMGo0L0Z0aTVTZDA5aUFDWEUKJ+e/7lR/rNPNVnIy+wkiKiAYMxWp4L7q\nwnSTx451vSnxv9j3JWB43Y7XQC08cisWDj06ULw8FnEbKYOvTYj9mQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwOTU3dUEzaXM5T1VkbDRO\nMm14OG1mUkk2bDRhdnBsMHBkc3kvUzlyNlQwCktFSHJhMnhoQ2J6bC9vUHNLWTRC\nRFpYeHo3N2xjWUhjQnRwQ2Nrc1pRUmsKLS0tIDdPeFBVdkxDd1JWSmcxQ0tLMTBD\ncHU3VExZOUhYUlJvbGNoK3FMK2VIbGMKFk94P9aBY04CPIi983f3Aalgh4fnU+/K\n2mxawSMf9jz8704N5XJfmr2hwNy8hqLIn8bjsEMAPTfE1YBGga4w0g==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-24T09:42:23Z",
+                "mac": "ENC[AES256_GCM,data:diCeJGvBmM0Ng722eKoFwDe7pqZrdLPSLn5j9LfdaFI64BAbSbA5bAq4NFXqdJ1vttarD2A5rEafYoXUxP8228x2GhNyWUGW5AWgBjVPUc59gjs4wYKR5HlkVMIadhTwNheEyoEjrxX40GNBgCG7X3ocOtOYKbKECp433gdAPDg=,iv:d+yJMWj2RyFnveo2ZNrpNeV+amXM+H7vdC0A2F7mwjA=,tag:yjibG2iusdprp0ORghYWhw==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/surtr/dns/zones/email.nights.soa b/hosts/surtr/dns/zones/email.nights.soa
index 913a88d4..34209a99 100644
--- a/hosts/surtr/dns/zones/email.nights.soa
+++ b/hosts/surtr/dns/zones/email.nights.soa
@@ -1,7 +1,7 @@
 $ORIGIN nights.email.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
+  2025060700 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -27,11 +27,7 @@ $TTL 3600
 _acme-challenge         IN      NS      ns.yggdrasil.li.
-ymir._domainkey         IN      TXT     ( 
+ymir._domainkey         IN      CNAME   ymir._domainkey.yggdrasil.li.
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
 _xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
 _xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
diff --git a/hosts/surtr/dns/zones/li.141.soa b/hosts/surtr/dns/zones/li.141.soa
index ab117f09..78d137bb 100644
--- a/hosts/surtr/dns/zones/li.141.soa
+++ b/hosts/surtr/dns/zones/li.141.soa
@@ -1,7 +1,7 @@
 $ORIGIN 141.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2025020900 ; serial
+  2025060701 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -45,11 +45,8 @@ ymir                    IN      AAAA    2a03:4000:6:d004::
 ymir                    IN      MX      0 ymir.yggdrasil.li
 ymir                    IN      TXT     "v=spf1 redirect=ymir.yggdrasil.li"
-ymir._domainkey         IN      TXT     ( 
+ymir._domainkey         IN      CNAME   ymir._domainkey.yggdrasil.li.
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
+surtr._domainkey        IN      CNAME   surtr._domainkey.yggdrasil.li.
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
 _xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
 _xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
diff --git a/hosts/surtr/dns/zones/li.kleen.soa b/hosts/surtr/dns/zones/li.kleen.soa
index a1c7d35a..5dd3e697 100644
--- a/hosts/surtr/dns/zones/li.kleen.soa
+++ b/hosts/surtr/dns/zones/li.kleen.soa
@@ -1,7 +1,7 @@
 $ORIGIN kleen.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
+  2025060701 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -27,11 +27,8 @@ $TTL 3600
 _acme-challenge         IN      NS      ns.yggdrasil.li.
-ymir._domainkey         IN      TXT     ( 
+ymir._domainkey         IN      CNAME   ymir._domainkey.yggdrasil.li.
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
+surtr._domainkey        IN      CNAME   surtr._domainkey.yggdrasil.li.
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
 _xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
 _xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
diff --git a/hosts/surtr/dns/zones/li.synapse.soa b/hosts/surtr/dns/zones/li.synapse.soa
index 086d4a85..247cf025 100644
--- a/hosts/surtr/dns/zones/li.synapse.soa
+++ b/hosts/surtr/dns/zones/li.synapse.soa
@@ -1,7 +1,7 @@
 $ORIGIN synapse.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023092100 ; serial
+  2025060701 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
diff --git a/hosts/surtr/dns/zones/li.xmpp.soa b/hosts/surtr/dns/zones/li.xmpp.soa
deleted file mode 100644
index a9e98fb4..00000000
--- a/hosts/surtr/dns/zones/li.xmpp.soa
+++ /dev/null
@@ -1,43 +0,0 @@
-$ORIGIN xmpp.li.
-$TTL 3600
-@ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
-  10800      ; refresh
-  3600       ; retry
-  604800     ; expire
-  3600       ; min TTL
-)
-                        IN      NS      ns.yggdrasil.li.
-                        IN      NS      ns.inwx.de.
-                        IN      NS      ns2.inwx.de.
-                        IN      NS      ns3.inwx.eu.
-@                       IN      CAA     128 issue "letsencrypt.org; validationmethods=dns-01"
-@                       IN      CAA     128 iodef "mailto:caa@yggdrasil.li"
-@                       IN      A       188.68.51.254
-@                       IN      AAAA    2a03:4000:6:d004::
-@                       IN      MX      0 ymir.yggdrasil.li.
-@                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
-*                       IN      A       188.68.51.254
-*                       IN      AAAA    2a03:4000:6:d004::
-*                       IN      MX      0 ymir.yggdrasil.li.
-*                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
-_acme-challenge         IN      NS      ns.yggdrasil.li.
-ymir._domainkey         IN      TXT     ( 
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
-_xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
-_xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
-_infinoted._tcp         IN      SRV     5 0 6523 ymir.yggdrasil.li.
-_submission._tcp        IN      SRV     5 0 25 ymir.yggdrasil.li.
-_imap._tcp              IN      SRV     5 0 143 ymir.yggdrasil.li.
-_imaps._tcp             IN      SRV     5 0 993 ymir.yggdrasil.li.
diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa
index 2ef120e6..500194ae 100644
--- a/hosts/surtr/dns/zones/li.yggdrasil.soa
+++ b/hosts/surtr/dns/zones/li.yggdrasil.soa
@@ -1,7 +1,7 @@
 $ORIGIN yggdrasil.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2025021901 ; serial
+  2025060700 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -93,12 +93,30 @@ _acme-challenge.hledger	IN	NS	ns.yggdrasil.li.
 hledger                 IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
+audiobookshelf                 IN      A       202.61.241.61
+audiobookshelf                 IN      AAAA    2a03:4000:52:ada::
+audiobookshelf                 IN      MX      0 surtr.yggdrasil.li
+audiobookshelf                 IN      TXT     "v=spf1 redirect=surtr.yggdrasil.li"
+_acme-challenge.audiobookshelf  IN      NS      ns.yggdrasil.li.
+audiobookshelf                  IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
+kimai                 IN      A       202.61.241.61
+kimai                 IN      AAAA    2a03:4000:52:ada::
+kimai                 IN      MX      0 surtr.yggdrasil.li
+kimai                 IN      TXT     "v=spf1 redirect=surtr.yggdrasil.li"
+_acme-challenge.kimai   IN      NS      ns.yggdrasil.li.
+kimai                   IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
 vidhar                  IN      AAAA    2a03:4000:52:ada:4:1::
 vidhar                  IN      MX      0 ymir.yggdrasil.li
 vidhar                  IN      TXT     "v=spf1 redirect=yggdrasil.li"
 mailout                 IN      A       188.68.51.254
 mailout                 IN      AAAA    2a03:4000:6:d004::
+mailout                 IN      A       202.61.241.61
+mailout                 IN      AAAA    2a03:4000:52:ada::
 mailout                 IN      MX      0 ymir.yggdrasil.li
 mailout                 IN      TXT     "v=spf1 redirect=yggdrasil.li"
diff --git a/hosts/surtr/dns/zones/org.dirty-haskell.soa b/hosts/surtr/dns/zones/org.dirty-haskell.soa
deleted file mode 100644
index 27f0d7f9..00000000
--- a/hosts/surtr/dns/zones/org.dirty-haskell.soa
+++ /dev/null
@@ -1,34 +0,0 @@
-$ORIGIN dirty-haskell.org.
-$TTL 3600
-@ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
-  10800      ; refresh
-  3600       ; retry
-  604800     ; expire
-  3600       ; min TTL
-)
-                        IN      NS      ns.yggdrasil.li.
-                        IN      NS      ns.inwx.de.
-                        IN      NS      ns2.inwx.de.
-                        IN      NS      ns3.inwx.eu.
-@                       IN      CAA     128 issue "letsencrypt.org; validationmethods=dns-01"
-@                       IN      CAA     128 iodef "mailto:caa@yggdrasil.li"
-@                       IN      A       188.68.51.254
-@                       IN      AAAA    2a03:4000:6:d004::
-@                       IN      MX      10 ymir.yggdrasil.li.
-@                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
-*                       IN      A       188.68.51.254
-*                       IN      AAAA    2a03:4000:6:d004::
-*                       IN      MX      0 ymir.yggdrasil.li.
-*                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
-_acme-challenge         IN      NS      ns.yggdrasil.li.
-ymir._domainkey         IN      TXT     ( 
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
diff --git a/hosts/surtr/dns/zones/org.praseodym.soa b/hosts/surtr/dns/zones/org.praseodym.soa
index df505b4c..2b97ca19 100644
--- a/hosts/surtr/dns/zones/org.praseodym.soa
+++ b/hosts/surtr/dns/zones/org.praseodym.soa
@@ -1,7 +1,7 @@
 $ORIGIN praseodym.org.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
+  2025060701 ; serial
  10800      ; refresh
  3600       ; retry
  604800     ; expire
@@ -32,11 +32,8 @@ surtr			IN	AAAA	2a03:4000:52:ada::
 surtr                   IN      MX      0 ymir.yggdrasil.li
 surtr                   IN      TXT     "v=spf1 redirect=yggdrasil.li"
-ymir._domainkey         IN      TXT     ( 
+ymir._domainkey         IN      CNAME   ymir._domainkey.yggdrasil.li.
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
+surtr._domainkey        IN      CNAME   surtr._domainkey.yggdrasil.li.
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
 _xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
 _xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
diff --git a/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py b/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py
index 00182523..45619fb0 100644
--- a/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py
+++ b/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py
@@ -28,12 +28,14 @@ class PolicyHandler(StreamRequestHandler):
        allowed = False
        user = None
+        relay_eligible = False
        if self.args['sasl_username']:
            user = self.args['sasl_username']
        if self.args['ccert_subject']:
            user = self.args['ccert_subject']
+            relay_eligible = True
-        if user:
+        if user and '@' in self.args['sender']:
            with self.server.db_pool.connection() as conn:
                local, domain = self.args['sender'].split(sep='@', maxsplit=1)
                extension = None
@@ -44,10 +46,16 @@ class PolicyHandler(StreamRequestHandler):
                with conn.cursor() as cur:
                    cur.row_factory = namedtuple_row
-                    cur.execute('SELECT "mailbox"."mailbox" as "user", "local", "extension", "domain" FROM "mailbox" INNER JOIN "mailbox_mapping" ON "mailbox".id = "mailbox_mapping"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s', params = {'user': user, 'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare=True)
-                    for record in cur:
+                    if relay_eligible:
-                        logger.debug('Received result: %s', record)
+                        cur.execute('SELECT EXISTS(SELECT true FROM "mailbox" INNER JOIN "relay_access" ON "mailbox".id = "relay_access"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("domain" = %(domain)s OR %(domain)s ilike CONCAT(\'%%_.\', "domain"))) as "exists"', params = {'user': user, 'domain': domain})
-                        allowed = True
+                        if (row := cur.fetchone()) is not None:
+                            allowed = row.exists
+                    if not allowed:
+                        cur.execute('SELECT EXISTS(SELECT true FROM "mailbox" INNER JOIN "mailbox_mapping" ON "mailbox".id = "mailbox_mapping"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s) as "exists"', params = {'user': user, 'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare=True)
+                        if (row := cur.fetchone()) is not None:
+                            allowed = row.exists
        action = '550 5.7.0 Sender address not authorized for current user'
        if allowed:
diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index a85b76aa..b4b2b5c8 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, flakeInputs, ... }:
+{ config, pkgs, lib, flake, flakeInputs, ... }:
 with lib;
@@ -15,7 +15,7 @@ let
      for file in $out/pipe/bin/*; do
        wrapProgram $file \
-          --set PATH "${pkgs.coreutils}/bin:${pkgs.rspamd}/bin"
+          --set PATH "${makeBinPath (with pkgs; [coreutils rspamd])}"
      done
    '';
  };
@@ -33,12 +33,28 @@ let
        });
      });
    };
+  internal-policy-server =
+    let
+      workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./internal-policy-server; };
+      pythonSet = flake.lib.pythonSet {
+        inherit pkgs;
+        python = pkgs.python312;
+        overlay = workspace.mkPyprojectOverlay {
+          sourcePreference = "wheel";
+        };
+      };
+      virtualEnv = pythonSet.mkVirtualEnv "internal-policy-server-env" workspace.deps.default;
+    in virtualEnv.overrideAttrs (oldAttrs: {
+      meta = (oldAttrs.meta or {}) // {
+        mainProgram = "internal-policy-server";
+      };
+    });
-  nftables-nologin-script = pkgs.writeScript "nftables-mail-nologin" ''
+  nftables-nologin-script = pkgs.resholve.writeScript "nftables-mail-nologin" {
-    #!${pkgs.zsh}/bin/zsh
+    inputs = with pkgs; [inetutils nftables gnugrep findutils];
+    interpreter = lib.getExe pkgs.zsh;
+  } ''
    set -e
-    export PATH="${lib.makeBinPath (with pkgs; [inetutils nftables])}:$PATH"
    typeset -a as_sets mnt_bys route route6
    as_sets=(${lib.escapeShellArgs config.services.email.nologin.ASSets})
@@ -51,7 +67,7 @@ let
            elif [[ "''${line}" =~ "^route6:\s+(.+)$" ]]; then
                route6+=($match[1])
            fi
-        done < <(whois -h whois.radb.net "!i''${as_set},1" | egrep -o 'AS[0-9]+' | xargs -- whois -h whois.radb.net -- -i origin)
+        done < <(whois -h whois.radb.net "!i''${as_set},1" | grep -Eo 'AS[0-9]+' | xargs whois -h whois.radb.net -- -i origin)
    done
    for mnt_by in $mnt_bys; do
        while IFS=$'\n' read line; do
@@ -108,19 +124,20 @@ in {
    services.postfix = {
      enable = true;
      enableSmtp = false;
-      hostname = "surtr.yggdrasil.li";
-      recipientDelimiter = "";
      setSendmail = true;
      postmasterAlias = ""; rootAlias = ""; extraAliases = "";
-      destination = [];
+      settings.main = {
-      sslCert = "/run/credentials/postfix.service/surtr.yggdrasil.li.pem";
+        recpipient_delimiter = "";
-      sslKey = "/run/credentials/postfix.service/surtr.yggdrasil.li.key.pem";
+        mydestination = [];
-      networks = [];
+        mynetworks = [];
-      config = let
+        myhostname = "surtr.yggdrasil.li";
-        relay_ccert = "texthash:${pkgs.writeText "relay_ccert" ""}";
-      in {
        smtpd_tls_security_level = "may";
+        smtpd_tls_chain_files = [
+          "/run/credentials/postfix.service/surtr.yggdrasil.li.full.pem"
+        ];
        #the dh params
        smtpd_tls_dh1024_param_file = toString config.security.dhparams.params."postfix-1024".path;
        smtpd_tls_dh512_param_file = toString config.security.dhparams.params."postfix-512".path;
@@ -155,21 +172,14 @@ in {
        smtp_tls_connection_reuse = true;
-        tls_server_sni_maps = ''texthash:${pkgs.writeText "sni" (
+        tls_server_sni_maps = "inline:{${concatMapStringsSep ", " (domain: "{ ${domain} = /run/credentials/postfix.service/${removePrefix "." domain}.full.pem }") (concatMap (domain: [domain "mailin.${domain}" "mailsub.${domain}" ".${domain}"]) emailDomains)}}";
-          concatMapStringsSep "\n\n" (domain:
-            concatMapStringsSep "\n" (subdomain: "${subdomain} /run/credentials/postfix.service/${removePrefix "." subdomain}.full.pem")
-              [domain "mailin.${domain}" "mailsub.${domain}" ".${domain}"]
-          ) emailDomains
-        )}'';
        smtp_tls_policy_maps = "socketmap:unix:${config.services.postfix-mta-sts-resolver.settings.path}:postfix";
        local_recipient_maps = "";
-        # 10 GiB
+        message_size_limit = 10 * 1024 * 1024 * 1024;
-        message_size_limit = "10737418240";
+        mailbox_size_limit = 10 * 1024 * 1024 * 1024;
-        # 10 GiB
-        mailbox_size_limit = "10737418240";
        smtpd_delay_reject = true;
        smtpd_helo_required = true;
@@ -184,25 +194,26 @@ in {
            dbname = email
            query = SELECT action FROM virtual_mailbox_access WHERE lookup = '%s'
          ''}"
-          "check_ccert_access ${relay_ccert}"
          "reject_non_fqdn_helo_hostname"
          "reject_invalid_helo_hostname"
          "reject_unauth_destination"
          "reject_unknown_recipient_domain"
          "reject_unverified_recipient"
+          "check_policy_service unix:/run/postfix-internal-policy.sock"
        ];
        unverified_recipient_reject_code = "550";
        unverified_recipient_reject_reason = "Recipient address lookup failed";
        address_verify_map = "internal:address_verify_map";
        address_verify_positive_expire_time = "1h";
        address_verify_positive_refresh_time = "15m";
-        address_verify_negative_expire_time = "15s";
+        address_verify_negative_expire_time = "5m";
-        address_verify_negative_refresh_time = "5s";
+        address_verify_negative_refresh_time = "1m";
-        address_verify_cache_cleanup_interval = "5s";
+        address_verify_cache_cleanup_interval = "12h";
+        address_verify_poll_count = "\${stress?15}\${stress:30}";
        address_verify_poll_delay = "1s";
+        address_verify_sender_ttl = "30045s";
        smtpd_relay_restrictions = [
-          "check_ccert_access ${relay_ccert}"
          "reject_unauth_destination"
        ];
@@ -213,7 +224,7 @@ in {
        smtpd_client_event_limit_exceptions = "";
        milter_default_action = "accept";
-        smtpd_milters = [config.services.opendkim.socket "local:/run/rspamd/rspamd-milter.sock"];
+        smtpd_milters = [config.services.opendkim.socket "local:/run/rspamd/rspamd-milter.sock" "local:/run/postsrsd/postsrsd-milter.sock"];
        non_smtpd_milters = [config.services.opendkim.socket "local:/run/rspamd/rspamd-milter.sock"];
        alias_maps = "";
@@ -225,6 +236,37 @@ in {
        bounce_queue_lifetime = "20m";
        delay_warning_time = "10m";
+        failure_template_file = toString (pkgs.writeText "failure.cf" ''
+          Charset: us-ascii
+          From: Mail Delivery System <MAILER-DAEMON>
+          Subject: Undelivered Mail Returned to Sender
+          Postmaster-Subject: Postmaster Copy: Undelivered Mail
+          This is the mail system at host $myhostname.
+          I'm sorry to have to inform you that your message could not
+          be delivered to one or more recipients. It's attached below.
+                             The mail system
+        '');
+        delay_template_file = toString (pkgs.writeText "delay.cf" ''
+          Charset: us-ascii
+          From: Mail Delivery System <MAILER-DAEMON>
+          Subject: Delayed Mail (still being retried)
+          Postmaster-Subject: Postmaster Warning: Delayed Mail
+          This is the mail system at host $myhostname.
+          ####################################################################
+          # THIS IS A WARNING ONLY.  YOU DO NOT NEED TO RESEND YOUR MESSAGE. #
+          ####################################################################
+          Your message could not be delivered for more than $delay_warning_time_minutes minute(s).
+          It will be retried until it is $maximal_queue_lifetime_minutes minute(s) old.
+                             The mail system
+        '');
        smtpd_discard_ehlo_keyword_address_maps = "cidr:${pkgs.writeText "esmtp_access" ''
          # Allow DSN requests from local subnet only
          192.168.0.0/16      silent-discard
@@ -235,11 +277,6 @@ in {
          ::/0                silent-discard, dsn
        ''}";
-        sender_canonical_maps = "tcp:localhost:${toString config.services.postsrsd.forwardPort}";
-        sender_canonical_classes = "envelope_sender";
-        recipient_canonical_maps = "tcp:localhost:${toString config.services.postsrsd.reversePort}";
-        recipient_canonical_classes = ["envelope_recipient" "header_recipient"];
        virtual_mailbox_domains = ''pgsql:${pkgs.writeText "virtual_mailbox_domains.cf" ''
          hosts = postgresql:///email
          dbname = email
@@ -254,13 +291,26 @@ in {
        virtual_transport = "dvlmtp:unix:/run/dovecot-lmtp";
        smtputf8_enable = false;
-        authorized_submit_users = "inline:{ root= postfwd= }";
+        authorized_submit_users = "inline:{ root= postfwd= ${config.services.dovecot2.user}= }";
+        authorized_flush_users = "inline:{ root= }";
+        authorized_mailq_users = "inline:{ root= }";
        postscreen_access_list = "";
        postscreen_denylist_action = "drop";
        postscreen_greet_action = "enforce";
+        sender_bcc_maps = ''pgsql:${pkgs.writeText "sender_bcc_maps.cf" ''
+          hosts = postgresql:///email
+          dbname = email
+          query = SELECT value FROM sender_bcc_maps WHERE key = '%s'
+        ''}'';
+        recipient_bcc_maps = ''pgsql:${pkgs.writeText "recipient_bcc_maps.cf" ''
+          hosts = postgresql:///email
+          dbname = email
+          query = SELECT value FROM recipient_bcc_maps WHERE key = '%s'
+        ''}'';
      };
-      masterConfig = {
+      settings.master = {
        "465" = {
          type = "inet";
          private = false;
@@ -283,7 +333,7 @@ in {
            hosts = postgresql:///email
            dbname = email
            query = SELECT action FROM virtual_mailbox_access WHERE lookup = '%s' OR (lookup = regexp_replace('%s', '\+[^@]*@', '@') AND NOT EXISTS (SELECT 1 FROM virtual_mailbox_access WHERE lookup = '%s'))
-          ''},permit_tls_all_clientcerts,reject}''
+          ''},check_policy_service unix:/run/postfix-internal-policy.sock,permit_tls_all_clientcerts,reject}''
            "-o" "smtpd_relay_restrictions=permit_tls_all_clientcerts,reject"
            "-o" "{smtpd_data_restrictions = check_policy_service unix:/run/postfwd3/postfwd3.sock}"
            "-o" "unverified_sender_reject_code=550"
@@ -313,7 +363,7 @@ in {
            hosts = postgresql:///email
            dbname = email
            query = SELECT action FROM virtual_mailbox_access WHERE lookup = '%s' OR (lookup = regexp_replace('%s', '\+[^@]*@', '@') AND NOT EXISTS (SELECT 1 FROM virtual_mailbox_access WHERE lookup = '%s'))
-          ''},permit_sasl_authenticated,reject}''
+          ''},check_policy_service unix:/run/postfix-internal-policy.sock,permit_sasl_authenticated,reject}''
            "-o" "smtpd_relay_restrictions=permit_sasl_authenticated,reject"
            "-o" "{smtpd_data_restrictions = check_policy_service unix:/run/postfwd3/postfwd3.sock}"
            "-o" "unverified_sender_reject_code=550"
@@ -328,7 +378,10 @@ in {
          maxproc = 0;
          args = [
            "-o" "header_checks=pcre:${pkgs.writeText "header_checks_submission" ''
+              if /^Received: /
+              !/by surtr\.yggdrasil\.li/ STRIP
              /^Received: from [^ ]+ \([^ ]+ [^ ]+\)\s+(.*)$/ REPLACE Received: $1
+              endif
            ''}"
          ];
        };
@@ -364,17 +417,19 @@ in {
    services.postsrsd = {
      enable = true;
-      domain = "surtr.yggdrasil.li";
+      domains = [ "surtr.yggdrasil.li" ] ++ concatMap (domain: [".${domain}" domain]) emailDomains;
      separator = "+";
-      excludeDomains = [ "surtr.yggdrasil.li"
+      extraConfig = ''
-                       ] ++ concatMap (domain: [".${domain}" domain]) emailDomains;
+        socketmap = unix:/run/postsrsd/postsrsd-socketmap.sock
+        milter = unix:/run/postsrsd/postsrsd-milter.sock
+      '';
    };
    services.opendkim = {
      enable = true;
      user = "postfix"; group = "postfix";
      socket = "local:/run/opendkim/opendkim.sock";
-      domains = ''csl:${concatStringsSep "," (["surtr.yggdrasil.li"] ++ emailDomains)}'';
+      domains = ''csl:${concatStringsSep "," (["surtr.yggdrasil.li" "yggdrasil.li" "141.li" "kleen.li" "synapse.li" "praseodym.org"] ++ emailDomains)}'';
      selector = "surtr";
      configFile = builtins.toFile "opendkim.conf" ''
        Syslog true
@@ -478,7 +533,7 @@ in {
      };
    };
-    users.groups.${config.services.rspamd.group}.members = [ config.services.postfix.user "dovecot2" ];
+    users.groups.${config.services.rspamd.group}.members = [ config.services.postfix.user config.services.dovecot2.user ];
    services.redis.servers.rspamd.enable = true;
@@ -488,22 +543,22 @@ in {
    services.dovecot2 = {
      enable = true;
      enablePAM = false;
-      sslServerCert = "/run/credentials/dovecot2.service/surtr.yggdrasil.li.pem";
+      sslServerCert = "/run/credentials/dovecot.service/surtr.yggdrasil.li.pem";
-      sslServerKey = "/run/credentials/dovecot2.service/surtr.yggdrasil.li.key.pem";
+      sslServerKey = "/run/credentials/dovecot.service/surtr.yggdrasil.li.key.pem";
      sslCACert = toString ./ca/ca.crt;
      mailLocation = "maildir:/var/lib/mail/%u/maildir:UTF-8:INDEX=/var/lib/dovecot/indices/%u";
      mailPlugins.globally.enable = [ "fts" "fts_xapian" ];
      protocols = [ "lmtp" "sieve" ];
      sieve = {
-        extensions = ["copy" "imapsieve" "variables" "imap4flags" "vacation"];
+        extensions = ["copy" "imapsieve" "variables" "imap4flags" "vacation" "vacation-seconds" "vnd.dovecot.debug"];
-        globalExtensions = ["copy" "imapsieve" "variables" "imap4flags" "vacation"];
+        globalExtensions = ["copy" "imapsieve" "variables" "imap4flags" "vacation" "vacation-seconds" "vnd.dovecot.debug"];
      };
      extraConfig = let
        dovecotSqlConf = pkgs.writeText "dovecot-sql.conf" ''
          driver = pgsql
          connect = dbname=email
-          password_query = SELECT (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN NULL ELSE "password" END) as password, (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN true WHEN password IS NULL THEN true ELSE NULL END) as nopassword, "user", quota_rule, 'dovecot2' as uid, 'dovecot2' as gid FROM imap_user WHERE "user" = '%n'
+          password_query = SELECT (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN NULL ELSE "password" END) as password, (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN true WHEN password IS NULL THEN true ELSE NULL END) as nopassword, "user", quota_rule, '${config.services.dovecot2.user}' as uid, '${config.services.dovecot2.group}' as gid FROM imap_user WHERE "user" = '%n'
-          user_query = SELECT "user", quota_rule, 'dovecot2' as uid, 'dovecot2' as gid FROM imap_user WHERE "user" = '%n'
+          user_query = SELECT "user", quota_rule, '${config.services.dovecot2.user}' as uid, 'dovecot2' as gid FROM imap_user WHERE "user" = '%n'
          iterate_query = SELECT "user" FROM imap_user
        '';
      in ''
@@ -511,16 +566,16 @@ in {
        mail_plugins = $mail_plugins quota
-        first_valid_uid = ${toString config.users.users.dovecot2.uid}
+        first_valid_uid = ${toString config.users.users.${config.services.dovecot2.user}.uid}
-        last_valid_uid = ${toString config.users.users.dovecot2.uid}
+        last_valid_uid = ${toString config.users.users.${config.services.dovecot2.user}.uid}
-        first_valid_gid = ${toString config.users.groups.dovecot2.gid}
+        first_valid_gid = ${toString config.users.groups.${config.services.dovecot2.group}.gid}
-        last_valid_gid = ${toString config.users.groups.dovecot2.gid}
+        last_valid_gid = ${toString config.users.groups.${config.services.dovecot2.group}.gid}
        ${concatMapStringsSep "\n\n" (domain:
          concatMapStringsSep "\n" (subdomain: ''
            local_name ${subdomain} {
-              ssl_cert = </run/credentials/dovecot2.service/${subdomain}.pem
+              ssl_cert = </run/credentials/dovecot.service/${subdomain}.pem
-              ssl_key = </run/credentials/dovecot2.service/${subdomain}.key.pem
+              ssl_key = </run/credentials/dovecot.service/${subdomain}.key.pem
            }
          '') ["imap.${domain}" domain]
        ) emailDomains}
@@ -541,10 +596,10 @@ in {
        auth_debug = yes
        service auth {
-          user = dovecot2
+          user = ${config.services.dovecot2.user}
        }
        service auth-worker {
-          user = dovecot2
+          user = ${config.services.dovecot2.user}
        }
        userdb {
@@ -565,7 +620,7 @@ in {
            args = ${pkgs.writeText "dovecot-sql.conf" ''
              driver = pgsql
              connect = dbname=email
-              user_query = SELECT DISTINCT ON (extension IS NULL, local IS NULL) "user", quota_rule, 'dovecot2' as uid, 'dovecot2' as gid FROM lmtp_mapping WHERE CASE WHEN extension IS NOT NULL AND local IS NOT NULL THEN ('%n' :: citext) = local || '+' || extension AND domain = ('%d' :: citext) WHEN local IS NOT NULL THEN (local = ('%n' :: citext) OR ('%n' :: citext) ILIKE local || '+%%') AND domain = ('%d' :: citext) WHEN extension IS NOT NULL THEN ('%n' :: citext) ILIKE '%%+' || extension AND domain = ('%d' :: citext) ELSE domain = ('%d' :: citext) END ORDER BY (extension IS NULL) ASC, (local IS NULL) ASC
+              user_query = SELECT DISTINCT ON (extension IS NULL, local IS NULL) "user", quota_rule, '${config.services.dovecot2.user}' as uid, '${config.services.dovecot2.group}' as gid FROM lmtp_mapping WHERE CASE WHEN extension IS NOT NULL AND local IS NOT NULL THEN ('%n' :: citext) = local || '+' || extension AND domain = ('%d' :: citext) WHEN local IS NOT NULL THEN (local = ('%n' :: citext) OR ('%n' :: citext) ILIKE local || '+%%') AND domain = ('%d' :: citext) WHEN extension IS NOT NULL THEN ('%n' :: citext) ILIKE '%%+' || extension AND domain = ('%d' :: citext) ELSE domain = ('%d' :: citext) END ORDER BY (extension IS NULL) ASC, (local IS NULL) ASC
            ''}
            skip = never
@@ -635,7 +690,7 @@ in {
          quota_status_success = DUNNO
          quota_status_nouser = DUNNO
          quota_grace = 10%%
-          quota_max_mail_size = ${config.services.postfix.config.message_size_limit}
+          quota_max_mail_size = ${toString config.services.postfix.settings.main.message_size_limit}
          quota_vsizes = yes
        }
@@ -673,7 +728,7 @@ in {
        plugin {
          plugin = fts fts_xapian
          fts = xapian
-          fts_xapian = partial=2 full=20 attachments=1 verbose=1
+          fts_xapian = partial=3 full=20 attachments=1 verbose=1
          fts_autoindex = yes
@@ -688,12 +743,12 @@ in {
    systemd.services.dovecot-fts-xapian-optimize = {
      description = "Optimize dovecot indices for fts_xapian";
-      requisite = [ "dovecot2.service" ];
+      requisite = [ "dovecot.service" ];
-      after = [ "dovecot2.service" ];
+      after = [ "dovecot.service" ];
      startAt = "*-*-* 22:00:00 Europe/Berlin";
      serviceConfig = {
        Type = "oneshot";
-        ExecStart = "${pkgs.dovecot}/bin/doveadm fts optimize -A";
+        ExecStart = "${getExe' pkgs.dovecot "doveadm"} fts optimize -A";
        PrivateDevices = true;
        PrivateNetwork = true;
        ProtectKernelTunables = true;
@@ -754,31 +809,29 @@ in {
    security.acme.rfc2136Domains = {
      "surtr.yggdrasil.li" = {
-        restartUnits = [ "postfix.service" "dovecot2.service" ];
+        restartUnits = [ "postfix.service" "dovecot.service" ];
      };
    } // listToAttrs (map (domain: nameValuePair "spm.${domain}" { restartUnits = ["nginx.service"]; }) spmDomains)
    // listToAttrs (concatMap (domain: [
-      (nameValuePair domain { restartUnits = ["postfix.service" "dovecot2.service"]; })
+      (nameValuePair domain { restartUnits = ["postfix.service" "dovecot.service"]; })
      (nameValuePair "mailin.${domain}" { restartUnits = ["postfix.service"]; })
      (nameValuePair "mailsub.${domain}" { restartUnits = ["postfix.service"]; })
-      (nameValuePair "imap.${domain}" { restartUnits = ["dovecot2.service"]; })
+      (nameValuePair "imap.${domain}" { restartUnits = ["dovecot.service"]; })
      (nameValuePair "mta-sts.${domain}" { restartUnits = ["nginx.service"]; })
    ]) emailDomains);
    systemd.services.postfix = {
-      serviceConfig.LoadCredential = [
+      serviceConfig.LoadCredential = let
-        "surtr.yggdrasil.li.key.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/key.pem"
+        tlsCredential = domain: "${domain}.full.pem:${config.security.acme.certs.${domain}.directory}/full.pem";
-        "surtr.yggdrasil.li.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/fullchain.pem"
+      in [
-      ] ++ concatMap (domain:
+        (tlsCredential "surtr.yggdrasil.li")
-        map (subdomain: "${subdomain}.full.pem:${config.security.acme.certs.${subdomain}.directory}/full.pem")
+      ] ++ concatMap (domain: map tlsCredential [domain "mailin.${domain}" "mailsub.${domain}"]) emailDomains;
-          [domain "mailin.${domain}" "mailsub.${domain}"]
-      ) emailDomains;
    };
-    systemd.services.dovecot2 = {
+    systemd.services.dovecot = {
      preStart = ''
        for f in /etc/dovecot/sieve_flag.d/*.sieve /etc/dovecot/sieve_before.d/*.sieve; do
-          ${pkgs.dovecot_pigeonhole}/bin/sievec $f
+          ${getExe' pkgs.dovecot_pigeonhole "sievec"} $f
        done
      '';
@@ -845,15 +898,16 @@ in {
              charset utf-8;
              source_charset utf-8;
            '';
-            root = pkgs.runCommand "mta-sts.${domain}" {} ''
+            root = pkgs.writeTextFile {
-              mkdir -p $out/.well-known
+              name = "mta-sts.${domain}";
-              cp ${pkgs.writeText "mta-sts.${domain}.txt" ''
+              destination = "/.well-known/mta-sts.txt";
+              text = ''
                version: STSv1
                mode: enforce
                max_age: 2419200
                mx: mailin.${domain}
-              ''} $out/.well-known/mta-sts.txt
+              '';
-            '';
+            };
          };
      }) emailDomains);
    };
@@ -870,7 +924,7 @@ in {
    systemd.services.spm = {
      serviceConfig = {
        Type = "notify";
-        ExecStart = "${pkgs.spm}/bin/spm-server";
+        ExecStart = getExe' pkgs.spm "spm-server";
        User = "spm";
        Group = "spm";
@@ -928,7 +982,7 @@ in {
      serviceConfig = {
        Type = "notify";
-        ExecStart = "${ccert-policy-server}/bin/ccert-policy-server";
+        ExecStart = getExe' ccert-policy-server "ccert-policy-server";
        Environment = [
          "PGDATABASE=email"
@@ -961,6 +1015,53 @@ in {
    };
    users.groups."postfix-ccert-sender-policy" = {};
+    systemd.sockets."postfix-internal-policy" = {
+      requiredBy = ["postfix.service"];
+      wants = ["postfix-internal-policy.service"];
+      socketConfig = {
+        ListenStream = "/run/postfix-internal-policy.sock";
+      };
+    };
+    systemd.services."postfix-internal-policy" = {
+      after = [ "postgresql.service" ];
+      bindsTo = [ "postgresql.service" ];
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = lib.getExe internal-policy-server;
+        Environment = [
+          "PGDATABASE=email"
+        ];
+        DynamicUser = false;
+        User = "postfix-internal-policy";
+        Group = "postfix-internal-policy";
+        ProtectSystem = "strict";
+        SystemCallFilter = "@system-service";
+        NoNewPrivileges = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        RestrictSUIDSGID = true;
+        KeyringMode = "private";
+        ProtectClock = true;
+        RestrictRealtime = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectHostname = true;
+        ReadWritePaths = ["/run/postgresql"];
+      };
+    };
+    users.users."postfix-internal-policy" = {
+      isSystemUser = true;
+      group = "postfix-internal-policy";
+    };
+    users.groups."postfix-internal-policy" = {};
    services.postfwd = {
      enable = true;
      cache = false;
diff --git a/hosts/surtr/email/internal-policy-server/.envrc b/hosts/surtr/email/internal-policy-server/.envrc
new file mode 100644
index 00000000..2c909235
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/.envrc
@@ -0,0 +1,4 @@
+use flake
+[[ -d ".venv" ]] || ( uv venv && uv sync )
+. .venv/bin/activate
diff --git a/hosts/surtr/email/internal-policy-server/.gitignore b/hosts/surtr/email/internal-policy-server/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/hosts/surtr/email/internal-policy-server/internal_policy_server/__init__.py b/hosts/surtr/email/internal-policy-server/internal_policy_server/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/internal_policy_server/__init__.py
diff --git a/hosts/surtr/email/internal-policy-server/internal_policy_server/__main__.py b/hosts/surtr/email/internal-policy-server/internal_policy_server/__main__.py
new file mode 100644
index 00000000..04f1a59a
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/internal_policy_server/__main__.py
@@ -0,0 +1,106 @@
+from systemd.daemon import listen_fds
+from sdnotify import SystemdNotifier
+from socketserver import StreamRequestHandler, ThreadingMixIn
+from systemd_socketserver import SystemdSocketServer
+import sys
+from threading import Thread
+from psycopg_pool import ConnectionPool
+from psycopg.rows import namedtuple_row
+import logging
+class PolicyHandler(StreamRequestHandler):
+    def handle(self):
+        logger.debug('Handling new connection...')
+        self.args = dict()
+        line = None
+        while line := self.rfile.readline().removesuffix(b'\n'):
+            if b'=' not in line:
+                break
+            key, val = line.split(sep=b'=', maxsplit=1)
+            self.args[key.decode()] = val.decode()
+        logger.info('Connection parameters: %s', self.args)
+        allowed = False
+        user = None
+        if self.args['sasl_username']:
+            user = self.args['sasl_username']
+        if self.args['ccert_subject']:
+            user = self.args['ccert_subject']
+        with self.server.db_pool.connection() as conn:
+            local, domain = self.args['recipient'].split(sep='@', maxsplit=1)
+            extension = None
+            if '+' in local:
+                local, extension = local.split(sep='+', maxsplit=1)
+            logger.debug('Parsed recipient address: %s', {'local': local, 'extension': extension, 'domain': domain})
+            with conn.cursor() as cur:
+                cur.row_factory = namedtuple_row
+                cur.execute('SELECT id, internal FROM "mailbox_mapping" WHERE ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s', params = {'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare = True)
+                if (row := cur.fetchone()) is not None:
+                    if not row.internal:
+                        logger.debug('Recipient mailbox is not internal')
+                        allowed = True
+                    elif user:
+                        cur.execute('SELECT EXISTS(SELECT true FROM "mailbox_mapping_access" INNER JOIN "mailbox" ON "mailbox".id = "mailbox_mapping_access"."mailbox" WHERE mailbox_mapping = %(mailbox_mapping)s AND "mailbox"."mailbox" = %(user)s) as "exists"', params = { 'mailbox_mapping': row.id, 'user': user }, prepare = True)
+                        if (row := cur.fetchone()) is not None:
+                            allowed = row.exists
+                else:
+                    logger.debug('Recipient is not local')
+                    allowed = True
+        action = '550 5.7.0 Recipient mailbox mapping not authorized for current user'
+        if allowed:
+            action = 'DUNNO'
+        logger.info('Reached verdict: %s', {'allowed': allowed, 'action': action})
+        self.wfile.write(f'action={action}\n\n'.encode())
+class ThreadedSystemdSocketServer(ThreadingMixIn, SystemdSocketServer):
+    def __init__(self, fd, RequestHandlerClass):
+        super().__init__(fd, RequestHandlerClass)
+        self.db_pool = ConnectionPool(min_size=1)
+        self.db_pool.wait()
+def main():
+    global logger
+    logger = logging.getLogger(__name__)
+    console_handler = logging.StreamHandler()
+    console_handler.setFormatter( logging.Formatter('[%(levelname)s](%(name)s): %(message)s') )
+    if sys.stderr.isatty():
+        console_handler.setFormatter( logging.Formatter('%(asctime)s [%(levelname)s](%(name)s): %(message)s') )
+    logger.addHandler(console_handler)
+    logger.setLevel(logging.DEBUG)
+    # log uncaught exceptions
+    def log_exceptions(type, value, tb):
+        global logger
+        logger.error(value)
+        sys.__excepthook__(type, value, tb) # calls default excepthook
+    sys.excepthook = log_exceptions
+    fds = listen_fds()
+    servers = [ThreadedSystemdSocketServer(fd, PolicyHandler) for fd in fds]
+    if servers:
+        for server in servers:
+            Thread(name=f'Server for fd{server.fileno()}', target=server.serve_forever).start()
+    else:
+        return 2
+    SystemdNotifier().notify('READY=1')
+    return 0
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/hosts/surtr/email/internal-policy-server/pyproject.toml b/hosts/surtr/email/internal-policy-server/pyproject.toml
new file mode 100644
index 00000000..c697cd01
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/pyproject.toml
@@ -0,0 +1,18 @@
+[project]
+name = "internal-policy-server"
+version = "0.1.0"
+requires-python = ">=3.12"
+dependencies = [
+    "psycopg>=3.2.9",
+    "psycopg-binary>=3.2.9",
+    "psycopg-pool>=3.2.6",
+    "sdnotify>=0.3.2",
+    "systemd-socketserver>=1.0",
+]
+[project.scripts]
+internal-policy-server = "internal_policy_server.__main__:main"
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
diff --git a/hosts/surtr/email/internal-policy-server/uv.lock b/hosts/surtr/email/internal-policy-server/uv.lock
new file mode 100644
index 00000000..f7a4e729
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/uv.lock
@@ -0,0 +1,119 @@
+version = 1
+revision = 2
+requires-python = ">=3.12"
+[[package]]
+name = "internal-policy-server"
+version = "0.1.0"
+source = { editable = "." }
+dependencies = [
+    { name = "psycopg" },
+    { name = "psycopg-binary" },
+    { name = "psycopg-pool" },
+    { name = "sdnotify" },
+    { name = "systemd-socketserver" },
+]
+[package.metadata]
+requires-dist = [
+    { name = "psycopg", specifier = ">=3.2.9" },
+    { name = "psycopg-binary", specifier = ">=3.2.9" },
+    { name = "psycopg-pool", specifier = ">=3.2.6" },
+    { name = "sdnotify", specifier = ">=0.3.2" },
+    { name = "systemd-socketserver", specifier = ">=1.0" },
+]
+[[package]]
+name = "psycopg"
+version = "3.2.9"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+    { name = "tzdata", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/27/4a/93a6ab570a8d1a4ad171a1f4256e205ce48d828781312c0bbaff36380ecb/psycopg-3.2.9.tar.gz", hash = "sha256:2fbb46fcd17bc81f993f28c47f1ebea38d66ae97cc2dbc3cad73b37cefbff700", size = 158122, upload-time = "2025-05-13T16:11:15.533Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/44/b0/a73c195a56eb6b92e937a5ca58521a5c3346fb233345adc80fd3e2f542e2/psycopg-3.2.9-py3-none-any.whl", hash = "sha256:01a8dadccdaac2123c916208c96e06631641c0566b22005493f09663c7a8d3b6", size = 202705, upload-time = "2025-05-13T16:06:26.584Z" },
+]
+[[package]]
+name = "psycopg-binary"
+version = "3.2.9"
+source = { registry = "https://pypi.org/simple" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/29/6f/ec9957e37a606cd7564412e03f41f1b3c3637a5be018d0849914cb06e674/psycopg_binary-3.2.9-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:be7d650a434921a6b1ebe3fff324dbc2364393eb29d7672e638ce3e21076974e", size = 4022205, upload-time = "2025-05-13T16:07:48.195Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/ba/497b8bea72b20a862ac95a94386967b745a472d9ddc88bc3f32d5d5f0d43/psycopg_binary-3.2.9-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:6a76b4722a529390683c0304501f238b365a46b1e5fb6b7249dbc0ad6fea51a0", size = 4083795, upload-time = "2025-05-13T16:07:50.917Z" },
+    { url = "https://files.pythonhosted.org/packages/42/07/af9503e8e8bdad3911fd88e10e6a29240f9feaa99f57d6fac4a18b16f5a0/psycopg_binary-3.2.9-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:96a551e4683f1c307cfc3d9a05fec62c00a7264f320c9962a67a543e3ce0d8ff", size = 4655043, upload-time = "2025-05-13T16:07:54.857Z" },
+    { url = "https://files.pythonhosted.org/packages/28/ed/aff8c9850df1648cc6a5cc7a381f11ee78d98a6b807edd4a5ae276ad60ad/psycopg_binary-3.2.9-cp312-cp312-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:61d0a6ceed8f08c75a395bc28cb648a81cf8dee75ba4650093ad1a24a51c8724", size = 4477972, upload-time = "2025-05-13T16:07:57.925Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/bd/8e9d1b77ec1a632818fe2f457c3a65af83c68710c4c162d6866947d08cc5/psycopg_binary-3.2.9-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad280bbd409bf598683dda82232f5215cfc5f2b1bf0854e409b4d0c44a113b1d", size = 4737516, upload-time = "2025-05-13T16:08:01.616Z" },
+    { url = "https://files.pythonhosted.org/packages/46/ec/222238f774cd5a0881f3f3b18fb86daceae89cc410f91ef6a9fb4556f236/psycopg_binary-3.2.9-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:76eddaf7fef1d0994e3d536ad48aa75034663d3a07f6f7e3e601105ae73aeff6", size = 4436160, upload-time = "2025-05-13T16:08:04.278Z" },
+    { url = "https://files.pythonhosted.org/packages/37/78/af5af2a1b296eeca54ea7592cd19284739a844974c9747e516707e7b3b39/psycopg_binary-3.2.9-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:52e239cd66c4158e412318fbe028cd94b0ef21b0707f56dcb4bdc250ee58fd40", size = 3753518, upload-time = "2025-05-13T16:08:07.567Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/ac/8a3ed39ea069402e9e6e6a2f79d81a71879708b31cc3454283314994b1ae/psycopg_binary-3.2.9-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:08bf9d5eabba160dd4f6ad247cf12f229cc19d2458511cab2eb9647f42fa6795", size = 3313598, upload-time = "2025-05-13T16:08:09.999Z" },
+    { url = "https://files.pythonhosted.org/packages/da/43/26549af068347c808fbfe5f07d2fa8cef747cfff7c695136172991d2378b/psycopg_binary-3.2.9-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:1b2cf018168cad87580e67bdde38ff5e51511112f1ce6ce9a8336871f465c19a", size = 3407289, upload-time = "2025-05-13T16:08:12.66Z" },
+    { url = "https://files.pythonhosted.org/packages/67/55/ea8d227c77df8e8aec880ded398316735add8fda5eb4ff5cc96fac11e964/psycopg_binary-3.2.9-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:14f64d1ac6942ff089fc7e926440f7a5ced062e2ed0949d7d2d680dc5c00e2d4", size = 3472493, upload-time = "2025-05-13T16:08:15.672Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/02/6ff2a5bc53c3cd653d281666728e29121149179c73fddefb1e437024c192/psycopg_binary-3.2.9-cp312-cp312-win_amd64.whl", hash = "sha256:7a838852e5afb6b4126f93eb409516a8c02a49b788f4df8b6469a40c2157fa21", size = 2927400, upload-time = "2025-05-13T16:08:18.652Z" },
+    { url = "https://files.pythonhosted.org/packages/28/0b/f61ff4e9f23396aca674ed4d5c9a5b7323738021d5d72d36d8b865b3deaf/psycopg_binary-3.2.9-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:98bbe35b5ad24a782c7bf267596638d78aa0e87abc7837bdac5b2a2ab954179e", size = 4017127, upload-time = "2025-05-13T16:08:21.391Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/00/7e181fb1179fbfc24493738b61efd0453d4b70a0c4b12728e2b82db355fd/psycopg_binary-3.2.9-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:72691a1615ebb42da8b636c5ca9f2b71f266be9e172f66209a361c175b7842c5", size = 4080322, upload-time = "2025-05-13T16:08:24.049Z" },
+    { url = "https://files.pythonhosted.org/packages/58/fd/94fc267c1d1392c4211e54ccb943be96ea4032e761573cf1047951887494/psycopg_binary-3.2.9-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:25ab464bfba8c401f5536d5aa95f0ca1dd8257b5202eede04019b4415f491351", size = 4655097, upload-time = "2025-05-13T16:08:27.376Z" },
+    { url = "https://files.pythonhosted.org/packages/41/17/31b3acf43de0b2ba83eac5878ff0dea5a608ca2a5c5dd48067999503a9de/psycopg_binary-3.2.9-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0e8aeefebe752f46e3c4b769e53f1d4ad71208fe1150975ef7662c22cca80fab", size = 4482114, upload-time = "2025-05-13T16:08:30.781Z" },
+    { url = "https://files.pythonhosted.org/packages/85/78/b4d75e5fd5a85e17f2beb977abbba3389d11a4536b116205846b0e1cf744/psycopg_binary-3.2.9-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b7e4e4dd177a8665c9ce86bc9caae2ab3aa9360b7ce7ec01827ea1baea9ff748", size = 4737693, upload-time = "2025-05-13T16:08:34.625Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/95/7325a8550e3388b00b5e54f4ced5e7346b531eb4573bf054c3dbbfdc14fe/psycopg_binary-3.2.9-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7fc2915949e5c1ea27a851f7a472a7da7d0a40d679f0a31e42f1022f3c562e87", size = 4437423, upload-time = "2025-05-13T16:08:37.444Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/db/cef77d08e59910d483df4ee6da8af51c03bb597f500f1fe818f0f3b925d3/psycopg_binary-3.2.9-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a1fa38a4687b14f517f049477178093c39c2a10fdcced21116f47c017516498f", size = 3758667, upload-time = "2025-05-13T16:08:40.116Z" },
+    { url = "https://files.pythonhosted.org/packages/95/3e/252fcbffb47189aa84d723b54682e1bb6d05c8875fa50ce1ada914ae6e28/psycopg_binary-3.2.9-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:5be8292d07a3ab828dc95b5ee6b69ca0a5b2e579a577b39671f4f5b47116dfd2", size = 3320576, upload-time = "2025-05-13T16:08:43.243Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/cd/9b5583936515d085a1bec32b45289ceb53b80d9ce1cea0fef4c782dc41a7/psycopg_binary-3.2.9-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:778588ca9897b6c6bab39b0d3034efff4c5438f5e3bd52fda3914175498202f9", size = 3411439, upload-time = "2025-05-13T16:08:47.321Z" },
+    { url = "https://files.pythonhosted.org/packages/45/6b/6f1164ea1634c87956cdb6db759e0b8c5827f989ee3cdff0f5c70e8331f2/psycopg_binary-3.2.9-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:f0d5b3af045a187aedbd7ed5fc513bd933a97aaff78e61c3745b330792c4345b", size = 3477477, upload-time = "2025-05-13T16:08:51.166Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/1d/bf54cfec79377929da600c16114f0da77a5f1670f45e0c3af9fcd36879bc/psycopg_binary-3.2.9-cp313-cp313-win_amd64.whl", hash = "sha256:2290bc146a1b6a9730350f695e8b670e1d1feb8446597bed0bbe7c3c30e0abcb", size = 2928009, upload-time = "2025-05-13T16:08:53.67Z" },
+]
+[[package]]
+name = "psycopg-pool"
+version = "3.2.6"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/cf/13/1e7850bb2c69a63267c3dbf37387d3f71a00fd0e2fa55c5db14d64ba1af4/psycopg_pool-3.2.6.tar.gz", hash = "sha256:0f92a7817719517212fbfe2fd58b8c35c1850cdd2a80d36b581ba2085d9148e5", size = 29770, upload-time = "2025-02-26T12:03:47.129Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/47/fd/4feb52a55c1a4bd748f2acaed1903ab54a723c47f6d0242780f4d97104d4/psycopg_pool-3.2.6-py3-none-any.whl", hash = "sha256:5887318a9f6af906d041a0b1dc1c60f8f0dda8340c2572b74e10907b51ed5da7", size = 38252, upload-time = "2025-02-26T12:03:45.073Z" },
+]
+[[package]]
+name = "sdnotify"
+version = "0.3.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/d8/9fdc36b2a912bf78106de4b3f0de3891ff8f369e7a6f80be842b8b0b6bd5/sdnotify-0.3.2.tar.gz", hash = "sha256:73977fc746b36cc41184dd43c3fe81323e7b8b06c2bb0826c4f59a20c56bb9f1", size = 2459, upload-time = "2017-08-02T20:03:44.395Z" }
+[[package]]
+name = "systemd-python"
+version = "235"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/10/9e/ab4458e00367223bda2dd7ccf0849a72235ee3e29b36dce732685d9b7ad9/systemd-python-235.tar.gz", hash = "sha256:4e57f39797fd5d9e2d22b8806a252d7c0106c936039d1e71c8c6b8008e695c0a", size = 61677, upload-time = "2023-02-11T13:42:16.588Z" }
+[[package]]
+name = "systemd-socketserver"
+version = "1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "systemd-python" },
+]
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d8/4f/b28b7f08880120a26669b080ca74487c8c67e8b54dcb0467a8f0c9f38ed6/systemd_socketserver-1.0-py3-none-any.whl", hash = "sha256:987a8bfbf28d959e7c2966c742ad7bad482f05e121077defcf95bb38267db9a8", size = 3248, upload-time = "2020-04-26T05:26:40.661Z" },
+]
+[[package]]
+name = "typing-extensions"
+version = "4.13.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f6/37/23083fcd6e35492953e8d2aaaa68b860eb422b34627b13f2ce3eb6106061/typing_extensions-4.13.2.tar.gz", hash = "sha256:e6c81219bd689f51865d9e372991c540bda33a0379d5573cddb9a3a23f7caaef", size = 106967, upload-time = "2025-04-10T14:19:05.416Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/8b/54/b1ae86c0973cc6f0210b53d508ca3641fb6d0c56823f288d108bc7ab3cc8/typing_extensions-4.13.2-py3-none-any.whl", hash = "sha256:a439e7c04b49fec3e5d3e2beaa21755cadbbdc391694e28ccdd36ca4a1408f8c", size = 45806, upload-time = "2025-04-10T14:19:03.967Z" },
+]
+[[package]]
+name = "tzdata"
+version = "2025.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/95/32/1a225d6164441be760d75c2c42e2780dc0873fe382da3e98a2e1e48361e5/tzdata-2025.2.tar.gz", hash = "sha256:b60a638fcc0daffadf82fe0f57e53d06bdec2f36c4df66280ae79bce6bd6f2b9", size = 196380, upload-time = "2025-03-23T13:54:43.652Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5c/23/c7abc0ca0a1526a0774eca151daeb8de62ec457e77262b66b359c3c7679e/tzdata-2025.2-py2.py3-none-any.whl", hash = "sha256:1a403fada01ff9221ca8044d701868fa132215d84beb92242d9acd2147f667a8", size = 347839, upload-time = "2025-03-23T13:54:41.845Z" },
+]
diff --git a/hosts/surtr/http/default.nix b/hosts/surtr/http/default.nix
index f3a7154e..ea527cb5 100644
--- a/hosts/surtr/http/default.nix
+++ b/hosts/surtr/http/default.nix
@@ -13,8 +13,6 @@
      recommendedTlsSettings = true;
      sslDhparam = config.security.dhparams.params.nginx.path;
      commonHttpConfig = ''
-        ssl_ecdh_curve X448:X25519:prime256v1:secp521r1:secp384r1;
        log_format main
                '$remote_addr "$remote_user" '
                '"$host" "$request" $status $bytes_sent '
diff --git a/hosts/surtr/kimai.nix b/hosts/surtr/kimai.nix
new file mode 100644
index 00000000..454b3d80
--- /dev/null
+++ b/hosts/surtr/kimai.nix
@@ -0,0 +1,68 @@
+{ config, ... }:
+{
+  config = {
+    security.acme.rfc2136Domains = {
+      "kimai.yggdrasil.li" = {
+        restartUnits = ["nginx.service"];
+      };
+    };
+    services.nginx = {
+      upstreams."kimai" = {
+        servers = {
+          "[2a03:4000:52:ada:6::2]:80" = {};
+        };
+        extraConfig = ''
+          keepalive 8;
+        '';
+      };
+      virtualHosts = {
+        "kimai.yggdrasil.li" = {
+          kTLS = true;
+          http3 = true;
+          forceSSL = true;
+          sslCertificate = "/run/credentials/nginx.service/kimai.yggdrasil.li.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/kimai.yggdrasil.li.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/kimai.yggdrasil.li.chain.pem";
+          extraConfig = ''
+            charset utf-8;
+          '';
+          locations = {
+            "/".extraConfig = ''
+              proxy_pass http://kimai;
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+              proxy_redirect off;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Host $server_name;
+              proxy_set_header X-Forwarded-Proto $scheme;
+              client_max_body_size 0;
+              proxy_request_buffering off;
+              proxy_buffering off;
+              proxy_read_timeout 300;
+            '';
+          };
+        };
+      };
+    };
+    systemd.services.nginx = {
+      serviceConfig = {
+        LoadCredential = [
+          "kimai.yggdrasil.li.key.pem:${config.security.acme.certs."kimai.yggdrasil.li".directory}/key.pem"
+          "kimai.yggdrasil.li.pem:${config.security.acme.certs."kimai.yggdrasil.li".directory}/fullchain.pem"
+          "kimai.yggdrasil.li.chain.pem:${config.security.acme.certs."kimai.yggdrasil.li".directory}/chain.pem"
+        ];
+      };
+    };
+  };
+}
diff --git a/hosts/surtr/postgresql/default.nix b/hosts/surtr/postgresql/default.nix
index 059f4088..3786ea7c 100644
--- a/hosts/surtr/postgresql/default.nix
+++ b/hosts/surtr/postgresql/default.nix
@@ -280,6 +280,64 @@ in {
          CREATE VIEW imap_user ("user", "password", quota_rule) AS SELECT mailbox.mailbox AS "user", "password", quota_rule FROM mailbox_quota_rule INNER JOIN mailbox ON mailbox_quota_rule.mailbox = mailbox.mailbox;
          COMMIT;
+          BEGIN;
+          SELECT _v.register_patch('013-internal', ARRAY['000-base'], null);
+          ALTER TABLE mailbox_mapping ADD COLUMN internal bool NOT NULL DEFAULT false;
+          CREATE TABLE mailbox_mapping_access (
+            id uuid PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
+            mailbox_mapping uuid REFERENCES mailbox_mapping(id),
+            mailbox uuid REFERENCES mailbox(id)
+          );
+          CREATE USER "postfix-internal-policy";
+          GRANT CONNECT ON DATABASE "email" TO "postfix-internal-policy";
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO "postfix-internal-policy";
+          GRANT SELECT ON ALL TABLES IN SCHEMA public TO "postfix-internal-policy";
+          COMMIT;
+          BEGIN;
+          SELECT _v.register_patch('014-relay', ARRAY['000-base'], null);
+          CREATE TABLE relay_access (
+            id uuid PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
+            mailbox uuid REFERENCES mailbox(id),
+            domain citext NOT NULL CONSTRAINT domain_non_empty CHECK (domain <> ''')
+          );
+          COMMIT;
+          BEGIN;
+          SELECT _v.register_patch('015-relay-unique', ARRAY['000-base', '014-relay'], null);
+          CREATE UNIQUE INDEX relay_unique ON relay_access (mailbox, domain);
+          COMMIT;
+          BEGIN;
+          SELECT _v.register_patch('015-sender_bcc', null, null);
+          CREATE TABLE sender_bcc_maps (
+            id uuid PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
+            key text NOT NULL CONSTRAINT key_not_empty CHECK (key <> '''),
+            value text NOT NULL CONSTRAINT value_not_empty CHECK (value <> '''),
+            CONSTRAINT key_unique UNIQUE (key)
+          );
+          COMMIT;
+          BEGIN;
+          SELECT _v.register_patch('016-recipient_bcc', null, null);
+          CREATE TABLE recipient_bcc_maps (
+            id uuid PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
+            key text NOT NULL CONSTRAINT key_not_empty CHECK (key <> '''),
+            value text NOT NULL CONSTRAINT value_not_empty CHECK (value <> '''),
+            CONSTRAINT recipient_bcc_maps_key_unique UNIQUE (key)
+          );
+          COMMIT;
        ''}
        psql etebase postgres -eXf ${pkgs.writeText "etebase.sql" ''
diff --git a/hosts/surtr/tls/default.nix b/hosts/surtr/tls/default.nix
index b1c05888..b25bd2ea 100644
--- a/hosts/surtr/tls/default.nix
+++ b/hosts/surtr/tls/default.nix
@@ -41,7 +41,7 @@ in {
      acceptTerms = true;
      # DNS challenge is slow
-      preliminarySelfsigned = true;
+      # preliminarySelfsigned = true;
      defaults = {
        email = "phikeebaogobaegh@141.li";
        # We don't like NIST curves and Let's Encrypt doesn't support
diff --git a/hosts/surtr/tls/tsig_keys/audiobookshelf.yggdrasil.li b/hosts/surtr/tls/tsig_keys/audiobookshelf.yggdrasil.li
new file mode 100644
index 00000000..8dd610dd
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/audiobookshelf.yggdrasil.li
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:r9jhdTlbDnCMq1QLJutn76uz1Ml8MFs7fXYRSiVYh1gafcXXsUZBq5+qqoQI,iv:un/luttuKpCiMf53fa2SRY0ffttGiYwT8DuHCKEnnEI=,tag:SkNULZSulQmP99aB/Ec+Fw==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkZGJzaEsrSU4raHlTVDVB\nczRnWVlSTTRuNXU0T3F1RTkxKytXeVJRdGpFCk9WMzNBR1NaTTMzN3BGQ2JmTjVt\nRU4rSWxCYjJPYVRzLzR0OVRYQm45TUkKLS0tIDNyMnpPN2VKUFFadTkveXRYeWps\nYUNaTjRJLzdWUnREaUVIWkpFV0FTZ2MKJS0K49SdkLW4p67FlgboHy/OVvCiUA7g\nuv5b+yotkQmh5xJwr7CUvwRewqJh56mg1yhWmE8wzpgLZMIjRXcQCQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQQ1h3M1lXTXVNd0d6cmtU\nU2JtUzFFblJudmEycnJONkkwME9wWm5jWVFzCnRYVEFWaVNvSW9GZ05TRWF4L2ho\nanltVytEU3ZOdHk1VHY5aGJDUkdDdmcKLS0tIEtzOFVkbmpjbWN5d0c1VEpxc1Rr\nSzJwclYxeC9TVWNaK2gwUmJSY0x1ZVUKTNivp5iS+1tzVMjMn17/ncvHcELhjQ/B\n0OVz4VpKM2wv6CjEcIMxmchqT8p8GFYVRrKUdqO2GEKOoe8ANtidWA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-09T17:07:16Z",
+                "mac": "ENC[AES256_GCM,data:SwS+8UQnPgHORobKLu+u2pNaMdKIvR+etUed8btbbne/IX/Wpxt0qyPYXNNGGRkN3KAxTHWjRRdrKU1bkuTU3ER1c94T935ExDESKJLVjzaEF5VSWCqLyUNCMsY2ANw84UES2swK4YI4zF1CP7rD8tKFFld78IWZoeQ7XNGDMRA=,iv:neLvamISgQ5+aqW1iRj9xJoXq1weNNyy7KCFG2+WRQE=,tag:66SDO61WnKU6DVElo9CImg==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/surtr/tls/tsig_keys/kimai.yggdrasil.li b/hosts/surtr/tls/tsig_keys/kimai.yggdrasil.li
new file mode 100644
index 00000000..b9199975
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/kimai.yggdrasil.li
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:ATcU3Ix7o5d/49rD5H8je1ozTjoghrloMh5DIZ5WE3oYauUAknpGfr9xq92V,iv:vy9YK5Ot7CCjMtgAGVeAUQuaSw4F5kmmZ0GJYV9kCdQ=,tag:F/MXTUM2AI1fGXa9Ewn8yQ==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDMEF0cUdydERYVzJCa3pW\nTlo0NUFON0d5RGJFVnVTNVg3cjNEUERQMEdFClEvQW5odlNEd2F1VTFmMWQrL2RB\ncllFZVpIVVJrNTJsSGF4UEdZMnVmQzAKLS0tIFUrQkkzRVZiOFNiTnFCT1pEYVRM\nQm8wV1JkQ3RrR1dkL0FsNkhsY2kxa1kKGnAo/6oibgXexUU31THdLu6X+pRtrkjD\nZnXGPZ2xaESDVUVEYQPVpNrjt9brZGJBI1BasrkEwHAXMbJC236yYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3MGs1Z2ZqK2pqWHdVYTJH\naTlncHdPa3Zld0JhQW5Ccmc1SStWSnlDR0JrCmpML2d4TGdldUdoZCtaWVpPZVl0\nVm4waWVBS1orRS90ZS96N0Y2M29LY0UKLS0tIEI1Z2VVbVVxRUpOZEN4NnBRRklC\nQXloelZCb04xbmduTlVuL005TlRGMHMKfLB6zA3sj3HgDBC7VGfGVB6I1zJpt0PV\nkCV2yADgvAA2pT9HPg9IWAEpTPysOBiuE2jPNtFvylZYwTDHoumFnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-24T09:42:23Z",
+                "mac": "ENC[AES256_GCM,data:0pk1LpWPmX9td/TwJFxwWp5pTDyW78UtHXMDah+V9Tmgi8hH7ONdysgjwpDwS/c4zGnMA3qtobEL286U3//CTXt2qVsiUGLsnngzs2E6yBg8oGMYlGrch4M355Fl5ZxYsc8QLA6qWcuZ4H3QW8PnoqdJixcHoYLoxG01dzh4Bc0=,iv:zchk4enI1D80BkJLji5RLm7OTk3GeF8nYHuwqBxCXIM=,tag:bgkknPMqkSidi6bDFfv6UQ==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/surtr/vpn/default.nix b/hosts/surtr/vpn/default.nix
index 1bdcf74e..92223144 100644
--- a/hosts/surtr/vpn/default.nix
+++ b/hosts/surtr/vpn/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, config, lib, ... }:
+{ flake, pkgs, config, lib, ... }:
 with lib;
@@ -22,7 +22,11 @@ in {
        "--load-credential=surtr.priv:/run/credentials/container@vpn.service/surtr.priv"
        "--network-ipvlan=ens3:upstream"
      ];
-      config = {
+      config = let hostConfig = config; in { config, pkgs, ... }: {
+        system.stateVersion = lib.mkIf hostConfig.containers."vpn".ephemeral config.system.nixos.release;
+        system.configurationRevision = mkIf (flake ? rev) flake.rev;
+        nixpkgs.pkgs = hostConfig.nixpkgs.pkgs;
        boot.kernel.sysctl = {
          "net.core.rmem_max" = 4194304;
          "net.core.wmem_max" = 4194304;
diff --git a/hosts/surtr/vpn/geri.pub b/hosts/surtr/vpn/geri.pub
index ed5de2b2..2cd9b24e 100644
--- a/hosts/surtr/vpn/geri.pub
+++ b/hosts/surtr/vpn/geri.pub
@@ -1 +1 @@
-sYuQSNZHzfegv8HRz71jnZm2nFLGeRnaGwVonhKUj2k=
+hhER05bvstOTGfiAG3IJsFkBNWCUZHokBXwaiC5d534=
diff --git a/hosts/vidhar/audiobookshelf/abs-podcast-autoplaylist-gkleen.toml b/hosts/vidhar/audiobookshelf/abs-podcast-autoplaylist-gkleen.toml
new file mode 100644
index 00000000..42920069
--- /dev/null
+++ b/hosts/vidhar/audiobookshelf/abs-podcast-autoplaylist-gkleen.toml
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:7STcG1J3zLHzlHi2LZgSa+pmKlYU6X1eLvjXcx7gvCuHFkXwa/ldrHdzaBXAMrQ+C+DWM4+cyhdal3ypxXueBuBEvH3P7/KofPP2A519sdZo1vDkXCzYRD3Ow74M+hX5ej6hL1mv21HayrRMPnYfH8HUWk1kd/y69EjpjvDHyCpQuw1WG5M4FDUaTd4Vh51QRCSG/Is29dEkvQowhIvNqnAR4KW9PpfjlbUPHauZ6PQLnlJmI9QCcAGJ8hHtp5T+xctTym82GAlXugTJpHnkqcxnGteu9H7UuiDMQ3aKKGYzZCpWkNHrbD1IRhzPzSjVlN2nIX3Ydp8ENNf61EGOrp5hzmV0MhwRHKfz5rE1FRVuyHcwhwBdJzfhzrL9zXZYzn9Zuf9KWwsF+1+58i9u9hPym63r4c1+RbMjNKzHc1/yhhsRDCrTwvMd/Hc6KfUi3H1wW/r02Va2bOCkYrOkWIQpBdx4ThMgkTaHr94DBMqT8n3Fzhc7+uaUsl6I9gMwTn8QCV3g4U7Mp3+/gnQLOdsCTgKr69x1iPfp7jzzbC29MWhIk+2aig+iWRMVT0n4AWIxooc3cYnfOJNtCdJwKuPUl4xNlZ22NK3XQfxBURSw0pi5KyDO1wgTVRoRJMnXZyin3bZ10OU8QKBqLp22FXpG/+mHrm3Y6yLkqfIP5ry+b86Rb7nWJlxDTwTGSoGi8sJzwNb+H9ioG7LjaSmvr7V+2aSq0+72WopAkIFSBq/yIWX3J/rNZuia6jKMY/8bSLDJz3V/YuzeUJ5feUkOS4KW1J1UkaYd6XxZ9Y8szCS/B7Ocz0YiV8fHmOzZKRn8BTmmXUIoyxO07MmwQ1shYfiVCwXjdjq2f3/CZbXNVOPvhGBYOcutUztftu3H9DRDTKrVae1TnztCVSkBSk1o52uSj0r8t6f4l1r7UG1TviOnVLVh1/6iiJVQey0m8G6ugw22zxfhI0Uea/rB70i+2UuoxrmsOfg+TgnvKBuakEBifp4rx0S5wyz05RYXkBLJTIwi2fVGmulqjZuCQNQnI3cfPI+oGcykob9IQqdo/Dwd118hNPVAwdDHyaiGXGh8eu8N2OCLQxlGZDtkVUveaEasJaZ0WWWaK97FUeoNJfUnB7Y3lNjv5u2rzviZyk4=,iv:jT21FNnHod6btDlBa3UflK3au5VmcsABs5OTMXF6oFA=,tag:Oh8cOL+edT5Wp0I1L5+vwg==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0aE1XNUNCM1Q5V0d3R2JG\nbjJZTmdvQ21JbmtyR0ZmODFMdVBGejRoam1vCjMzMGdTb3BReDVCa2JJU0JrSHFP\ndTdicU5TRjIrTWpteDMzeGtDT0xaelkKLS0tIFhaSlFrbzFDUjRZV0lGR0cydVdZ\nY2xma0VSVXlTM1JucFJUSys4dlRvdEUK9gQNQEdKDDf1ikWzd6uTlE50WsfO/EB0\nGH2Ono6oNWbKWTyl/wRO8NzXx0nudwqq66s0oBLIdTMQOpIBBNI0XQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiRWFqSHNlY1IvMkkwaEto\ncHZHa2p1Y25SakFkS2JYMlRFcFhnZGY1dVRFCkxSWmxvcHZMampQKzdKRHI0ZVMx\nUTFtR0pHbzFaQ0xQUFA2ZERDSWpwS0UKLS0tIFBaSGczY3VWdy9TKzRDZWZ2SElY\nbVQ4dDNhQllmVmViWGs5c3V4TmNscjQKeugevQJFAN/8JrzeAm4hm2JsQGb26BCb\n3dKYnN1kJU7oVHr1aVfXwMpELNYt9poX6WTY2h9lsdHuRlqoFXAA5Q==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-08-11T07:08:36Z",
+                "mac": "ENC[AES256_GCM,data:ZL/dOz+NC8sr8vPBsux+gFOWxUhQqMSmG1az7udhB0ckmOXtnrPBzMM1gs+5pwXLvfLux0m4xzT87+o87axIECnCq35FSuMjtEBK24OUJXsLG/q/tDv5dfRBy/976dM5W7YkBVX/uc03p8CLKf5w4XYNeRKnSwjLvWGd9runDOU=,iv:9ZIeJ5aDVVPHi3/oHqWkWtEfeivV/nFFyQ1lJWJwMu8=,tag:TfkHaopMa+Z0zk38A6/NTA==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/vidhar/audiobookshelf/default.nix b/hosts/vidhar/audiobookshelf/default.nix
new file mode 100644
index 00000000..136bcaff
--- /dev/null
+++ b/hosts/vidhar/audiobookshelf/default.nix
@@ -0,0 +1,21 @@
+{ config, pkgs, lib, ... }:
+{
+  config = {
+    services.audiobookshelf = {
+      enable = true;
+      host = "2a03:4000:52:ada:4:1::";
+      port = 28982;
+    };
+    users.groups.audiobookshelf.members = [ "gkleen" ];
+    services.abs-podcast-autoplaylist = {
+      gkleen = {};
+    };
+    sops.secrets.${config.services.abs-podcast-autoplaylist.gkleen.configSecret} = {
+      format = "binary";
+      sopsFile = ./abs-podcast-autoplaylist-gkleen.toml;
+    };
+  };
+}
diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix
index 90ab40dd..1c60ed22 100644
--- a/hosts/vidhar/default.nix
+++ b/hosts/vidhar/default.nix
@@ -4,7 +4,7 @@ with lib;
 {
  imports = with flake.nixosModules.systemProfiles; [
-    ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix ./paperless ./hledger
+    ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix ./paperless ./hledger ./audiobookshelf ./kimai
    tmpfs-root zfs
    initrd-all-crypto-modules default-locale openssh rebuild-machines
    build-server
@@ -136,7 +136,7 @@ with lib;
      wantedBy = ["basic.target"];
      serviceConfig = {
        ExecStart = pkgs.writeShellScript "limit-pstate-start" ''
-          echo 50 > /sys/devices/system/cpu/intel_pstate/max_perf_pct
+          echo 40 > /sys/devices/system/cpu/intel_pstate/max_perf_pct
        '';
        RemainAfterExit = true;
        ExecStop = pkgs.writeShellScript "limit-pstate-stop" ''
@@ -157,8 +157,6 @@ with lib;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
      commonHttpConfig = ''
-        ssl_ecdh_curve X25519:prime256v1:secp521r1:secp384r1;
        log_format main
                '$remote_addr "$remote_user" '
                '"$host" "$request" $status $bytes_sent '
diff --git a/hosts/vidhar/kimai/default.nix b/hosts/vidhar/kimai/default.nix
new file mode 100644
index 00000000..0258697b
--- /dev/null
+++ b/hosts/vidhar/kimai/default.nix
@@ -0,0 +1,89 @@
+{ flake, config, ... }:
+{
+  config = {
+    boot.enableContainers = true;
+    boot.kernel.sysctl = {
+      "net.netfilter.nf_log_all_netns" = true;
+    };
+    containers."kimai" = {
+      autoStart = true;
+      ephemeral = true;
+      bindMounts = {
+        "/var/lib/kimai" = {
+          hostPath = "/var/lib/kimai/state";
+          isReadOnly = false;
+        };
+        "/var/lib/mysql" = {
+          hostPath = "/var/lib/kimai/mysql";
+          isReadOnly = false;
+        };
+      };
+      privateNetwork = true;
+      # forwardPorts = [
+      #   { containerPort = 80;
+      #     hostPort = 28983;
+      #   }
+      # ];
+      hostAddress = "192.168.52.113";
+      localAddress = "192.168.52.114";
+      hostAddress6 = "2a03:4000:52:ada:6::1";
+      localAddress6 = "2a03:4000:52:ada:6::2";
+      config = let hostConfig = config; in { config, pkgs, lib, ... }: {
+        system.stateVersion = lib.mkIf hostConfig.containers."kimai".ephemeral config.system.nixos.release;
+        system.configurationRevision = lib.mkIf (flake ? rev) flake.rev;
+        nixpkgs.pkgs = hostConfig.nixpkgs.pkgs;
+        services.kimai.sites."kimai.yggdrasil.li" = {
+          database.socket = "/run/mysqld/mysqld.sock";
+        };
+        networking = {
+          useDHCP = false;
+          useNetworkd = true;
+          useHostResolvConf = false;
+          firewall.enable = false;
+          nftables = {
+            enable = true;
+            rulesetFile = ./ruleset.nft;
+          };
+        };
+        services.resolved.fallbackDns = [
+          "9.9.9.10#dns10.quad9.net"
+          "149.112.112.10#dns10.quad9.net"
+          "2620:fe::10#dns10.quad9.net"
+          "2620:fe::fe:10#dns10.quad9.net"
+        ];
+        systemd.network = {
+          networks.upstream = {
+            name = "eth0";
+            matchConfig = {
+              Name = "eth0";
+            };
+            linkConfig = {
+              RequiredForOnline = true;
+            };
+            networkConfig = {
+              Address = [ "192.168.52.114/32" "2a03:4000:52:ada:6::2/128" ];
+              LLMNR = false;
+              MulticastDNS = false;
+            };
+            routes = [
+              { Destination = "192.168.52.113/32"; }
+              { Destination = "2a03:4000:52:ada:6::1/128"; }
+              { Destination = "0.0.0.0/0";
+                Gateway = "192.168.52.113";
+              }
+              { Destination = "::/0";
+                Gateway = "2a03:4000:52:ada:6::1";
+              }
+            ];
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/vidhar/kimai/ruleset.nft b/hosts/vidhar/kimai/ruleset.nft
new file mode 100644
index 00000000..ad4db6d5
--- /dev/null
+++ b/hosts/vidhar/kimai/ruleset.nft
@@ -0,0 +1,149 @@
+define icmp_protos = {ipv6-icmp, icmp, igmp}
+table arp filter {
+  limit lim_arp {
+    rate over 50 mbytes/second burst 50 mbytes
+  }
+  counter arp-rx {}
+  counter arp-tx {}
+  counter arp-ratelimit-rx {}
+  counter arp-ratelimit-tx {}
+  chain input {
+    type filter hook input priority filter
+    policy accept
+    limit name lim_arp counter name arp-ratelimit-rx drop
+    counter name arp-rx
+  }
+  chain output {
+    type filter hook output priority filter
+    policy accept
+    limit name lim_arp counter name arp-ratelimit-tx drop
+    counter name arp-tx
+  }
+}
+table inet filter {
+  limit lim_reject {
+    rate over 1000/second burst 1000 packets
+  }
+  limit lim_icmp {
+    rate over 50 mbytes/second burst 50 mbytes
+  }
+  counter invalid-fw {}
+  counter fw-lo {}
+  counter reject-ratelimit-fw {}
+  counter reject-fw {}
+  counter reject-tcp-fw {}
+  counter reject-icmp-fw {}
+  counter drop-fw {}
+  counter invalid-rx {}
+  counter rx-lo {}
+  counter invalid-local4-rx {}
+  counter invalid-local6-rx {}
+  counter icmp-ratelimit-rx {}
+  counter icmp-rx {}
+  counter kimai-rx {}
+  counter established-rx {}
+  counter reject-ratelimit-rx {}
+  counter reject-rx {}
+  counter reject-tcp-rx {}
+  counter reject-icmp-rx {}
+  counter drop-rx {}
+  counter tx-lo {}
+  counter icmp-ratelimit-tx {}
+  counter icmp-tx {}
+  counter kimai-tx {}
+  counter tx {}
+  chain forward {
+    type filter hook forward priority filter
+    policy drop
+    ct state invalid log level debug prefix "kimai: drop invalid forward: " counter name invalid-fw drop
+    iifname lo counter name fw-lo accept
+    limit name lim_reject log level debug prefix "kimai: drop forward: " counter name reject-ratelimit-fw drop
+    log level debug prefix "kimai: reject forward: " counter name reject-fw
+    meta l4proto tcp ct state new counter name reject-tcp-fw reject with tcp reset
+    ct state new counter name reject-icmp-fw reject
+    counter name drop-fw
+  }
+  chain input {
+    type filter hook input priority filter
+    policy drop
+    ct state invalid log level debug prefix "kimai: drop invalid input: " counter name invalid-rx drop
+    iifname lo counter name rx-lo accept
+    iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
+    iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
+    meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-rx drop
+    meta l4proto $icmp_protos counter name icmp-rx accept
+    tcp dport 80 counter name kimai-rx accept
+    ct state { established, related } counter name established-rx accept
+    limit name lim_reject log level debug prefix "kimai: drop input: " counter name reject-ratelimit-rx drop
+    log level debug prefix "kimai: reject input: " counter name reject-rx
+    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
+    ct state new counter name reject-icmp-rx reject
+    counter name drop-rx
+  }
+  chain output {
+    type filter hook output priority filter
+    policy accept
+    oifname lo counter name tx-lo accept
+    meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-tx drop
+    meta l4proto $icmp_protos counter name icmp-tx accept
+    tcp sport 80 counter name kimai-tx
+    counter name tx
+  }
+}
diff --git a/hosts/vidhar/network/default.nix b/hosts/vidhar/network/default.nix
index 0643f0bb..6fcef9d8 100644
--- a/hosts/vidhar/network/default.nix
+++ b/hosts/vidhar/network/default.nix
@@ -1,9 +1,9 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, config, ... }:
 with lib;
 {
-  imports = [ ./gpon.nix ./bifrost ./dhcp ];
+  imports = [ ./pppoe.nix ./bifrost ./dhcp ];
  config = {
    networking = {
@@ -61,7 +61,9 @@ with lib;
      firewall.enable = false;
      nftables = {
        enable = true;
-        rulesetFile = ./ruleset.nft;
+        rulesetFile = pkgs.replaceVars ./ruleset.nft {
+          inherit (config.networking) pppInterface;
+        };
      };
      resolvconf = {
@@ -103,7 +105,14 @@ with lib;
          /srv/nfs/nix-store 10.141.0.0/24(ro,async,root_squash) 2a03:4000:52:ada:1::/80(ro,async,root_squash)
        '';
      };
-      settings.nfsd.vers3 = false;
+      settings.nfsd = {
+        rdma = true;
+        vers3 = false;
+        vers4 = true;
+        "vers4.0" = false;
+        "vers4.1" = false;
+        "vers4.2" = true;
+      };
    };
    fileSystems = {
diff --git a/hosts/vidhar/network/dhcp/default.nix b/hosts/vidhar/network/dhcp/default.nix
index 07a83351..11460393 100644
--- a/hosts/vidhar/network/dhcp/default.nix
+++ b/hosts/vidhar/network/dhcp/default.nix
@@ -1,8 +1,33 @@
-{ flake, config, pkgs, lib, ... }:
+{ flake, config, pkgs, lib, sources, ... }:
 with lib;
-{
+let
+  nfsrootBaseUrl = "http://nfsroot.vidhar.yggdrasil";
+  tftpIp = "10.141.0.1";
+  nfsIp = tftpIp;
+  ipxe = pkgs.ipxe.override {
+    additionalTargets = {
+      "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
+    };
+    additionalOptions = [
+      "NSLOOKUP_CMD"
+      "PING_CMD"
+      "CONSOLE_CMD"
+    ];
+    embedScript = pkgs.writeText "yggdrasil.ipxe" ''
+      #!ipxe
+      cpair --background 9 1
+      cpair --background 9 3
+      cpair --background 9 6
+      set user-class iPXE-yggdrasil
+      autoboot
+    '';
+  };
+in {
  config = {
    services.kea = {
      dhcp4 = {
@@ -23,41 +48,67 @@ with lib;
          };
          client-classes = [
-            { name = "eostre-ipxe";
+            { name = "ipxe-eostre";
-              test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE'";
+              test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE-yggdrasil'";
-              next-server = "10.141.0.1";
+              next-server = tftpIp;
-              boot-file-name = "http://nfsroot.vidhar.yggdrasil/eostre/netboot.ipxe";
+              boot-file-name = "${nfsrootBaseUrl}/eostre.menu.ipxe";
+              only-if-required = true;
+            }
+            { name = "ipxe-yggdrasil";
+              test = "option[77].hex == 'iPXE-yggdrasil'";
+              next-server = tftpIp;
+              boot-file-name = "${nfsrootBaseUrl}/installer-x86_64-linux.menu.ipxe";
+              only-if-required = true;
+            }
+            { name = "uefi-http";
+              test = "option[client-system].hex == 0x0010";
+              option-data = [
+                { name = "vendor-class-identifier"; data = "HTTPClient"; }
+              ];
+              boot-file-name = "${nfsrootBaseUrl}/ipxe.efi";
+              only-if-required = true;
+            }
+            { name = "ipxe-uefi-64";
+              test = "option[77].hex == 'iPXE' and (substring(option[60].hex,0,20) == 'PXEClient:Arch:00007' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00008' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00009')";
+              boot-file-name = "${nfsrootBaseUrl}/ipxe.efi";
+              only-if-required = true;
+            }
+            { name = "ipxe-uefi-32";
+              test = "option[77].hex == 'iPXE' and (substring(option[60].hex,0,20) == 'PXEClient:Arch:00002' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00006')";
+              boot-file-name = "${nfsrootBaseUrl}/i386-ipxe.efi";
              only-if-required = true;
            }
-            { name = "ipxe";
+            { name = "ipxe-legacy";
-              test = "option[77].hex == 'iPXE'";
+              test = "option[77].hex == 'iPXE' and substring(option[60].hex,0,20) == 'PXEClient:Arch:00000'";
-              next-server = "10.141.0.1";
+              boot-file-name = "${nfsrootBaseUrl}/ipxe.lkrn";
-              boot-file-name = "http://nfsroot.vidhar.yggdrasil/installer-x86_64-linux/netboot.ipxe";
              only-if-required = true;
            }
            { name = "uefi-64";
              test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:00007' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00008' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00009'";
-              only-if-required = true;
              option-data = [
-                { name = "tftp-server-name"; data = "10.141.0.1"; }
+                { name = "tftp-server-name"; data = tftpIp; }
              ];
              boot-file-name = "ipxe.efi";
+              only-if-required = true;
            }
            { name = "uefi-32";
              test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:00002' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00006'";
-              only-if-required = true;
              option-data = [
-                { name = "tftp-server-name"; data = "10.141.0.1"; }
+                { name = "tftp-server-name"; data = tftpIp; }
              ];
              boot-file-name = "i386-ipxe.efi";
+              only-if-required = true;
            }
            { name = "legacy";
              test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:00000'";
-              only-if-required = true;
              option-data = [
-                { name = "tftp-server-name"; data = "10.141.0.1"; }
+                { name = "tftp-server-name"; data = tftpIp; }
              ];
-              boot-file-name = "undionly.kpxe";
+              boot-file-name = "ipxe.lkrn";
+              only-if-required = true;
            }
          ];
@@ -252,34 +303,78 @@ with lib;
          name = "nfsroot.vidhar.yggdrasil";
          paths =
            (map (system:
-               let
+              pkgs.symlinkJoin {
-                 installerBuild = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
+                name = "installer-${system}";
-                   modules = [
+                paths = [
-                     ({ ... }: {
+                  (builtins.addErrorContext "while evaluating installer-${system}-nfsroot" (let
-                       config.nfsroot.storeDevice = "10.141.0.1:nix-store";
+                    installerBuild' = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
-                       config.nfsroot.registrationUrl = "http://nfsroot.vidhar.yggdrasil/installer-${system}/registration";
+                      modules = [
-                     })
+                        ({ ... }: {
-                   ];
+                          config.nfsroot.storeDevice = "${nfsIp}:nix-store";
-                 }).config.system.build;
+                          config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/installer-${system}/registration";
-               in builtins.toPath (pkgs.runCommandLocal "install-${system}" {} ''
+                          config.system.nixos.label = "installer-${system}";
-                 mkdir -p $out/installer-${system}
+                        })
-                 install -m 0444 -t $out/installer-${system} \
+                      ];
-                   ${installerBuild.initialRamdisk}/initrd \
+                    });
-                   ${installerBuild.kernel}/bzImage \
+                    installerBuild = installerBuild'.config.system.build;
-                   ${installerBuild.netbootIpxeScript}/netboot.ipxe \
+                  in builtins.toPath (pkgs.runCommandLocal "installer-${system}" {} ''
-                   ${pkgs.closureInfo { rootPaths = installerBuild.storeContents; }}/registration
+                    mkdir -p $out/installer-${system}
-               '')
+                    install -m 0444 -t $out/installer-${system} \
-              ) ["x86_64-linux"]
+                      ${installerBuild.initialRamdisk}/initrd \
+                      ${installerBuild.kernel}/bzImage \
+                      ${installerBuild.netbootIpxeScript}/netboot.ipxe \
+                      ${pkgs.closureInfo { rootPaths = installerBuild.storeContents; }}/registration
+                    install -m 0444 ${pkgs.writeText "installer-${system}.menu.ipxe" ''
+                      #!ipxe
+                      :start
+                      menu iPXE boot menu for installer-${system}
+                      item installer ${with installerBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
+                      item memtest memtest86plus
+                      item netboot netboot.xyz
+                      item shell iPXE shell
+                      choose --timeout 0 --default installer selected || goto shell
+                      goto ''${selected}
+                      :shell
+                      shell
+                      goto start
+                      :installer
+                      chain installer-${system}/netboot.ipxe
+                      goto start
+                      :netboot
+                      iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
+                      goto start
+                      :memtest
+                      iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin
+                      goto start
+                    ''} $out/installer-${system}.menu.ipxe
+                  '')))
+                ];
+              }) ["x86_64-linux"]
            ) ++ [
-              (let
+              (pkgs.runCommandLocal "utils" {} ''
-                 eostreBuild = (flake.nixosConfigurations.eostre.extendModules {
+                mkdir $out
+                install -m 0444 -t $out \
+                  ${ipxe}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn} \
+                  ${pkgs.memtest86plus}/{memtest.efi,memtest.bin}
+                install -m 0444 ${sources.netbootxyz-efi.src} $out/netboot.xyz.efi
+                install -m 0444 ${sources.netbootxyz-lkrn.src} $out/netboot.xyz.lkrn
+              '')
+              (builtins.addErrorContext "while evaluating eostre" (let
+                 eostreBuild' = (flake.nixosConfigurations.eostre.extendModules {
                   modules = [
                     ({ ... }: {
-                       config.nfsroot.storeDevice = "10.141.0.1:nix-store";
+                       config.nfsroot.storeDevice = "${nfsIp}:nix-store";
-                       config.nfsroot.registrationUrl = "http://nfsroot.vidhar.yggdrasil/eostre/registration";
+                       config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/eostre/registration";
+                       config.system.nixos.label = "eostre";
                     })
                   ];
-                 }).config.system.build;
+                 });
+                 eostreBuild = eostreBuild'.config.system.build;
               in builtins.toPath (pkgs.runCommandLocal "eostre" {} ''
                    mkdir -p $out/eostre
                    install -m 0444 -t $out/eostre \
@@ -287,7 +382,39 @@ with lib;
                      ${eostreBuild.kernel}/bzImage \
                      ${eostreBuild.netbootIpxeScript}/netboot.ipxe \
                      ${pkgs.closureInfo { rootPaths = eostreBuild.storeContents; }}/registration
-                  ''))
+                    install -m 0444 ${pkgs.writeText "eostre.menu.ipxe" ''
+                      #!ipxe
+                      set menu-timeout 5000
+                      :start
+                      menu iPXE boot menu for eostre
+                      item eostre ${with eostreBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
+                      item memtest memtest86plus
+                      item netboot netboot.xyz
+                      item shell iPXE shell
+                      choose --timeout ''${menu-timeout} --default eostre selected || goto shell
+                      set menu-timeout 0
+                      goto ''${selected}
+                      :shell
+                      set menu-timeout 0
+                      shell
+                      goto start
+                      :eostre
+                      chain eostre/netboot.ipxe
+                      goto start
+                      :netboot
+                      iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
+                      goto start
+                      :memtest
+                      iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin
+                      goto start
+                    ''} $out/eostre.menu.ipxe
+                  '')))
            ];
        };
      };
@@ -298,20 +425,12 @@ with lib;
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig.ExecStart = let
-        ipxe = pkgs.ipxe.override {
-          additionalTargets = {
-            "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
-          };
-          additionalOptions = [
-            "NSLOOKUP_CMD"
-          ];
-        };
        tftpRoot = pkgs.runCommandLocal "netboot" {} ''
          mkdir -p $out
          install -m 0444 -t $out \
-            ${ipxe}/ipxe.efi ${ipxe}/i386-ipxe.efi ${ipxe}/undionly.kpxe
+            ${ipxe}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn}
        '';
-      in "${pkgs.atftp}/sbin/atftpd --daemon --no-fork --bind-address=10.141.0.1 ${tftpRoot}";
+      in "${pkgs.atftp}/sbin/atftpd --daemon --no-fork --bind-address=${tftpIp} ${tftpRoot}";
    };
  };
 }
diff --git a/hosts/vidhar/network/pap-secrets b/hosts/vidhar/network/pap-secrets
deleted file mode 100644
index 3516de6c..00000000
--- a/hosts/vidhar/network/pap-secrets
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-        "data": "ENC[AES256_GCM,data:BOyWdys7Oja54Ijv5j+kqufdokQe0onnqw/gVxpNOMf+YI/LlzJscaEtGqPh3ehVtYoSWGumCBPrjdq/zhYq4VV/PCtdeu3MnX1CH2B5bH0mFs0eXcqeGK6NErz/b5nEglv4Z19ig2CUDlbvi8h1zZAEjxTNKhT16ItCtJnBCsIoiMl2QcTTWMyh4a02v3wA1UrOQZvFuCgCHmRoBE6vpREyB23gQdrdKLk7D1LLw5C1aZnzQOhFsgs7bVjOcBnmwTao8ntXxw==,iv:X5FgYkl3DGA/lkRsoc+5XrK3Nlp/ldnFigpXpYNfSJE=,tag:qUH7m9NzuVNnOfr3rRgaOg==,type:str]",
-        "sops": {
-                "kms": null,
-                "gcp_kms": null,
-                "azure_kv": null,
-                "hc_vault": null,
-                "age": [
-                        {
-                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
-                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwYTFaTDZRbDd6cFBRSTNN\nVk1kcFJXRG9TT21IMDZsVmtoZjBTNDNjeDFzCkhxNEI2Ujd6SW1STG43eE5EdzZa\nS3phenJZN0RxajBXQ1BnbUhTa3htdFEKLS0tIGVlT3lReHJSQ2UvQ1FST0M0RzVP\nNmxWNzJmNlFPclJTeDUycDJiUzA4Yk0K4JHtkEPY49TGnKPZzEoEZ131RxeQEWkR\nK1ftH2ilr2tUhiErhpqxoTqfAm33xvruqTsePxh1uC7svzKtKBlS2g==\n-----END AGE ENCRYPTED FILE-----\n"
-                        }
-                ],
-                "lastmodified": "2021-11-15T08:30:09Z",
-                "mac": "ENC[AES256_GCM,data:TAgZ4ktdN9sZPMo1UtwjKdTM2QBjLorcm84HYXTGYNNEorPoqrXAWOvyWRLjx+zxzpRuDLBPQHCkjwkVO2CctxnTaWPMwITbYtQqj/5ZxACuAeX8MaSximB8s5MJK2faCuVXEnFehbnnPr5Fs8ZsgHwu2iH6DU8ScLEkgckzGV0=,iv:keUbKwWfoIIBsp5Rsm2lEba1ZHAozQY2YpA6p5qDBiU=,tag:1llGytMGvOjSVYKJXGUmXg==,type:str]",
-                "pgp": [
-                        {
-                                "created_at": "2023-01-30T10:58:50Z",
-                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdA+cwEt6Gv5oKvym4ceJek+J/5guNpmsLLXWIY5CCCSXUw\npXyQpqxm7LQnasIqYNNsNCVbB1mAu6WU6MKn0BG03YWjr8buLB+7PpwZcxeZzRfD\n0l4BAsl+vKwa2YSMCR+EWYSfeEzEVHqoGBJ60dYXuiFiNZInCik+g69PdhsGygNH\nRtIcRiCB8t94GkvdWySTq5ohi1wKOe224l9evbt4zXntVngCHxixuufLrr3Cj+EE\n=3lw4\n-----END PGP MESSAGE-----\n",
-                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
-                        }
-                ],
-                "unencrypted_suffix": "_unencrypted",
-                "version": "3.7.1"
-        }
-}
-\ No newline at end of file
diff --git a/hosts/vidhar/network/gpon.nix b/hosts/vidhar/network/pppoe.nix
index 1628159c..5cc84862 100644
--- a/hosts/vidhar/network/gpon.nix
+++ b/hosts/vidhar/network/pppoe.nix
@@ -8,7 +8,7 @@ in {
  options = {
    networking.pppInterface = mkOption {
      type = types.str;
-      default = "gpon";
+      default = "ppp";
    };
  };
@@ -26,14 +26,14 @@ in {
        nodefaultroute
        ifname ${pppInterface}
        lcp-echo-adaptive
-        lcp-echo-failure 5
+        lcp-echo-failure 10
        lcp-echo-interval 1
        maxfail 0
        mtu 1492
        mru 1492
        plugin pppoe.so
-        name telekom
+        user congstar
-        user 002576900250551137425220#0001@t-online.de
+        password congstar
        nic-telekom
        debug
        +ipv6
@@ -43,62 +43,55 @@ in {
      stopIfChanged = true;
      serviceConfig = {
+        Type = lib.mkForce "notify";
+        ExecStart = lib.mkForce "${getBin config.services.pppd.package}/sbin/pppd call telekom up_sdnotify nolog";
        PIDFile = "/run/pppd/${pppInterface}.pid";
      };
      restartTriggers = with config; [
        environment.etc."ppp/ip-pre-up".source
        environment.etc."ppp/ip-up".source
        environment.etc."ppp/ip-down".source
-        # sops.secrets."pap-secrets".sopsFile
      ];
    };
-    sops.secrets."pap-secrets" = {
-      format = "binary";
-      sopsFile = ./pap-secrets;
-      path = "/etc/ppp/pap-secrets";
-    };
    environment.etc = {
-      "ppp/ip-pre-up".source = let
+      "ppp/ip-pre-up".source = pkgs.resholve.writeScript "ip-pre-up" {
-        app = pkgs.writeShellApplication {
+        interpreter = pkgs.runtimeShell;
-          name = "ip-pre-up";
+        inputs = [ pkgs.iproute2 pkgs.ethtool ];
-          runtimeInputs = with pkgs; [ iproute2 ethtool ];
+        execer = [
-          text = ''
+          "cannot:${lib.getExe' pkgs.iproute2 "ip"}"
-            ethtool -K telekom tso off gso off gro off
+          "cannot:${lib.getExe' pkgs.iproute2 "tc"}"
+        ];
+      } ''
+        ethtool -K telekom tso off gso off gro off
-            ip link del "ifb4${pppInterface}" || true
+        ip link del "ifb4${pppInterface}" || true
-            ip link add name "ifb4${pppInterface}" type ifb
+        ip link add name "ifb4${pppInterface}" type ifb
-            ip link set "ifb4${pppInterface}" up
+        ip link set "ifb4${pppInterface}" up
-            tc qdisc del dev "ifb4${pppInterface}" root || true
+        tc qdisc del dev "ifb4${pppInterface}" root || true
-            tc qdisc del dev "${pppInterface}" ingress || true
+        tc qdisc del dev "${pppInterface}" ingress || true
-            tc qdisc del dev "${pppInterface}" root || true
+        tc qdisc del dev "${pppInterface}" root || true
-            tc qdisc add dev "${pppInterface}" handle ffff: ingress
+        tc qdisc add dev "${pppInterface}" handle ffff: ingress
-            tc filter add dev "${pppInterface}" parent ffff: basic action ctinfo dscp 0x0000003f 0x00000040 action mirred egress redirect dev "ifb4${pppInterface}"
+        tc filter add dev "${pppInterface}" parent ffff: basic action ctinfo dscp 0x0000003f 0x00000040 action mirred egress redirect dev "ifb4${pppInterface}"
-            tc qdisc replace dev "ifb4${pppInterface}" root cake memlimit 128Mb overhead 35 mpu 74 regional diffserv4 bandwidth 285mbit
+        tc qdisc replace dev "ifb4${pppInterface}" root cake memlimit 128Mb overhead 35 mpu 74 regional diffserv4 bandwidth ${toString (builtins.floor (177968 * 0.95))}kbit
-            tc qdisc replace dev "${pppInterface}" root cake memlimit 128Mb overhead 35 mpu 74 regional nat diffserv4 wash bandwidth 143mbit
+        tc qdisc replace dev "${pppInterface}" root cake memlimit 128Mb overhead 35 mpu 74 regional nat diffserv4 wash bandwidth ${toString (builtins.floor (41216 * 0.95))}kbit
-          '';
+      '';
-        };
+      "ppp/ip-up".source = pkgs.resholve.writeScript "ip-up" {
-      in "${app}/bin/${app.meta.mainProgram}";
+        interpreter = pkgs.runtimeShell;
-      "ppp/ip-up".source = let
+        inputs = [ pkgs.iproute2 ];
-        app = pkgs.writeShellApplication {
+        execer = [ "cannot:${lib.getExe' pkgs.iproute2 "ip"}" ];
-          name = "ip-up";
+      } ''
-          runtimeInputs = with pkgs; [ iproute2 ];
+        ip route add default via "$5" dev "${pppInterface}" metric 512
-          text = ''
+      '';
-            ip route add default via "$5" dev "${pppInterface}" metric 512
+      "ppp/ip-down".source = pkgs.resholve.writeScript "ip-down" {
-          '';
+        interpreter = pkgs.runtimeShell;
-        };
+        inputs = [ pkgs.iproute2 ];
-      in "${app}/bin/${app.meta.mainProgram}";
+        execer = [ "cannot:${lib.getExe' pkgs.iproute2 "ip"}" ];
-      "ppp/ip-down".source = let
+      } ''
-        app = pkgs.writeShellApplication {
+        ip link del "ifb4${pppInterface}"
-          name = "ip-down";
+      '';
-          runtimeInputs = with pkgs; [ iproute2 ];
-          text = ''
-            ip link del "ifb4${pppInterface}"
-          '';
-        };
-      in "${app}/bin/${app.meta.mainProgram}";
    };
    systemd.network.networks.${pppInterface} = {
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 1edae167..dd750394 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -5,15 +5,15 @@ table arp filter {
  limit lim_arp_local {
    rate over 50 mbytes/second burst 50 mbytes
  }
-  limit lim_arp_gpon {
+  limit lim_arp_ppp {
    rate over 7500 kbytes/second burst 7500 kbytes
  }
  counter arp-rx {}
  counter arp-tx {}
-  counter arp-ratelimit-gpon-rx {}
+  counter arp-ratelimit-ppp-rx {}
-  counter arp-ratelimit-gpon-tx {}
+  counter arp-ratelimit-ppp-tx {}
  counter arp-ratelimit-local-rx {}
  counter arp-ratelimit-local-tx {}
@@ -22,8 +22,8 @@ table arp filter {
    type filter hook input priority filter
    policy accept
-    iifname != gpon limit name lim_arp_local counter name arp-ratelimit-local-rx drop
+    iifname != @pppInterface@ limit name lim_arp_local counter name arp-ratelimit-local-rx drop
-    iifname gpon limit name lim_arp_gpon counter name arp-ratelimit-gpon-rx drop
+    iifname @pppInterface@ limit name lim_arp_ppp counter name arp-ratelimit-ppp-rx drop
    counter name arp-rx
  }
@@ -32,8 +32,8 @@ table arp filter {
    type filter hook output priority filter
    policy accept
-    oifname != gpon limit name lim_arp_local counter name arp-ratelimit-local-tx drop
+    oifname != @pppInterface@ limit name lim_arp_local counter name arp-ratelimit-local-tx drop
-    oifname gpon limit name lim_arp_gpon counter name arp-ratelimit-gpon-tx drop
+    oifname @pppInterface@ limit name lim_arp_ppp counter name arp-ratelimit-ppp-tx drop
    counter name arp-tx
  }
@@ -47,11 +47,11 @@ table inet filter {
  limit lim_icmp_local {
    rate over 50 mbytes/second burst 50 mbytes
  }
-  limit lim_icmp_gpon {
+  limit lim_icmp_ppp {
    rate over 7500 kbytes/second burst 7500 kbytes
  }
-  counter icmp-ratelimit-gpon-fw {}
+  counter icmp-ratelimit-ppp-fw {}
  counter icmp-ratelimit-local-fw {}
  counter icmp-fw {}
@@ -59,7 +59,8 @@ table inet filter {
  counter invalid-fw {}
  counter fw-lo {}
  counter fw-lan {}
-  counter fw-gpon {}
+  counter fw-ppp {}
+  counter fw-kimai {}
  counter fw-cups {}
@@ -74,7 +75,7 @@ table inet filter {
  counter invalid-local4-rx {}
  counter invalid-local6-rx {}
-  counter icmp-ratelimit-gpon-rx {}
+  counter icmp-ratelimit-ppp-rx {}
  counter icmp-ratelimit-local-rx {}
  counter icmp-rx {}
@@ -94,6 +95,8 @@ table inet filter {
  counter immich-rx {}
  counter paperless-rx {}
  counter hledger-rx {}
+  counter audiobookshelf-rx {}
+  counter kimai-rx {}
  counter established-rx {}
@@ -105,7 +108,7 @@ table inet filter {
  counter tx-lo {}
-  counter icmp-ratelimit-gpon-tx {}
+  counter icmp-ratelimit-ppp-tx {}
  counter icmp-ratelimit-local-tx {}
  counter icmp-tx {}
@@ -125,15 +128,17 @@ table inet filter {
  counter immich-tx {}
  counter paperless-tx {}
  counter hledger-tx {}
+  counter audiobookshelf-tx {}
+  counter kimai-tx {}
  counter tx {}
  chain forward_icmp_accept {
-    oifname { gpon, bifrost } limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-fw drop
+    oifname { @pppInterface@, bifrost } limit name lim_icmp_ppp counter name icmp-ratelimit-ppp-fw drop
-    iifname { gpon, bifrost } limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-fw drop
+    iifname { @pppInterface@, bifrost } limit name lim_icmp_ppp counter name icmp-ratelimit-ppp-fw drop
-    oifname != { gpon, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    oifname != { @pppInterface@, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
-    iifname != { gpon, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    iifname != { @pppInterface@, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
    counter name icmp-fw accept
  }
  chain forward {
@@ -146,10 +151,15 @@ table inet filter {
    iifname lo counter name fw-lo accept
-    oifname { lan, gpon, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
+    oifname { lan, @pppInterface@, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
-    iifname lan oifname { gpon, bifrost } counter name fw-lan accept
+    iifname lan oifname { @pppInterface@, bifrost } counter name fw-lan accept
+    iifname ve-kimai oifname @pppInterface@ counter name fw-kimai accept
-    iifname gpon oifname lan ct state { established, related } counter name fw-gpon accept
+    iifname @pppInterface@ oifname lan ct state { established, related } counter name fw-ppp accept
+    iifname @pppInterface@ oifname ve-kimai ct state { established, related } counter name fw-kimai accept
+    iifname bifrost oifname ve-kimai tcp dport 80 ip6 saddr $bifrost_surtr ip6 daddr 2a03:4000:52:ada:6::2 counter name kimai-rx accept
+    iifname ve-kimai oifname bifrost tcp sport 80 ip6 saddr 2a03:4000:52:ada:6::2 ip6 daddr $bifrost_surtr counter name kimai-tx accept
    limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop
@@ -170,22 +180,22 @@ table inet filter {
    iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
    iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
-    iifname { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-rx drop
+    iifname { bifrost, @pppInterface@ } meta l4proto $icmp_protos limit name lim_icmp_ppp counter name icmp-ratelimit-ppp-rx drop
-    iifname != { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
+    iifname != { bifrost, @pppInterface@ } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
    meta l4proto $icmp_protos counter name icmp-rx accept
-    iifname { lan, mgmt, gpon, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
+    iifname { lan, mgmt, @pppInterface@, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
-    iifname { lan, mgmt, gpon, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept
+    iifname { lan, mgmt, @pppInterface@, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept
    iifname { lan, mgmt, wifibh, yggdrasil } meta l4proto { tcp, udp } th dport 53 counter name dns-rx accept
    iifname { lan, yggdrasil } tcp dport 2049 counter name nfs-rx accept
-    iifname { lan, mgmt, gpon } meta protocol ip udp dport 51820 counter name wg-rx accept
+    iifname { lan, mgmt, @pppInterface@ } meta protocol ip udp dport 51820 counter name wg-rx accept
-    iifname { lan, mgmt, gpon } meta protocol ip6 udp dport 51821 counter name wg-rx accept
+    iifname { lan, mgmt, @pppInterface@ } meta protocol ip6 udp dport 51821 counter name wg-rx accept
    iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-rx accept
-    iifname gpon meta protocol ip6 udp dport 546 udp sport 547 counter name ipv6-pd-rx accept
+    iifname @pppInterface@ meta protocol ip6 udp dport 546 udp sport 547 counter name ipv6-pd-rx accept
    iifname mgmt udp dport 123 counter name ntp-rx accept
@@ -203,6 +213,7 @@ table inet filter {
    iifname bifrost tcp dport 2283 ip6 saddr $bifrost_surtr counter name immich-rx accept
    iifname bifrost tcp dport 28981 ip6 saddr $bifrost_surtr counter name paperless-rx accept
    iifname bifrost tcp dport 5000 ip6 saddr $bifrost_surtr counter name hledger-rx accept
+    iifname bifrost tcp dport 28982 ip6 saddr $bifrost_surtr counter name audiobookshelf-rx accept
    ct state { established, related } counter name established-rx accept
@@ -220,8 +231,8 @@ table inet filter {
    oifname lo counter name tx-lo accept
-    oifname { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-tx drop
+    oifname { bifrost, @pppInterface@ } meta l4proto $icmp_protos limit name lim_icmp_ppp counter name icmp-ratelimit-ppp-tx drop
-    oifname != { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
+    oifname != { bifrost, @pppInterface@ } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
    meta l4proto $icmp_protos counter name icmp-tx accept
@@ -254,6 +265,7 @@ table inet filter {
    iifname bifrost tcp sport 2283 ip6 daddr $bifrost_surtr counter name immich-tx accept
    iifname bifrost tcp sport 28981 ip6 daddr $bifrost_surtr counter name paperless-tx accept
    iifname bifrost tcp sport 5000 ip6 daddr $bifrost_surtr counter name hledger-tx accept
+    iifname bifrost tcp sport 28982 ip6 daddr $bifrost_surtr counter name audiobookshelf-tx accept
    counter name tx
@@ -261,28 +273,28 @@ table inet filter {
 }
 table inet nat {
-  counter gpon-nat {}
+  counter ppp-nat {}
-  # counter container-nat {}
+  counter kimai-nat {}
  chain postrouting {
    type nat hook postrouting priority srcnat
    policy accept
-    meta nfproto ipv4 oifname gpon counter name gpon-nat masquerade
+    meta nfproto ipv4 oifname @pppInterface@ counter name ppp-nat masquerade
-    # iifname ve-* oifname gpon counter name container-nat masquerade
+    iifname ve-kimai oifname @pppInterface@ counter name kimai-nat masquerade
  }
 }
 table inet mss_clamp {
-  counter gpon-mss-clamp {}
+  counter ppp-mss-clamp {}
  chain postrouting {
    type filter hook postrouting priority mangle
    policy accept
-    oifname gpon tcp flags & (syn|rst) == syn counter name gpon-mss-clamp tcp option maxseg size set rt mtu
+    oifname @pppInterface@ tcp flags & (syn|rst) == syn counter name ppp-mss-clamp tcp option maxseg size set rt mtu
  }
 }
@@ -417,7 +429,7 @@ table inet dscpclassify {
    chain postrouting {
        type filter hook postrouting priority filter + 1; policy accept
-        oifname != gpon return
+        oifname != @pppInterface@ return
        ip dscp cs0 goto ct_set_cs0
        ip dscp lephb goto ct_set_lephb
diff --git a/hosts/vidhar/paperless/default.nix b/hosts/vidhar/paperless/default.nix
index 34cd18c4..dd02da38 100644
--- a/hosts/vidhar/paperless/default.nix
+++ b/hosts/vidhar/paperless/default.nix
@@ -4,7 +4,7 @@
  config = {
    services.paperless = {
      enable = true;
-      address = "[2a03:4000:52:ada:4:1::]";
+      address = "2a03:4000:52:ada:4:1::";
      passwordFile = config.sops.secrets."paperless-rootpw".path;
      settings = {
        PAPERLESS_OCR_LANGUAGE = "deu+eng";
diff --git a/hosts/vidhar/prometheus/default.nix b/hosts/vidhar/prometheus/default.nix
index d368ad52..df135b58 100644
--- a/hosts/vidhar/prometheus/default.nix
+++ b/hosts/vidhar/prometheus/default.nix
@@ -26,7 +26,8 @@ in {
      enable = true;
      extraFlags = [
-        "--enable-feature=remote-write-receiver"
+        "--web.enable-remote-write-receiver"
+        "--storage.tsdb.retention.size=35GB"
      ];
      exporters = {
@@ -144,6 +145,17 @@ in {
          ];
          scrape_interval = "15s";
        }
+        { job_name = "zte";
+          static_configs = [
+            { targets = ["localhost:9900"]; }
+          ];
+          relabel_configs = [
+            { replacement = "dsl01";
+              target_label = "instance";
+            }
+          ];
+          scrape_interval = "15s";
+        }
        { job_name = "unbound";
          static_configs = [
            { targets = ["localhost:${toString config.services.prometheus.exporters.unbound.port}"]; }
@@ -287,6 +299,22 @@ in {
                }
              ];
            }
+            { name = "dsl-disconnects";
+              rules = [
+                { record = "dsl_uptime_seconds:resets_per_hour";
+                  expr = "resets(dsl_uptime_seconds[1h])";
+                }
+                { record = "dsl_uptime_seconds:resets_per_day";
+                  expr = "resets(dsl_uptime_seconds[1d])";
+                }
+                { record = "dsl_uptime_seconds:resets_per_week";
+                  expr = "resets(dsl_uptime_seconds[1w])";
+                }
+                { record = "dsl_uptime_seconds:avg_resets_per_day";
+                  expr = "avg_over_time(dsl_uptime_seconds:resets_per_day[1w])";
+                }
+              ];
+            }
          ];
        })
      ];
@@ -424,6 +452,47 @@ in {
      };
    };
+    systemd.services."prometheus-zte-exporter@dsl01.mgmt.yggdrasil" = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      serviceConfig = {
+        Restart = "always";
+        PrivateTmp = true;
+        WorkingDirectory = "/tmp";
+        DynamicUser = true;
+        CapabilityBoundingSet = [""];
+        DeviceAllow = [""];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+        Type = "simple";
+        ExecStart = "${pkgs.zte-prometheus-exporter}/bin/zte-prometheus-exporter";
+        Environment = "ZTE_BASEURL=http://10.141.1.3 ZTE_HOSTNAME=localhost ZTE_PORT=9900";
+        EnvironmentFile = config.sops.secrets."zte_dsl01.mgmt.yggdrasil".path;
+      };
+    };
+    sops.secrets."zte_dsl01.mgmt.yggdrasil" = {
+      format = "binary";
+      sopsFile = ./zte_dsl01.mgmt.yggdrasil;
+    };
    services.nginx = {
      upstreams.prometheus = {
        servers = { "localhost:${toString config.services.prometheus.port}" = {}; };
diff --git a/hosts/vidhar/prometheus/zte_dsl01.mgmt.yggdrasil b/hosts/vidhar/prometheus/zte_dsl01.mgmt.yggdrasil
new file mode 100644
index 00000000..1c9c1fe0
--- /dev/null
+++ b/hosts/vidhar/prometheus/zte_dsl01.mgmt.yggdrasil
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:nAsn7dhfDr0+V1cJjpqWn/kJQt2zGjlfQKi3n5speroJkL3IvMG/9fsTaXJQZSi2gPlrN8GbxKQ=,iv:9g0V3xRBC+sa/JPP2bUZMfg//VuKT5qI7ua9iU4QRCg=,tag:fzwih9OHUBLmx8dxL4BjGg==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaEE3bUFBY0xKSDUrVnc2\nbFpjSkNOSm56amJTNjdXcTljdDNRREhITm1NCjZrOUEwNFpxN2FmTVV5T2xCbENk\nMEFmVzlPZ29CTlJ4dVNCRUsyRFFseXcKLS0tIEhscVZ4VUVsaG9OUnBIRFE4WXA2\ncGFnbWpNMlNIQzFLc1Ryc1Z3NUl1bVUKi9zYBlF2vslGKu4GP368ApbvuxjZnQpF\nuOujXSNoEps21wY6xUENm+CbYbgaJjSgmb5c1IjAmnubVI4JVY9OyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2021-12-31T15:00:33Z",
+                "mac": "ENC[AES256_GCM,data:sw2NVXHLibbuOChgScLhSTjGZBjSoHpzIuRqfCW0eL3DwhL5CekG6T/oYu06KjNmxVjxwb3OmqECSU0TUvPn9ySOWwMSoBfyJpDoTHnZ+YOjOH351IOAMBNcBDJse7aLGRWW5YXKLDfmp8Dhg2hlMhCmkVwAquQjPhfmAdJfj64=,iv:wgM/BlRU2XJSGj7KvAo1WRamecffUDnFvv2+4twtsQY=,tag:0mXblJtTGMTvxndedws94A==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2023-01-30T10:58:49Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAcwl1Blp3J5wgpRJKbYI1G1yEZrRYeYuoDtYUh3ToMAQw\nd92/bIJJR5Ml91eDym9uBN0fFRRy72r6FOx4qZT7S4DhmuA84qCbASjF8bKSclc0\n0l4BBXvDS5Dz1Q7iYc+LxZjHASV1v73A+MaeCFvG/pjmHzF0z0EzBiAJD4ZWGcP0\nX2dDbjl+n9VFrvmeLRxQNh4XZW43iTXdRjwHDgm16zhd9X6VOVhr5UkC4Nyjq2Ar\n=4ZEa\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
+\ No newline at end of file
diff --git a/installer-profiles/cd-dvd.nix b/installer-profiles/cd-dvd.nix
index 45291bad..ac12d885 100644
--- a/installer-profiles/cd-dvd.nix
+++ b/installer-profiles/cd-dvd.nix
@@ -1,7 +1,13 @@
-{ flakeInputs, ... }:
+{ flakeInputs, lib, ... }:
 {
  imports = [
    "${flakeInputs.nixpkgs.outPath}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
  ];
+  config = {
+    isoImage.squashfsCompression = "zstd -Xcompression-level 9";
+    system.installer.channel.enable = false;
+    boot.loader.grub.memtest86.enable = lib.mkForce false;
+  };
 }
diff --git a/installer-profiles/netboot.nix b/installer-profiles/netboot.nix
index 28e8084d..6e39ebfb 100644
--- a/installer-profiles/netboot.nix
+++ b/installer-profiles/netboot.nix
@@ -4,4 +4,9 @@
  imports = [
    "${flakeInputs.nixpkgs.outPath}/nixos/modules/installer/netboot/netboot-minimal.nix"
  ];
+  config = {
+    netboot.squashfsCompression = "zstd -Xcompression-level 9";
+    system.installer.channel.enable = false;
+  };
 }
diff --git a/installer-profiles/nfsroot.nix b/installer-profiles/nfsroot.nix
index 6bd875b4..a8f6def6 100644
--- a/installer-profiles/nfsroot.nix
+++ b/installer-profiles/nfsroot.nix
@@ -8,4 +8,6 @@
    "${flakeInputs.nixpkgs.outPath}/nixos/modules/profiles/base.nix"
    "${flakeInputs.nixpkgs.outPath}/nixos/modules/profiles/installation-device.nix"
  ];
+  config.system.installer.channel.enable = false;
 }
diff --git a/installer/default.nix b/installer/default.nix
index ec47832a..26f38572 100644
--- a/installer/default.nix
+++ b/installer/default.nix
@@ -8,7 +8,7 @@ with lib;
  ];
  config = {
-    boot.initrd.availableKernelModules = [ "e1000e" ];
+    boot.initrd.kernelModules = [ "e1000e" "virtio_net" ];
    hardware.cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware;
@@ -47,7 +47,7 @@ with lib;
    services.xserver.videoDrivers = [ "nvidia" ];
    systemd.services.nvidia-control-devices = {
      wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.linuxPackages.nvidia_x11.bin}/bin/nvidia-smi";
+      serviceConfig.ExecStart = lib.getExe' pkgs.linuxPackages.nvidia_x11.bin "nvidia-smi";
    };
    nixpkgs.externalConfig.allowUnfree = true;
diff --git a/lib/pythonSet.nix b/lib/pythonSet.nix
new file mode 100644
index 00000000..c69216cc
--- /dev/null
+++ b/lib/pythonSet.nix
@@ -0,0 +1,42 @@
+{ uv2nix, pyproject-nix, pyproject-build-systems, ... }:
+{ pkgs, python, overlay, lib ? pkgs.lib }:
+(pkgs.callPackage pyproject-nix.build.packages {
+  inherit python;
+}).overrideScope
+  (
+    lib.composeManyExtensions [
+      pyproject-build-systems.overlays.default
+      overlay
+      (final: prev: {
+        sdnotify = (prev.sdnotify.override {
+          sourcePreference = "sdist";
+        }).overrideAttrs (oldAttrs: {
+          nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [
+            (final.resolveBuildSystem { setuptools = []; })
+          ];
+        });
+        systemd-python = (prev.systemd-python.override {
+          sourcePreference = "sdist";
+        }).overrideAttrs (oldAttrs: {
+          nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [
+            pkgs.pkg-config pkgs.systemd.dev
+            (final.resolveBuildSystem { setuptools = []; })
+          ];
+        });
+        halo = (prev.halo.override {
+          sourcePreference = "sdist";
+        }).overrideAttrs (oldAttrs: {
+          nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [
+            (final.resolveBuildSystem { setuptools = []; })
+          ];
+        });
+        unshare = (prev.unshare.override {
+          sourcePreference = "sdist";
+        }).overrideAttrs (oldAttrs: {
+          nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [
+            (final.resolveBuildSystem { setuptools = []; })
+          ];
+        });
+      })
+    ]
+  )
diff --git a/modules/abs-podcast-autoplaylist.nix b/modules/abs-podcast-autoplaylist.nix
new file mode 100644
index 00000000..f526a434
--- /dev/null
+++ b/modules/abs-podcast-autoplaylist.nix
@@ -0,0 +1,55 @@
+{ config, pkgs, lib, utils, ... }:
+let
+  cfg = config.services.abs-podcast-autoplaylist;
+  enabledAttrs = lib.filterAttrs (_name: { enable, ... }: enable) cfg;
+in {
+  options = {
+    services.abs-podcast-autoplaylist = lib.mkOption {
+      default = {};
+      type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
+        options = {
+          enable = lib.mkEnableOption "this instance of abs-podcast-autoplaylist" // {
+            default = true;
+          };
+          cron = lib.mkOption {
+            type = lib.types.str;
+            default = "*-*-* *:00/30:00";
+          };
+          configSecret = lib.mkOption {
+            type = lib.types.str;
+            default = "abs-podcast-autoplaylist-${name}.toml";
+          };
+        };
+      }));
+    };
+  };
+  config = lib.mkIf (enabledAttrs != {}) {
+    systemd.services = {
+      "abs-podcast-autoplaylist@" = {
+        serviceConfig = {
+          WorkingDirectory = "%d";
+          DynamicUser = true;
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          Type = "oneshot";
+          ExecStart = "${lib.getExe pkgs.abs-podcast-autoplaylist} %I.toml";
+          TimeoutSec = "5min";
+        };
+      };
+    } // lib.mapAttrs' (name: { configSecret, ... }: lib.nameValuePair "abs-podcast-autoplaylist@${utils.escapeSystemdPath name}" {
+      overrideStrategy = "asDropin";
+      serviceConfig = {
+        LoadCredential = "${name}.toml:${config.sops.secrets.${configSecret}.path}";
+      };
+    }) enabledAttrs;
+    systemd.timers = lib.mapAttrs' (name: { cron, ... }: lib.nameValuePair "abs-podcast-autoplaylist@${utils.escapeSystemdPath name}" {
+      wantedBy = [ "timers.target" ];
+      timerConfig.OnCalendar = cron;
+    }) enabledAttrs;
+  };
+}
diff --git a/modules/borgcopy/.envrc b/modules/borgcopy/.envrc
new file mode 100644
index 00000000..01e755c1
--- /dev/null
+++ b/modules/borgcopy/.envrc
@@ -0,0 +1,4 @@
+use flake
+uv venv && uv sync
+. .venv/bin/activate
diff --git a/modules/borgcopy/.gitignore b/modules/borgcopy/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/modules/borgcopy/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/modules/borgcopy/default.nix b/modules/borgcopy/default.nix
index 8e1afc27..af021777 100644
--- a/modules/borgcopy/default.nix
+++ b/modules/borgcopy/default.nix
@@ -1,25 +1,32 @@
-{ config, pkgs, lib, utils, flakeInputs, ... }:
+{ config, pkgs, lib, utils, flake, flakeInputs, ... }:
 with lib;
 let
-  copyBorg =
+  copyBorg = let
-    with pkgs.poetry2nix;
+    workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
-    mkPoetryApplication {
+    pythonSet = flake.lib.pythonSet {
-      projectDir = cleanPythonSources { src = ./.; };
+      inherit pkgs;
+      python = pkgs.python312;
+      overlay = workspace.mkPyprojectOverlay {
+        sourcePreference = "wheel";
+      };
+    };
+    virtualEnv = pythonSet.mkVirtualEnv "copy_borg" workspace.deps.default;
+  in virtualEnv.overrideAttrs (oldAttrs: {
+    meta = (oldAttrs.meta or {}) // {
+      mainProgram = "copy_borg";
+    };
-      overrides = overrides.withDefaults (self: super: {
+    nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [ pkgs.makeWrapper ];
-        pyprctl = super.pyprctl.overridePythonAttrs (oldAttrs: {
-          buildInputs = (oldAttrs.buildInputs or []) ++ [super.setuptools];
-        });
-        inherit (pkgs.python3Packages) python-unshare;
-      });
-      postInstall = ''
+    postInstall = ''
-        wrapProgram $out/bin/copy_borg \
+      ${oldAttrs.postInstall or ""}
-          --prefix PATH : ${makeBinPath (with pkgs; [util-linux borgbackup])}:${config.security.wrapperDir}
-      '';
+      wrapProgram $out/bin/copy_borg \
-    };
+        --prefix PATH : ${makeBinPath (with pkgs; [util-linux borgbackup])}:${config.security.wrapperDir}
+    '';
+  });
  copyService = name: opts: nameValuePair "copy-borg@${utils.escapeSystemdPath name}" {
    restartIfChanged = false;
diff --git a/modules/borgcopy/poetry.lock b/modules/borgcopy/poetry.lock
deleted file mode 100644
index 759ecfe9..00000000
--- a/modules/borgcopy/poetry.lock
+++ /dev/null
@@ -1,180 +0,0 @@
-# This file is automatically @generated by Poetry 1.4.2 and should not be changed by hand.
-[[package]]
-name = "colorama"
-version = "0.4.6"
-description = "Cross-platform colored terminal text."
-category = "main"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
-files = [
-    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
-    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
-]
-[[package]]
-name = "halo"
-version = "0.0.31"
-description = "Beautiful terminal spinners in Python"
-category = "main"
-optional = false
-python-versions = ">=3.4"
-files = [
-    {file = "halo-0.0.31-py2-none-any.whl", hash = "sha256:5350488fb7d2aa7c31a1344120cee67a872901ce8858f60da7946cef96c208ab"},
-    {file = "halo-0.0.31.tar.gz", hash = "sha256:7b67a3521ee91d53b7152d4ee3452811e1d2a6321975137762eb3d70063cc9d6"},
-]
-[package.dependencies]
-colorama = ">=0.3.9"
-log-symbols = ">=0.0.14"
-six = ">=1.12.0"
-spinners = ">=0.0.24"
-termcolor = ">=1.1.0"
-[package.extras]
-ipython = ["IPython (==5.7.0)", "ipywidgets (==7.1.0)"]
-[[package]]
-name = "humanize"
-version = "4.6.0"
-description = "Python humanize utilities"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "humanize-4.6.0-py3-none-any.whl", hash = "sha256:401201aca462749773f02920139f302450cb548b70489b9b4b92be39fe3c3c50"},
-    {file = "humanize-4.6.0.tar.gz", hash = "sha256:5f1f22bc65911eb1a6ffe7659bd6598e33dcfeeb904eb16ee1e705a09bf75916"},
-]
-[package.extras]
-tests = ["freezegun", "pytest", "pytest-cov"]
-[[package]]
-name = "log-symbols"
-version = "0.0.14"
-description = "Colored symbols for various log levels for Python"
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "log_symbols-0.0.14-py3-none-any.whl", hash = "sha256:4952106ff8b605ab7d5081dd2c7e6ca7374584eff7086f499c06edd1ce56dcca"},
-    {file = "log_symbols-0.0.14.tar.gz", hash = "sha256:cf0bbc6fe1a8e53f0d174a716bc625c4f87043cc21eb55dd8a740cfe22680556"},
-]
-[package.dependencies]
-colorama = ">=0.3.9"
-[[package]]
-name = "pyprctl"
-version = "0.1.3"
-description = "An interface to Linux's prctl() syscall written in pure Python using ctypes."
-category = "main"
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "pyprctl-0.1.3-py3-none-any.whl", hash = "sha256:6302e5114f078fb33e5799835d0a69e2fc180bb6b28ad073515fa40c5272f1dd"},
-    {file = "pyprctl-0.1.3.tar.gz", hash = "sha256:1fb54d3ab030ec02e4afc38fb9662d6634c12834e91ae7959de56a9c09f69c26"},
-]
-[[package]]
-name = "python-dateutil"
-version = "2.8.2"
-description = "Extensions to the standard Python datetime module"
-category = "main"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-files = [
-    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
-    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
-]
-[package.dependencies]
-six = ">=1.5"
-[[package]]
-name = "python-unshare"
-version = "0.2"
-description = "Python bindings for the Linux unshare() syscall"
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "python-unshare-0.2.tar.gz", hash = "sha256:f79b7de441b6c27930b775085a6a4fd2f378b628737aaaebc2a6c519023fd47a"},
-]
-[[package]]
-name = "six"
-version = "1.16.0"
-description = "Python 2 and 3 compatibility utilities"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
-    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
-]
-[[package]]
-name = "spinners"
-version = "0.0.24"
-description = "Spinners for terminals"
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "spinners-0.0.24-py3-none-any.whl", hash = "sha256:2fa30d0b72c9650ad12bbe031c9943b8d441e41b4f5602b0ec977a19f3290e98"},
-    {file = "spinners-0.0.24.tar.gz", hash = "sha256:1eb6aeb4781d72ab42ed8a01dcf20f3002bf50740d7154d12fb8c9769bf9e27f"},
-]
-[[package]]
-name = "termcolor"
-version = "2.2.0"
-description = "ANSI color formatting for output in terminal"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "termcolor-2.2.0-py3-none-any.whl", hash = "sha256:91ddd848e7251200eac969846cbae2dacd7d71c2871e92733289e7e3666f48e7"},
-    {file = "termcolor-2.2.0.tar.gz", hash = "sha256:dfc8ac3f350788f23b2947b3e6cfa5a53b630b612e6cd8965a015a776020b99a"},
-]
-[package.extras]
-tests = ["pytest", "pytest-cov"]
-[[package]]
-name = "tqdm"
-version = "4.65.0"
-description = "Fast, Extensible Progress Meter"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "tqdm-4.65.0-py3-none-any.whl", hash = "sha256:c4f53a17fe37e132815abceec022631be8ffe1b9381c2e6e30aa70edc99e9671"},
-    {file = "tqdm-4.65.0.tar.gz", hash = "sha256:1871fb68a86b8fb3b59ca4cdd3dcccbc7e6d613eeed31f4c332531977b89beb5"},
-]
-[package.dependencies]
-colorama = {version = "*", markers = "platform_system == \"Windows\""}
-[package.extras]
-dev = ["py-make (>=0.1.0)", "twine", "wheel"]
-notebook = ["ipywidgets (>=6)"]
-slack = ["slack-sdk"]
-telegram = ["requests"]
-[[package]]
-name = "xdg"
-version = "6.0.0"
-description = "Variables defined by the XDG Base Directory Specification"
-category = "main"
-optional = false
-python-versions = ">=3.7,<4.0"
-files = [
-    {file = "xdg-6.0.0-py3-none-any.whl", hash = "sha256:df3510755b4395157fc04fc3b02467c777f3b3ca383257397f09ab0d4c16f936"},
-    {file = "xdg-6.0.0.tar.gz", hash = "sha256:24278094f2d45e846d1eb28a2ebb92d7b67fc0cab5249ee3ce88c95f649a1c92"},
-]
-[metadata]
-lock-version = "2.0"
-python-versions = ">=3.10.0,<3.12"
-content-hash = "3c6b538852447a8f3ae34e1be122716d47e669a2b44f7c5d3d850e5d877353c7"
diff --git a/modules/borgcopy/pyproject.toml b/modules/borgcopy/pyproject.toml
index f3401ed2..d76d73c6 100644
--- a/modules/borgcopy/pyproject.toml
+++ b/modules/borgcopy/pyproject.toml
@@ -1,22 +1,25 @@
-[tool.poetry]
+[project]
 name = "copy_borg"
 version = "0.0.0"
-authors = ["Gregor Kleen <gkleen@yggdrasil.li>"]
 description = ""
+authors = [{ name = "Gregor Kleen", email = "gkleen@yggdrasil.li" }]
+requires-python = "~=3.12"
+dependencies = [
+    "humanize>=4.6.0,<5",
+    "tqdm>=4.65.0,<5",
+    "python-dateutil>=2.8.2,<3",
+    "xdg>=6.0.0,<7",
+    "pyprctl>=0.1.3,<0.2",
+    "halo>=0.0.31,<0.0.32",
+    "unshare>=0.22",
+]
-[tool.poetry.scripts]
+[project.scripts]
 copy_borg = "copy_borg.__main__:main"
-[tool.poetry.dependencies]
-python = ">=3.10.0,<3.12"
-humanize = "^4.6.0"
-tqdm = "^4.65.0"
-python-dateutil = "^2.8.2"
-xdg = "^6.0.0"
-python-unshare = "^0.2"
-pyprctl = "^0.1.3"
-halo = "^0.0.31"
 [build-system]
-requires = ["poetry-core>=1.0.0"]
+requires = ["hatchling"]
-build-backend = "poetry.core.masonry.api"
-\ No newline at end of file
+build-backend = "hatchling.build"
+[tool.hatch.build.targets.wheel]
+packages = ["copy_borg"]
diff --git a/modules/borgcopy/uv.lock b/modules/borgcopy/uv.lock
new file mode 100644
index 00000000..1a282598
--- /dev/null
+++ b/modules/borgcopy/uv.lock
@@ -0,0 +1,146 @@
+version = 1
+revision = 2
+requires-python = ">=3.12, <4"
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+[[package]]
+name = "copy-borg"
+version = "0.0.0"
+source = { editable = "." }
+dependencies = [
+    { name = "halo" },
+    { name = "humanize" },
+    { name = "pyprctl" },
+    { name = "python-dateutil" },
+    { name = "tqdm" },
+    { name = "unshare" },
+    { name = "xdg" },
+]
+[package.metadata]
+requires-dist = [
+    { name = "halo", specifier = ">=0.0.31,<0.0.32" },
+    { name = "humanize", specifier = ">=4.6.0,<5" },
+    { name = "pyprctl", specifier = ">=0.1.3,<0.2" },
+    { name = "python-dateutil", specifier = ">=2.8.2,<3" },
+    { name = "tqdm", specifier = ">=4.65.0,<5" },
+    { name = "unshare", specifier = ">=0.22" },
+    { name = "xdg", specifier = ">=6.0.0,<7" },
+]
+[[package]]
+name = "halo"
+version = "0.0.31"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama" },
+    { name = "log-symbols" },
+    { name = "six" },
+    { name = "spinners" },
+    { name = "termcolor" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ee/48/d53580d30b1fabf25d0d1fcc3f5b26d08d2ac75a1890ff6d262f9f027436/halo-0.0.31.tar.gz", hash = "sha256:7b67a3521ee91d53b7152d4ee3452811e1d2a6321975137762eb3d70063cc9d6", size = 11666, upload-time = "2020-11-10T02:36:48.335Z" }
+[[package]]
+name = "humanize"
+version = "4.12.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/22/d1/bbc4d251187a43f69844f7fd8941426549bbe4723e8ff0a7441796b0789f/humanize-4.12.3.tar.gz", hash = "sha256:8430be3a615106fdfceb0b2c1b41c4c98c6b0fc5cc59663a5539b111dd325fb0", size = 80514, upload-time = "2025-04-30T11:51:07.98Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a0/1e/62a2ec3104394a2975a2629eec89276ede9dbe717092f6966fcf963e1bf0/humanize-4.12.3-py3-none-any.whl", hash = "sha256:2cbf6370af06568fa6d2da77c86edb7886f3160ecd19ee1ffef07979efc597f6", size = 128487, upload-time = "2025-04-30T11:51:06.468Z" },
+]
+[[package]]
+name = "log-symbols"
+version = "0.0.14"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/45/87/e86645d758a4401c8c81914b6a88470634d1785c9ad09823fa4a1bd89250/log_symbols-0.0.14.tar.gz", hash = "sha256:cf0bbc6fe1a8e53f0d174a716bc625c4f87043cc21eb55dd8a740cfe22680556", size = 3211, upload-time = "2019-08-08T06:32:22.538Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/28/5d/d710c38be68b0fb54e645048fe359c3904cc3cb64b2de9d40e1712bf110c/log_symbols-0.0.14-py3-none-any.whl", hash = "sha256:4952106ff8b605ab7d5081dd2c7e6ca7374584eff7086f499c06edd1ce56dcca", size = 3081, upload-time = "2019-08-08T06:32:20.604Z" },
+]
+[[package]]
+name = "pyprctl"
+version = "0.1.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c9/16/6ed71ebcad76c1cd5f22185bcc6b31c0ee62fc5e693b626febea8fedeba3/pyprctl-0.1.3.tar.gz", hash = "sha256:1fb54d3ab030ec02e4afc38fb9662d6634c12834e91ae7959de56a9c09f69c26", size = 18739, upload-time = "2021-10-26T23:52:03.87Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/bf/5e/62765de39bbce8111fb1f4453a4a804913bf49179fa265fb713ed66c9d15/pyprctl-0.1.3-py3-none-any.whl", hash = "sha256:6302e5114f078fb33e5799835d0a69e2fc180bb6b28ad073515fa40c5272f1dd", size = 20016, upload-time = "2021-10-26T23:52:02.986Z" },
+]
+[[package]]
+name = "python-dateutil"
+version = "2.9.0.post0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/66/c0/0c8b6ad9f17a802ee498c46e004a0eb49bc148f2fd230864601a86dcf6db/python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 342432, upload-time = "2024-03-01T18:36:20.211Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
+]
+[[package]]
+name = "six"
+version = "1.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/94/e7/b2c673351809dca68a0e064b6af791aa332cf192da575fd474ed7d6f16a2/six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81", size = 34031, upload-time = "2024-12-04T17:35:28.174Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" },
+]
+[[package]]
+name = "spinners"
+version = "0.0.24"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d3/91/bb331f0a43e04d950a710f402a0986a54147a35818df0e1658551c8d12e1/spinners-0.0.24.tar.gz", hash = "sha256:1eb6aeb4781d72ab42ed8a01dcf20f3002bf50740d7154d12fb8c9769bf9e27f", size = 5308, upload-time = "2020-02-19T21:42:32.326Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9f/8e/3310207a68118000ca27ac878b8386123628b335ecb3d4bec4743357f0d1/spinners-0.0.24-py3-none-any.whl", hash = "sha256:2fa30d0b72c9650ad12bbe031c9943b8d441e41b4f5602b0ec977a19f3290e98", size = 5499, upload-time = "2020-02-19T21:42:30.876Z" },
+]
+[[package]]
+name = "termcolor"
+version = "3.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ca/6c/3d75c196ac07ac8749600b60b03f4f6094d54e132c4d94ebac6ee0e0add0/termcolor-3.1.0.tar.gz", hash = "sha256:6a6dd7fbee581909eeec6a756cff1d7f7c376063b14e4a298dc4980309e55970", size = 14324, upload-time = "2025-04-30T11:37:53.791Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4f/bd/de8d508070629b6d84a30d01d57e4a65c69aa7f5abe7560b8fad3b50ea59/termcolor-3.1.0-py3-none-any.whl", hash = "sha256:591dd26b5c2ce03b9e43f391264626557873ce1d379019786f99b0c2bee140aa", size = 7684, upload-time = "2025-04-30T11:37:52.382Z" },
+]
+[[package]]
+name = "tqdm"
+version = "4.67.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a8/4b/29b4ef32e036bb34e4ab51796dd745cdba7ed47ad142a9f4a1eb8e0c744d/tqdm-4.67.1.tar.gz", hash = "sha256:f8aef9c52c08c13a65f30ea34f4e5aac3fd1a34959879d7e59e63027286627f2", size = 169737, upload-time = "2024-11-24T20:12:22.481Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d0/30/dc54f88dd4a2b5dc8a0279bdd7270e735851848b762aeb1c1184ed1f6b14/tqdm-4.67.1-py3-none-any.whl", hash = "sha256:26445eca388f82e72884e0d580d5464cd801a3ea01e63e5601bdff9ba6a48de2", size = 78540, upload-time = "2024-11-24T20:12:19.698Z" },
+]
+[[package]]
+name = "unshare"
+version = "0.22"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/15/85/2ba218129c95b894efe87506489b525f859c40f6e21cb0521ff3cec754f4/unshare-0.22.tar.gz", hash = "sha256:d521d72cca6e876f22cbd5ff5eb51f1beef75e8f9c53b599b55fa05fba1dd3a6", size = 2041, upload-time = "2019-10-17T12:58:31.498Z" }
+[[package]]
+name = "xdg"
+version = "6.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/2a/b9/0e6e6f19fb75cf5e1758f4f33c1256738f718966700cffc0fde2f966218b/xdg-6.0.0.tar.gz", hash = "sha256:24278094f2d45e846d1eb28a2ebb92d7b67fc0cab5249ee3ce88c95f649a1c92", size = 3453, upload-time = "2023-02-27T19:27:44.309Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dd/54/3516c1cf349060fc3578686d271eba242f10ec00b4530c2985af9faac49b/xdg-6.0.0-py3-none-any.whl", hash = "sha256:df3510755b4395157fc04fc3b02467c777f3b3ca383257397f09ab0d4c16f936", size = 3855, upload-time = "2023-02-27T19:27:42.151Z" },
+]
diff --git a/modules/i18n.nix b/modules/i18n.nix
new file mode 100644
index 00000000..f84e8b64
--- /dev/null
+++ b/modules/i18n.nix
@@ -0,0 +1,156 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  aggregatedLocales =
+    (builtins.map
+      (l: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8")
+      (
+        [ config.i18n.defaultLocale ]
+        ++ (lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales)
+        ++ (lib.attrValues (lib.filterAttrs (n: _v: lib.hasPrefix "LC_" n) config.i18n.extraLocaleSettings))
+      )
+    )
+    ++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
+in
+{
+  disabledModules = [ "config/i18n.nix" ];
+  ###### interface
+  options = {
+    i18n = {
+      glibcLocales = lib.mkOption {
+        type = lib.types.path;
+        default = pkgs.glibcLocales.override {
+          allLocales = lib.any (x: x == "all") config.i18n.supportedLocales;
+          locales = config.i18n.supportedLocales;
+        };
+        defaultText = lib.literalExpression ''
+          pkgs.glibcLocales.override {
+            allLocales = lib.any (x: x == "all") config.i18n.supportedLocales;
+            locales = config.i18n.supportedLocales;
+          }
+        '';
+        example = lib.literalExpression "pkgs.glibcLocales";
+        description = ''
+          Customized pkg.glibcLocales package.
+          Changing this option can disable handling of i18n.defaultLocale
+          and supportedLocale.
+        '';
+      };
+      defaultLocale = lib.mkOption {
+        type = lib.types.str;
+        default = "en_US.UTF-8";
+        example = "nl_NL.UTF-8";
+        description = ''
+          The default locale.  It determines the language for program
+          messages, the format for dates and times, sort order, and so on.
+          It also determines the character set, such as UTF-8.
+        '';
+      };
+      extraLocales = lib.mkOption {
+        type = lib.types.either (lib.types.listOf lib.types.str) (lib.types.enum [ "all" ]);
+        default = [ ];
+        example = [ "nl_NL.UTF-8" ];
+        description = ''
+          Additional locales that the system should support, besides the ones
+          configured with {option}`i18n.defaultLocale` and
+          {option}`i18n.extraLocaleSettings`.
+          Set this to `"all"` to install all available locales.
+        '';
+      };
+      extraLocaleSettings = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        example = {
+          LC_MESSAGES = "en_US.UTF-8";
+          LC_TIME = "de_DE.UTF-8";
+        };
+        description = ''
+          A set of additional system-wide locale settings other than
+          `LANG` which can be configured with
+          {option}`i18n.defaultLocale`.
+        '';
+      };
+      supportedLocales = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        visible = false;
+        default = lib.unique (
+          [
+            "C.UTF-8/UTF-8"
+            "en_US.UTF-8/UTF-8"
+          ]
+          ++ aggregatedLocales
+        );
+        example = [
+          "en_US.UTF-8/UTF-8"
+          "nl_NL.UTF-8/UTF-8"
+          "nl_NL/ISO-8859-1"
+        ];
+        description = ''
+          List of locales that the system should support.  The value
+          `"all"` means that all locales supported by
+          Glibc will be installed.  A full list of supported locales
+          can be found at <https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED>.
+        '';
+      };
+    };
+  };
+  ###### implementation
+  config = {
+    warnings =
+      lib.optional
+        (
+          !(
+            (lib.subtractLists config.i18n.supportedLocales aggregatedLocales) == [ ]
+            || lib.any (x: x == "all") config.i18n.supportedLocales
+          )
+        )
+        ''
+          `i18n.supportedLocales` is deprecated in favor of `i18n.extraLocales`,
+          and it seems you are using `i18n.supportedLocales` and forgot to
+          include some locales specified in `i18n.defaultLocale`,
+          `i18n.extraLocales` or `i18n.extraLocaleSettings`.
+          If you're trying to install additional locales not specified in
+          `i18n.defaultLocale` or `i18n.extraLocaleSettings`, consider adding
+          only those locales to `i18n.extraLocales`.
+        '';
+    environment.systemPackages =
+      # We increase the priority a little, so that plain glibc in systemPackages can't win.
+      lib.optional (config.i18n.supportedLocales != [ ]) (lib.setPrio (-1) config.i18n.glibcLocales);
+    environment.sessionVariables = {
+      LANG = config.i18n.defaultLocale;
+      LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
+    } // config.i18n.extraLocaleSettings;
+    systemd.globalEnvironment = lib.mkIf (config.i18n.supportedLocales != [ ]) {
+      LOCALE_ARCHIVE = "${config.i18n.glibcLocales}/lib/locale/locale-archive";
+    };
+    # ‘/etc/locale.conf’ is used by systemd.
+    environment.etc."locale.conf".source = pkgs.writeText "locale.conf" ''
+      LANG=${config.i18n.defaultLocale}
+      ${lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (n: v: "${n}=${v}") config.i18n.extraLocaleSettings
+      )}
+    '';
+  };
+}
diff --git a/modules/impermanence-timezone.nix b/modules/impermanence-timezone.nix
new file mode 100644
index 00000000..a1edbfa5
--- /dev/null
+++ b/modules/impermanence-timezone.nix
@@ -0,0 +1,41 @@
+{ config, lib, utils, pkgs, ... }:
+{
+  options = {
+    environment.persistence = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule {
+        options = {
+          timezone = lib.mkEnableOption "storing system timezone";
+        };
+      });
+    };
+  };
+  config = {
+    systemd = lib.mkMerge (lib.mapAttrsToList (name: cfg: lib.mkIf cfg.timezone {
+      services = {
+        "timezone@${utils.escapeSystemdPath name}" = {
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${pkgs.coreutils}/bin/cp -vP ${utils.escapeSystemdExecArg "${name}/etc/localtime"} /etc/localtime";
+            ExecStop = "${pkgs.coreutils}/bin/cp -vP /etc/localtime ${utils.escapeSystemdExecArg "${name}/etc/localtime"}";
+          };
+        };
+        "etc-localtime@${utils.escapeSystemdPath name}" = {
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${pkgs.coreutils}/bin/cp -vP /etc/localtime ${utils.escapeSystemdExecArg "${name}/etc/localtime"}";
+          };
+        };
+      };
+      paths."etc-localtime@${utils.escapeSystemdPath name}" = {
+        wantedBy = [ "timezone@${utils.escapeSystemdPath name}.service" ];
+        after = [ "timezone@${utils.escapeSystemdPath name}.service" ];
+        pathConfig.PathChanged = "/etc/localtime";
+      };
+    }) config.environment.persistence);
+  };
+}
diff --git a/modules/impermanence.nix b/modules/impermanence.nix
new file mode 100644
index 00000000..621576a3
--- /dev/null
+++ b/modules/impermanence.nix
@@ -0,0 +1,6 @@
+{ flakeInputs, ... }:
+{
+  imports = [
+    flakeInputs.impermanence.nixosModules.impermanence
+  ];
+}
diff --git a/modules/installer.nix b/modules/installer.nix
new file mode 100644
index 00000000..3e5c6d5b
--- /dev/null
+++ b/modules/installer.nix
@@ -0,0 +1,56 @@
+{ flake, config, lib, pkgs, ... }:
+let
+  cfg = config.installer.links;
+  installerOutPath = {
+    "cd-dvd" = _: installerBuild: "${installerBuild.config.system.build.isoImage}/iso";
+    "netboot" = {system, variant}: installerBuild: pkgs.runCommandLocal "${system}-${variant}" {} ''
+      mkdir $out
+      install -m 0444 -t $out \
+        ${installerBuild.config.system.build.netbootRamdisk}/initrd \
+        ${installerBuild.config.system.build.kernel}/${config.system.boot.loader.kernelFile} \
+        ${installerBuild.config.system.build.netbootIpxeScript}/netboot.ipxe \
+        ${pkgs.ipxe.override {
+          additionalTargets = {
+            "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
+          };
+          additionalOptions = [
+            "NSLOOKUP_CMD"
+            "PING_CMD"
+            "CONSOLE_CMD"
+          ];
+          embedScript = pkgs.writeText "netboot.ipxe" ''
+            #!ipxe
+            chain netboot.ipxe
+          '';
+        }}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn}
+    '';
+  };
+in {
+  options = {
+    installer.links = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule {
+        options = {
+          system = lib.mkOption {
+            type = lib.types.str;
+          };
+          variant = lib.mkOption {
+            type = lib.types.str;
+          };
+        };
+      });
+      default = [];
+    };
+  };
+  config = lib.mkIf (cfg != []) {
+    systemd.tmpfiles.rules = map (installer'@{system, variant}:
+      let
+        installer = "${system}-${variant}";
+        installerBuild = builtins.addErrorContext "while evaluating installer-${installer}" flake.nixosConfigurations.${"installer-${installer}"};
+      in "L+ /run/installer-${installer} - - - - ${installerOutPath.${variant} installer' installerBuild}"
+    ) cfg;
+  };
+}
diff --git a/modules/pgbackrest.nix b/modules/pgbackrest.nix
index 81c74a8e..550e970b 100644
--- a/modules/pgbackrest.nix
+++ b/modules/pgbackrest.nix
@@ -43,6 +43,8 @@ let
  loglevelType = types.enum ["off" "error" "warn" "info" "detail" "debug" "trace"];
  inherit (utils.systemdUtils.unitOptions) unitOption;
 in {
+  disabledModules = ["services/backup/pgbackrest.nix"];
  options = {
    services.pgbackrest = {
      enable = mkEnableOption "pgBackRest";
diff --git a/modules/postsrsd.nix b/modules/postsrsd.nix
new file mode 100644
index 00000000..bc941e3e
--- /dev/null
+++ b/modules/postsrsd.nix
@@ -0,0 +1,163 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.postsrsd;
+  runtimeDirectoryName = "postsrsd";
+  runtimeDirectory = "/run/${runtimeDirectoryName}";
+  # TODO: follow RFC 42, but we need a libconfuse format first:
+  #       https://github.com/NixOS/nixpkgs/issues/401565
+  # Arrays in `libconfuse` look like this: {"Life", "Universe", "Everything"}
+  # See https://www.nongnu.org/confuse/tutorial-html/ar01s03.html.
+  #
+  # Note: We're using `builtins.toJSON` to escape strings, but JSON strings
+  # don't have exactly the same semantics as libconfuse strings. For example,
+  # "${F}" gets treated as an env var reference, see above issue for details.
+  libconfuseDomains = "{ " + lib.concatMapStringsSep ", " builtins.toJSON cfg.domains + " }";
+  configFile = pkgs.writeText "postsrsd.conf" ''
+    secrets-file = "''${CREDENTIALS_DIRECTORY}/secrets-file"
+    domains = ${libconfuseDomains}
+    separator = "${cfg.separator}"
+    # Disable postsrsd's jailing in favor of confinement with systemd.
+    unprivileged-user = ""
+    chroot-dir = ""
+    ${cfg.extraConfig}
+  '';
+in
+{
+  imports =
+    map
+      (
+        name:
+        lib.mkRemovedOptionModule [ "services" "postsrsd" name ] ''
+          `postsrsd` was upgraded to `>= 2.0.0`, with some different behaviors and configuration settings:
+            - NixOS Release Notes: https://nixos.org/manual/nixos/unstable/release-notes#sec-nixpkgs-release-25.05-incompatibilities
+            - NixOS Options Reference: https://nixos.org/manual/nixos/unstable/options#opt-services.postsrsd.enable
+            - Migration instructions: https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#migrating-from-version-1x
+            - Postfix Setup: https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#postfix-setup
+        ''
+      )
+      [
+        "domain"
+        "forwardPort"
+        "reversePort"
+        "timeout"
+        "excludeDomains"
+      ];
+  disabledModules = [ "services/mail/postsrsd.nix" ];
+  options = {
+    services.postsrsd = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable the postsrsd SRS server for Postfix.";
+      };
+      secretsFile = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/postsrsd/postsrsd.secret";
+        description = "Secret keys used for signing and verification";
+      };
+      domains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = "Domain names for rewrite";
+        default = [ config.networking.hostName ];
+        defaultText = lib.literalExpression "[ config.networking.hostName ]";
+      };
+      separator = lib.mkOption {
+        type = lib.types.enum [
+          "-"
+          "="
+          "+"
+        ];
+        default = "=";
+        description = "First separator character in generated addresses";
+      };
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "postsrsd";
+        description = "User for the daemon";
+      };
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "postsrsd";
+        description = "Group for the daemon";
+      };
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+      };
+      configurePostfix = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "noop";
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
+      postsrsd = {
+        group = cfg.group;
+        uid = config.ids.uids.postsrsd;
+      };
+    };
+    users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
+      postsrsd.gid = config.ids.gids.postsrsd;
+    };
+    systemd.services.postsrsd-generate-secrets = {
+      path = [ pkgs.coreutils ];
+      script = ''
+        if [ -e "${cfg.secretsFile}" ]; then
+          echo "Secrets file exists. Nothing to do!"
+        else
+          echo "WARNING: secrets file not found, autogenerating!"
+          DIR="$(dirname "${cfg.secretsFile}")"
+          install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
+          install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
+        fi
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+      };
+    };
+    systemd.services.postsrsd = {
+      description = "PostSRSd SRS rewriting server";
+      after = [
+        "network.target"
+        "postsrsd-generate-secrets.service"
+      ];
+      before = [ "postfix.service" ];
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "postsrsd-generate-secrets.service" ];
+      confinement.enable = true;
+      serviceConfig = {
+        ExecStart = "${lib.getExe pkgs.postsrsd} -C ${configFile}";
+        User = cfg.user;
+        Group = cfg.group;
+        PermissionsStartOnly = true;
+        RuntimeDirectory = runtimeDirectoryName;
+        LoadCredential = "secrets-file:${cfg.secretsFile}";
+      };
+    };
+  };
+}
diff --git a/modules/systemd-run0.nix b/modules/systemd-run0.nix
new file mode 100644
index 00000000..8575ec7c
--- /dev/null
+++ b/modules/systemd-run0.nix
@@ -0,0 +1,4 @@
+{ config, lib, ... }:
+{
+  config.security.pam.services.systemd-run0 = lib.mkIf (lib.versionAtLeast config.systemd.package.version "256") {};
+}
diff --git a/modules/tzupdate.nix b/modules/tzupdate.nix
new file mode 100644
index 00000000..6465d33f
--- /dev/null
+++ b/modules/tzupdate.nix
@@ -0,0 +1,81 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.tzupdate;
+in
+{
+  disabledModules = [ "services/misc/tzupdate.nix" ];
+  options.services.tzupdate = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable the tzupdate timezone updating service. This provides
+        a one-shot service which can be activated with systemctl to
+        update the timezone.
+      '';
+    };
+    package = lib.mkPackageOption pkgs "tzupdate" { };
+    timer.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Enable the tzupdate timer to update the timezone automatically.
+      '';
+    };
+    timer.interval = lib.mkOption {
+      type = lib.types.str;
+      default = "hourly";
+      description = ''
+        The interval at which the tzupdate timer should run. See
+        {manpage}`systemd.time(7)` to understand the format.
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    # We need to have imperative time zone management for this to work.
+    # This will give users an error if they have set an explicit time
+    # zone, which is better than silently overriding it.
+    time.timeZone = null;
+    # We provide a one-shot service that runs at startup once network
+    # interfaces are up, but we can’t ensure we actually have Internet access
+    # at that point. It can also be run manually with `systemctl start tzupdate`.
+    systemd.services.tzupdate = {
+      description = "tzupdate timezone update service";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      script = ''
+        timezone="$(${lib.getExe cfg.package} --print-only)"
+        if [[ -n "$timezone" ]]; then
+          echo "Setting timezone to '$timezone'"
+          ${lib.getExe' config.systemd.package "timedatectl"} set-timezone "$timezone"
+        fi
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+      };
+    };
+    systemd.timers.tzupdate = {
+      enable = cfg.timer.enable;
+      timerConfig = {
+        OnStartupSec = "30s";
+        OnCalendar = cfg.timer.interval;
+        Persistent = true;
+      };
+      wantedBy = [ "timers.target" ];
+    };
+  };
+}
diff --git a/modules/uucp.nix b/modules/uucp.nix
deleted file mode 100644
index 10f7297b..00000000
--- a/modules/uucp.nix
+++ /dev/null
@@ -1,373 +0,0 @@
-{ flake, config, lib, pkgs, ... }:
-with lib;
-let
-  portSpec = name: node: concatStringsSep "\n" (map (port: ''
-    port ${name}.${port}
-    type pipe
-    protocol ${node.protocols}
-    reliable true
-    command ${pkgs.openssh}/bin/ssh -x -o batchmode=yes ${name}.${port}
-  '') node.hostnames);
-  sysSpec = name: node: ''
-    system ${name}
-    time any
-    chat-seven-bit false
-    chat . ""
-    protocol ${node.protocols}
-    command-path ${concatStringsSep " " cfg.commandPath}
-    commands ${concatStringsSep " " node.commands}
-    ${concatStringsSep "\nalternate\n" (map (port: ''
-      port ${name}.${port}
-    '') node.hostnames)}
-  '';
-  sshConfig = name: node: concatStringsSep "\n" (map (port: ''
-    Host ${name}.${port}
-      Hostname ${port}
-      IdentitiesOnly Yes
-      IdentityFile ${cfg.sshKeyDir}/${name}
-  '') node.hostnames);
-  sshKeyGen = name: node: ''
-    if [[ ! -e ${cfg.sshKeyDir}/${name} ]]; then
-      ${pkgs.openssh}/bin/ssh-keygen ${escapeShellArgs node.generateKey} -f ${cfg.sshKeyDir}/${name}
-    fi
-  '';
-  restrictKey = key: ''
-    restrict,command="${chat}" ${key}
-  '';
-  chat = pkgs.writeScript "chat" ''
-    #!${pkgs.stdenv.shell}
-    echo .
-    exec ${config.security.wrapperDir}/uucico
-  '';
-  nodeCfg = {
-    options = {
-      commands = mkOption {
-        type = types.listOf types.str;
-        default = cfg.defaultCommands;
-        defaultText = literalExpression "config.services.uucp.defaultCommands";
-        description = "Commands to allow for this remote";
-      };
-      protocols = mkOption {
-        type = types.separatedString "";
-              default = cfg.defaultProtocols;
-        defaultText = literalExpression "config.services.uucp.defaultProtocols";
-              description = "UUCP protocols to use for this remote";
-      };
-      publicKeys = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = "SSH client public keys for this node";
-      };
-      generateKey = mkOption {
-        type = types.listOf types.str;
-        default = [ "-t" "ed25519" "-N" "" ];
-        description = "Arguments to pass to `ssh-keygen` to generate a keypair for communication with this host";
-      };
-      hostnames = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = "Hostnames to try in order when connecting";
-      };
-    };
-  };
-  cfg = config.services.uucp;
-in {
-  options = {
-    services.uucp = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          If enabled we set up an account accesible via uucp over ssh
-        '';
-      };
-      nodeName = mkOption {
-        type = types.str;
-        default = "nixos";
-        description = "uucp node name";
-      };
-      sshUser = mkOption { 
-        type = types.attrs;
-        default = {};
-        description = "Overrides for the local uucp linux-user";
-      };
-      extraSSHConfig = mkOption {
-        type = types.str;
-        default = "";
-        description = "Extra SSH config";
-      };
-      remoteNodes = mkOption {
-        type = types.attrsOf (types.submodule nodeCfg);
-        default = {};
-        description = ''
-          Ports to set up
-          Names will probably need to be configured in sshConfig
-        '';
-      };
-      commandPath = mkOption {
-        type = types.listOf types.path;
-        default = [ "${pkgs.rmail}/bin" ];
-        defaultText = literalExpression ''[ "''${pkgs.rmail}/bin" ]'';
-        description = ''
-          Command search path for all systems
-        '';
-      };
-      defaultCommands = mkOption {
-        type = types.listOf types.str;
-        default = ["rmail"];
-        description = "Commands allowed for remotes without explicit override";
-      };
-      defaultProtocols = mkOption {
-        type = types.separatedString "";
-              default = "te";
-              description = "UUCP protocol to use within ssh unless overriden";
-      };
-      incomingProtocols = mkOption {
-        type = types.separatedString "";
-        default = "te";
-        description = "UUCP protocols to use when called";
-      };
-      homeDir = mkOption {
-        type = types.path;
-        default = "/var/uucp";
-        description = "Home of the uucp user";
-      };
-      sshKeyDir = mkOption {
-        type = types.path;
-        default = "${cfg.homeDir}/.ssh/";
-        defaultText = literalExpression ''''${config.services.uucp.homeDir}/.ssh/'';
-        description = "Directory to store ssh keypairs";
-      };
-      spoolDir = mkOption {
-        type = types.path;
-        default = "/var/spool/uucp";
-        description = "Spool directory";
-      };
-      lockDir = mkOption {
-        type = types.path;
-        default = "/var/spool/uucp";
-        description = "Lock directory";
-      };
-      pubDir = mkOption {
-        type = types.path;
-        default = "/var/spool/uucppublic";
-        description = "Public directory";
-      };
-      logFile = mkOption {
-        type = types.path;
-        default = "/var/log/uucp";
-        description = "Log file";
-      };
-      statFile = mkOption {
-        type = types.path;
-        default = "/var/log/uucp.stat";
-        description = "Statistics file";
-      };
-      debugFile = mkOption {
-        type = types.path;
-        default = "/var/log/uucp.debug";
-        description = "Debug file";
-      };
-      interval = mkOption {
-        type = types.nullOr types.str;
-        default = "1h";
-        description = ''
-          Specification of when to run `uucico' in format used by systemd timers
-          The default is to do so every hour
-        '';
-      };
-      nmDispatch = mkOption {
-        type = types.bool;
-        default = config.networking.networkmanager.enable;
-        defaultText = literalExpression "config.networking.networkmanager.enable";
-        description = ''
-          Install a network-manager dispatcher script to automatically
-          call all remotes when networking is available
-        '';
-      };
-      extraConfig = mkOption {
-        type = types.lines;
-        default = ''
-          run-uuxqt 1
-        '';
-        description = "Extra configuration to append verbatim to `/etc/uucp/config'";
-      };
-      extraSys = mkOption {
-        type = types.lines;
-        default = ''
-          protocol-parameter g packet-size 4096
-        '';
-              description = "Extra configuration to prepend verbatim to `/etc/uucp/sys`";
-      };
-    };
-  };
-  config = mkIf cfg.enable {
-    environment.etc."uucp/config" = {
-      text = ''
-        hostname ${cfg.nodeName}
-      
-        spool ${cfg.spoolDir}
-        lockdir ${cfg.lockDir}
-        pubdir ${cfg.pubDir}
-        logfile ${cfg.logFile}
-        statfile ${cfg.statFile}
-        debugfile ${cfg.debugFile}
-        
-        ${cfg.extraConfig}
-      '';
-    };
-    users.groups."uucp" = {};
-    users.users."uucp" = {
-      name = "uucp";
-      group = "uucp";
-      isSystemUser = true;
-      isNormalUser = false;
-      createHome = true;
-      home = cfg.homeDir;
-      description = "User for uucp over ssh";
-      useDefaultShell = true;
-      openssh.authorizedKeys.keys = map restrictKey (concatLists (mapAttrsToList (name: node: node.publicKeys) cfg.remoteNodes));
-    } // cfg.sshUser;
-    system.activationScripts."uucp-sshconfig" = ''
-      mkdir -p ${config.users.users."uucp".home}/.ssh
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${config.users.users."uucp".home}/.ssh
-      chmod 700 ${config.users.users."uucp".home}/.ssh
-      ln -fs ${builtins.toFile "ssh-config" ''
-        ${concatStringsSep "\n" (mapAttrsToList sshConfig cfg.remoteNodes)}
-      
-        ${cfg.extraSSHConfig}
-      ''} ${config.users.users."uucp".home}/.ssh/config
-      mkdir -p ${cfg.sshKeyDir}
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${cfg.sshKeyDir}
-      chmod 700 ${cfg.sshKeyDir}
-      ${concatStringsSep "\n" (mapAttrsToList sshKeyGen cfg.remoteNodes)}
-    '';
-    system.activationScripts."uucp-logs" = ''
-      touch ${cfg.logFile}
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${cfg.logFile}
-      chmod 644 ${cfg.logFile}
-      touch ${cfg.statFile}
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${cfg.statFile}
-      chmod 644 ${cfg.statFile}
-      touch ${cfg.debugFile}
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${cfg.debugFile}
-      chmod 644 ${cfg.debugFile}
-    '';
-    environment.etc."uucp/port" = {
-      text = ''
-        port ssh
-        type stdin
-        protocol ${cfg.incomingProtocols}
-      '' + concatStringsSep "\n" (mapAttrsToList portSpec cfg.remoteNodes);
-    };
-    environment.etc."uucp/sys" = {
-      text = cfg.extraSys + "\n" + concatStringsSep "\n" (mapAttrsToList sysSpec cfg.remoteNodes);
-    };
-    security.wrappers = let
-      wrapper = p: {
-        name = p;
-        value = {
-          source = "${pkgs.uucp}/bin/${p}";
-          owner = "root";
-          group = "root";
-          setuid = true;
-          setgid = false;
-        };
-      };
-    in listToAttrs (map wrapper ["uucico" "cu" "uucp" "uuname" "uustat" "uux" "uuxqt"]);
-    nixpkgs.overlays = [(self: super: {
-      rmail = super.writeShellScriptBin "rmail" ''
-          # Dummy UUCP rmail command for postfix/qmail systems
-          IFS=" " read junk from junk junk junk junk junk junk junk relay
-          case "$from" in
-            *[@!]*) ;;
-            *) from="$from@$relay";;
-          esac
-          exec ${config.security.wrapperDir}/sendmail -G -i -f "$from" -- "$@"
-        '';
-    })];
-    environment.systemPackages = with pkgs; [
-      uucp
-    ];
-    systemd.services."uucico@" = {
-      serviceConfig = {
-        User = "uucp";
-        Type = "oneshot";
-        ExecStart = "${config.security.wrapperDir}/uucico -D -S %i";
-      };
-    };
-    systemd.timers."uucico@" = {
-      timerConfig.OnActiveSec = cfg.interval;
-      timerConfig.OnUnitActiveSec = cfg.interval;
-    };
-    systemd.targets."multi-user" = {
-      wants = mapAttrsToList (name: node: "uucico@${name}.timer") cfg.remoteNodes;
-    };
-    systemd.kill-user.enable = true;
-    systemd.targets."sleep" = {
-      after = [ "kill-user@uucp.service" ];
-      wants = [ "kill-user@uucp.service" ];
-    };
-    
-    networking.networkmanager.dispatcherScripts = optional cfg.nmDispatch {
-      type = "basic";
-      source = pkgs.writeScript "callRemotes.sh" ''
-        #!${pkgs.stdenv.shell}
-        shopt -s extglob
-        case "''${2}" in
-          (?(vpn-)up)
-            ${concatStringsSep "\n    " (mapAttrsToList (name: node: "${pkgs.systemd}/bin/systemctl start uucico@${name}.service") cfg.remoteNodes)}
-            ;;
-        esac
-      '';
-    };
-  };
-}
diff --git a/nvfetcher.toml b/nvfetcher.toml
index ecaebba0..8e3ba905 100644
--- a/nvfetcher.toml
+++ b/nvfetcher.toml
@@ -115,3 +115,15 @@ fetch.git = "https://github.com/emersion/mako"
 [swayosd]
 src.git = "https://github.com/ErikReider/SwayOSD"
 fetch.git = "https://github.com/ErikReider/SwayOSD"
+[netbootxyz-efi]
+src.github = "netbootxyz/netboot.xyz"
+fetch.url = "https://github.com/netbootxyz/netboot.xyz/releases/download/$ver/netboot.xyz.efi"
+[netbootxyz-lkrn]
+src.github = "netbootxyz/netboot.xyz"
+fetch.url = "https://github.com/netbootxyz/netboot.xyz/releases/download/$ver/netboot.xyz.lkrn"
+[quickshell]
+src.git = "https://git.outfoxxed.me/quickshell/quickshell.git"
+fetch.git = "https://git.outfoxxed.me/quickshell/quickshell.git"
diff --git a/overlays/abs-podcast-autoplaylist/.envrc b/overlays/abs-podcast-autoplaylist/.envrc
new file mode 100644
index 00000000..2c909235
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/.envrc
@@ -0,0 +1,4 @@
+use flake
+[[ -d ".venv" ]] || ( uv venv && uv sync )
+. .venv/bin/activate
diff --git a/overlays/abs-podcast-autoplaylist/.gitignore b/overlays/abs-podcast-autoplaylist/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__init__.py b/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__init__.py
diff --git a/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__main__.py b/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__main__.py
new file mode 100644
index 00000000..fd739805
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__main__.py
@@ -0,0 +1,107 @@
+import click
+from pathlib import Path
+import tomllib
+import requests
+from urllib.parse import urljoin
+from operator import itemgetter
+import re
+from frozendict import frozendict
+class BearerAuth(requests.auth.AuthBase):
+    def __init__(self, token):
+        self.token = token
+    def __call__(self, r):
+        r.headers["authorization"] = "Bearer " + self.token
+        return r
+class ABSSession(requests.Session):
+    def __init__(self, config):
+        super().__init__()
+        self.base_url = config['instance']
+        self.auth = BearerAuth(config['api_token'])
+    def request(self, method, url, *args, **kwargs):
+        joined_url = urljoin(self.base_url, url)
+        return super().request(method, joined_url, *args, **kwargs)
+@click.command()
+@click.argument('config_file', type=click.Path(dir_okay=False, path_type=Path))
+def main(config_file: Path):
+    with config_file.open('rb') as fh:
+        config = tomllib.load(fh)
+    with ABSSession(config) as s:
+        libraries = s.get('/api/libraries').json()['libraries']
+        playlists = s.get('/api/playlists').json()['playlists']
+        for library_config in config['libraries']:
+            [library] = filter(lambda l: l['name'] == library_config['name'], libraries)
+            filtered_playlists = list(filter(lambda p: p['name'] == library_config['playlist'] and p['libraryId'] == library['id'], playlists))
+            def get_playlist():
+                playlist = None
+                if filtered_playlists:
+                    [playlist] = filtered_playlists
+                if not playlist:
+                    playlist = s.post('/api/playlists', json={
+                        'libraryId': library['id'],
+                        'name': library_config['playlist'],
+                    }).json()
+                return playlist
+            podcasts = dict()
+            items = s.get('/api/libraries/{}/items'.format(library['id'])).json()['results']
+            for item in items:
+                item = s.get('/api/items/{}'.format(item['id']), json={'expanded': True}).json()
+                episodes = list()
+                for episode in sorted(item['media']['episodes'], key = itemgetter('publishedAt')):
+                    progress = s.get('/api/me/progress/{}/{}'.format(episode['libraryItemId'], episode['id']))
+                    if progress.ok and progress.json()["isFinished"]:
+                        continue
+                    episodes.append(episode)
+                podcasts[item['media']['metadata']['title']] = list(map(lambda x: frozendict({ 'libraryItemId': x['libraryItemId'], 'episodeId': x['id']}), episodes))
+            def lookup_podcast(expr):
+                expr = re.compile(expr, flags=re.I)
+                matches = filter(lambda t: expr.search(t), podcasts.keys())
+                match list(matches):
+                    case [x]:
+                        return (x,)
+                    case _:
+                        raise RuntimeError("No unique match for ‘{}’".format(expr))
+            priorities = [
+                [
+                    k
+                    for item in (section if type(section) is list else [section])
+                    for k in lookup_podcast(item)
+                ]
+                for section in library_config['priorities']
+            ]
+            playlist_items = list()
+            for section in priorities:
+                while any(map(lambda item: item in podcasts, section)):
+                    for item in section:
+                        if not item in podcasts:
+                            continue
+                        if not podcasts[item]:
+                            del podcasts[item]
+                            continue
+                        playlist_items.append(podcasts[item].pop(0))
+            playlist = get_playlist()
+            current_playlist_items = map(lambda item: frozendict({ k: v for k, v in item.items() if k in {'libraryItemId', 'episodeId'}}), playlist['items'])
+            if current_playlist_items == playlist_items:
+                continue
+            to_remove = set(current_playlist_items) - set(playlist_items)
+            if to_remove:
+                s.post('/api/playlists/{}/batch/remove'.format(playlist['id']), json={'items': list(to_remove)}).raise_for_status()
+                playlist = get_playlist()
+            to_add = set(playlist_items) - set(current_playlist_items)
+            if to_add:
+                s.post('/api/playlists/{}/batch/add'.format(playlist['id']), json={'items': list(to_add)}).raise_for_status()
+            r = s.patch('/api/playlists/{}'.format(playlist['id']), json={'items': playlist_items}).raise_for_status()
diff --git a/overlays/abs-podcast-autoplaylist/default.nix b/overlays/abs-podcast-autoplaylist/default.nix
new file mode 100644
index 00000000..843f1b65
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/default.nix
@@ -0,0 +1,19 @@
+{ prev, final, flake, flakeInputs, ... }:
+let
+  workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
+  pythonSet = flake.lib.pythonSet {
+    pkgs = final;
+    python = final.python312;
+    overlay = workspace.mkPyprojectOverlay {
+      sourcePreference = "wheel";
+    };
+  };
+  virtualEnv = pythonSet.mkVirtualEnv "abs-podcast-autoplaylist-env" workspace.deps.default;
+in {
+  abs-podcast-autoplaylist = virtualEnv.overrideAttrs (oldAttrs: {
+    meta = (oldAttrs.meta or {}) // {
+      mainProgram = "abs-podcast-autoplaylist";
+    };
+  });
+}
diff --git a/overlays/abs-podcast-autoplaylist/pyproject.toml b/overlays/abs-podcast-autoplaylist/pyproject.toml
new file mode 100644
index 00000000..f52a84bc
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/pyproject.toml
@@ -0,0 +1,16 @@
+[project]
+name = "abs-podcast-autoplaylist"
+version = "0.1.0"
+requires-python = ">=3.12"
+dependencies = [
+    "click>=8.1.8",
+    "frozendict>=2.4.6",
+    "requests>=2.32.3",
+]
+[project.scripts]
+abs-podcast-autoplaylist = "abs_podcast_autoplaylist.__main__:main"
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
diff --git a/overlays/abs-podcast-autoplaylist/uv.lock b/overlays/abs-podcast-autoplaylist/uv.lock
new file mode 100644
index 00000000..17de5f0e
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/uv.lock
@@ -0,0 +1,129 @@
+version = 1
+revision = 2
+requires-python = ">=3.12"
+[[package]]
+name = "abs-podcast-autoplaylist"
+version = "0.1.0"
+source = { editable = "." }
+dependencies = [
+    { name = "click" },
+    { name = "frozendict" },
+    { name = "requests" },
+]
+[package.metadata]
+requires-dist = [
+    { name = "click", specifier = ">=8.1.8" },
+    { name = "frozendict", specifier = ">=2.4.6" },
+    { name = "requests", specifier = ">=2.32.3" },
+]
+[[package]]
+name = "certifi"
+version = "2025.4.26"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e8/9e/c05b3920a3b7d20d3d3310465f50348e5b3694f4f88c6daf736eef3024c4/certifi-2025.4.26.tar.gz", hash = "sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6", size = 160705, upload_time = "2025-04-26T02:12:29.51Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4a/7e/3db2bd1b1f9e95f7cddca6d6e75e2f2bd9f51b1246e546d88addca0106bd/certifi-2025.4.26-py3-none-any.whl", hash = "sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3", size = 159618, upload_time = "2025-04-26T02:12:27.662Z" },
+]
+[[package]]
+name = "charset-normalizer"
+version = "3.4.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e4/33/89c2ced2b67d1c2a61c19c6751aa8902d46ce3dacb23600a283619f5a12d/charset_normalizer-3.4.2.tar.gz", hash = "sha256:5baececa9ecba31eff645232d59845c07aa030f0c81ee70184a90d35099a0e63", size = 126367, upload_time = "2025-05-02T08:34:42.01Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d7/a4/37f4d6035c89cac7930395a35cc0f1b872e652eaafb76a6075943754f095/charset_normalizer-3.4.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:0c29de6a1a95f24b9a1aa7aefd27d2487263f00dfd55a77719b530788f75cff7", size = 199936, upload_time = "2025-05-02T08:32:33.712Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/8a/1a5e33b73e0d9287274f899d967907cd0bf9c343e651755d9307e0dbf2b3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cddf7bd982eaa998934a91f69d182aec997c6c468898efe6679af88283b498d3", size = 143790, upload_time = "2025-05-02T08:32:35.768Z" },
+    { url = "https://files.pythonhosted.org/packages/66/52/59521f1d8e6ab1482164fa21409c5ef44da3e9f653c13ba71becdd98dec3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:fcbe676a55d7445b22c10967bceaaf0ee69407fbe0ece4d032b6eb8d4565982a", size = 153924, upload_time = "2025-05-02T08:32:37.284Z" },
+    { url = "https://files.pythonhosted.org/packages/86/2d/fb55fdf41964ec782febbf33cb64be480a6b8f16ded2dbe8db27a405c09f/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d41c4d287cfc69060fa91cae9683eacffad989f1a10811995fa309df656ec214", size = 146626, upload_time = "2025-05-02T08:32:38.803Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/73/6ede2ec59bce19b3edf4209d70004253ec5f4e319f9a2e3f2f15601ed5f7/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4e594135de17ab3866138f496755f302b72157d115086d100c3f19370839dd3a", size = 148567, upload_time = "2025-05-02T08:32:40.251Z" },
+    { url = "https://files.pythonhosted.org/packages/09/14/957d03c6dc343c04904530b6bef4e5efae5ec7d7990a7cbb868e4595ee30/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cf713fe9a71ef6fd5adf7a79670135081cd4431c2943864757f0fa3a65b1fafd", size = 150957, upload_time = "2025-05-02T08:32:41.705Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/c8/8174d0e5c10ccebdcb1b53cc959591c4c722a3ad92461a273e86b9f5a302/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a370b3e078e418187da8c3674eddb9d983ec09445c99a3a263c2011993522981", size = 145408, upload_time = "2025-05-02T08:32:43.709Z" },
+    { url = "https://files.pythonhosted.org/packages/58/aa/8904b84bc8084ac19dc52feb4f5952c6df03ffb460a887b42615ee1382e8/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:a955b438e62efdf7e0b7b52a64dc5c3396e2634baa62471768a64bc2adb73d5c", size = 153399, upload_time = "2025-05-02T08:32:46.197Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/26/89ee1f0e264d201cb65cf054aca6038c03b1a0c6b4ae998070392a3ce605/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:7222ffd5e4de8e57e03ce2cef95a4c43c98fcb72ad86909abdfc2c17d227fc1b", size = 156815, upload_time = "2025-05-02T08:32:48.105Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/07/68e95b4b345bad3dbbd3a8681737b4338ff2c9df29856a6d6d23ac4c73cb/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:bee093bf902e1d8fc0ac143c88902c3dfc8941f7ea1d6a8dd2bcb786d33db03d", size = 154537, upload_time = "2025-05-02T08:32:49.719Z" },
+    { url = "https://files.pythonhosted.org/packages/77/1a/5eefc0ce04affb98af07bc05f3bac9094513c0e23b0562d64af46a06aae4/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:dedb8adb91d11846ee08bec4c8236c8549ac721c245678282dcb06b221aab59f", size = 149565, upload_time = "2025-05-02T08:32:51.404Z" },
+    { url = "https://files.pythonhosted.org/packages/37/a0/2410e5e6032a174c95e0806b1a6585eb21e12f445ebe239fac441995226a/charset_normalizer-3.4.2-cp312-cp312-win32.whl", hash = "sha256:db4c7bf0e07fc3b7d89ac2a5880a6a8062056801b83ff56d8464b70f65482b6c", size = 98357, upload_time = "2025-05-02T08:32:53.079Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/4f/c02d5c493967af3eda9c771ad4d2bbc8df6f99ddbeb37ceea6e8716a32bc/charset_normalizer-3.4.2-cp312-cp312-win_amd64.whl", hash = "sha256:5a9979887252a82fefd3d3ed2a8e3b937a7a809f65dcb1e068b090e165bbe99e", size = 105776, upload_time = "2025-05-02T08:32:54.573Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/12/a93df3366ed32db1d907d7593a94f1fe6293903e3e92967bebd6950ed12c/charset_normalizer-3.4.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:926ca93accd5d36ccdabd803392ddc3e03e6d4cd1cf17deff3b989ab8e9dbcf0", size = 199622, upload_time = "2025-05-02T08:32:56.363Z" },
+    { url = "https://files.pythonhosted.org/packages/04/93/bf204e6f344c39d9937d3c13c8cd5bbfc266472e51fc8c07cb7f64fcd2de/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:eba9904b0f38a143592d9fc0e19e2df0fa2e41c3c3745554761c5f6447eedabf", size = 143435, upload_time = "2025-05-02T08:32:58.551Z" },
+    { url = "https://files.pythonhosted.org/packages/22/2a/ea8a2095b0bafa6c5b5a55ffdc2f924455233ee7b91c69b7edfcc9e02284/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3fddb7e2c84ac87ac3a947cb4e66d143ca5863ef48e4a5ecb83bd48619e4634e", size = 153653, upload_time = "2025-05-02T08:33:00.342Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/57/1b090ff183d13cef485dfbe272e2fe57622a76694061353c59da52c9a659/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98f862da73774290f251b9df8d11161b6cf25b599a66baf087c1ffe340e9bfd1", size = 146231, upload_time = "2025-05-02T08:33:02.081Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/28/ffc026b26f441fc67bd21ab7f03b313ab3fe46714a14b516f931abe1a2d8/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6c9379d65defcab82d07b2a9dfbfc2e95bc8fe0ebb1b176a3190230a3ef0e07c", size = 148243, upload_time = "2025-05-02T08:33:04.063Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/0f/9abe9bd191629c33e69e47c6ef45ef99773320e9ad8e9cb08b8ab4a8d4cb/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e635b87f01ebc977342e2697d05b56632f5f879a4f15955dfe8cef2448b51691", size = 150442, upload_time = "2025-05-02T08:33:06.418Z" },
+    { url = "https://files.pythonhosted.org/packages/67/7c/a123bbcedca91d5916c056407f89a7f5e8fdfce12ba825d7d6b9954a1a3c/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1c95a1e2902a8b722868587c0e1184ad5c55631de5afc0eb96bc4b0d738092c0", size = 145147, upload_time = "2025-05-02T08:33:08.183Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/fe/1ac556fa4899d967b83e9893788e86b6af4d83e4726511eaaad035e36595/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ef8de666d6179b009dce7bcb2ad4c4a779f113f12caf8dc77f0162c29d20490b", size = 153057, upload_time = "2025-05-02T08:33:09.986Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/ff/acfc0b0a70b19e3e54febdd5301a98b72fa07635e56f24f60502e954c461/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:32fc0341d72e0f73f80acb0a2c94216bd704f4f0bce10aedea38f30502b271ff", size = 156454, upload_time = "2025-05-02T08:33:11.814Z" },
+    { url = "https://files.pythonhosted.org/packages/92/08/95b458ce9c740d0645feb0e96cea1f5ec946ea9c580a94adfe0b617f3573/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:289200a18fa698949d2b39c671c2cc7a24d44096784e76614899a7ccf2574b7b", size = 154174, upload_time = "2025-05-02T08:33:13.707Z" },
+    { url = "https://files.pythonhosted.org/packages/78/be/8392efc43487ac051eee6c36d5fbd63032d78f7728cb37aebcc98191f1ff/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4a476b06fbcf359ad25d34a057b7219281286ae2477cc5ff5e3f70a246971148", size = 149166, upload_time = "2025-05-02T08:33:15.458Z" },
+    { url = "https://files.pythonhosted.org/packages/44/96/392abd49b094d30b91d9fbda6a69519e95802250b777841cf3bda8fe136c/charset_normalizer-3.4.2-cp313-cp313-win32.whl", hash = "sha256:aaeeb6a479c7667fbe1099af9617c83aaca22182d6cf8c53966491a0f1b7ffb7", size = 98064, upload_time = "2025-05-02T08:33:17.06Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/b0/0200da600134e001d91851ddc797809e2fe0ea72de90e09bec5a2fbdaccb/charset_normalizer-3.4.2-cp313-cp313-win_amd64.whl", hash = "sha256:aa6af9e7d59f9c12b33ae4e9450619cf2488e2bbe9b44030905877f0b2324980", size = 105641, upload_time = "2025-05-02T08:33:18.753Z" },
+    { url = "https://files.pythonhosted.org/packages/20/94/c5790835a017658cbfabd07f3bfb549140c3ac458cfc196323996b10095a/charset_normalizer-3.4.2-py3-none-any.whl", hash = "sha256:7f56930ab0abd1c45cd15be65cc741c28b1c9a34876ce8c17a2fa107810c0af0", size = 52626, upload_time = "2025-05-02T08:34:40.053Z" },
+]
+[[package]]
+name = "click"
+version = "8.1.8"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b9/2e/0090cbf739cee7d23781ad4b89a9894a41538e4fcf4c31dcdd705b78eb8b/click-8.1.8.tar.gz", hash = "sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a", size = 226593, upload_time = "2024-12-21T18:38:44.339Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7e/d4/7ebdbd03970677812aac39c869717059dbb71a4cfc033ca6e5221787892c/click-8.1.8-py3-none-any.whl", hash = "sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2", size = 98188, upload_time = "2024-12-21T18:38:41.666Z" },
+]
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload_time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload_time = "2022-10-25T02:36:20.889Z" },
+]
+[[package]]
+name = "frozendict"
+version = "2.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bb/59/19eb300ba28e7547538bdf603f1c6c34793240a90e1a7b61b65d8517e35e/frozendict-2.4.6.tar.gz", hash = "sha256:df7cd16470fbd26fc4969a208efadc46319334eb97def1ddf48919b351192b8e", size = 316416, upload_time = "2024-10-13T12:15:32.449Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/13/d9839089b900fa7b479cce495d62110cddc4bd5630a04d8469916c0e79c5/frozendict-2.4.6-py311-none-any.whl", hash = "sha256:d065db6a44db2e2375c23eac816f1a022feb2fa98cbb50df44a9e83700accbea", size = 16148, upload_time = "2024-10-13T12:15:26.839Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/d0/d482c39cee2ab2978a892558cf130681d4574ea208e162da8958b31e9250/frozendict-2.4.6-py312-none-any.whl", hash = "sha256:49344abe90fb75f0f9fdefe6d4ef6d4894e640fadab71f11009d52ad97f370b9", size = 16146, upload_time = "2024-10-13T12:15:28.16Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/8e/b6bf6a0de482d7d7d7a2aaac8fdc4a4d0bb24a809f5ddd422aa7060eb3d2/frozendict-2.4.6-py313-none-any.whl", hash = "sha256:7134a2bb95d4a16556bb5f2b9736dceb6ea848fa5b6f3f6c2d6dba93b44b4757", size = 16146, upload_time = "2024-10-13T12:15:29.495Z" },
+]
+[[package]]
+name = "idna"
+version = "3.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload_time = "2024-09-15T18:07:39.745Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload_time = "2024-09-15T18:07:37.964Z" },
+]
+[[package]]
+name = "requests"
+version = "2.32.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "charset-normalizer" },
+    { name = "idna" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/63/70/2bf7780ad2d390a8d301ad0b550f1581eadbd9a20f896afe06353c2a2913/requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760", size = 131218, upload_time = "2024-05-29T15:37:49.536Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f9/9b/335f9764261e915ed497fcdeb11df5dfd6f7bf257d4a6a2a686d80da4d54/requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6", size = 64928, upload_time = "2024-05-29T15:37:47.027Z" },
+]
+[[package]]
+name = "urllib3"
+version = "2.4.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/8a/78/16493d9c386d8e60e442a35feac5e00f0913c0f4b7c217c11e8ec2ff53e0/urllib3-2.4.0.tar.gz", hash = "sha256:414bc6535b787febd7567804cc015fee39daab8ad86268f1310a9250697de466", size = 390672, upload_time = "2025-04-10T15:23:39.232Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/6b/11/cc635220681e93a0183390e26485430ca2c7b5f9d33b15c74c2861cb8091/urllib3-2.4.0-py3-none-any.whl", hash = "sha256:4e16665048960a0900c702d4a66415956a584919c03361cac9f1df5c5dd7e813", size = 128680, upload_time = "2025-04-10T15:23:37.377Z" },
+]
diff --git a/overlays/cake-prometheus-exporter/default.nix b/overlays/cake-prometheus-exporter/default.nix
index 3d0acc2d..69a5008c 100644
--- a/overlays/cake-prometheus-exporter/default.nix
+++ b/overlays/cake-prometheus-exporter/default.nix
@@ -1,19 +1,18 @@
 { final, prev, ... }:
 let
  inpPython = final.python310.override {};
+  python = inpPython.withPackages (ps: with ps; []);
 in {
  cake-prometheus-exporter = prev.stdenv.mkDerivation rec {
    pname = "cake-prometheus-exporter";
    version = "0.0.0";
-    src = ./cake-prometheus-exporter.py;
+    src = prev.replaceVars ./cake-prometheus-exporter.py { inherit python; };
-    phases = [ "buildPhase" "checkPhase" "installPhase" ];
+    phases = [ "unpackPhase" "checkPhase" "installPhase" ];
-    python = inpPython.withPackages (ps: with ps; []);
+    unpackPhase = ''
+      cp $src cake-prometheus-exporter
-    buildPhase = ''
-      substituteAll $src cake-prometheus-exporter
    '';
    doCheck = true;
diff --git a/overlays/deploy-rs.nix b/overlays/deploy-rs.nix
new file mode 100644
index 00000000..678c6f5f
--- /dev/null
+++ b/overlays/deploy-rs.nix
@@ -0,0 +1,16 @@
+{ final, prev, flakeInputs, ... }: prev.lib.composeExtensions
+  flakeInputs.deploy-rs.overlays.default
+  (final: prev: {
+    deploy-rs = prev.deploy-rs // {
+      deploy-rs = prev.symlinkJoin {
+        name = "${prev.deploy-rs.deploy-rs.name}-wrapped";
+        paths = [ prev.deploy-rs.deploy-rs ];
+        buildInputs = [ prev.makeWrapper ];
+        postBuild = ''
+          wrapProgram $out/bin/deploy \
+            --prefix PATH : ${prev.lib.makeBinPath (with final; [ nix-monitored ])}
+        '';
+      };
+    };
+  })
+  final prev
diff --git a/overlays/etesync-dav.nix b/overlays/etesync-dav.nix
index cec216e2..e0ced1e3 100644
--- a/overlays/etesync-dav.nix
+++ b/overlays/etesync-dav.nix
@@ -1,55 +1,58 @@
 { final, prev, ... }: {
-  etesync-dav = prev.python3Packages.buildPythonApplication rec {
+  etesync-dav = final.python3Packages.buildPythonApplication rec {
    pname = "etesync-dav";
-    version = "0.33.4";
+    version = "0.35.1";
+    pyproject = true;
    src = prev.fetchFromGitHub {
      owner = "etesync";
      repo = "etesync-dav";
-      rev = "v${version}";
+      tag = "v${version}";
-      hash = "sha256-g+rK762tSWPDaBsaTwpTzfK/lqVs+Z/Qrpq2HCpipQE=";
+      hash = "sha256-y4BhU2kSn+RWqc5+pJQFhbwfat9cMWD0ED0EXJp25cY=";
    };
-    dependencies = with prev.python3Packages; [
+    build-system = with final.python3Packages; [ setuptools ];
+    dependencies = with final.python3Packages; [
      appdirs
      etebase
      etesync
      flask
      flask-wtf
      msgpack
-      setuptools
+      requests
-      (toPythonModule (buildPythonApplication rec {
+      requests.optional-dependencies.socks
+      (buildPythonApplication rec {
        pname = "radicale";
-        version = "3.2.3";
+        version = "3.2.0";
        pyproject = true;
        src = prev.fetchFromGitHub {
          owner = "Kozea";
          repo = "Radicale";
          rev = "refs/tags/v${version}";
-          hash = "sha256-1IlnXVetQQuKBt6+QVKNeMM6qBQAiUhqc+4x3xOnSdE=";
+          hash = "sha256-RxC8VOfdTXJZiAroDHTKjJqGWu65Z5uyb4WK1LOqubQ=";
        };
+        postPatch = ''
+          sed -i '/addopts/d' setup.cfg
+        '';
        build-system = [
          setuptools
        ];
-        dependencies =
+        dependencies = [
-          [
+          defusedxml
-            defusedxml
+          passlib
-            passlib
+          vobject
-            vobject
+          pika
-            pika
+          python-dateutil
-            python-dateutil
+          pytz # https://github.com/Kozea/Radicale/issues/816
-            pytz # https://github.com/Kozea/Radicale/issues/816
+        ] ++ passlib.optional-dependencies.bcrypt;
-          ]
-          ++ passlib.optional-dependencies.bcrypt;
        doCheck = false;
-      }))
+      })
-      requests
-      types-setuptools
-      requests.optional-dependencies.socks
    ];
    doCheck = false;
diff --git a/overlays/inwx-cdnskey/default.nix b/overlays/inwx-cdnskey/default.nix
index cd564f24..e1bee0f2 100644
--- a/overlays/inwx-cdnskey/default.nix
+++ b/overlays/inwx-cdnskey/default.nix
@@ -2,17 +2,16 @@
 let
  packageOverrides = final.callPackage ./python-packages.nix {};
  inpPython = final.python39.override { inherit packageOverrides; };
+  python = inpPython.withPackages (ps: with ps; [pyxdg inwx-domrobot configparser dnspython]);
 in {
  inwx-cdnskey = prev.stdenv.mkDerivation rec {
    name = "inwx-cdnskey";
-    src = ./inwx-cdnskey.py;
+    src = prev.replaceVars ./inwx-cdnskey.py { inherit python; };
-    phases = [ "buildPhase" "checkPhase" "installPhase" ];
+    phases = [ "unpackPhase" "checkPhase" "installPhase" ];
-    python = inpPython.withPackages (ps: with ps; [pyxdg inwx-domrobot configparser dnspython]);
+    unpackPhase = ''
+      cp $src inwx-cdnskey
-    buildPhase = ''
-      substituteAll $src inwx-cdnskey
    '';
    doCheck = true;
diff --git a/overlays/lesspipe.nix b/overlays/lesspipe.nix
index 3258eb70..b791f6e5 100644
--- a/overlays/lesspipe.nix
+++ b/overlays/lesspipe.nix
@@ -17,7 +17,7 @@
    preFixup = ''
      wrapProgram $out/bin/lesspipe.sh \
-        --prefix PATH : ${final.python3.pkgs.pygments}/bin:${final.file}/bin:${final.ncurses}/bin
+        --prefix PATH : ${prev.lib.makeBinPath (with final; [ file ncurses binutils ])}
    '';
  };
 }
diff --git a/overlays/nftables-prometheus-exporter/default.nix b/overlays/nftables-prometheus-exporter/default.nix
index aab0c8e9..48f668c4 100644
--- a/overlays/nftables-prometheus-exporter/default.nix
+++ b/overlays/nftables-prometheus-exporter/default.nix
@@ -1,17 +1,16 @@
 { final, prev, ... }:
 let
  inpPython = final.python310;
+  python = inpPython.withPackages (ps: with ps; []);
 in {
  nftables-prometheus-exporter = prev.stdenv.mkDerivation rec {
    name = "nftables-prometheus-exporter";
-    src = ./nftables-prometheus-exporter.py;
+    src = prev.replaceVars ./nftables-prometheus-exporter.py { inherit python; };
-    phases = [ "buildPhase" "checkPhase" "installPhase" ];
+    phases = [ "unpackPhase" "checkPhase" "installPhase" ];
-    python = inpPython.withPackages (ps: with ps; []);
+    unpackPhase = ''
+      cp $src nftables-prometheus-exporter
-    buildPhase = ''
-      substituteAll $src nftables-prometheus-exporter
    '';
    doCheck = true;
diff --git a/overlays/nftables-prometheus-exporter/nftables-prometheus-exporter.py b/overlays/nftables-prometheus-exporter/nftables-prometheus-exporter.py
index 484228c8..60ef4670 100644
--- a/overlays/nftables-prometheus-exporter/nftables-prometheus-exporter.py
+++ b/overlays/nftables-prometheus-exporter/nftables-prometheus-exporter.py
@@ -42,7 +42,7 @@ class NFTMetrics:
            cls._instance = cls.__new__(cls)
            cls._instance.attrs = None
        return cls._instance
-    
    def __init__(self):
        raise RuntimeError('Call instance() instead')
@@ -62,7 +62,7 @@ class NFTMetrics:
                raise RuntimeError(f'nftables json schema v{version} is not supported')
            queries[query_name] = data['nftables'][1:]
-        
        def extract_query(query_name, type_name):
            return [
                item[type_name]
@@ -98,21 +98,21 @@ class NFTMetrics:
        metrics += _format_prom_metrics('nftables_counter_packets_count', 'counter', counter_packets)
        map_counts = []
-        for meter in self.attrs['maps']:
+        for item in self.attrs['maps']:
            labels = {  k: v for k, v in counter.items() if k not in set(['elem']) }
-            map_counts += [(labels, len(meter['elem']))]
+            map_counts += [(labels, len(item['elem']) if 'elem' in item else 0)]
        metrics += _format_prom_metrics('nftables_map_elem_count', 'gauge', map_counts)
        meter_counts = []
-        for meter in self.attrs['meters']:
+        for item in self.attrs['meters']:
            labels = {  k: v for k, v in counter.items() if k not in set(['elem']) }
-            meter_counts += [(labels, len(meter['elem']))]
+            item_counts += [(labels, len(item['elem']) if 'elem' in item else 0)]
        metrics += _format_prom_metrics('nftables_meter_elem_count', 'gauge', meter_counts)
-            
        set_counts = []
-        for meter in self.attrs['sets']:
+        for item in self.attrs['sets']:
            labels = {  k: v for k, v in counter.items() if k not in set(['elem']) }
-            set_counts += [(labels, len(meter['elem']))]
+            set_counts += [(labels, len(item['elem']) if 'elem' in item else 0)]
        metrics += _format_prom_metrics('nftables_set_elem_count', 'gauge', set_counts)
        return metrics.encode('utf-8')
@@ -120,7 +120,7 @@ class NFTMetrics:
 class NFTMetricsServer(BaseHTTPRequestHandler):
    def log_message(self, format, *args):
        pass
-    
    def do_GET(self):
        nft_metrics = NFTMetrics.instance()
        nft_metrics.update()
@@ -138,7 +138,7 @@ class NFTMetricsServer(BaseHTTPRequestHandler):
                self.send_response(200)
                self.send_header("Content-type", "text/plain")
                self.end_headers()
-                
                self.wfile.write(nft_metrics.prometheus())
            case _:
                self.send_response(404)
diff --git a/overlays/niri.nix b/overlays/niri.nix
index 9188ed7d..95a918b0 100644
--- a/overlays/niri.nix
+++ b/overlays/niri.nix
@@ -3,6 +3,7 @@
  (final: prev: {
    niri-unstable = prev.niri-unstable.overrideAttrs (oldAttrs: {
      buildInputs = (oldAttrs.buildInputs or []) ++ [ final.libgbm ];
+      doCheck = false;
    });
  })
  final prev
diff --git a/overlays/nix-direnv/default.nix b/overlays/nix-direnv/default.nix
new file mode 100644
index 00000000..7c488e4e
--- /dev/null
+++ b/overlays/nix-direnv/default.nix
@@ -0,0 +1,53 @@
+{ final, prev, ... }: {
+  nix-direnv = prev.resholve.mkDerivation rec {
+    pname = "nix-direnv";
+    version = "3.0.6";
+    patches = [
+      ./static-nix.patch
+    ];
+    src = prev.fetchFromGitHub {
+      owner = "nix-community";
+      repo = "nix-direnv";
+      rev = version;
+      hash = "sha256-oNqhPqgQT92yxbKmcgX4F3e2yTUPyXYG7b2xQm3TvQw=";
+    };
+    installPhase = ''
+      runHook preInstall
+      install -m400 -D direnvrc $out/share/nix-direnv/direnvrc
+      runHook postInstall
+    '';
+    solutions = {
+      default = {
+        scripts = [ "share/nix-direnv/direnvrc" ];
+        interpreter = "none";
+        inputs = with final; [ coreutils nix-monitored ];
+        fake = {
+          builtin = [
+            "PATH_add"
+            "direnv_layout_dir"
+            "has"
+            "log_error"
+            "log_status"
+            "watch_file"
+          ];
+          function = [
+            # not really a function - this is in an else branch for macOS/homebrew that
+            # cannot be reached when built with nix
+            "shasum"
+          ];
+        };
+        keep = {
+          "$cmd" = true;
+          "$direnv" = true;
+        };
+        execer = [
+          "cannot:${prev.lib.getExe' final.nix-monitored "nix"}"
+        ];
+      };
+    };
+  };
+}
diff --git a/overlays/nix-direnv/static-nix.patch b/overlays/nix-direnv/static-nix.patch
new file mode 100644
index 00000000..5de8193f
--- /dev/null
+++ b/overlays/nix-direnv/static-nix.patch
@@ -0,0 +1,62 @@
+diff --git i/direnvrc w/direnvrc
+index ddac0f5..fbcade6 100644
+--- i/direnvrc
+++ w/direnvrc
+@@ -29,10 +29,8 @@ _nix_direnv_warning() {
+ 
+ _nix_direnv_error() { log_error "${_NIX_DIRENV_LOG_PREFIX}$*"; }
+ 
+-_nix_direnv_nix=""
+-
+ _nix() {
+-  ${_nix_direnv_nix} --extra-experimental-features "nix-command flakes" "$@"
+  nix --extra-experimental-features "nix-command flakes" "$@"
+ }
+ 
+ _require_version() {
+@@ -55,34 +53,6 @@ _require_cmd_version() {
+   _require_version "$cmd" "${BASH_REMATCH[1]}" "$required"
+ }
+ 
+-_nix_direnv_resolve_nix() {
+-  local ambient_nix
+-
+-  if ambient_nix=$(command -v nix); then
+-    if _require_cmd_version "${ambient_nix}" "${NIX_MIN_VERSION}"; then
+-      echo "${ambient_nix}"
+-      return 0
+-    else
+-      _nix_direnv_warning "Nix version in PATH is too old, wanted ${NIX_MIN_VERSION}+, got $(${ambient_nix} --version), will attempt fallback"
+-    fi
+-  else
+-    _nix_direnv_warning "Could not find Nix in PATH, will attempt fallback"
+-  fi
+-
+-  if [ -n "${NIX_DIRENV_FALLBACK_NIX}" ]; then
+-    if _require_cmd_version "${NIX_DIRENV_FALLBACK_NIX}" "${NIX_MIN_VERSION}"; then
+-      echo "${NIX_DIRENV_FALLBACK_NIX}"
+-      return 0
+-    else
+-      _nix_direnv_error "Fallback Nix version is too old, wanted ${NIX_MIN_VERSION}+, got $(${NIX_DIRENV_FALLBACK_NIX} --version)"
+-      return 1
+-    fi
+-  else
+-    _nix_direnv_error "Could not find fallback Nix binary, please add Nix to PATH or set NIX_DIRENV_FALLBACK_NIX"
+-    return 1
+-  fi
+-}
+-
+ _nix_direnv_preflight() {
+   if [[ -z $direnv ]]; then
+     # shellcheck disable=2016
+@@ -102,10 +72,6 @@ _nix_direnv_preflight() {
+     fi
+   fi
+ 
+-  if ! _nix_direnv_nix=$(_nix_direnv_resolve_nix); then
+-    return 1
+-  fi
+-
+   local layout_dir
+   layout_dir=$(direnv_layout_dir)
+ 
diff --git a/overlays/nix-monitored.nix b/overlays/nix-monitored.nix
new file mode 100644
index 00000000..9f6caff1
--- /dev/null
+++ b/overlays/nix-monitored.nix
@@ -0,0 +1,8 @@
+{ final, prev, flakeInputs, ... }: prev.lib.composeExtensions
+  flakeInputs.nix-monitored.overlays.default
+  (final: prev: {
+    nix-monitored = prev.nix-monitored.override {
+      withNotify = false;
+    };
+  })
+  final prev
diff --git a/overlays/persistent-nix-shell/default.nix b/overlays/persistent-nix-shell/default.nix
index c36b9e86..6067cade 100644
--- a/overlays/persistent-nix-shell/default.nix
+++ b/overlays/persistent-nix-shell/default.nix
@@ -5,10 +5,9 @@
    phases = [ "buildPhase" "installPhase" ];
-    inherit (final) zsh;
    buildPhase = ''
-      substituteAll $src persistent-nix-shell
+      substitute $src persistent-nix-shell \
+        --subst-var-by zsh ${final.zsh}
    '';
    installPhase = ''
diff --git a/overlays/postsrsd.nix b/overlays/postsrsd.nix
new file mode 100644
index 00000000..cb1ccf30
--- /dev/null
+++ b/overlays/postsrsd.nix
@@ -0,0 +1,11 @@
+{ final, prev, ... }:
+{
+  postsrsd = prev.postsrsd.overrideAttrs (oldAttrs: {
+    cmakeFlags = (oldAttrs.cmakeFlags or []) ++ [
+      "-DWITH_MILTER=ON"
+    ];
+    buildInputs = (oldAttrs.buildInputs or []) ++ [
+      final.libmilter
+    ];
+  });
+}
diff --git a/overlays/prometheus-lvm-exporter.nix b/overlays/prometheus-lvm-exporter.nix
index 240f8d85..72d9c7ca 100644
--- a/overlays/prometheus-lvm-exporter.nix
+++ b/overlays/prometheus-lvm-exporter.nix
@@ -3,7 +3,7 @@
    pname = "prometheus-lvm-exporter";
    inherit (sources.prometheus-lvm-exporter) version src;
-    vendorHash = "sha256-z/fV0PzoWSDTJ44En19o7zJPPPox5ymFw7sw0Ab9t00=";
+    vendorHash = "sha256-CoTNTCBBugbHWDsOuZY1t8HrpdmEbbSMyVb3+1u0q+g=";
    doCheck = false;
diff --git a/overlays/quickshell/default.nix b/overlays/quickshell/default.nix
new file mode 100644
index 00000000..c01fac20
--- /dev/null
+++ b/overlays/quickshell/default.nix
@@ -0,0 +1,13 @@
+{ final, prev, sources, ... }:
+{
+  quickshell = prev.quickshell.overrideAttrs (oldAttrs: {
+    inherit (sources.quickshell) version src;
+    patches = (oldAttrs.patches or []) ++ [
+        ./greetd-response.patch
+        ./lock-state-changed.patch
+        ./pipewire.patch
+        ./io.patch
+    ];
+  });
+}
diff --git a/overlays/quickshell/greetd-response.patch b/overlays/quickshell/greetd-response.patch
new file mode 100644
index 00000000..a0efb562
--- /dev/null
+++ b/overlays/quickshell/greetd-response.patch
@@ -0,0 +1,16 @@
+diff --git c/src/services/greetd/connection.cpp w/src/services/greetd/connection.cpp
+index bf0d1fd..a790ab7 100644
+--- c/src/services/greetd/connection.cpp
+++ w/src/services/greetd/connection.cpp
+@@ -225,6 +225,11 @@ void GreetdConnection::onSocketReady() {
+ 
+                this->mResponseRequired = responseRequired;
+                emit this->authMessage(message, error, responseRequired, echoResponse);
+
+               if (!responseRequired)
+                       this->sendRequest({
+                               {"type", "post_auth_message_response"}
+                       });
+        } else goto unexpected;
+ 
+        return;
diff --git a/overlays/quickshell/io.patch b/overlays/quickshell/io.patch
new file mode 100644
index 00000000..961bdcaf
--- /dev/null
+++ b/overlays/quickshell/io.patch
@@ -0,0 +1,13 @@
+diff --git i/src/io/socket.cpp w/src/io/socket.cpp
+index 371f687..d12eaeb 100644
+--- i/src/io/socket.cpp
+++ w/src/io/socket.cpp
+@@ -66,7 +66,7 @@ void Socket::onSocketDisconnected() {
+ }
+ 
+ void Socket::onSocketError(QLocalSocket::LocalSocketError error) {
+-       qCWarning(logSocket) << "Socket error for" << this << error;
+       // qCWarning(logSocket) << "Socket error for" << this << error;
+        emit this->error(error);
+ }
+ 
diff --git a/overlays/quickshell/lock-state-changed.patch b/overlays/quickshell/lock-state-changed.patch
new file mode 100644
index 00000000..4be273fa
--- /dev/null
+++ b/overlays/quickshell/lock-state-changed.patch
@@ -0,0 +1,12 @@
+diff --git i/src/wayland/session_lock.cpp w/src/wayland/session_lock.cpp
+index 0ecf9ec..3dbd19b 100644
+--- i/src/wayland/session_lock.cpp
+++ w/src/wayland/session_lock.cpp
+@@ -127,6 +127,7 @@ void WlSessionLock::realizeLockTarget(WlSessionLock* old) {
+                this->updateSurfaces(false);
+ 
+                if (!this->manager->lock()) this->lockTarget = false;
+               emit this->lockStateChanged();
+ 
+                this->updateSurfaces(true, old);
+        } else {
diff --git a/overlays/quickshell/pipewire.patch b/overlays/quickshell/pipewire.patch
new file mode 100644
index 00000000..2d98eefc
--- /dev/null
+++ b/overlays/quickshell/pipewire.patch
@@ -0,0 +1,488 @@
+diff --git i/src/services/pipewire/device.cpp w/src/services/pipewire/device.cpp
+index 616e7d0..0c55008 100644
+--- i/src/services/pipewire/device.cpp
+++ w/src/services/pipewire/device.cpp
+@@ -3,6 +3,7 @@
+ #include <cstdint>
+ #include <functional>
+ #include <utility>
+#include <algorithm>
+ 
+ #include <pipewire/device.h>
+ #include <qcontainerfwd.h>
+@@ -19,6 +20,8 @@
+ #include <spa/pod/pod.h>
+ #include <spa/pod/vararg.h>
+ #include <spa/utils/type.h>
+#include <spa/monitor/device.h>
+#include <spa/utils/keys.h>
+ 
+ #include "../../core/logcat.hpp"
+ #include "core.hpp"
+@@ -46,6 +49,25 @@ void PwDevice::unbindHooks() {
+        this->mWaitingForDevice = false;
+ }
+ 
+void PwDevice::initProps(const spa_dict* props) {
+       if (const auto* deviceName = spa_dict_lookup(props, SPA_KEY_DEVICE_NAME)) {
+               this->name = deviceName;
+       }
+
+       if (const auto* deviceDesc = spa_dict_lookup(props, SPA_KEY_DEVICE_DESCRIPTION)) {
+               this->description = deviceDesc;
+       }
+
+       if (const auto* deviceNick = spa_dict_lookup(props, SPA_KEY_DEVICE_NICK)) {
+               this->nick = deviceNick;
+       }
+
+       if (const auto* mediaClass = spa_dict_lookup(props, SPA_KEY_MEDIA_CLASS)) {
+               this->type = mediaClass;
+       }
+}
+
+
+ const pw_device_events PwDevice::EVENTS = {
+     .version = PW_VERSION_DEVICE_EVENTS,
+     .info = &PwDevice::onInfo,
+@@ -71,6 +93,11 @@ void PwDevice::onInfo(void* data, const pw_device_info* info) {
+                                }
+ 
+                                break;
+                       } else if (param.id == SPA_PARAM_EnumProfile && param.flags & SPA_PARAM_INFO_READ) {
+                               self->validProfiles.clear();
+                               pw_device_enum_params(self->proxy(), 0, param.id, 0, UINT32_MAX, nullptr);
+                       } else if (param.id == SPA_PARAM_Profile && param.flags & SPA_PARAM_INFO_READ) {
+                               pw_device_enum_params(self->proxy(), 0, param.id, 0, UINT32_MAX, nullptr);
+                        }
+                }
+        }
+@@ -97,6 +124,15 @@ void PwDevice::onParam(
+                }
+ 
+                self->addDeviceIndexPairs(param);
+       } else if (id == SPA_PARAM_EnumProfile) {
+               PwProfile profile = PwProfile::parseSpaPod(param);
+               self->profilesUpdated = true;
+               self->profiles.insertOrAssign(profile.index, profile);
+               self->validProfiles.insert(profile.index);
+       } else if (id == SPA_PARAM_Profile) {
+               PwProfile profile = PwProfile::parseSpaPod(param);
+               self->currentProfileUpdated = true;
+               self->currentProfile = profile;
+        }
+ }
+ 
+@@ -145,6 +181,21 @@ void PwDevice::polled() {
+                        return false;
+                });
+        }
+       if (this->profilesUpdated) {
+               this->profiles.removeIf([&](const std::pair<qint32, PwProfile>& entry) {
+                       return !this->validProfiles.contains(entry.first);
+               });
+               this->profilesUpdated = false;
+               QList<PwProfile> profiles = this->profiles.values();
+               std::sort(profiles.begin(), profiles.end(), [](const PwProfile& a, const PwProfile& b) { return a.index < b.index; });
+               emit this->profilesChanged(profiles);
+       }
+       if (this->currentProfileUpdated) {
+               this->currentProfileUpdated = false;
+               if (this->currentProfile) {
+                       emit this->currentProfileChanged(*this->currentProfile);
+               }
+       }
+ }
+ 
+ bool PwDevice::setVolumes(qint32 routeDevice, const QVector<float>& volumes) {
+@@ -182,6 +233,15 @@ bool PwDevice::setMuted(qint32 routeDevice, bool muted) {
+        });
+ }
+ 
+void PwDevice::setProfile(qint32 profileIndex) {
+       auto buffer = std::array<uint8_t, 1024>();
+       auto builder = SPA_POD_BUILDER_INIT(buffer.data(), buffer.size());
+       auto* pod = spa_pod_builder_add_object(&builder,
+               SPA_TYPE_OBJECT_ParamProfile, SPA_PARAM_Profile,
+               SPA_PARAM_PROFILE_index, SPA_POD_Int(profileIndex));
+       pw_device_set_param(this->proxy(), SPA_PARAM_Profile, 0, static_cast<spa_pod*>(pod));
+}
+
+ void PwDevice::waitForDevice() { this->mWaitingForDevice = true; }
+ bool PwDevice::waitingForDevice() const { return this->mWaitingForDevice; }
+ 
+@@ -222,4 +282,24 @@ bool PwDevice::setRouteProps(
+        return true;
+ }
+ 
+PwProfile PwProfile::parseSpaPod(const spa_pod* param) {
+       PwProfile profile;
+
+       const auto* indexProp = spa_pod_find_prop(param, nullptr, SPA_PARAM_PROFILE_index);
+       const auto* descProp = spa_pod_find_prop(param, nullptr, SPA_PARAM_PROFILE_description);
+       const auto* nameProp = spa_pod_find_prop(param, nullptr, SPA_PARAM_PROFILE_name);
+
+       spa_pod_get_int(&indexProp->value, &profile.index);
+
+       const char* desc_cstr = nullptr;
+       spa_pod_get_string(&descProp->value, &desc_cstr);
+       profile.description = QString(desc_cstr);
+
+       const char* name_cstr = nullptr;
+       spa_pod_get_string(&nameProp->value, &name_cstr);
+       profile.name = QString(name_cstr);
+
+       return profile;
+}
+
+ } // namespace qs::service::pipewire
+diff --git i/src/services/pipewire/device.hpp w/src/services/pipewire/device.hpp
+index 1a1f705..ee64858 100644
+--- i/src/services/pipewire/device.hpp
+++ w/src/services/pipewire/device.hpp
+@@ -1,6 +1,7 @@
+ #pragma once
+ 
+ #include <functional>
+#include <optional>
+ 
+ #include <pipewire/core.h>
+ #include <pipewire/device.h>
+@@ -17,6 +18,20 @@
+ 
+ namespace qs::service::pipewire {
+ 
+struct PwProfile {
+       Q_GADGET;
+       Q_PROPERTY(qint32 index MEMBER index)
+       Q_PROPERTY(QString description MEMBER description)
+       Q_PROPERTY(QString name MEMBER name)
+
+public:
+       qint32 index;
+       QString description;
+       QString name;
+
+       static PwProfile parseSpaPod(const spa_pod* param);
+};
+
+ class PwDevice;
+ 
+ class PwDevice: public PwBindable<pw_device, PW_TYPE_INTERFACE_Device, PW_VERSION_DEVICE> {
+@@ -25,6 +40,12 @@ class PwDevice: public PwBindable<pw_device, PW_TYPE_INTERFACE_Device, PW_VERSIO
+ public:
+        void bindHooks() override;
+        void unbindHooks() override;
+       void initProps(const spa_dict* props) override;
+
+       QString name;
+       QString description;
+       QString nick;
+       QString type;
+ 
+        bool setVolumes(qint32 routeDevice, const QVector<float>& volumes);
+        bool setMuted(qint32 routeDevice, bool muted);
+@@ -32,9 +53,16 @@ public:
+        void waitForDevice();
+        [[nodiscard]] bool waitingForDevice() const;
+ 
+       void setProfile(qint32 profileIndex);
+
+       QHash<qint32, PwProfile> profiles;
+       std::optional<PwProfile> currentProfile;
+
+ signals:
+        void deviceReady();
+        void routeVolumesChanged(qint32 routeDevice, const PwVolumeProps& volumeProps);
+       void profilesChanged(QList<PwProfile> profiles);
+        void currentProfileChanged(PwProfile profile);
+ 
+ private slots:
+        void polled();
+@@ -49,6 +77,11 @@ private:
+        QList<qint32> stagingIndexes;
+        void addDeviceIndexPairs(const spa_pod* param);
+ 
+       bool profilesUpdated = false;
+       QSet<qint32> validProfiles;
+
+       bool currentProfileUpdated = false;
+
+        bool
+        setRouteProps(qint32 routeDevice, const std::function<void*(spa_pod_builder*)>& propsCallback);
+ 
+diff --git i/src/services/pipewire/node.cpp w/src/services/pipewire/node.cpp
+index 3e68149..4721a58 100644
+--- i/src/services/pipewire/node.cpp
+++ w/src/services/pipewire/node.cpp
+@@ -145,6 +145,10 @@ void PwNode::initProps(const spa_dict* props) {
+                        this->type = PwNodeType::VideoSink;
+                } else if (strcmp(mediaClass, "Video/Source") == 0) {
+                        this->type = PwNodeType::VideoSource;
+               } else if (strcmp(mediaClass, "Stream/Output/Video") == 0) {
+                       this->type = PwNodeType::VideoOutStream;
+               } else if (strcmp(mediaClass, "Stream/Input/Video") == 0) {
+                       this->type = PwNodeType::VideoInStream;
+                }
+        }
+ 
+diff --git i/src/services/pipewire/node.hpp w/src/services/pipewire/node.hpp
+index 0d4c92e..ee6f223 100644
+--- i/src/services/pipewire/node.hpp
+++ w/src/services/pipewire/node.hpp
+@@ -144,6 +144,8 @@ public:
+                // This is equivalent to the media class `Video/Sink` and is composed of the
+                // @@PwNodeType.Video and @@PwNodeType.Sink flags.
+                VideoSink = Video | Sink,
+               VideoOutStream = Video | Sink | Stream,
+               VideoInStream = Video | Source | Stream,
+        };
+        Q_ENUM(Flag);
+        Q_DECLARE_FLAGS(Flags, Flag);
+diff --git i/src/services/pipewire/qml.cpp w/src/services/pipewire/qml.cpp
+index 9efb17e..921d12a 100644
+--- i/src/services/pipewire/qml.cpp
+++ w/src/services/pipewire/qml.cpp
+@@ -9,6 +9,9 @@
+ #include <qtypes.h>
+ #include <qvariant.h>
+ 
+#include <cstdint>
+#include <algorithm>
+
+ #include "../../core/model.hpp"
+ #include "connection.hpp"
+ #include "defaults.hpp"
+@@ -54,6 +57,12 @@ Pipewire::Pipewire(QObject* parent): QObject(parent) {
+ 
+        QObject::connect(&connection->registry, &PwRegistry::nodeAdded, this, &Pipewire::onNodeAdded);
+ 
+       for (auto* device: connection->registry.devices.values()) {
+               this->onDeviceAdded(device);
+       }
+
+       QObject::connect(&connection->registry, &PwRegistry::deviceAdded, this, &Pipewire::onDeviceAdded);
+
+        for (auto* link: connection->registry.links.values()) {
+                this->onLinkAdded(link);
+        }
+@@ -123,6 +132,19 @@ void Pipewire::onNodeRemoved(QObject* object) {
+        this->mNodes.removeObject(iface);
+ }
+ 
+ObjectModel<PwDeviceIface>* Pipewire::devices() { return &this->mDevices; }
+
+void Pipewire::onDeviceAdded(PwDevice* device) {
+       auto* iface = PwDeviceIface::instance(device);
+       QObject::connect(iface, &QObject::destroyed, this, &Pipewire::onDeviceRemoved);
+       this->mDevices.insertObject(iface);
+}
+
+void Pipewire::onDeviceRemoved(QObject* object) {
+       auto* iface = static_cast<PwDeviceIface*>(object); // NOLINT
+       this->mDevices.removeObject(iface);
+}
+
+ ObjectModel<PwLinkIface>* Pipewire::links() { return &this->mLinks; }
+ 
+ void Pipewire::onLinkAdded(PwLink* link) {
+@@ -357,6 +379,8 @@ QVariantMap PwNodeIface::properties() const {
+ 
+ PwNodeAudioIface* PwNodeIface::audio() const { return this->audioIface; }
+ 
+PwDeviceIface* PwNodeIface::device() const { return PwDeviceIface::instance(this->mNode->device); }
+
+ PwNodeIface* PwNodeIface::instance(PwNode* node) {
+        if (node == nullptr) return nullptr;
+ 
+@@ -481,4 +505,42 @@ void PwObjectTracker::objectDestroyed(QObject* object) {
+        emit this->objectsChanged();
+ }
+ 
+PwDeviceIface::PwDeviceIface(PwDevice* device): PwObjectIface(device), mDevice(device) {
+       QObject::connect(device, &PwDevice::profilesChanged, this, &PwDeviceIface::deviceProfilesChanged);
+       QObject::connect(device, &PwDevice::currentProfileChanged, this, &PwDeviceIface::deviceCurrentProfileChanged);
+}
+
+void PwDeviceIface::deviceProfilesChanged(QList<PwProfile>) { emit this->profilesChanged(); }
+void PwDeviceIface::deviceCurrentProfileChanged(PwProfile) { emit this->currentProfileChanged(); }
+
+quint32 PwDeviceIface::id() const { return this->mDevice->id; }
+QString PwDeviceIface::name() const { return this->mDevice->name; }
+QString PwDeviceIface::description() const { return this->mDevice->description; }
+QString PwDeviceIface::nickname() const { return this->mDevice->nick; }
+QString PwDeviceIface::type() const { return this->mDevice->type; }
+QList<PwProfile> PwDeviceIface::profiles() const {
+       QList<PwProfile> profiles = this->mDevice->profiles.values();
+       std::sort(profiles.begin(), profiles.end(), [](const PwProfile& a, const PwProfile& b) { return a.index < b.index; });
+       return profiles;
+}
+qint32 PwDeviceIface::currentProfile() const { return this->mDevice->currentProfile->index; }
+
+PwDeviceIface* PwDeviceIface::instance(PwDevice* device) {
+       if (device == nullptr) return nullptr;
+
+       auto v = device->property("iface");
+       if (v.canConvert<PwDeviceIface*>()) {
+               return v.value<PwDeviceIface*>();
+       }
+
+       auto* instance = new PwDeviceIface(device);
+       device->setProperty("iface", QVariant::fromValue(instance));
+
+       return instance;
+}
+
+void PwDeviceIface::setProfile(qint32 profileIndex) {
+       this->mDevice->setProfile(profileIndex);
+}
+
+ } // namespace qs::service::pipewire
+diff --git i/src/services/pipewire/qml.hpp w/src/services/pipewire/qml.hpp
+index e3489a1..e5e1891 100644
+--- i/src/services/pipewire/qml.hpp
+++ w/src/services/pipewire/qml.hpp
+@@ -12,11 +12,13 @@
+ #include "../../core/model.hpp"
+ #include "link.hpp"
+ #include "node.hpp"
+#include "device.hpp"
+ #include "registry.hpp"
+ 
+ namespace qs::service::pipewire {
+ 
+ class PwNodeIface;
+class PwDeviceIface;
+ class PwLinkIface;
+ class PwLinkGroupIface;
+ 
+@@ -65,6 +67,8 @@ class Pipewire: public QObject {
+        /// - @@PwNode.audio - if non null the node is an audio node.
+        QSDOC_TYPE_OVERRIDE(ObjectModel<qs::service::pipewire::PwNodeIface>*);
+        Q_PROPERTY(UntypedObjectModel* nodes READ nodes CONSTANT);
+       QSDOC_TYPE_OVERRIDE(ObjectModel<qs::service::pipewire::PwDeviceIface>*);
+       Q_PROPERTY(UntypedObjectModel* devices READ devices CONSTANT);
+        /// All links present in pipewire.
+        ///
+        /// Links connect pipewire nodes to each other, and can be used to determine
+@@ -134,6 +138,7 @@ public:
+        explicit Pipewire(QObject* parent = nullptr);
+ 
+        [[nodiscard]] ObjectModel<PwNodeIface>* nodes();
+       [[nodiscard]] ObjectModel<PwDeviceIface>* devices();
+        [[nodiscard]] ObjectModel<PwLinkIface>* links();
+        [[nodiscard]] ObjectModel<PwLinkGroupIface>* linkGroups();
+ 
+@@ -159,7 +164,9 @@ signals:
+ 
+ private slots:
+        void onNodeAdded(PwNode* node);
+       void onDeviceAdded(PwDevice* node);
+        void onNodeRemoved(QObject* object);
+       void onDeviceRemoved(QObject* object);
+        void onLinkAdded(PwLink* link);
+        void onLinkRemoved(QObject* object);
+        void onLinkGroupAdded(PwLinkGroup* group);
+@@ -167,6 +174,7 @@ private slots:
+ 
+ private:
+        ObjectModel<PwNodeIface> mNodes {this};
+       ObjectModel<PwDeviceIface> mDevices {this};
+        ObjectModel<PwLinkIface> mLinks {this};
+        ObjectModel<PwLinkGroupIface> mLinkGroups {this};
+ };
+@@ -315,6 +323,7 @@ class PwNodeIface: public PwObjectIface {
+        /// > [!NOTE] The node may be used before it is fully bound, but some data
+        /// > may be missing or incorrect.
+        Q_PROPERTY(bool ready READ isReady NOTIFY readyChanged);
+       Q_PROPERTY(qs::service::pipewire::PwDeviceIface* device READ device CONSTANT);
+        QML_NAMED_ELEMENT(PwNode);
+        QML_UNCREATABLE("PwNodes cannot be created directly");
+ 
+@@ -332,6 +341,7 @@ public:
+        [[nodiscard]] PwNodeType::Flags type() const;
+        [[nodiscard]] QVariantMap properties() const;
+        [[nodiscard]] PwNodeAudioIface* audio() const;
+       [[nodiscard]] PwDeviceIface* device() const;
+ 
+        static PwNodeIface* instance(PwNode* node);
+ 
+@@ -344,6 +354,44 @@ private:
+        PwNodeAudioIface* audioIface = nullptr;
+ };
+ 
+class PwDeviceIface: public PwObjectIface {
+       Q_OBJECT;
+       Q_PROPERTY(quint32 id READ id CONSTANT);
+       Q_PROPERTY(QString name READ name CONSTANT);
+       Q_PROPERTY(QString description READ description CONSTANT);
+       Q_PROPERTY(QString nickname READ nickname CONSTANT);
+       Q_PROPERTY(QString type READ type CONSTANT);
+       Q_PROPERTY(QList<PwProfile> profiles READ profiles NOTIFY profilesChanged);
+       Q_PROPERTY(qint32 currentProfile READ currentProfile NOTIFY currentProfileChanged);
+
+       QML_NAMED_ELEMENT(PwDevice);
+       QML_UNCREATABLE("PwDevices cannot be created directly");
+
+signals:
+       void profilesChanged();
+       void currentProfileChanged();
+
+public:
+       explicit PwDeviceIface(PwDevice* node);
+
+       [[nodiscard]] quint32 id() const;
+       [[nodiscard]] QString name() const;
+       [[nodiscard]] QString description() const;
+       [[nodiscard]] QString nickname() const;
+       [[nodiscard]] QString type() const;
+       QList<PwProfile> profiles() const;
+       qint32 currentProfile() const;
+
+       Q_INVOKABLE void setProfile(qint32 profileIndex);
+
+       static PwDeviceIface* instance(PwDevice* node);
+private:
+       PwDevice* mDevice;
+
+       void deviceProfilesChanged(QList<PwProfile> profiles);
+       void deviceCurrentProfileChanged(PwProfile profile);
+};
+
+ ///! A connection between pipewire nodes.
+ /// Note that there is one link per *channel* of a connection between nodes.
+ /// You usually want @@PwLinkGroup.
+diff --git i/src/services/pipewire/registry.cpp w/src/services/pipewire/registry.cpp
+index c08fc1d..50c6d7a 100644
+--- i/src/services/pipewire/registry.cpp
+++ w/src/services/pipewire/registry.cpp
+@@ -196,6 +196,7 @@ void PwRegistry::onGlobal(
+                device->initProps(props);
+ 
+                self->devices.emplace(id, device);
+               emit self->deviceAdded(device);
+        }
+ }
+ 
+@@ -211,6 +212,9 @@ void PwRegistry::onGlobalRemoved(void* data, quint32 id) {
+        } else if (auto* node = self->nodes.value(id)) {
+                self->nodes.remove(id);
+                node->safeDestroy();
+       } else if (auto* device = self->devices.value(id)) {
+               self->devices.remove(id);
+               device->safeDestroy();
+        }
+ }
+ 
+diff --git i/src/services/pipewire/registry.hpp w/src/services/pipewire/registry.hpp
+index 8473f04..87e0766 100644
+--- i/src/services/pipewire/registry.hpp
+++ w/src/services/pipewire/registry.hpp
+@@ -132,6 +132,7 @@ public:
+ 
+ signals:
+        void nodeAdded(PwNode* node);
+       void deviceAdded(PwDevice* node);
+        void linkAdded(PwLink* link);
+        void linkGroupAdded(PwLinkGroup* group);
+        void metadataAdded(PwMetadata* metadata);
diff --git a/overlays/scutiger.nix b/overlays/scutiger.nix
index 7a56adaf..fea15c5f 100644
--- a/overlays/scutiger.nix
+++ b/overlays/scutiger.nix
@@ -2,7 +2,7 @@
  scutiger = final.rustPlatform.buildRustPackage {
    inherit (sources.scutiger) pname version src;
-    cargoHash = "sha256-d+wJ3trrldCVATsudsbglElU6q4LaS6feRocRyHal2k=";
+    cargoHash = if prev.lib.versionOlder prev.lib.version "24.05" then "sha256-d+wJ3trrldCVATsudsbglElU6q4LaS6feRocRyHal2k=" else "sha256-FTAEmRuO95ii84uwaALVuImiymnSAQkB2UwZ5yX0WPs=";
    nativeBuildInputs = with final; [ pkg-config pcre2.dev zlib.dev git ];
  };
diff --git a/overlays/spice-record.nix b/overlays/spice-record.nix
index 06a114da..2d37079b 100644
--- a/overlays/spice-record.nix
+++ b/overlays/spice-record.nix
@@ -8,5 +8,7 @@
      wrapProgram $out/bin/spice-record \
        --prefix PATH : ${prev.lib.makeBinPath (with prev; [ ffmpeg-full ])}
    '';
+    pyproject = true;
+    build-system = [ prev.python3Packages.setuptools ];
  };
 }
diff --git a/overlays/swayosd/default.nix b/overlays/swayosd/default.nix
deleted file mode 100644
index 2a3a0f2b..00000000
--- a/overlays/swayosd/default.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ final, prev, sources, ... }: {
-  swayosd = prev.swayosd.overrideAttrs (oldAttrs: rec {
-    inherit (sources.swayosd) version src;
-    cargoDeps = prev.rustPlatform.fetchCargoTarball {
-      inherit (oldAttrs) pname;
-      inherit version src;
-      hash = "sha256-s2vgyQP6J3i0q2o/Tt8dYoamBH3vrI/FNJYteHO8v5Q=";
-    };
-    patches = (oldAttrs.patches or []) ++ [
-      ./exponential.patch
-    ];
-  });
-}
diff --git a/overlays/swayosd/exponential.patch b/overlays/swayosd/exponential.patch
deleted file mode 100644
index eb90d739..00000000
--- a/overlays/swayosd/exponential.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-diff --git a/src/brightness_backend/brightnessctl.rs b/src/brightness_backend/brightnessctl.rs
-index ccb0e11..740fdb6 100644
--- a/src/brightness_backend/brightnessctl.rs
-+++ b/src/brightness_backend/brightnessctl.rs
-@@ -107,10 +107,21 @@ impl VirtualDevice {
-                }
-        }
- 
-       fn set_percent(&mut self, mut val: u32) -> anyhow::Result<()> {
-               val = val.clamp(0, 100);
-               self.current = self.max.map(|max| val * max / 100);
-               let _: String = self.run(("set", &*format!("{val}%")))?;
-+        fn val_to_percent(&mut self, val: u32) -> u32 {
-+                return ((val as f64 / self.get_max() as f64).powf(0.25) * 100_f64).round() as u32;
-+        }
-+        fn percent_to_val(&mut self, perc: u32) -> u32 {
-+                return ((perc as f64 / 100_f64).powf(4_f64) * self.get_max() as f64).round() as u32;
-+        }
-+
-+       fn set_percent(&mut self, val: u32) -> anyhow::Result<()> {
-+                let new = self.percent_to_val(val);
-+                self.set_val(new)
-+       }
-+       fn set_val(&mut self, val: u32) -> anyhow::Result<()> {
-+                let curr = val.clamp(0, self.get_max());
-+                self.current = Some(curr);
-+               let _: String = self.run(("set", &*format!("{curr}")))?;
-                Ok(())
-        }
- }
-@@ -134,20 +145,18 @@ impl BrightnessBackend for BrightnessCtl {
- 
-        fn lower(&mut self, by: u32) -> anyhow::Result<()> {
-                let curr = self.get_current();
-               let max = self.get_max();
-
-               let curr = curr * 100 / max;
-+                let mut new = self.device.val_to_percent(curr).saturating_sub(by);
-+                new = self.device.percent_to_val(new).min(curr.saturating_sub(1));
- 
-               self.device.set_percent(curr.saturating_sub(by))
-+               self.device.set_val(new)
-        }
- 
-        fn raise(&mut self, by: u32) -> anyhow::Result<()> {
-                let curr = self.get_current();
-               let max = self.get_max();
-
-               let curr = curr * 100 / max;
-+                let mut new = self.device.val_to_percent(curr) + by;
-+                new = self.device.percent_to_val(new).max(curr + 1);
- 
-               self.device.set_percent(curr + by)
-+               self.device.set_val(new)
-        }
- 
-        fn set(&mut self, val: u32) -> anyhow::Result<()> {
diff --git a/overlays/thunderbird.nix b/overlays/thunderbird.nix
deleted file mode 100644
index 48ae2ccb..00000000
--- a/overlays/thunderbird.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ final, prev, ... }: {
-  thunderbird-unwrapped = prev.thunderbird-unwrapped.overrideAttrs (oldAttrs: {
-    patches = (oldAttrs.patches or [])
-           ++ prev.lib.optional (prev.lib.versionAtLeast oldAttrs.version "136") (prev.fetchpatch {
-                url = "https://hg.mozilla.org/comm-central/raw-rev/a82bd8fc0bc0";
-                hash = "sha256-7t8IqxwcZJqXmOevpGof1mcrFKZvXtCcY2EOIsP47EY=";
-                stripLen = 1;
-                extraPrefix = "comm/";
-              });
-  });
-}
diff --git a/overlays/uucp/default.nix b/overlays/uucp/default.nix
deleted file mode 100644
index 4189dbcc..00000000
--- a/overlays/uucp/default.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ final, prev, ... }: {
-  uucp = prev.uucp.overrideAttrs (oldAttrs: {
-    configureFlags = (oldAttrs.configureFlags or []) ++ ["--with-newconfigdir=/etc/uucp"];
-    patches = (oldAttrs.patches or []) ++ [
-      ./mailprogram.patch
-    ];
-    NIX_CFLAGS_COMPILE = "${oldAttrs.NIX_CFLAGS_COMPILE or ""} -Wno-error=incompatible-pointer-types";
-  });
-}
diff --git a/overlays/uucp/mailprogram.patch b/overlays/uucp/mailprogram.patch
deleted file mode 100644
index 89ac8f31..00000000
--- a/overlays/uucp/mailprogram.patch
+++ /dev/null
@@ -1,16 +0,0 @@
- policy.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/policy.h b/policy.h
-index 5afe34b..8e92c8b 100644
--- a/policy.h
-+++ b/policy.h
-@@ -240,7 +240,7 @@
-    the sendmail choice below.  Otherwise, select one of the other
-    choices as appropriate.  */
- #if 1
-#define MAIL_PROGRAM "/usr/lib/sendmail -t"
-+#define MAIL_PROGRAM "${config.security.wrapperDir}/sendmail -t"
- /* #define MAIL_PROGRAM "/usr/sbin/sendmail -t" */
- #define MAIL_PROGRAM_TO_BODY 1
- #define MAIL_PROGRAM_SUBJECT_BODY 1
diff --git a/overlays/waybar-systemd-inhibit/.envrc b/overlays/waybar-systemd-inhibit/.envrc
new file mode 100644
index 00000000..2c909235
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/.envrc
@@ -0,0 +1,4 @@
+use flake
+[[ -d ".venv" ]] || ( uv venv && uv sync )
+. .venv/bin/activate
diff --git a/overlays/waybar-systemd-inhibit/.gitignore b/overlays/waybar-systemd-inhibit/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/overlays/waybar-systemd-inhibit/default.nix b/overlays/waybar-systemd-inhibit/default.nix
new file mode 100644
index 00000000..ae6b8c75
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/default.nix
@@ -0,0 +1,20 @@
+{ prev, final, flake, flakeInputs, ... }:
+let
+  workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
+  pythonSet = flake.lib.pythonSet {
+    pkgs = final;
+    python = final.python312;
+    overlay = workspace.mkPyprojectOverlay {
+      sourcePreference = "wheel";
+    };
+  };
+  virtualEnv = pythonSet.mkVirtualEnv "waybar-systemd-inhibit-env" workspace.deps.default;
+in {
+  waybar-systemd-inhibit = virtualEnv.overrideAttrs (oldAttrs: {
+    meta = (oldAttrs.meta or {}) // {
+      mainProgram = "waybar-systemd-inhibit";
+    };
+    nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [ final.gobject-introspection final.wrapGAppsHook ];
+  });
+}
diff --git a/overlays/waybar-systemd-inhibit/pyproject.toml b/overlays/waybar-systemd-inhibit/pyproject.toml
new file mode 100644
index 00000000..6c6240b8
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/pyproject.toml
@@ -0,0 +1,17 @@
+[project]
+name = "waybar-systemd-inhibit"
+version = "0.1.0"
+requires-python = ">=3.12"
+dependencies = [
+    "asyncclick>=8.1.8",
+    "asyncio>=3.4.3",
+    "dbus-next>=0.2.3",
+]
+[project.scripts]
+waybar-systemd-inhibit = "waybar_systemd_inhibit.__main__:main"
+waybar-systemd-inhibit-toggle = "waybar_systemd_inhibit.__main__:toggle"
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
diff --git a/overlays/waybar-systemd-inhibit/uv.lock b/overlays/waybar-systemd-inhibit/uv.lock
new file mode 100644
index 00000000..4e10d145
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/uv.lock
@@ -0,0 +1,102 @@
+version = 1
+revision = 2
+requires-python = ">=3.12"
+[[package]]
+name = "anyio"
+version = "4.9.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "idna" },
+    { name = "sniffio" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/95/7d/4c1bd541d4dffa1b52bd83fb8527089e097a106fc90b467a7313b105f840/anyio-4.9.0.tar.gz", hash = "sha256:673c0c244e15788651a4ff38710fea9675823028a6f08a5eda409e0c9840a028", size = 190949, upload-time = "2025-03-17T00:02:54.77Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a1/ee/48ca1a7c89ffec8b6a0c5d02b89c305671d5ffd8d3c94acf8b8c408575bb/anyio-4.9.0-py3-none-any.whl", hash = "sha256:9f76d541cad6e36af7beb62e978876f3b41e3e04f2c1fbf0884604c0a9c4d93c", size = 100916, upload-time = "2025-03-17T00:02:52.713Z" },
+]
+[[package]]
+name = "asyncclick"
+version = "8.1.8"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/cb/b5/e1e5fdf1c1bb7e6e614987c120a98d9324bf8edfaa5f5cd16a6235c9d91b/asyncclick-8.1.8.tar.gz", hash = "sha256:0f0eb0f280e04919d67cf71b9fcdfb4db2d9ff7203669c40284485c149578e4c", size = 232900, upload-time = "2025-01-06T09:46:52.694Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/14/cc/a436f0fc2d04e57a0697e0f87a03b9eaed03ad043d2d5f887f8eebcec95f/asyncclick-8.1.8-py3-none-any.whl", hash = "sha256:eb1ccb44bc767f8f0695d592c7806fdf5bd575605b4ee246ffd5fadbcfdbd7c6", size = 99093, upload-time = "2025-01-06T09:46:51.046Z" },
+    { url = "https://files.pythonhosted.org/packages/92/c4/ae9e9d25522c6dc96ff167903880a0fe94d7bd31ed999198ee5017d977ed/asyncclick-8.1.8.0-py3-none-any.whl", hash = "sha256:be146a2d8075d4fe372ff4e877f23c8b5af269d16705c1948123b9415f6fd678", size = 99115, upload-time = "2025-01-06T09:50:52.72Z" },
+]
+[[package]]
+name = "asyncio"
+version = "3.4.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/da/54/054bafaf2c0fb8473d423743e191fcdf49b2c1fd5e9af3524efbe097bafd/asyncio-3.4.3.tar.gz", hash = "sha256:83360ff8bc97980e4ff25c964c7bd3923d333d177aa4f7fb736b019f26c7cb41", size = 204411, upload-time = "2015-03-10T14:11:26.494Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/22/74/07679c5b9f98a7cb0fc147b1ef1cc1853bc07a4eb9cb5731e24732c5f773/asyncio-3.4.3-py3-none-any.whl", hash = "sha256:c4d18b22701821de07bd6aea8b53d21449ec0ec5680645e5317062ea21817d2d", size = 101767, upload-time = "2015-03-10T14:05:10.959Z" },
+]
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+[[package]]
+name = "dbus-next"
+version = "0.2.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/45/6a40fbe886d60a8c26f480e7d12535502b5ba123814b3b9a0b002ebca198/dbus_next-0.2.3.tar.gz", hash = "sha256:f4eae26909332ada528c0a3549dda8d4f088f9b365153952a408e28023a626a5", size = 71112, upload-time = "2021-07-25T22:11:28.398Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d2/fc/c0a3f4c4eaa5a22fbef91713474666e13d0ea2a69c84532579490a9f2cc8/dbus_next-0.2.3-py3-none-any.whl", hash = "sha256:58948f9aff9db08316734c0be2a120f6dc502124d9642f55e90ac82ffb16a18b", size = 57885, upload-time = "2021-07-25T22:11:25.466Z" },
+]
+[[package]]
+name = "idna"
+version = "3.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
+]
+[[package]]
+name = "sniffio"
+version = "1.3.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a2/87/a6771e1546d97e7e041b6ae58d80074f81b7d5121207425c964ddf5cfdbd/sniffio-1.3.1.tar.gz", hash = "sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc", size = 20372, upload-time = "2024-02-25T23:20:04.057Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e9/44/75a9c9421471a6c4805dbf2356f7c181a29c1879239abab1ea2cc8f38b40/sniffio-1.3.1-py3-none-any.whl", hash = "sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2", size = 10235, upload-time = "2024-02-25T23:20:01.196Z" },
+]
+[[package]]
+name = "typing-extensions"
+version = "4.13.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f6/37/23083fcd6e35492953e8d2aaaa68b860eb422b34627b13f2ce3eb6106061/typing_extensions-4.13.2.tar.gz", hash = "sha256:e6c81219bd689f51865d9e372991c540bda33a0379d5573cddb9a3a23f7caaef", size = 106967, upload-time = "2025-04-10T14:19:05.416Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/8b/54/b1ae86c0973cc6f0210b53d508ca3641fb6d0c56823f288d108bc7ab3cc8/typing_extensions-4.13.2-py3-none-any.whl", hash = "sha256:a439e7c04b49fec3e5d3e2beaa21755cadbbdc391694e28ccdd36ca4a1408f8c", size = 45806, upload-time = "2025-04-10T14:19:03.967Z" },
+]
+[[package]]
+name = "waybar-systemd-inhibit"
+version = "0.1.0"
+source = { editable = "." }
+dependencies = [
+    { name = "asyncclick" },
+    { name = "asyncio" },
+    { name = "dbus-next" },
+]
+[package.metadata]
+requires-dist = [
+    { name = "asyncclick", specifier = ">=8.1.8" },
+    { name = "asyncio", specifier = ">=3.4.3" },
+    { name = "dbus-next", specifier = ">=0.2.3" },
+]
diff --git a/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__init__.py b/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__init__.py
diff --git a/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__main__.py b/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__main__.py
new file mode 100644
index 00000000..35cc7fd1
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__main__.py
@@ -0,0 +1,117 @@
+import asyncclick as click
+from dbus_next.aio import MessageBus
+from dbus_next import BusType, Message, PropertyAccess
+import asyncio
+from functools import update_wrapper
+from dbus_next.service import ServiceInterface, method, dbus_property
+from dbus_next import Variant, DBusError
+import os
+import json
+class BlockInterface(ServiceInterface):
+    def __init__(self, system_bus, logind):
+        super().__init__('li.yggdrasil.WaybarSystemdInhibit')
+        self.system_bus = system_bus
+        self.logind = logind
+        self.fd = None
+    def Release(self):
+        if not self.fd:
+            return
+        os.close(self.fd)
+        self.fd = None
+        self.emit_properties_changed({'IsAcquired': False})
+    async def Acquire(self):
+        if self.fd:
+            return
+        res = await self.system_bus.call(Message(
+            destination='org.freedesktop.login1',
+            path='/org/freedesktop/login1',
+            interface='org.freedesktop.login1.Manager',
+            member='Inhibit',
+            signature='ssss',
+            body=[
+                "handle-lid-switch",
+                "waybar-systemd-inhibit",
+                "User request",
+                "block",
+            ],
+        ))
+        self.fd = res.unix_fds[res.body[0]]
+        self.emit_properties_changed({'IsAcquired': True})
+    @method()
+    async def ToggleBlock(self):
+        if self.fd:
+            self.Release()
+        else:
+            await self.Acquire()
+    @dbus_property(access=PropertyAccess.READ)
+    def IsAcquired(self) -> 'b':
+        return self.fd is not None
+@click.command()
+async def main():
+    system_bus = await MessageBus(bus_type=BusType.SYSTEM, negotiate_unix_fd=True).connect()
+    session_bus = await MessageBus(bus_type=BusType.SESSION).connect()
+    introspection = await system_bus.introspect('org.freedesktop.login1', '/org/freedesktop/login1')
+    obj = system_bus.get_proxy_object('org.freedesktop.login1', '/org/freedesktop/login1', introspection)
+    logind = obj.get_interface('org.freedesktop.login1.Manager')
+    properties = obj.get_interface('org.freedesktop.DBus.Properties')
+    def is_blocked_logind(what: str):
+        return "handle-lid-switch" in what.split(':')
+    def print_state(is_blocked: bool, is_acquired: bool = False):
+        icon = "&#xf0322;" if is_blocked else "&#xf06e7;"
+        text = f"<span font=\"Symbols Nerd Font Mono\">{icon}</span>"
+        if is_acquired:
+            text = f"<span color=\"#f28a21\">{text}</span>"
+        elif is_blocked:
+            text = f"<span color=\"#ffffff\">{text}</span>"
+        print(json.dumps({'text': text, 'tooltip': ("Manually inhibited" if is_acquired else None)}, separators=(',', ':')), flush=True)
+    print_state(is_blocked_logind(await logind.get_block_inhibited()))
+    async def get_inhibit():
+        introspection = await session_bus.introspect('li.yggdrasil.WaybarSystemdInhibit', '/li/yggdrasil/WaybarSystemdInhibit')
+        return session_bus.get_proxy_object('li.yggdrasil.WaybarSystemdInhibit', '/li/yggdrasil/WaybarSystemdInhibit', introspection)
+    async def on_logind_properties_changed(interface_name, changed_properties, invalidated_properties):
+        if 'BlockInhibited' not in changed_properties:
+            return
+        properties = (await get_inhibit()).get_interface('li.yggdrasil.WaybarSystemdInhibit')
+        print_state(is_blocked_logind(changed_properties['BlockInhibited'].value), await properties.get_is_acquired())
+    properties.on_properties_changed(on_logind_properties_changed)
+    session_bus.export('/li/yggdrasil/WaybarSystemdInhibit', BlockInterface(system_bus, logind))
+    await session_bus.request_name('li.yggdrasil.WaybarSystemdInhibit')
+    properties = (await get_inhibit()).get_interface('org.freedesktop.DBus.Properties')
+    async def on_inhibit_properties_changed(interface_name, changed_properties, invalidated_properties):
+        if 'IsAcquired' not in changed_properties:
+            return
+        print_state(is_blocked_logind(await logind.get_block_inhibited()), changed_properties['IsAcquired'].value)
+    properties.on_properties_changed(on_inhibit_properties_changed)
+    await session_bus.wait_for_disconnect()
+@click.command()
+async def toggle():
+    session_bus = await MessageBus(bus_type=BusType.SESSION).connect()
+    introspection = await session_bus.introspect('li.yggdrasil.WaybarSystemdInhibit', '/li/yggdrasil/WaybarSystemdInhibit')
+    obj = session_bus.get_proxy_object('li.yggdrasil.WaybarSystemdInhibit', '/li/yggdrasil/WaybarSystemdInhibit', introspection)
+    interface = obj.get_interface('li.yggdrasil.WaybarSystemdInhibit')
+    await interface.call_toggle_block()
diff --git a/overlays/worktime/.envrc b/overlays/worktime/.envrc
new file mode 100644
index 00000000..2c909235
--- /dev/null
+++ b/overlays/worktime/.envrc
@@ -0,0 +1,4 @@
+use flake
+[[ -d ".venv" ]] || ( uv venv && uv sync )
+. .venv/bin/activate
diff --git a/overlays/worktime/.gitignore b/overlays/worktime/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/overlays/worktime/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/overlays/worktime/default.nix b/overlays/worktime/default.nix
index 1d8433af..579cf7ad 100644
--- a/overlays/worktime/default.nix
+++ b/overlays/worktime/default.nix
@@ -1,13 +1,19 @@
-{ prev, ... }:
+{ prev, final, flake, flakeInputs, ... }:
-with prev.poetry2nix;
+let
+  workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
-{
+  pythonSet = flake.lib.pythonSet {
-  worktime = mkPoetryApplication {
+    pkgs = final;
-    python = prev.python312;
+    python = final.python312;
+    overlay = workspace.mkPyprojectOverlay {
-    projectDir = cleanPythonSources { src = ./.; };
+      sourcePreference = "wheel";
+    };
-    meta.mainProgram = "worktime";
  };
+  virtualEnv = pythonSet.mkVirtualEnv "worktime" workspace.deps.default;
+in {
+  worktime = virtualEnv.overrideAttrs (oldAttrs: {
+    meta = (oldAttrs.meta or {}) // {
+      mainProgram = "worktime";
+    };
+  });
 }
diff --git a/overlays/worktime/poetry.lock b/overlays/worktime/poetry.lock
deleted file mode 100644
index 7c1ca91d..00000000
--- a/overlays/worktime/poetry.lock
+++ /dev/null
@@ -1,284 +0,0 @@
-# This file is automatically @generated by Poetry 2.1.1 and should not be changed by hand.
-[[package]]
-name = "backoff"
-version = "2.2.1"
-description = "Function decoration for backoff and retry"
-optional = false
-python-versions = ">=3.7,<4.0"
-groups = ["main"]
-files = [
-    {file = "backoff-2.2.1-py3-none-any.whl", hash = "sha256:63579f9a0628e06278f7e47b7d7d5b6ce20dc65c5e96a6f3ca99a6adca0396e8"},
-    {file = "backoff-2.2.1.tar.gz", hash = "sha256:03f829f5bb1923180821643f8753b0502c3b682293992485b0eef2807afa5cba"},
-]
-[[package]]
-name = "certifi"
-version = "2025.1.31"
-description = "Python package for providing Mozilla's CA Bundle."
-optional = false
-python-versions = ">=3.6"
-groups = ["main"]
-files = [
-    {file = "certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe"},
-    {file = "certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651"},
-]
-[[package]]
-name = "charset-normalizer"
-version = "3.4.1"
-description = "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet."
-optional = false
-python-versions = ">=3.7"
-groups = ["main"]
-files = [
-    {file = "charset_normalizer-3.4.1-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:91b36a978b5ae0ee86c394f5a54d6ef44db1de0815eb43de826d41d21e4af3de"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7461baadb4dc00fd9e0acbe254e3d7d2112e7f92ced2adc96e54ef6501c5f176"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e218488cd232553829be0664c2292d3af2eeeb94b32bea483cf79ac6a694e037"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:80ed5e856eb7f30115aaf94e4a08114ccc8813e6ed1b5efa74f9f82e8509858f"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b010a7a4fd316c3c484d482922d13044979e78d1861f0e0650423144c616a46a"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4532bff1b8421fd0a320463030c7520f56a79c9024a4e88f01c537316019005a"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:d973f03c0cb71c5ed99037b870f2be986c3c05e63622c017ea9816881d2dd247"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:3a3bd0dcd373514dcec91c411ddb9632c0d7d92aed7093b8c3bbb6d69ca74408"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:d9c3cdf5390dcd29aa8056d13e8e99526cda0305acc038b96b30352aff5ff2bb"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:2bdfe3ac2e1bbe5b59a1a63721eb3b95fc9b6817ae4a46debbb4e11f6232428d"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:eab677309cdb30d047996b36d34caeda1dc91149e4fdca0b1a039b3f79d9a807"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-win32.whl", hash = "sha256:c0429126cf75e16c4f0ad00ee0eae4242dc652290f940152ca8c75c3a4b6ee8f"},
-    {file = "charset_normalizer-3.4.1-cp310-cp310-win_amd64.whl", hash = "sha256:9f0b8b1c6d84c8034a44893aba5e767bf9c7a211e313a9605d9c617d7083829f"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:8bfa33f4f2672964266e940dd22a195989ba31669bd84629f05fab3ef4e2d125"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:28bf57629c75e810b6ae989f03c0828d64d6b26a5e205535585f96093e405ed1"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f08ff5e948271dc7e18a35641d2f11a4cd8dfd5634f55228b691e62b37125eb3"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:234ac59ea147c59ee4da87a0c0f098e9c8d169f4dc2a159ef720f1a61bbe27cd"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fd4ec41f914fa74ad1b8304bbc634b3de73d2a0889bd32076342a573e0779e00"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:eea6ee1db730b3483adf394ea72f808b6e18cf3cb6454b4d86e04fa8c4327a12"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c96836c97b1238e9c9e3fe90844c947d5afbf4f4c92762679acfe19927d81d77"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:4d86f7aff21ee58f26dcf5ae81a9addbd914115cdebcbb2217e4f0ed8982e146"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:09b5e6733cbd160dcc09589227187e242a30a49ca5cefa5a7edd3f9d19ed53fd"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:5777ee0881f9499ed0f71cc82cf873d9a0ca8af166dfa0af8ec4e675b7df48e6"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:237bdbe6159cff53b4f24f397d43c6336c6b0b42affbe857970cefbb620911c8"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-win32.whl", hash = "sha256:8417cb1f36cc0bc7eaba8ccb0e04d55f0ee52df06df3ad55259b9a323555fc8b"},
-    {file = "charset_normalizer-3.4.1-cp311-cp311-win_amd64.whl", hash = "sha256:d7f50a1f8c450f3925cb367d011448c39239bb3eb4117c36a6d354794de4ce76"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:73d94b58ec7fecbc7366247d3b0b10a21681004153238750bb67bd9012414545"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dad3e487649f498dd991eeb901125411559b22e8d7ab25d3aeb1af367df5efd7"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c30197aa96e8eed02200a83fba2657b4c3acd0f0aa4bdc9f6c1af8e8962e0757"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2369eea1ee4a7610a860d88f268eb39b95cb588acd7235e02fd5a5601773d4fa"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc2722592d8998c870fa4e290c2eec2c1569b87fe58618e67d38b4665dfa680d"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ffc9202a29ab3920fa812879e95a9e78b2465fd10be7fcbd042899695d75e616"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:804a4d582ba6e5b747c625bf1255e6b1507465494a40a2130978bda7b932c90b"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:0f55e69f030f7163dffe9fd0752b32f070566451afe180f99dbeeb81f511ad8d"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c4c3e6da02df6fa1410a7680bd3f63d4f710232d3139089536310d027950696a"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:5df196eb874dae23dcfb968c83d4f8fdccb333330fe1fc278ac5ceeb101003a9"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:e358e64305fe12299a08e08978f51fc21fac060dcfcddd95453eabe5b93ed0e1"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-win32.whl", hash = "sha256:9b23ca7ef998bc739bf6ffc077c2116917eabcc901f88da1b9856b210ef63f35"},
-    {file = "charset_normalizer-3.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:6ff8a4a60c227ad87030d76e99cd1698345d4491638dfa6673027c48b3cd395f"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:aabfa34badd18f1da5ec1bc2715cadc8dca465868a4e73a0173466b688f29dda"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:22e14b5d70560b8dd51ec22863f370d1e595ac3d024cb8ad7d308b4cd95f8313"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8436c508b408b82d87dc5f62496973a1805cd46727c34440b0d29d8a2f50a6c9"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2d074908e1aecee37a7635990b2c6d504cd4766c7bc9fc86d63f9c09af3fa11b"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:955f8851919303c92343d2f66165294848d57e9bba6cf6e3625485a70a038d11"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:44ecbf16649486d4aebafeaa7ec4c9fed8b88101f4dd612dcaf65d5e815f837f"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:0924e81d3d5e70f8126529951dac65c1010cdf117bb75eb02dd12339b57749dd"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:2967f74ad52c3b98de4c3b32e1a44e32975e008a9cd2a8cc8966d6a5218c5cb2"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:c75cb2a3e389853835e84a2d8fb2b81a10645b503eca9bcb98df6b5a43eb8886"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:09b26ae6b1abf0d27570633b2b078a2a20419c99d66fb2823173d73f188ce601"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:fa88b843d6e211393a37219e6a1c1df99d35e8fd90446f1118f4216e307e48cd"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-win32.whl", hash = "sha256:eb8178fe3dba6450a3e024e95ac49ed3400e506fd4e9e5c32d30adda88cbd407"},
-    {file = "charset_normalizer-3.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:b1ac5992a838106edb89654e0aebfc24f5848ae2547d22c2c3f66454daa11971"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f30bf9fd9be89ecb2360c7d94a711f00c09b976258846efe40db3d05828e8089"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:97f68b8d6831127e4787ad15e6757232e14e12060bec17091b85eb1486b91d8d"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7974a0b5ecd505609e3b19742b60cee7aa2aa2fb3151bc917e6e2646d7667dcf"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fc54db6c8593ef7d4b2a331b58653356cf04f67c960f584edb7c3d8c97e8f39e"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:311f30128d7d333eebd7896965bfcfbd0065f1716ec92bd5638d7748eb6f936a"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_aarch64.whl", hash = "sha256:7d053096f67cd1241601111b698f5cad775f97ab25d81567d3f59219b5f1adbd"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_i686.whl", hash = "sha256:807f52c1f798eef6cf26beb819eeb8819b1622ddfeef9d0977a8502d4db6d534"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_ppc64le.whl", hash = "sha256:dccbe65bd2f7f7ec22c4ff99ed56faa1e9f785482b9bbd7c717e26fd723a1d1e"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_s390x.whl", hash = "sha256:2fb9bd477fdea8684f78791a6de97a953c51831ee2981f8e4f583ff3b9d9687e"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-musllinux_1_2_x86_64.whl", hash = "sha256:01732659ba9b5b873fc117534143e4feefecf3b2078b0a6a2e925271bb6f4cfa"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-win32.whl", hash = "sha256:7a4f97a081603d2050bfaffdefa5b02a9ec823f8348a572e39032caa8404a487"},
-    {file = "charset_normalizer-3.4.1-cp37-cp37m-win_amd64.whl", hash = "sha256:7b1bef6280950ee6c177b326508f86cad7ad4dff12454483b51d8b7d673a2c5d"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:ecddf25bee22fe4fe3737a399d0d177d72bc22be6913acfab364b40bce1ba83c"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8c60ca7339acd497a55b0ea5d506b2a2612afb2826560416f6894e8b5770d4a9"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b7b2d86dd06bfc2ade3312a83a5c364c7ec2e3498f8734282c6c3d4b07b346b8"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:dd78cfcda14a1ef52584dbb008f7ac81c1328c0f58184bf9a84c49c605002da6"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6e27f48bcd0957c6d4cb9d6fa6b61d192d0b13d5ef563e5f2ae35feafc0d179c"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:01ad647cdd609225c5350561d084b42ddf732f4eeefe6e678765636791e78b9a"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_aarch64.whl", hash = "sha256:619a609aa74ae43d90ed2e89bdd784765de0a25ca761b93e196d938b8fd1dbbd"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_i686.whl", hash = "sha256:89149166622f4db9b4b6a449256291dc87a99ee53151c74cbd82a53c8c2f6ccd"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_ppc64le.whl", hash = "sha256:7709f51f5f7c853f0fb938bcd3bc59cdfdc5203635ffd18bf354f6967ea0f824"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_s390x.whl", hash = "sha256:345b0426edd4e18138d6528aed636de7a9ed169b4aaf9d61a8c19e39d26838ca"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-musllinux_1_2_x86_64.whl", hash = "sha256:0907f11d019260cdc3f94fbdb23ff9125f6b5d1039b76003b5b0ac9d6a6c9d5b"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-win32.whl", hash = "sha256:ea0d8d539afa5eb2728aa1932a988a9a7af94f18582ffae4bc10b3fbdad0626e"},
-    {file = "charset_normalizer-3.4.1-cp38-cp38-win_amd64.whl", hash = "sha256:329ce159e82018d646c7ac45b01a430369d526569ec08516081727a20e9e4af4"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:b97e690a2118911e39b4042088092771b4ae3fc3aa86518f84b8cf6888dbdb41"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:78baa6d91634dfb69ec52a463534bc0df05dbd546209b79a3880a34487f4b84f"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1a2bc9f351a75ef49d664206d51f8e5ede9da246602dc2d2726837620ea034b2"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:75832c08354f595c760a804588b9357d34ec00ba1c940c15e31e96d902093770"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0af291f4fe114be0280cdd29d533696a77b5b49cfde5467176ecab32353395c4"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0167ddc8ab6508fe81860a57dd472b2ef4060e8d378f0cc555707126830f2537"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:2a75d49014d118e4198bcee5ee0a6f25856b29b12dbf7cd012791f8a6cc5c496"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:363e2f92b0f0174b2f8238240a1a30142e3db7b957a5dd5689b0e75fb717cc78"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:ab36c8eb7e454e34e60eb55ca5d241a5d18b2c6244f6827a30e451c42410b5f7"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:4c0907b1928a36d5a998d72d64d8eaa7244989f7aaaf947500d3a800c83a3fd6"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:04432ad9479fa40ec0f387795ddad4437a2b50417c69fa275e212933519ff294"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-win32.whl", hash = "sha256:3bed14e9c89dcb10e8f3a29f9ccac4955aebe93c71ae803af79265c9ca5644c5"},
-    {file = "charset_normalizer-3.4.1-cp39-cp39-win_amd64.whl", hash = "sha256:49402233c892a461407c512a19435d1ce275543138294f7ef013f0b63d5d3765"},
-    {file = "charset_normalizer-3.4.1-py3-none-any.whl", hash = "sha256:d98b1668f06378c6dbefec3b92299716b931cd4e6061f3c875a71ced1780ab85"},
-    {file = "charset_normalizer-3.4.1.tar.gz", hash = "sha256:44251f18cd68a75b56585dd00dae26183e102cd5e0f9f1466e6df5da2ed64ea3"},
-]
-[[package]]
-name = "idna"
-version = "3.10"
-description = "Internationalized Domain Names in Applications (IDNA)"
-optional = false
-python-versions = ">=3.6"
-groups = ["main"]
-files = [
-    {file = "idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3"},
-    {file = "idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9"},
-]
-[package.extras]
-all = ["flake8 (>=7.1.1)", "mypy (>=1.11.2)", "pytest (>=8.3.2)", "ruff (>=0.6.2)"]
-[[package]]
-name = "jsonpickle"
-version = "4.0.5"
-description = "jsonpickle encodes/decodes any Python object to/from JSON"
-optional = false
-python-versions = ">=3.8"
-groups = ["main"]
-files = [
-    {file = "jsonpickle-4.0.5-py3-none-any.whl", hash = "sha256:b4ac7d0a75ddcdfd93445737f1d36ff28768690d43e54bf5d0ddb1d915e580df"},
-    {file = "jsonpickle-4.0.5.tar.gz", hash = "sha256:f299818b39367c361b3f26bdba827d4249ab5d383cd93144d0f94b5417aacb35"},
-]
-[package.extras]
-cov = ["pytest-cov"]
-dev = ["black", "pyupgrade"]
-docs = ["furo", "rst.linker (>=1.9)", "sphinx (>=3.5)"]
-packaging = ["build", "setuptools (>=61.2)", "setuptools-scm[toml] (>=6.0)", "twine"]
-testing = ["PyYAML", "atheris (>=2.3.0,<2.4.0) ; python_version < \"3.12\"", "bson", "ecdsa", "feedparser", "gmpy2", "numpy", "pandas", "pymongo", "pytest (>=6.0,!=8.1.*)", "pytest-benchmark", "pytest-benchmark[histogram]", "pytest-checkdocs (>=1.2.3)", "pytest-enabler (>=1.0.1)", "pytest-ruff (>=0.2.1)", "scikit-learn", "scipy (>=1.9.3) ; python_version > \"3.10\"", "scipy ; python_version <= \"3.10\"", "simplejson", "sqlalchemy", "ujson"]
-[[package]]
-name = "python-dateutil"
-version = "2.9.0.post0"
-description = "Extensions to the standard Python datetime module"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-groups = ["main"]
-files = [
-    {file = "python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3"},
-    {file = "python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427"},
-]
-[package.dependencies]
-six = ">=1.5"
-[[package]]
-name = "pyxdg"
-version = "0.28"
-description = "PyXDG contains implementations of freedesktop.org standards in python."
-optional = false
-python-versions = "*"
-groups = ["main"]
-files = [
-    {file = "pyxdg-0.28-py2.py3-none-any.whl", hash = "sha256:bdaf595999a0178ecea4052b7f4195569c1ff4d344567bccdc12dfdf02d545ab"},
-    {file = "pyxdg-0.28.tar.gz", hash = "sha256:3267bb3074e934df202af2ee0868575484108581e6f3cb006af1da35395e88b4"},
-]
-[[package]]
-name = "requests"
-version = "2.32.3"
-description = "Python HTTP for Humans."
-optional = false
-python-versions = ">=3.8"
-groups = ["main"]
-files = [
-    {file = "requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6"},
-    {file = "requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760"},
-]
-[package.dependencies]
-certifi = ">=2017.4.17"
-charset-normalizer = ">=2,<4"
-idna = ">=2.5,<4"
-urllib3 = ">=1.21.1,<3"
-[package.extras]
-socks = ["PySocks (>=1.5.6,!=1.5.7)"]
-use-chardet-on-py3 = ["chardet (>=3.0.2,<6)"]
-[[package]]
-name = "six"
-version = "1.17.0"
-description = "Python 2 and 3 compatibility utilities"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-groups = ["main"]
-files = [
-    {file = "six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274"},
-    {file = "six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81"},
-]
-[[package]]
-name = "tabulate"
-version = "0.9.0"
-description = "Pretty-print tabular data"
-optional = false
-python-versions = ">=3.7"
-groups = ["main"]
-files = [
-    {file = "tabulate-0.9.0-py3-none-any.whl", hash = "sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f"},
-    {file = "tabulate-0.9.0.tar.gz", hash = "sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c"},
-]
-[package.extras]
-widechars = ["wcwidth"]
-[[package]]
-name = "toml"
-version = "0.10.2"
-description = "Python Library for Tom's Obvious, Minimal Language"
-optional = false
-python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
-groups = ["main"]
-files = [
-    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
-    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
-]
-[[package]]
-name = "uritools"
-version = "4.0.3"
-description = "URI parsing, classification and composition"
-optional = false
-python-versions = ">=3.7"
-groups = ["main"]
-files = [
-    {file = "uritools-4.0.3-py3-none-any.whl", hash = "sha256:bae297d090e69a0451130ffba6f2f1c9477244aa0a5543d66aed2d9f77d0dd9c"},
-    {file = "uritools-4.0.3.tar.gz", hash = "sha256:ee06a182a9c849464ce9d5fa917539aacc8edd2a4924d1b7aabeeecabcae3bc2"},
-]
-[[package]]
-name = "urllib3"
-version = "2.3.0"
-description = "HTTP library with thread-safe connection pooling, file post, and more."
-optional = false
-python-versions = ">=3.9"
-groups = ["main"]
-files = [
-    {file = "urllib3-2.3.0-py3-none-any.whl", hash = "sha256:1cee9ad369867bfdbbb48b7dd50374c0967a0bb7710050facf0dd6911440e3df"},
-    {file = "urllib3-2.3.0.tar.gz", hash = "sha256:f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d"},
-]
-[package.extras]
-brotli = ["brotli (>=1.0.9) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\""]
-h2 = ["h2 (>=4,<5)"]
-socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"]
-zstd = ["zstandard (>=0.18.0)"]
-[metadata]
-lock-version = "2.1"
-python-versions = "^3.12"
-content-hash = "2b335da94bf3e2d2bee7d8ca6e84cdb56e97ac29d1224d8c8dca98d93bbdcea2"
diff --git a/overlays/worktime/pyproject.toml b/overlays/worktime/pyproject.toml
index de4b9fd4..42da51f5 100644
--- a/overlays/worktime/pyproject.toml
+++ b/overlays/worktime/pyproject.toml
@@ -1,23 +1,28 @@
-[tool.poetry]
+[project]
 name = "worktime"
-version = "0.1.0"
+version = "1.0.0"
-description = ""
+requires-python = "~=3.12"
-authors = ["Gregor Kleen <gkleen@yggdrasil.li>"]
+dependencies = [
+    "pyxdg>=0.28,<0.29",
+    "python-dateutil>=2.9.0.post0,<3",
+    "uritools>=4.0.3,<5",
+    "requests>=2.32.3,<3",
+    "tabulate>=0.9.0,<0.10",
+    "toml>=0.10.2,<0.11",
+    "jsonpickle>=4.0.5,<5",
+    "frozendict>=2.4.6",
+    "atomicwriter>=0.2.5",
+    "desktop-notify>=1.3.3",
+]
-[tool.poetry.dependencies]
+[project.scripts]
-python = "^3.12"
-pyxdg = "^0.28"
-python-dateutil = "^2.9.0.post0"
-uritools = "^4.0.3"
-requests = "^2.32.3"
-tabulate = "^0.9.0"
-backoff = "^2.2.1"
-toml = "^0.10.2"
-jsonpickle = "^4.0.5"
-[tool.poetry.scripts]
 worktime = "worktime.__main__:main"
+worktime-ui = "worktime.__main__:ui"
+worktime-stop = "worktime.__main__:stop"
 [build-system]
-requires = ["poetry-core"]
+requires = ["hatchling"]
-build-backend = "poetry.core.masonry.api"
-\ No newline at end of file
+build-backend = "hatchling.build"
+[dependency-groups]
+dev = []
diff --git a/overlays/worktime/uv.lock b/overlays/worktime/uv.lock
new file mode 100644
index 00000000..39de4ccf
--- /dev/null
+++ b/overlays/worktime/uv.lock
@@ -0,0 +1,248 @@
+version = 1
+revision = 2
+requires-python = ">=3.12, <4"
+[[package]]
+name = "atomicwriter"
+version = "0.2.5"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/50/b4/dd04e186eb244d1ed84b1d0ebfba19ddc7f8886b98e345aaca4208b031d2/atomicwriter-0.2.5.tar.gz", hash = "sha256:5ced6afb0579377a13e191b17a16115e14c30ec00e6c38b60403f58235a867af", size = 64990, upload-time = "2025-05-24T20:35:42.538Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/99/7c/672a0de09b0b355a2ffa521ef25cf106f1984823379dee37f7305fdc1774/atomicwriter-0.2.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:5c1fab874e62ebe96f1af0e965dc1e92c4c1ef2e2e9612a444371b8fc751ec43", size = 234141, upload-time = "2025-05-24T20:34:32.74Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/0c/e1c5bad033284c212c0a77121b48dd4147f80e9a7cd82a9d2ce0a2160901/atomicwriter-0.2.5-cp312-cp312-macosx_11_0_x86_64.whl", hash = "sha256:8dbb67cc730be7d6bdfd5e991271bc17052be8fb2e4fa27854b47d8a76d36349", size = 245788, upload-time = "2025-05-24T20:34:33.897Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/d3/7036e203cc5fc4c49bf916b4ba158e0d2779de127afad5963edd7e3b9400/atomicwriter-0.2.5-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:a4e7f81932839c738425dc96ad98e4a7511b740cd3d75f480bfabbcf8e6f7eae", size = 260428, upload-time = "2025-05-24T20:34:35.533Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/b9/9a4d235a8d67fb442302dc0f3ea2394b7bd994bfc99b1dc0f744c7852418/atomicwriter-0.2.5-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:de37a3a5d1b57b719cfb0b81a11cab2114acfdc2c36051bf0af72d05eb644411", size = 263648, upload-time = "2025-05-24T20:34:36.72Z" },
+    { url = "https://files.pythonhosted.org/packages/71/7c/32d4ddad53375de42f3e972bb0633ec76f2c31772f2e508479d4788651d9/atomicwriter-0.2.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:0b925e55750092fd482565b6068b8c8366fd79de526681af9e58eb209f0deeca", size = 323775, upload-time = "2025-05-24T20:34:37.968Z" },
+    { url = "https://files.pythonhosted.org/packages/06/fe/6a226368a3f7ea30001fbd165f6a97f28c8f1a884896357b3d694983f5d2/atomicwriter-0.2.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:538f78f25e01584535782397211c66b8b3c9de90c2d1fc01a668ddce73dd0cb2", size = 340819, upload-time = "2025-05-24T20:34:39.63Z" },
+    { url = "https://files.pythonhosted.org/packages/92/95/b035b2296c483fde5392c629e0b6e3844eba6e54ea965c4b8827379b0893/atomicwriter-0.2.5-cp312-cp312-win_amd64.whl", hash = "sha256:1d2d49a1b94ea7b289be9f7134d756bfb0bbf53eb0e58411334ed1b9958abe5e", size = 152789, upload-time = "2025-05-24T20:34:40.905Z" },
+    { url = "https://files.pythonhosted.org/packages/da/25/caa0959ae8ce24763e24e1f45be6cb897414545d224a155f929d496d6812/atomicwriter-0.2.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3f5490fd5bec378509521f7c2a19a64031a0de07d368d76733c3f76a0b9f026b", size = 233830, upload-time = "2025-05-24T20:34:42.532Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/76/3c41bfd4fd74bc63bec29f05a806a767258eea7cf151496b4ab015cb5323/atomicwriter-0.2.5-cp313-cp313-macosx_11_0_x86_64.whl", hash = "sha256:a4dada83ff1255c7e640363cc2a4399ab9a822d4dbc9c18f55bbf0c8b12ce056", size = 245461, upload-time = "2025-05-24T20:34:44.454Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/1e/5512dbdfdc3f4ab12f5923c50ae4765cc2fc65a9f112bb9dccbcbe60b395/atomicwriter-0.2.5-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:ef2cf15e67513f05ad37d4cec48e403982c6b3c07f491472effd76d2157de7e2", size = 259892, upload-time = "2025-05-24T20:34:45.688Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/1d/2382b6cacb119115828eb519697a555900bcfdb062efeb0f82603295402d/atomicwriter-0.2.5-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:73618f74c3c5f5401d3da0a3cd3043f23de5b6bb4a3d85bc580940a441355d25", size = 263125, upload-time = "2025-05-24T20:34:47.205Z" },
+    { url = "https://files.pythonhosted.org/packages/07/d7/c4d68386161870db4a8d0452f0655a19902fa435b749c12e6ef800e89b19/atomicwriter-0.2.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:bbd5eda80710ddac7aefb421c79cef6b905852a827e764f0f12fcbaa88919f7a", size = 323503, upload-time = "2025-05-24T20:34:48.417Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/08/0fc03c0736ab8466e1b47a3ee17a528da18019cff93b7c4c2b33df82c19e/atomicwriter-0.2.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:b4776aaca40bc3040c3716c2adad74625c42285083ff31e8bf24a95315225c7b", size = 340156, upload-time = "2025-05-24T20:34:50.389Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/09/7ba888cf4d90bcabd9e82db3bdb9de50e4ef072e0ea0d375cd1931b79349/atomicwriter-0.2.5-cp313-cp313-win_amd64.whl", hash = "sha256:225ed1fbfa1996d9b0b2252f8a5d81263e51cbc797086d830f488c35b1d2ab42", size = 152274, upload-time = "2025-05-24T20:34:51.785Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/70/07d2ba2e0a126cfecfbfed46baf599c9e2155f4c8338fed4d3ae0041b133/atomicwriter-0.2.5-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:63b55982cfa47232f179689933bf003eefb2bd33464235883ed3ce7322cf38f3", size = 232879, upload-time = "2025-05-24T20:34:53.195Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/4d/397eb5435917135df93b339d849884bb1125896b1e15163c5244aa590336/atomicwriter-0.2.5-cp313-cp313t-macosx_11_0_x86_64.whl", hash = "sha256:e33f40b2a27f8831beeabb485923acb6dd067cc70bba1a63096749b3dc4747ff", size = 244386, upload-time = "2025-05-24T20:34:54.852Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/01/73f0b683fa55e61dd29d30e48e9a75ddb049e6dad0ac4ae1a29dbc05f21e/atomicwriter-0.2.5-cp313-cp313t-manylinux_2_28_aarch64.whl", hash = "sha256:c646e115e88147d71f845a005fc53910f22c4dc65bd634768cb90b7f34259359", size = 258255, upload-time = "2025-05-24T20:34:56.046Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/19/692387c1fb1b8714a9b2fab99a58850fd4136bed988814c8ff74d0c8de02/atomicwriter-0.2.5-cp313-cp313t-manylinux_2_28_x86_64.whl", hash = "sha256:47f974e986ff6514351c3ea75041009a514be0c34c225c062b0ad8a28ec9c0a3", size = 261768, upload-time = "2025-05-24T20:34:57.795Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/f2/4d466f52ee635cc54011713272f302584c6d1ce612c331d9989fa6fa672f/atomicwriter-0.2.5-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:e1db8b9004cd3f628166e83b25eb814b82345f9d6bc15e99b6d201c355455b45", size = 321975, upload-time = "2025-05-24T20:34:59.45Z" },
+    { url = "https://files.pythonhosted.org/packages/84/ad/0189ad9783ca6609df47e06cc0cd22866a8073d46478f59c6ab3ec13e0fb/atomicwriter-0.2.5-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:a7da4a114121ab865663578b801a0520b2b518d4591af0bd294f6aac0dad243b", size = 338946, upload-time = "2025-05-24T20:35:01.501Z" },
+    { url = "https://files.pythonhosted.org/packages/94/79/2c4d8f75eeb09192cf572957f031271998f3c985fabd79d513fff66ac715/atomicwriter-0.2.5-cp313-cp313t-win_amd64.whl", hash = "sha256:7aab4b3956cc17219e7e4da76e8a1bceb3d3aeaf03234f89b90e234a2adcf27b", size = 151571, upload-time = "2025-05-24T20:35:02.747Z" },
+    { url = "https://files.pythonhosted.org/packages/32/19/d6a686d189c3577e7f08b33df398b959c24bf74b3cec34359104db1a24ff/atomicwriter-0.2.5-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:8d0fccac2dfe5d884d97edbda28be9c16d55faee9bdf66f53a99384ac387cc43", size = 239320, upload-time = "2025-05-24T20:35:04.028Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/35/35571a4eed57816c3b5fdbefcb15f38563fbe4f3a4a7d1588c8ef899afaf/atomicwriter-0.2.5-cp39-abi3-macosx_11_0_x86_64.whl", hash = "sha256:6583c24333508839db2156d895cbbb5cd3ff20d4f9c698e341435e5b35990eaa", size = 250818, upload-time = "2025-05-24T20:35:05.21Z" },
+    { url = "https://files.pythonhosted.org/packages/81/d9/145093630bc25f115a49d32d9ef66745f5cdef787492d77fd27e74d20389/atomicwriter-0.2.5-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:136a9902ae3f1c0cb262a07dd3ac85069d71f8b11347cd740030567e67d611aa", size = 265796, upload-time = "2025-05-24T20:35:06.388Z" },
+    { url = "https://files.pythonhosted.org/packages/58/32/d1881adade2ebc70aa9dbb61cadabc2c00cfa99a7a5d6ba48f44e279056f/atomicwriter-0.2.5-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:0b6830434b6a49c19473c3f3975dfa0a87dec95bee81297f7393e378f9a0b82f", size = 269378, upload-time = "2025-05-24T20:35:07.578Z" },
+    { url = "https://files.pythonhosted.org/packages/93/f5/2661ea763784a4991c4c7be5c932a468937bd1d4618b833a63ec638a3b76/atomicwriter-0.2.5-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:53095a01891a2901aa04c10c8de52c0ba41e0d8a4a1893318cf34ccbdbde00b7", size = 328167, upload-time = "2025-05-24T20:35:08.764Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/bc/e3aa521671a589bee9662d3e2108e4835a5d80e6da76e4d05d98d1c78005/atomicwriter-0.2.5-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:ecf4dc3983bb1f28b21cb09c2d96b6936d8864c559dcf151b57813cb1eae998b", size = 347153, upload-time = "2025-05-24T20:35:10.507Z" },
+    { url = "https://files.pythonhosted.org/packages/59/b7/e190383e7240b1f247c6df9bc6667db8df10190cd0bb2dba8ea6bd704ea4/atomicwriter-0.2.5-cp39-abi3-win_amd64.whl", hash = "sha256:92cff264a20364301ab341b332fd0112866870b8cb35caf99a3f3fee0e6c19e8", size = 156374, upload-time = "2025-05-24T20:35:11.716Z" },
+]
+[[package]]
+name = "certifi"
+version = "2025.1.31"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1c/ab/c9f1e32b7b1bf505bf26f0ef697775960db7932abeb7b516de930ba2705f/certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651", size = 167577, upload-time = "2025-01-31T02:16:47.166Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/38/fc/bce832fd4fd99766c04d1ee0eead6b0ec6486fb100ae5e74c1d91292b982/certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe", size = 166393, upload-time = "2025-01-31T02:16:45.015Z" },
+]
+[[package]]
+name = "charset-normalizer"
+version = "3.4.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/16/b0/572805e227f01586461c80e0fd25d65a2115599cc9dad142fee4b747c357/charset_normalizer-3.4.1.tar.gz", hash = "sha256:44251f18cd68a75b56585dd00dae26183e102cd5e0f9f1466e6df5da2ed64ea3", size = 123188, upload-time = "2024-12-24T18:12:35.43Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0a/9a/dd1e1cdceb841925b7798369a09279bd1cf183cef0f9ddf15a3a6502ee45/charset_normalizer-3.4.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:73d94b58ec7fecbc7366247d3b0b10a21681004153238750bb67bd9012414545", size = 196105, upload-time = "2024-12-24T18:10:38.83Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/8c/90bfabf8c4809ecb648f39794cf2a84ff2e7d2a6cf159fe68d9a26160467/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dad3e487649f498dd991eeb901125411559b22e8d7ab25d3aeb1af367df5efd7", size = 140404, upload-time = "2024-12-24T18:10:44.272Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/8f/e410d57c721945ea3b4f1a04b74f70ce8fa800d393d72899f0a40526401f/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c30197aa96e8eed02200a83fba2657b4c3acd0f0aa4bdc9f6c1af8e8962e0757", size = 150423, upload-time = "2024-12-24T18:10:45.492Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/b8/e6825e25deb691ff98cf5c9072ee0605dc2acfca98af70c2d1b1bc75190d/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2369eea1ee4a7610a860d88f268eb39b95cb588acd7235e02fd5a5601773d4fa", size = 143184, upload-time = "2024-12-24T18:10:47.898Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/a2/513f6cbe752421f16d969e32f3583762bfd583848b763913ddab8d9bfd4f/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc2722592d8998c870fa4e290c2eec2c1569b87fe58618e67d38b4665dfa680d", size = 145268, upload-time = "2024-12-24T18:10:50.589Z" },
+    { url = "https://files.pythonhosted.org/packages/74/94/8a5277664f27c3c438546f3eb53b33f5b19568eb7424736bdc440a88a31f/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ffc9202a29ab3920fa812879e95a9e78b2465fd10be7fcbd042899695d75e616", size = 147601, upload-time = "2024-12-24T18:10:52.541Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/5f/6d352c51ee763623a98e31194823518e09bfa48be2a7e8383cf691bbb3d0/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:804a4d582ba6e5b747c625bf1255e6b1507465494a40a2130978bda7b932c90b", size = 141098, upload-time = "2024-12-24T18:10:53.789Z" },
+    { url = "https://files.pythonhosted.org/packages/78/d4/f5704cb629ba5ab16d1d3d741396aec6dc3ca2b67757c45b0599bb010478/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:0f55e69f030f7163dffe9fd0752b32f070566451afe180f99dbeeb81f511ad8d", size = 149520, upload-time = "2024-12-24T18:10:55.048Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/96/64120b1d02b81785f222b976c0fb79a35875457fa9bb40827678e54d1bc8/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c4c3e6da02df6fa1410a7680bd3f63d4f710232d3139089536310d027950696a", size = 152852, upload-time = "2024-12-24T18:10:57.647Z" },
+    { url = "https://files.pythonhosted.org/packages/84/c9/98e3732278a99f47d487fd3468bc60b882920cef29d1fa6ca460a1fdf4e6/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:5df196eb874dae23dcfb968c83d4f8fdccb333330fe1fc278ac5ceeb101003a9", size = 150488, upload-time = "2024-12-24T18:10:59.43Z" },
+    { url = "https://files.pythonhosted.org/packages/13/0e/9c8d4cb99c98c1007cc11eda969ebfe837bbbd0acdb4736d228ccaabcd22/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:e358e64305fe12299a08e08978f51fc21fac060dcfcddd95453eabe5b93ed0e1", size = 146192, upload-time = "2024-12-24T18:11:00.676Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/21/2b6b5b860781a0b49427309cb8670785aa543fb2178de875b87b9cc97746/charset_normalizer-3.4.1-cp312-cp312-win32.whl", hash = "sha256:9b23ca7ef998bc739bf6ffc077c2116917eabcc901f88da1b9856b210ef63f35", size = 95550, upload-time = "2024-12-24T18:11:01.952Z" },
+    { url = "https://files.pythonhosted.org/packages/21/5b/1b390b03b1d16c7e382b561c5329f83cc06623916aab983e8ab9239c7d5c/charset_normalizer-3.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:6ff8a4a60c227ad87030d76e99cd1698345d4491638dfa6673027c48b3cd395f", size = 102785, upload-time = "2024-12-24T18:11:03.142Z" },
+    { url = "https://files.pythonhosted.org/packages/38/94/ce8e6f63d18049672c76d07d119304e1e2d7c6098f0841b51c666e9f44a0/charset_normalizer-3.4.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:aabfa34badd18f1da5ec1bc2715cadc8dca465868a4e73a0173466b688f29dda", size = 195698, upload-time = "2024-12-24T18:11:05.834Z" },
+    { url = "https://files.pythonhosted.org/packages/24/2e/dfdd9770664aae179a96561cc6952ff08f9a8cd09a908f259a9dfa063568/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:22e14b5d70560b8dd51ec22863f370d1e595ac3d024cb8ad7d308b4cd95f8313", size = 140162, upload-time = "2024-12-24T18:11:07.064Z" },
+    { url = "https://files.pythonhosted.org/packages/24/4e/f646b9093cff8fc86f2d60af2de4dc17c759de9d554f130b140ea4738ca6/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8436c508b408b82d87dc5f62496973a1805cd46727c34440b0d29d8a2f50a6c9", size = 150263, upload-time = "2024-12-24T18:11:08.374Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/67/2937f8d548c3ef6e2f9aab0f6e21001056f692d43282b165e7c56023e6dd/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2d074908e1aecee37a7635990b2c6d504cd4766c7bc9fc86d63f9c09af3fa11b", size = 142966, upload-time = "2024-12-24T18:11:09.831Z" },
+    { url = "https://files.pythonhosted.org/packages/52/ed/b7f4f07de100bdb95c1756d3a4d17b90c1a3c53715c1a476f8738058e0fa/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:955f8851919303c92343d2f66165294848d57e9bba6cf6e3625485a70a038d11", size = 144992, upload-time = "2024-12-24T18:11:12.03Z" },
+    { url = "https://files.pythonhosted.org/packages/96/2c/d49710a6dbcd3776265f4c923bb73ebe83933dfbaa841c5da850fe0fd20b/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:44ecbf16649486d4aebafeaa7ec4c9fed8b88101f4dd612dcaf65d5e815f837f", size = 147162, upload-time = "2024-12-24T18:11:13.372Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/41/35ff1f9a6bd380303dea55e44c4933b4cc3c4850988927d4082ada230273/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:0924e81d3d5e70f8126529951dac65c1010cdf117bb75eb02dd12339b57749dd", size = 140972, upload-time = "2024-12-24T18:11:14.628Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/43/c6a0b685fe6910d08ba971f62cd9c3e862a85770395ba5d9cad4fede33ab/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:2967f74ad52c3b98de4c3b32e1a44e32975e008a9cd2a8cc8966d6a5218c5cb2", size = 149095, upload-time = "2024-12-24T18:11:17.672Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/ff/a9a504662452e2d2878512115638966e75633519ec11f25fca3d2049a94a/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:c75cb2a3e389853835e84a2d8fb2b81a10645b503eca9bcb98df6b5a43eb8886", size = 152668, upload-time = "2024-12-24T18:11:18.989Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/71/189996b6d9a4b932564701628af5cee6716733e9165af1d5e1b285c530ed/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:09b26ae6b1abf0d27570633b2b078a2a20419c99d66fb2823173d73f188ce601", size = 150073, upload-time = "2024-12-24T18:11:21.507Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/93/946a86ce20790e11312c87c75ba68d5f6ad2208cfb52b2d6a2c32840d922/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:fa88b843d6e211393a37219e6a1c1df99d35e8fd90446f1118f4216e307e48cd", size = 145732, upload-time = "2024-12-24T18:11:22.774Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/e5/131d2fb1b0dddafc37be4f3a2fa79aa4c037368be9423061dccadfd90091/charset_normalizer-3.4.1-cp313-cp313-win32.whl", hash = "sha256:eb8178fe3dba6450a3e024e95ac49ed3400e506fd4e9e5c32d30adda88cbd407", size = 95391, upload-time = "2024-12-24T18:11:24.139Z" },
+    { url = "https://files.pythonhosted.org/packages/27/f2/4f9a69cc7712b9b5ad8fdb87039fd89abba997ad5cbe690d1835d40405b0/charset_normalizer-3.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:b1ac5992a838106edb89654e0aebfc24f5848ae2547d22c2c3f66454daa11971", size = 102702, upload-time = "2024-12-24T18:11:26.535Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/f6/65ecc6878a89bb1c23a086ea335ad4bf21a588990c3f535a227b9eea9108/charset_normalizer-3.4.1-py3-none-any.whl", hash = "sha256:d98b1668f06378c6dbefec3b92299716b931cd4e6061f3c875a71ced1780ab85", size = 49767, upload-time = "2024-12-24T18:12:32.852Z" },
+]
+[[package]]
+name = "dbus-next"
+version = "0.2.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/45/6a40fbe886d60a8c26f480e7d12535502b5ba123814b3b9a0b002ebca198/dbus_next-0.2.3.tar.gz", hash = "sha256:f4eae26909332ada528c0a3549dda8d4f088f9b365153952a408e28023a626a5", size = 71112, upload-time = "2021-07-25T22:11:28.398Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d2/fc/c0a3f4c4eaa5a22fbef91713474666e13d0ea2a69c84532579490a9f2cc8/dbus_next-0.2.3-py3-none-any.whl", hash = "sha256:58948f9aff9db08316734c0be2a120f6dc502124d9642f55e90ac82ffb16a18b", size = 57885, upload-time = "2021-07-25T22:11:25.466Z" },
+]
+[[package]]
+name = "desktop-notify"
+version = "1.3.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "dbus-next" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/7a/d8/7ae5779257f5f1aa0a2d50c02d70b29522bd414692f3d3bd18ef119fe82d/desktop-notify-1.3.3.tar.gz", hash = "sha256:62934ad1f72f292f9a3af5ffe45af32814af18c396c00369385540c72bf08077", size = 7828, upload-time = "2021-01-03T16:46:36.483Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0a/cd/a7e3bd0262f3e8a9272fd24d0193e24dad7cb4e4edd27da48e74b5523e59/desktop_notify-1.3.3-py3-none-any.whl", hash = "sha256:8ad7ecc3a9a603dd5fa3cdc11cc6265cfbc7f6df9d8ed240f4663f43ef0de37a", size = 9937, upload-time = "2021-01-03T16:46:35.157Z" },
+]
+[[package]]
+name = "frozendict"
+version = "2.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bb/59/19eb300ba28e7547538bdf603f1c6c34793240a90e1a7b61b65d8517e35e/frozendict-2.4.6.tar.gz", hash = "sha256:df7cd16470fbd26fc4969a208efadc46319334eb97def1ddf48919b351192b8e", size = 316416, upload-time = "2024-10-13T12:15:32.449Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/13/d9839089b900fa7b479cce495d62110cddc4bd5630a04d8469916c0e79c5/frozendict-2.4.6-py311-none-any.whl", hash = "sha256:d065db6a44db2e2375c23eac816f1a022feb2fa98cbb50df44a9e83700accbea", size = 16148, upload-time = "2024-10-13T12:15:26.839Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/d0/d482c39cee2ab2978a892558cf130681d4574ea208e162da8958b31e9250/frozendict-2.4.6-py312-none-any.whl", hash = "sha256:49344abe90fb75f0f9fdefe6d4ef6d4894e640fadab71f11009d52ad97f370b9", size = 16146, upload-time = "2024-10-13T12:15:28.16Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/8e/b6bf6a0de482d7d7d7a2aaac8fdc4a4d0bb24a809f5ddd422aa7060eb3d2/frozendict-2.4.6-py313-none-any.whl", hash = "sha256:7134a2bb95d4a16556bb5f2b9736dceb6ea848fa5b6f3f6c2d6dba93b44b4757", size = 16146, upload-time = "2024-10-13T12:15:29.495Z" },
+]
+[[package]]
+name = "idna"
+version = "3.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
+]
+[[package]]
+name = "jsonpickle"
+version = "4.0.5"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d6/33/4bda317ab294722fcdfff8f63aab74af9fda3675a4652d984a101aa7587e/jsonpickle-4.0.5.tar.gz", hash = "sha256:f299818b39367c361b3f26bdba827d4249ab5d383cd93144d0f94b5417aacb35", size = 315661, upload-time = "2025-03-29T19:22:56.92Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dc/1b/0e79cf115e0f54f1e8f56effb6ffd2ef8f92e9c324d692ede660067f1bfe/jsonpickle-4.0.5-py3-none-any.whl", hash = "sha256:b4ac7d0a75ddcdfd93445737f1d36ff28768690d43e54bf5d0ddb1d915e580df", size = 46382, upload-time = "2025-03-29T19:22:54.252Z" },
+]
+[[package]]
+name = "python-dateutil"
+version = "2.9.0.post0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/66/c0/0c8b6ad9f17a802ee498c46e004a0eb49bc148f2fd230864601a86dcf6db/python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 342432, upload-time = "2024-03-01T18:36:20.211Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
+]
+[[package]]
+name = "pyxdg"
+version = "0.28"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b0/25/7998cd2dec731acbd438fbf91bc619603fc5188de0a9a17699a781840452/pyxdg-0.28.tar.gz", hash = "sha256:3267bb3074e934df202af2ee0868575484108581e6f3cb006af1da35395e88b4", size = 77776, upload-time = "2022-06-05T11:35:01Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e5/8d/cf41b66a8110670e3ad03dab9b759704eeed07fa96e90fdc0357b2ba70e2/pyxdg-0.28-py2.py3-none-any.whl", hash = "sha256:bdaf595999a0178ecea4052b7f4195569c1ff4d344567bccdc12dfdf02d545ab", size = 49520, upload-time = "2022-06-05T11:34:58.832Z" },
+]
+[[package]]
+name = "requests"
+version = "2.32.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "charset-normalizer" },
+    { name = "idna" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/63/70/2bf7780ad2d390a8d301ad0b550f1581eadbd9a20f896afe06353c2a2913/requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760", size = 131218, upload-time = "2024-05-29T15:37:49.536Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f9/9b/335f9764261e915ed497fcdeb11df5dfd6f7bf257d4a6a2a686d80da4d54/requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6", size = 64928, upload-time = "2024-05-29T15:37:47.027Z" },
+]
+[[package]]
+name = "six"
+version = "1.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/94/e7/b2c673351809dca68a0e064b6af791aa332cf192da575fd474ed7d6f16a2/six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81", size = 34031, upload-time = "2024-12-04T17:35:28.174Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" },
+]
+[[package]]
+name = "tabulate"
+version = "0.9.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ec/fe/802052aecb21e3797b8f7902564ab6ea0d60ff8ca23952079064155d1ae1/tabulate-0.9.0.tar.gz", hash = "sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c", size = 81090, upload-time = "2022-10-06T17:21:48.54Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/40/44/4a5f08c96eb108af5cb50b41f76142f0afa346dfa99d5296fe7202a11854/tabulate-0.9.0-py3-none-any.whl", hash = "sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f", size = 35252, upload-time = "2022-10-06T17:21:44.262Z" },
+]
+[[package]]
+name = "toml"
+version = "0.10.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/be/ba/1f744cdc819428fc6b5084ec34d9b30660f6f9daaf70eead706e3203ec3c/toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f", size = 22253, upload-time = "2020-11-01T01:40:22.204Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/44/6f/7120676b6d73228c96e17f1f794d8ab046fc910d781c8d151120c3f1569e/toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b", size = 16588, upload-time = "2020-11-01T01:40:20.672Z" },
+]
+[[package]]
+name = "uritools"
+version = "4.0.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d3/43/4182fb2a03145e6d38698e38b49114ce59bc8c79063452eb585a58f8ce78/uritools-4.0.3.tar.gz", hash = "sha256:ee06a182a9c849464ce9d5fa917539aacc8edd2a4924d1b7aabeeecabcae3bc2", size = 24184, upload-time = "2024-05-28T18:07:45.194Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e6/17/5a4510d9ca9cc8be217ce359eb54e693dca81cf4d442308b282d5131b17d/uritools-4.0.3-py3-none-any.whl", hash = "sha256:bae297d090e69a0451130ffba6f2f1c9477244aa0a5543d66aed2d9f77d0dd9c", size = 10304, upload-time = "2024-05-28T18:07:42.731Z" },
+]
+[[package]]
+name = "urllib3"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/aa/63/e53da845320b757bf29ef6a9062f5c669fe997973f966045cb019c3f4b66/urllib3-2.3.0.tar.gz", hash = "sha256:f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d", size = 307268, upload-time = "2024-12-22T07:47:30.032Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c8/19/4ec628951a74043532ca2cf5d97b7b14863931476d117c471e8e2b1eb39f/urllib3-2.3.0-py3-none-any.whl", hash = "sha256:1cee9ad369867bfdbbb48b7dd50374c0967a0bb7710050facf0dd6911440e3df", size = 128369, upload-time = "2024-12-22T07:47:28.074Z" },
+]
+[[package]]
+name = "worktime"
+version = "1.0.0"
+source = { editable = "." }
+dependencies = [
+    { name = "atomicwriter" },
+    { name = "desktop-notify" },
+    { name = "frozendict" },
+    { name = "jsonpickle" },
+    { name = "python-dateutil" },
+    { name = "pyxdg" },
+    { name = "requests" },
+    { name = "tabulate" },
+    { name = "toml" },
+    { name = "uritools" },
+]
+[package.metadata]
+requires-dist = [
+    { name = "atomicwriter", specifier = ">=0.2.5" },
+    { name = "desktop-notify", specifier = ">=1.3.3" },
+    { name = "frozendict", specifier = ">=2.4.6" },
+    { name = "jsonpickle", specifier = ">=4.0.5,<5" },
+    { name = "python-dateutil", specifier = ">=2.9.0.post0,<3" },
+    { name = "pyxdg", specifier = ">=0.28,<0.29" },
+    { name = "requests", specifier = ">=2.32.3,<3" },
+    { name = "tabulate", specifier = ">=0.9.0,<0.10" },
+    { name = "toml", specifier = ">=0.10.2,<0.11" },
+    { name = "uritools", specifier = ">=4.0.3,<5" },
+]
+[package.metadata.requires-dev]
+dev = []
diff --git a/overlays/worktime/worktime/__main__.py b/overlays/worktime/worktime/__main__.py
index 4eee5dc2..ffeb1b84 100755
--- a/overlays/worktime/worktime/__main__.py
+++ b/overlays/worktime/worktime/__main__.py
@@ -1,10 +1,12 @@
 import requests
 from requests.exceptions import HTTPError
 from requests.auth import HTTPBasicAuth
+from requests.adapters import HTTPAdapter, Retry
 from datetime import *
 from xdg import BaseDirectory
 import toml
-from uritools import (uricompose)
+from uritools import uricompose
+from urllib.parse import urljoin
 from inspect import signature
@@ -27,77 +29,76 @@ from sys import stderr, stdout
 from tabulate import tabulate
-from itertools import groupby, count
+from itertools import groupby, count, islice
 from functools import cache, partial
-import backoff
 from pathlib import Path
 from collections import defaultdict
+from collections.abc import Iterable, Generator
+from typing import Any
 import jsonpickle
 from hashlib import blake2s
 import json
-class TogglAPISection(Enum):
+import asyncio
-    TOGGL = '/api/v9'
-    REPORTS = '/reports/api/v2'
+from frozendict import frozendict
+from contextlib import closing
-class TogglAPIError(Exception):
+import os
-    def __init__(self, response, *, http_error=None):
+from time import clock_gettime_ns, CLOCK_MONOTONIC
-        self.http_error = http_error
+from atomicwriter import AtomicWriter
-        self.response = response
+import desktop_notify.aio as notify
-    def __str__(self):
+class BearerAuth(requests.auth.AuthBase):
-        if not self.http_error is None:
+    def __init__(self, token):
-            return str(self.http_error)
+        self.token = token
-        else:
+    def __call__(self, r):
-            return self.response.text
+        r.headers["authorization"] = "Bearer " + self.token
+        return r
-class TogglAPI(object):
-    def __init__(self, api_token, workspace_id, client_ids):
+class KimaiSession(requests.Session):
-        self._api_token = api_token
+    def __init__(self, base_url: str, api_token: str):
-        self._workspace_id = workspace_id
+        super().__init__()
-        self._client_ids = set(map(int, client_ids.split(','))) if client_ids else None
+        self.base_url = base_url
+        self.auth = BearerAuth(api_token)
-    def _make_url(self, api=TogglAPISection.TOGGL, section=['me', 'time_entries', 'current'], params={}):
+        retries = Retry(total=5, backoff_factor=0.1, status_forcelist=[500, 502, 503, 504])
-        if api is TogglAPISection.REPORTS:
+        super().mount(base_url, HTTPAdapter(max_retries=retries))
-          params.update({'user_agent': 'worktime', 'workspace_id': self._workspace_id})
+    def request(self, method, url, *args, **kwargs):
-        api_path = api.value
+        joined_url = urljoin(self.base_url, url)
-        section_path = '/'.join(section)
+        return super().request(method, joined_url, *args, headers = {'Accept': 'application/json'} | (kwargs['headers'] if 'headers' in kwargs else {}), **{k: v for k, v in kwargs.items() if k not in ['headers']})
-        uri = uricompose(scheme='https', host='api.track.toggl.com', path=f"{api_path}/{section_path}", query=params)
+class KimaiAPI(object):
-        return uri
+    def __init__(self, base_url: str, api_token: str, clients: Iterable[str]):
+        self._session = KimaiSession(base_url, api_token)
-    def _query(self, url, method):
+        self._kimai_clients = self._session.get('/api/customers').json()
-        response = self._raw_query(url, method)
+        self._client_ids = self.resolve_clients(clients)
-        response.raise_for_status()
+        kimai_user = self._session.get('/api/users/me').json()
-        return response
+        self._tz = gettz(kimai_user['timezone'])
-    @backoff.on_predicate(
+    def resolve_clients(self, clients: Iterable[str]) -> frozenset[int]:
-        backoff.expo,
+        return frozenset({ client['id'] for client in self._kimai_clients if client['name'] in clients })
-        factor=0.1, max_value=2,
-        predicate=lambda r: r.status_code == 429,
+    def render_datetime(self, datetime: datetime) -> str:
-        max_time=10,
+        return datetime.astimezone(self._tz).strftime('%Y-%m-%dT%H:%M:%S')
-    )
-    def _raw_query(self, url, method):
+    def get_timesheets(self, params: dict[str, Any] = {}) -> Generator[Any]:
-        headers = {'content-type': 'application/json', 'accept': 'application/json'}
+        for page in count(start=1):
-        response = None
+            resp = self._session.get('/api/timesheets', params=params | {'size': 100, 'page': page})
+            if resp.status_code == 404:
-        if method == 'GET':
+                break
-            response = requests.get(url, headers=headers, auth=HTTPBasicAuth(self._api_token, 'api_token'))
+            yield from resp.json()
-        elif method == 'POST':
-            response = requests.post(url, headers=headers, auth=HTTPBasicAuth(self._api_token, 'api_token'))
-        else:
-            raise ValueError(f"Undefined HTTP method “{method}”")
-        return response
-    def entry_durations(self, start_date, *, end_date, rounding=False, client_ids):
+    def entry_durations(self, start_date: datetime, *, end_date: datetime, clients: Iterable[str] | None = None) -> Generator[timedelta]:
-        if client_ids is not None and not client_ids:
+        client_ids = None
+        if clients is not None and not clients:
            return
+        elif clients is None:
+            client_ids = self._client_ids
+        else:
+            client_ids = self.resolve_clients(clients)
        cache_dir = Path(BaseDirectory.save_cache_path('worktime')) / 'entry_durations'
        step = timedelta(days = 120)
@@ -116,11 +117,8 @@ class TogglAPI(object):
                cache_key = blake2s(jsonpickle.encode({
                    'start': req_start,
                    'end': req_end,
-                    'rounding': rounding,
+                    'client_ids': client_ids,
-                    'clients': client_ids,
+                }).encode('utf-8'), key = self._session.auth.token.encode('utf-8')).hexdigest()
-                    'workspace': self._workspace_id,
-                    'workspace_clients': self._client_ids
-                }).encode('utf-8'), key = self._api_token.encode('utf-8')).hexdigest()
                cache_path = cache_dir / cache_key[:2] / cache_key[2:4] / f'{cache_key[4:]}.json'
                try:
                    with cache_path.open('r', encoding='utf-8') as ch:
@@ -130,85 +128,83 @@ class TogglAPI(object):
                    pass
            entries = list()
-            params = { 'since': (req_start - timedelta(days=1)).date().isoformat(),
+            params = {
-                       'until': (req_end + timedelta(days=1)).date().isoformat(),
+                'begin': self.render_datetime(req_start),
-                       'rounding': 'yes' if rounding else 'no',
+                'end': self.render_datetime(req_end),
-                       'billable': 'yes'
+                'customers[]': list(client_ids),
-                      }
+                'billable': 1,
-            if client_ids is not None:
+            }
-                params |= { 'client_ids': ','.join(map(str, client_ids)) }
-            for page in count(start = 1):
+            for entry in self.get_timesheets(params):
-                url = self._make_url(api = TogglAPISection.REPORTS, section = ['details'], params = params | { 'page': page })
+                if entry['end'] is None:
-                r = self._query(url = url, method='GET')
+                    continue
-                if not r or not r.json():
-                    raise TogglAPIError(r)
-                report = r.json()
-                for entry in report['data']:
-                    start = isoparse(entry['start'])
-                    end = isoparse(entry['end'])
-                    if start > req_end or end < req_start:
-                        continue
-                    x = min(end, req_end) - max(start, req_start)
+                start = isoparse(entry['begin'])
-                    if cache_key:
+                end = isoparse(entry['end'])
-                        entries.append(x)
-                    yield x
+                if start > req_end or end < req_start:
-                if not report['data']:
+                    continue
-                    break
+                x = min(end, req_end) - max(start, req_start)
+                if cache_key:
+                    entries.append(x)
+                yield x
            if cache_path:
                cache_path.parent.mkdir(parents=True, exist_ok=True)
                with cache_path.open('w', encoding='utf-8') as ch:
                    ch.write(jsonpickle.encode(entries))
-            # res = timedelta(milliseconds=report['total_billable']) if report['total_billable'] else timedelta(milliseconds=0)
-            # return res
-    def get_billable_hours(self, start_date, end_date=datetime.now(timezone.utc), rounding=False):
-        billable_acc = timedelta(milliseconds = 0)
-        if 0 in self._client_ids:
-            url = self._make_url(api = TogglAPISection.TOGGL, section = ['workspaces', self._workspace_id, 'clients'])
-            r = self._query(url = url, method = 'GET')
-            if not r or not r.json():
-                raise TogglAPIError(r)
-            billable_acc += sum(self.entry_durations(start_date, end_date=end_date, rounding=rounding, client_ids=None), start=timedelta(milliseconds=0)) - sum(self.entry_durations(start_date, end_date=end_date, rounding=rounding, client_ids=frozenset(map(lambda c: c['id'], r.json()))), start=timedelta(milliseconds=0))
-        billable_acc += sum(self.entry_durations(start_date, end_date=end_date, rounding=rounding, client_ids=frozenset(*(self._client_ids - {0}))), start=timedelta(milliseconds=0))
+    def get_billable_hours(self, start_date: datetime, end_date: datetime = datetime.now(timezone.utc)) -> timedelta:
+        return sum(self.entry_durations(start_date, end_date=end_date), start=timedelta(milliseconds=0))
-        return billable_acc
+    def get_running_entry(self) -> Any | None:
+        kimai_entries = self._session.get('/api/timesheets/active').json()
+        if not kimai_entries:
+            return None
+        entry = kimai_entries[0]
-    def get_running_clock(self, now=datetime.now(timezone.utc)):
+        if entry['project']['customer']['id'] not in self._client_ids:
-        url = self._make_url(api = TogglAPISection.TOGGL, section = ['me', 'time_entries', 'current'])
+            return None
-        r = self._query(url = url, method='GET')
-        if not r or (not r.json() and r.json() is not None):
+        return entry
-            raise TogglAPIError(r)
-        if not r.json() or not r.json()['billable']:
+    def get_running_clock(self, now: datetime = datetime.now(timezone.utc)) -> timedelta | None:
+        entry = self.get_running_entry()
+        if not entry:
            return None
+        start = isoparse(entry['begin'])
+        return now - start if start <= now else None
-        if self._client_ids is not None:
+    def get_recent_entries(self) -> Generator[Any]:
-            if 'pid' in r.json() and r.json()['pid']:
+        step = timedelta(days = 7)
-                url = self._make_url(api = TogglAPISection.TOGGL, section = ['projects', str(r.json()['pid'])])
+        now = datetime.now().astimezone(timezone.utc)
-                pr = self._query(url = url, method = 'GET')
+        ids = set()
-                if not pr or not pr.json():
+        for req_end in (now - step * i for i in count()):
-                    raise TogglAPIError(pr)
+            params = {
+                'begin': self.render_datetime(req_end - step),
+                'end': self.render_datetime(req_end),
+                'full': 'true',
+            }
+            for entry in self.get_timesheets(params):
+                if entry['id'] in ids:
+                    continue
+                ids.add(entry['id'])
+                yield entry
-                if not pr.json():
+    def start_clock(self, project_id: int, activity_id: int, description: str | None = None, tags: Iterable[str] | None = None, billable: bool = True):
-                    return None
+        self._session.post('/api/timesheets', json={
+            'begin': self.render_datetime(datetime.now()),
+            'project': project_id,
+            'activity': activity_id,
+            'description': description if description else '',
+            'tags': (','.join(tags)) if tags else '',
+            'billable': billable,
+        }).raise_for_status()
-                if 'cid' in pr.json() and pr.json()['cid']:
+    def stop_clock(self, running_id: int):
-                    if pr.json()['cid'] not in self._client_ids:
+        self._session.patch(f'/api/timesheets/{running_id}/stop').raise_for_status()
-                        return None
-                elif 0 not in self._client_ids:
-                    return None
-            elif 0 not in self._client_ids:
-                return None
-        start = isoparse(r.json()['start'])
-        return now - start if start <= now else None
 class Worktime(object):
    time_worked = timedelta()
@@ -281,10 +277,10 @@ class Worktime(object):
      config = Worktime.config()
      config_dir = BaseDirectory.load_first_config('worktime')
-      api = TogglAPI(
+      api = KimaiAPI(
-          api_token=config.get("TOGGL", {}).get("ApiToken", None),
+          base_url=config.get("KIMAI", {}).get("BaseUrl", None),
-          workspace_id=config.get("TOGGL", {}).get("Workspace", None),
+          api_token=config.get("KIMAI", {}).get("ApiToken", None),
-          client_ids=config.get("TOGGL", {}).get("ClientIds", None)
+          clients=config.get("KIMAI", {}).get("Clients", None)
      )
      date_format = config.get("WORKTIME", {}).get("DateFormat", '%Y-%m-%d')
@@ -379,10 +375,7 @@ class Worktime(object):
                              parse_datestr(stripped_line)
                          for day in [fromDay + timedelta(days = x) for x in range(0, (toDay - fromDay).days + 1)]:
-                              if self.end_date.date() < day or day < self.start_date.date():
+                              if self.would_be_workday(day) and self.start_date.date() <= day and day <= self.end_date.date():
-                                  continue
-                              if self.would_be_workday(day):
                                  if excused_kind == 'leave':
                                      self.leave_days.add(day)
                                  elif time is not None and time >= self.time_per_day(day):
@@ -397,9 +390,29 @@ class Worktime(object):
      start_day = self.start_date.date()
      end_day = self.end_date.date()
+      self.extra_days_to_work = dict()
      try:
-          with open(Path(config_dir) / "pull-forward", 'r') as excused:
+          with open(Path(config_dir) / "days-to-work", 'r') as extra_days_to_work_file:
-              for line in excused:
+              for line in extra_days_to_work_file:
+                  stripped_line = line.strip()
+                  if stripped_line:
+                      splitLine = stripped_line.split(' ')
+                      if len(splitLine) == 2:
+                          [hours, datestr] = splitLine
+                          day = datetime.strptime(datestr, date_format).replace(tzinfo=tzlocal()).date()
+                          self.extra_days_to_work[day] = timedelta(hours = float(hours))
+                      else:
+                          day = datetime.strptime(stripped_line, date_format).replace(tzinfo=tzlocal()).date()
+                          self.extra_days_to_work[day] = self.time_per_day(day)
+      except IOError as e:
+          if e.errno != 2:
+              raise e
+      try:
+          with open(Path(config_dir) / "pull-forward", 'r') as pull_forward:
+              for line in pull_forward:
                  stripped_line = line.strip()
                  if stripped_line:
                      [hours, datestr] = stripped_line.split(' ')
@@ -420,15 +433,22 @@ class Worktime(object):
                                  if not d == datetime.strptime(c, date_format).replace(tzinfo=tzlocal()).date(): break
                          else:
                              if d >= self.end_date.date():
-                                  self.pull_forward[d] = min(timedelta(hours = float(hours)), self.time_per_day(d) - (holidays[d] if d in holidays else timedelta()))
+                                  time_for_day = self.time_per_day(d) if d.isoweekday() in self.workdays else timedelta()
+                                  if d in self.extra_days_to_work:
+                                      time_for_day += self.extra_days_to_work[d]
+                                  self.pull_forward[d] = min(timedelta(hours = float(hours)), time_for_day)
      except IOError as e:
          if e.errno != 2:
              raise e
+      if self.pull_forward:
+          for year in range(self.end_date.year + 1, max(self.pull_forward.keys()).year + 1):
+              holidays |= {k: v * timedelta(hours = hours_per_week(k)) / len(self.workdays) for k, v in Worktime.holidays(year).items()}
      self.days_to_work = dict()
-      if self.pull_forward:
+      # if self.pull_forward:
-          end_day = max(end_day, max(list(self.pull_forward)))
+      #     end_day = max(end_day, max(self.pull_forward.keys()))
      for day in [start_day + timedelta(days = x) for x in range(0, (end_day - start_day).days + 1)]:
          if day.isoweekday() in self.workdays:
@@ -436,26 +456,6 @@ class Worktime(object):
              if time_to_work > timedelta():
                self.days_to_work[day] = time_to_work
-      self.extra_days_to_work = dict()
-      try:
-          with open(Path(config_dir) / "days-to-work", 'r') as extra_days_to_work_file:
-              for line in extra_days_to_work_file:
-                  stripped_line = line.strip()
-                  if stripped_line:
-                      splitLine = stripped_line.split(' ')
-                      if len(splitLine) == 2:
-                          [hours, datestr] = splitLine
-                          day = datetime.strptime(datestr, date_format).replace(tzinfo=tzlocal()).date()
-                          self.extra_days_to_work[day] = timedelta(hours = float(hours))
-                      else:
-                          day = datetime.strptime(stripped_line, date_format).replace(tzinfo=tzlocal()).date()
-                          self.extra_days_to_work[day] = self.time_per_day(day)
-      except IOError as e:
-          if e.errno != 2:
-              raise e
      self.now_is_workday = self.is_workday(self.now.date())
      self.time_worked = timedelta()
@@ -471,9 +471,9 @@ class Worktime(object):
      self.time_to_work = sum([self.days_to_work[day] for day in self.days_to_work.keys() if day <= self.end_date.date()], timedelta())
      for day in [d for d in list(self.pull_forward) if d > self.end_date.date()]:
-          days_forward = set([d for d in self.days_to_work.keys() if d >= self.end_date.date() and d < day and (not d in self.pull_forward or d == self.end_date.date())])
+          days_forward = set([d for d in [start_day + timedelta(days = x) for x in range(0, (day - start_day).days + 1)] if d >= self.end_date.date() and d < day and (d not in self.pull_forward or d == self.end_date.date())])
-          extra_days_forward = set([d for d in self.extra_days_to_work.keys() if d >= self.end_date.date() and d < day and (not d in self.pull_forward or d == self.end_date.date())])
+          extra_days_forward = set([d for d in self.extra_days_to_work.keys() if d >= self.end_date.date() and d < day and (d not in self.pull_forward or d == self.end_date.date())])
-          days_forward = days_forward.union(extra_days_forward)
+          days_forward |= extra_days_forward
          extra_day_time_left = timedelta()
          for extra_day in extra_days_forward:
@@ -486,17 +486,30 @@ class Worktime(object):
                day_time = max(timedelta(), self.time_per_day(extra_day) - self.extra_days_to_work[extra_day])
                self.extra_days_to_work[extra_day] += extra_day_time * (day_time / extra_day_time_left)
-          hours_per_day_forward = time_forward / len(days_forward) if len(days_forward) > 0 else timedelta()
+          def days_count(days_forward):
+              r = 0
+              for day in sorted(days_forward):
+                  day_time = timedelta()
+                  if day in self.extra_days_to_work:
+                      day_time += self.extra_days_to_work[day]
+                  if day in holidays and not day in self.extra_days_to_work:
+                      day_time -= holidays[day]
+                  if day.isoweekday() in self.workdays:
+                      day_time += timedelta(hours = hours_per_week(day)) / len(self.workdays)
+                  r += max(timedelta(), day_time) / (timedelta(hours = hours_per_week(day)) / len(self.workdays))
+              return r
+          hours_per_day_forward = time_forward / days_count(days_forward) if days_count(days_forward) > 0 else timedelta()
          days_forward.discard(self.end_date.date())
-          self.time_pulled_forward += time_forward - hours_per_day_forward * len(days_forward)
+          self.time_pulled_forward += time_forward - hours_per_day_forward * days_count(days_forward)
      if self.end_date.date() in self.extra_days_to_work:
          self.time_pulled_forward += self.extra_days_to_work[self.end_date.date()]
-      self.time_to_work += self.time_pulled_forward
+      # self.time_to_work += self.time_pulled_forward
-      self.time_worked += api.get_billable_hours(self.start_date, self.now, rounding = config.get("WORKTIME", {}).get("rounding", True))
+      self.time_worked += api.get_billable_hours(self.start_date, self.now)
 def format_days(worktime, days, date_format=None):
    if not date_format:
@@ -573,7 +586,7 @@ def worktime(pull_forward_cutoff, waybar, **args):
    pull_forward_sum = sum(worktime.pull_forward.values(), start=timedelta(milliseconds=0))
    if pull_forward_sum >= min(pull_forward_cutoff, timedelta(seconds = 1)):
        worktime_no_pulled_forward = deepcopy(worktime)
-        worktime_no_pulled_forward.time_to_work -= worktime_no_pulled_forward.time_pulled_forward
+        # worktime_no_pulled_forward.time_to_work -= worktime_no_pulled_forward.time_pulled_forward
        worktime_no_pulled_forward.time_pulled_forward = timedelta()
        worktime_no_pulled_forward.pull_forward = dict()
        worktime.time_to_work += pull_forward_sum
@@ -611,7 +624,7 @@ def time_worked(now, waybar, **args):
    out_text = None
    out_class = "running" if now.running_entry else "stopped"
    tooltip = tooltip_timedelta(worked)
-    target_time = max(then.time_per_day(then.now.date()), now.time_per_day(now.now.date())) if then.time_per_day(then.now.date()) and now.time_per_day(now.now.date()) else (then.time_per_day(then.now.date()) if then.time_per_day(then.now.date()) else now.time_per_day(now.now.date()));
+    target_time = max(then.time_per_day(then.now.date()), now.time_per_day(now.now.date())) if then.time_per_day(then.now.date()) and now.time_per_day(now.now.date()) else (then.time_per_day(then.now.date()) if then.time_per_day(then.now.date()) else now.time_per_day(now.now.date()))
    difference = target_time - worked
    difference_pull_forward = difference + now.time_pulled_forward
    if now.running_entry and difference_pull_forward < timedelta(seconds=0):
@@ -886,7 +899,7 @@ def main():
    config = Worktime.config()
-    parser = argparse.ArgumentParser(prog = "worktime", description = 'Track worktime using toggl API')
+    parser = argparse.ArgumentParser(prog = "worktime", description = 'Track worktime using Kimai API')
    parser.add_argument('--time', dest = 'now', metavar = 'TIME', type = isotime, help = 'Time to calculate status for (default: current time)', default = datetime.now(tzlocal()))
    parser.add_argument('--start', dest = 'start_datetime', metavar = 'TIME', type = isotime, help = 'Time to calculate status from (default: None)', default = None)
    parser.add_argument('--no-running', dest = 'include_running', action = 'store_false')
@@ -923,5 +936,139 @@ def main():
    args.cmd(**vars(args))
+async def ui_update_options(api, cache_path):
+    options = set()
+    sort_order = dict()
+    entry_iter = enumerate(api.get_recent_entries())
+    loop = asyncio.get_event_loop()
+    start = clock_gettime_ns(CLOCK_MONOTONIC)
+    while item := await loop.run_in_executor(None, next, entry_iter):
+        ix, entry = item
+        if len(options) >= 20 or ix >= 1000:
+            break
+        elif len(options) >= 3:
+            now = clock_gettime_ns(CLOCK_MONOTONIC)
+            if now - start >= 4000000000:
+                break
+        option = frozendict({
+            'tags': frozenset(entry['tags']),
+            'activity': frozendict({'id': entry['activity']['id'], 'name': entry['activity']['name']}),
+            'project': frozendict({'id': entry['project']['id'], 'customer': entry['project']['customer']['name'], 'name': entry['project']['name']}),
+            'description': entry['description'] if entry['description'] else None,
+            'billable': entry['billable'],
+        })
+        sort_value = isoparse(entry['begin'])
+        if option in sort_order:
+            sort_value = max(sort_value, sort_order[option])
+        sort_order[option] = sort_value
+        options.add(option)
+    options = list(sorted(options, key = lambda o: sort_order[o], reverse = True))
+    with AtomicWriter(cache_path, overwrite=True) as ch:
+        ch.write_text(jsonpickle.encode(options))
+    return options
+def ui_render_option(option):
+    res = ''
+    if option['description']:
+        res += '„{}“, '.format(option['description'])
+    res += option['activity']['name'] + ', '
+    res += option['project']['name']
+    if option['project']['customer'] not in option['project']['name']:
+        res += ' ({})'.format(option['project']['customer'])
+    if option['tags']:
+        res += ', {}'.format(' '.join(map(lambda t: '#{}'.format(t), option['tags'])))
+    if not option['billable']:
+        res += ', not billable'
+    return res
+async def ui_main():
+    cache_path = Path(BaseDirectory.save_cache_path('worktime-ui')) / 'options.json'
+    options = None
+    try:
+        with cache_path.open('r', encoding='utf-8') as ch:
+            options = jsonpickle.decode(ch.read())
+    except FileNotFoundError:
+        pass
+    config = Worktime.config()
+    api = KimaiAPI(
+        base_url=config.get("KIMAI", {}).get("BaseUrl", None),
+        api_token=config.get("KIMAI", {}).get("ApiToken", None),
+        clients=config.get("KIMAI", {}).get("Clients", None)
+    )
+    running_entry = api.get_running_entry()
+    async with asyncio.TaskGroup() as tg:
+        update_options = tg.create_task(ui_update_options(api, cache_path))
+        if not options:
+            options = await update_options
+        read_fd, write_fd = os.pipe()
+        w_pipe = open(write_fd, 'wb', 0)
+        loop = asyncio.get_event_loop()
+        w_transport, _ = await loop.connect_write_pipe(
+            asyncio.Protocol,
+            w_pipe,
+        )
+        r_pipe = open(read_fd, 'rb', 0)
+        proc = await asyncio.create_subprocess_exec(
+            "fuzzel", "--dmenu", "--index", "--width=60",
+            stdout = asyncio.subprocess.PIPE,
+            stdin = r_pipe,
+        )
+        with closing(w_transport) as t:
+            if running_entry:
+                t.write(b'Stop running timesheet\n')
+            for option in options:
+                t.write(ui_render_option(option).encode('utf-8') + b'\n')
+        stdout, _ = await proc.communicate()
+        if proc.returncode != 0:
+            return
+        fuzzel_out = int(stdout.decode('utf-8'))
+        if fuzzel_out < 0 or fuzzel_out >= len(options):
+            return
+        elif running_entry and fuzzel_out == 0:
+            api.stop_clock(running_entry['id'])
+            await notify.Server('worktime').Notify("Stopped running timesheet").set_timeout(65000).show()
+        else:
+            if running_entry:
+                fuzzel_out -= 1
+            option = options[fuzzel_out]
+            api.start_clock(
+                project_id = option['project']['id'],
+                activity_id = option['activity']['id'],
+                description = option['description'],
+                tags = option['tags'],
+                billable = option['billable'],
+            )
+            await notify.Server('worktime').Notify("Timesheet started…").set_timeout(65000).show()
+def ui():
+    asyncio.run(ui_main())
+async def stop_main():
+    config = Worktime.config()
+    api = KimaiAPI(
+        base_url=config.get("KIMAI", {}).get("BaseUrl", None),
+        api_token=config.get("KIMAI", {}).get("ApiToken", None),
+        clients=config.get("KIMAI", {}).get("Clients", None)
+    )
+    if running_entry := api.get_running_entry():
+        api.stop_clock(running_entry['id'])
+        await notify.Server('worktime').Notify("Stopped running timesheet").set_timeout(65000).show()
+    else:
+        await notify.Server('worktime').Notify("No timesheet currently running").set_timeout(65000).show()
+def stop():
+    asyncio.run(stop_main())
 if __name__ == "__main__":
    sys.exit(main())
diff --git a/overlays/yt-dlp.nix b/overlays/yt-dlp.nix
index 94ab1fdd..9a54a32b 100644
--- a/overlays/yt-dlp.nix
+++ b/overlays/yt-dlp.nix
@@ -1,5 +1,7 @@
 { prev, sources, ... }: {
  yt-dlp = prev.yt-dlp.overrideAttrs (oldAttrs: {
    inherit (sources.yt-dlp) pname version src;
+    postPatch = "";
  });
 }
diff --git a/overlays/zte-prometheus-exporter/default.nix b/overlays/zte-prometheus-exporter/default.nix
index 2188e7b3..6295567d 100644
--- a/overlays/zte-prometheus-exporter/default.nix
+++ b/overlays/zte-prometheus-exporter/default.nix
@@ -1,18 +1,17 @@
 { final, prev, ... }:
 let
  packageOverrides = final.callPackage ./python-packages.nix {};
-  inpPython = final.python310.override { inherit packageOverrides; };
+  inpPython = final.python3.override { inherit packageOverrides; };
+  python = inpPython.withPackages (ps: with ps; [pytimeparse requests]);
 in {
  zte-prometheus-exporter = prev.stdenv.mkDerivation rec {
    name = "zte-prometheus-exporter";
-    src = ./zte-prometheus-exporter.py;
+    src = prev.replaceVars ./zte-prometheus-exporter.py { inherit python; };
-    phases = [ "buildPhase" "checkPhase" "installPhase" ];
+    phases = [ "unpackPhase" "checkPhase" "installPhase" ];
-    python = inpPython.withPackages (ps: with ps; [pytimeparse requests]);
+    unpackPhase = ''
+      cp $src zte-prometheus-exporter
-    buildPhase = ''
-      substituteAll $src zte-prometheus-exporter
    '';
    doCheck = true;
diff --git a/overlays/zte-prometheus-exporter/zte-prometheus-exporter.py b/overlays/zte-prometheus-exporter/zte-prometheus-exporter.py
index fc719a96..bc8326ff 100644
--- a/overlays/zte-prometheus-exporter/zte-prometheus-exporter.py
+++ b/overlays/zte-prometheus-exporter/zte-prometheus-exporter.py
@@ -54,13 +54,13 @@ class ZTEMetrics:
            cls._instance.password = environ.get('ZTE_PASSWORD')
            cls._instance.attrs = None
        return cls._instance
-    
    def __init__(self):
        raise RuntimeError('Call instance() instead')
-    _error_pattern = re.compile('^IF_ERROR(PARAM|TYPE|STR|ID)$')
+    _error_pattern = re.compile(r'^IF_ERROR(PARAM|TYPE|STR|ID)$')
-    _obj_pattern = re.compile('^(?:OBJ_(.+)_ID)|(?:ID_(WAN_COMFIG))$')
+    _obj_pattern = re.compile(r'^(?:OBJ_(.+)_ID)|(?:ID_(WAN_COMFIG))$')
    def update(self):
        attrs = dict()
@@ -106,6 +106,8 @@ class ZTEMetrics:
                                    value = child.text
                                case _:
                                    pass
+                            if value == '0,0':
+                                value = '0'
                            if not name is None and not value is None:
                                instance_dict[name] = value
                                name = None
@@ -120,8 +122,8 @@ class ZTEMetrics:
    def json_text(self):
        return json.dumps(self.attrs)
-    _link_pattern = re.compile('^IGD\.WD1\.LINE([0-9]+)$')
+    _link_pattern = re.compile(r'^IGD\.WD1\.LINE([0-9]+)$')
-    _eth_pattern = re.compile('^IGD\.LD1\.ETH([0-9]+)$')
+    _eth_pattern = re.compile(r'^IGD\.LD1\.ETH([0-9]+)$')
    def prometheus(self):
        metrics = ''
@@ -133,34 +135,41 @@ class ZTEMetrics:
            link_match = self._link_pattern.match(link)
            link_number = link_match.group(1)
-            if 'crc_errors_count' not in link_metrics:
+            link_is_up = self.attrs['DSLINTERFACE'][link]['Status'] == 'Up'
-                link_metrics['crc_errors_count'] = {'type': 'counter', 'metrics': []}
-            link_metrics['crc_errors_count']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['UpCrc_errors']))]
+            if link_is_up:
-            link_metrics['crc_errors_count']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['DownCrc_errors']))]
+                if 'crc_errors_count' not in link_metrics:
+                    link_metrics['crc_errors_count'] = {'type': 'counter', 'metrics': []}
+                link_metrics['crc_errors_count']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['UpCrc_errors']))]
+                link_metrics['crc_errors_count']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['DownCrc_errors']))]
-            if 'noise_margin_db' not in link_metrics:
+                if 'noise_margin_db' not in link_metrics:
-                link_metrics['noise_margin_db'] = {'type': 'gauge', 'metrics': []}
+                    link_metrics['noise_margin_db'] = {'type': 'gauge', 'metrics': []}
-            link_metrics['noise_margin_db']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Upstream_noise_margin']))]
+                link_metrics['noise_margin_db']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Upstream_noise_margin']) / 10)]
-            link_metrics['noise_margin_db']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Downstream_noise_margin']))]
+                link_metrics['noise_margin_db']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Downstream_noise_margin']) / 10)]
-            if 'attenuation_db' not in link_metrics:
+                if 'attenuation_db' not in link_metrics:
-                link_metrics['attenuation_db'] = {'type': 'gauge', 'metrics': []}
+                    link_metrics['attenuation_db'] = {'type': 'gauge', 'metrics': []}
-            link_metrics['attenuation_db']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Upstream_attenuation']))]
+                link_metrics['attenuation_db']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Upstream_attenuation']) / 10)]
-            link_metrics['attenuation_db']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Downstream_attenuation']))]
+                link_metrics['attenuation_db']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Downstream_attenuation']) / 10)]
-            if 'max_rate_kbps' not in link_metrics:
+                if 'max_rate_kbps' not in link_metrics:
-                link_metrics['max_rate_kbps'] = {'type': 'gauge', 'metrics': []}
+                    link_metrics['max_rate_kbps'] = {'type': 'gauge', 'metrics': []}
-            link_metrics['max_rate_kbps']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Upstream_max_rate']))]
+                link_metrics['max_rate_kbps']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Upstream_max_rate']))]
-            link_metrics['max_rate_kbps']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Downstream_max_rate']))]
+                link_metrics['max_rate_kbps']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Downstream_max_rate']))]
-            if 'current_rate_kbps' not in link_metrics:
+                if 'current_rate_kbps' not in link_metrics:
-                link_metrics['current_rate_kbps'] = {'type': 'gauge', 'metrics': []}
+                    link_metrics['current_rate_kbps'] = {'type': 'gauge', 'metrics': []}
-            link_metrics['current_rate_kbps']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Upstream_current_rate']))]
+                link_metrics['current_rate_kbps']['metrics'] += [({"direction": "up", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Upstream_current_rate']))]
-            link_metrics['current_rate_kbps']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Downstream_current_rate']))]
+                link_metrics['current_rate_kbps']['metrics'] += [({"direction": "down", "link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Downstream_current_rate']))]
            if 'dsl_uptime_seconds' not in link_metrics:
-                link_metrics['dsl_uptime_seconds'] = {'type': 'gauge', 'metrics': []}
+                link_metrics['uptime_seconds'] = {'type': 'gauge', 'metrics': []}
-            link_metrics['dsl_uptime_seconds']['metrics'] += [({"link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Showtime_start']))]
+            link_metrics['uptime_seconds']['metrics'] += [({"link": link_number}, int(self.attrs['DSLINTERFACE'][link]['Showtime_start']) if link_is_up else 0)]
+            if 'status' not in link_metrics:
+                link_metrics['status'] = {'type': 'gauge', 'metrics': []}
+            link_metrics['status']['metrics'] += [({"link": link_number, "status": self.attrs['DSLINTERFACE'][link]['Status']}, 1)]
        if link_metrics:
            for metric_name in link_metrics:
                metrics += _format_prom_metrics(f'dsl_{metric_name}', link_metrics[metric_name]['type'], link_metrics[metric_name]['metrics'])
@@ -203,7 +212,7 @@ class ZTEMetricsServer(BaseHTTPRequestHandler):
                self.send_response(200)
                self.send_header("Content-type", "text/plain")
                self.end_headers()
-                
                self.wfile.write(zte_metrics.prometheus())
            case _:
                self.send_response(404)
diff --git a/shell.nix b/shell.nix
index 5bcb8180..1b334187 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,19 +1,29 @@
-inputs@{ system, self, deploy-rs, nvfetcher, nixpkgs, ca-util, ... }:
+inputs@{ system, self, nvfetcher, nixpkgs, ca-util, ... }:
 let
  pkgs = self.legacyPackages.${system};
  utils = import ./utils { inherit (nixpkgs) lib; };
  inherit (utils) nixImport;
+  uv-links = pkgs.symlinkJoin {
+    name = "uv-links";
+    paths = [
+      pkgs.python312.pkgs.pygobject3
+    ];
+  };
 in pkgs.mkShell {
  nativeBuildInputs = builtins.attrValues self.packages.${system} ++ (with pkgs; [
    sops
    wireguard-tools
    gup
    nftables
-    deploy-rs.packages.${system}.deploy-rs
+    deploy-rs.deploy-rs
    knot-dns
    yq
    nvfetcher.packages.${system}.default
    ca-util.packages.${system}.ca
-    poetry
+    poetry uv
+    ninja pkg-config cairo.dev systemd.dev
  ]);
+  shellHook = ''
+    export UV_FIND_LINKS=${uv-links}/lib/python3.12/site-packages
+  '';
 }
diff --git a/system-profiles/bcachefs.nix b/system-profiles/bcachefs.nix
index f9f048b9..be12bf20 100644
--- a/system-profiles/bcachefs.nix
+++ b/system-profiles/bcachefs.nix
@@ -1,6 +1,16 @@
-{ pkgs, ... } : {
+{ pkgs, lib, ... } : {
  config = {
    boot.supportedFilesystems.bcachefs = true;
    environment.systemPackages = with pkgs; [ bcachefs-tools ];
+    boot.kernelPatches = [
+      {
+        name = "bcachefs-casefold-fix";
+        patch = null;
+        structuredExtraConfig = with lib.kernel; {
+          UNICODE = lib.mkOverride 90 no;
+        };
+      }
+    ];
  };
 }
diff --git a/system-profiles/core/default.nix b/system-profiles/core/default.nix
index b85aea4e..e5f9dc16 100644
--- a/system-profiles/core/default.nix
+++ b/system-profiles/core/default.nix
@@ -127,36 +127,16 @@ in {
          flake-registry = "${flakeInputs.flake-registry}/flake-registry.json";
        };
-        nixPath = [
+        nixPath = map (flake: "${flake}=flake:${flake}") (attrNames config.nix.registry);
-          "nixpkgs=${pkgs.runCommand "nixpkgs" {} ''
-            mkdir $out
-            ln -s ${./nixpkgs.nix} $out/default.nix
-            ln -s /run/nixpkgs/lib $out/lib
-          ''}"
-        ];
        registry =
          let override = { self = "nixos"; };
          in mapAttrs' (inpName: inpFlake: nameValuePair
            (override.${inpName} or inpName)
-            { flake = inpFlake; } ) flakeInputs;
+            { to = { type = "path"; path = inpFlake; }; } ) flakeInputs;
      };
      systemd.tmpfiles.rules = [
        "L+ /run/nixpkgs - - - - ${flakeInputs.${config.nixpkgs.flakeInput}.outPath}"
-        "L+ /run/nixpkgs-overlays.nix - - - - ${pkgs.writeText "overlays.nix" ''
-          with builtins;
-          attrValues (import
-            (
-              let lock = fromJSON (readFile ${flake + "/flake.lock"}); in
-              fetchTarball {
-                url = "https://github.com/edolstra/flake-compat/archive/''${lock.nodes.flake-compat.locked.rev}.tar.gz";
-                sha256 = lock.nodes.flake-compat.locked.narHash;
-              }
-            )
-            { src = ${flake}; }
-          ).defaultNix.overlays
-        ''}"
        "L+ /etc/nixos - - - - ${flake}"
      ] ++ map (input: "L+ /run/flake-inputs/${input} - - - - ${flakeInputs.${input}.outPath}") (attrNames flakeInputs);
@@ -177,8 +157,6 @@ in {
          {
            manual.manpages.enable = true;
            systemd.user.startServices = "sd-switch";
-            programs.ssh.internallyManaged = mkForce true;
          }
        ];
        extraSpecialArgs = { inherit flake flakeInputs path; hostConfig = config; };
@@ -202,13 +180,7 @@ in {
      };
      environment.systemPackages = with pkgs; [ git-annex scutiger ];
    }
-  ] ++ (optional (options ? system.switch.enableNg) {
+  ] ++ (optional (options ? system.rebuild.enableNg) {
-    system.switch = lib.mkDefault {
-      enable = false;
-      enableNg = true;
-    };
-  })
-  ++ (optional (options ? system.rebuild.enableNg) {
    system.rebuild.enableNg = lib.mkDefault true;
  })
  ++ (optional (options ? services.userborn) {
diff --git a/system-profiles/default-locale.nix b/system-profiles/default-locale.nix
index 2d483f04..60d338cb 100644
--- a/system-profiles/default-locale.nix
+++ b/system-profiles/default-locale.nix
@@ -1,16 +1,23 @@
-{ lib, ... }:
+{ lib, options, ... }:
 with lib;
 {
-  i18n = {
+  config = foldr recursiveUpdate {} ([
-    defaultLocale = "en_DK.UTF-8";
+    {
-    extraLocaleSettings = {
+      i18n = {
-      "TIME_STYLE" = "long-iso";
+        defaultLocale = "en_DK.UTF-8";
-    };
+        extraLocaleSettings = {
-    supportedLocales = [ "C.UTF-8/UTF-8" "en_US.UTF-8/UTF-8" "en_DK.UTF-8/UTF-8" ];
+          "TIME_STYLE" = "long-iso";
-  };
+        };
-  console.keyMap = mkDefault "dvorak-programmer";
+      };
+      console.keyMap = mkDefault "dvorak-programmer";
-  time.timeZone = mkDefault "Europe/Berlin";
+      time.timeZone = mkDefault "Europe/Berlin";
+    }
+  ] ++ (optional (options ? i18n.extraLocales) {
+    i18n.extraLocales = [ "C.UTF-8" "en_US.UTF-8" "en_DK.UTF-8" ];
+  }) ++ (optional (!(options ? i18n.extraLocales)) {
+    i18n.supportedLocales = [ "C.UTF-8/UTF-8" "en_US.UTF-8/UTF-8" "en_DK.UTF-8/UTF-8" ];
+  }));
 }
diff --git a/system-profiles/initrd-all-crypto-modules.nix b/system-profiles/initrd-all-crypto-modules.nix
index 45cd4b74..da6c781e 100644
--- a/system-profiles/initrd-all-crypto-modules.nix
+++ b/system-profiles/initrd-all-crypto-modules.nix
@@ -18,7 +18,7 @@ in {
    {
      name = "encrypted_key";
      patch = null;
-      extraStructuredConfig.ENCRYPTED_KEYS = lib.kernel.yes;
+      structuredExtraConfig.ENCRYPTED_KEYS = lib.kernel.yes;
    }
  ];
 }
diff --git a/system-profiles/lanzaboote.nix b/system-profiles/lanzaboote.nix
new file mode 100644
index 00000000..f1e179cf
--- /dev/null
+++ b/system-profiles/lanzaboote.nix
@@ -0,0 +1,14 @@
+{ flakeInputs, pkgs, ... }:
+{
+  imports = [
+    flakeInputs.lanzaboote.nixosModules.lanzaboote
+  ];
+  config = {
+    environment.systemPackages = [ pkgs.sbctl ];
+    boot.lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+    };
+  };
+}
diff --git a/system-profiles/nfsroot.nix b/system-profiles/nfsroot.nix
index 1cd930d9..e3dc2d2e 100644
--- a/system-profiles/nfsroot.nix
+++ b/system-profiles/nfsroot.nix
@@ -1,4 +1,4 @@
-{ config, options, pkgs, lib, flake, flakeInputs, ... }:
+{ config, options, pkgs, lib, flake, ... }:
 with lib;
@@ -48,7 +48,7 @@ in {
      fileSystems."/nix/.ro-store" = mkImageMediaOverride
        { fsType = "nfs4";
          device = cfg.storeDevice;
-          options = [ "ro" ];
+          options = [ "ro" "nfsvers=4.2" ];
          neededForBoot = true;
        };
@@ -86,7 +86,7 @@ in {
        mkdir -p /mnt-root/etc/
        cp /etc/resolv.conf /mnt-root/etc/resolv.conf
      '';
-      networking.useDHCP = true;
+      networking.useDHCP = mkImageMediaOverride true;
      networking.resolvconf.enable = false;
      networking.dhcpcd.persistent = true;
diff --git a/system-profiles/rebuild-machines/default.nix b/system-profiles/rebuild-machines/default.nix
index 544f47e1..de86cd74 100644
--- a/system-profiles/rebuild-machines/default.nix
+++ b/system-profiles/rebuild-machines/default.nix
@@ -25,16 +25,18 @@ let
    phases = [ "buildPhase" "installPhase" ];
-    inherit (pkgs) zsh coreutils openssh;
-    inherit (cfg) scriptName;
-    inherit (cfg.flake) flakeOutput;
-    flake = cfg.flake.name;
-    nixosRebuild = config.system.build.nixos-rebuild;
-    inherit (config.security) wrapperDir;
-    inherit sshConfig;
    buildPhase = ''
-      substituteAll $src rebuild-machine.zsh
+      substitute $src rebuild-machine.zsh \
+        --subst-var-by zsh ${pkgs.zsh} \
+        --subst-var-by coreutils ${pkgs.coreutils} \
+        --subst-var-by openssh ${pkgs.openssh} \
+        --subst-var-by wrapperDir ${config.security.wrapperDir} \
+        --subst-var-by sshConfig ${sshConfig} \
+        --subst-var-by out "$out" \
+        --subst-var-by nixosRebuild ${config.system.build.nixos-rebuild} \
+        --subst-var-by flake ${cfg.flake.name} \
+        --subst-var-by scriptName ${cfg.scriptName} \
+        --subst-var-by flakeOutput ${cfg.flake.flakeOutput}
    '';
    installPhase = ''
diff --git a/system-profiles/zfs.nix b/system-profiles/zfs.nix
index a93dddd2..af9f1c17 100644
--- a/system-profiles/zfs.nix
+++ b/system-profiles/zfs.nix
@@ -1,4 +1,4 @@
-{ pkgs, lib, ... } : {
+{ config, pkgs, lib, ... } : {
  config = {
    boot = {
      kernelPackages = pkgs.linuxPackages_6_12;
diff --git a/user-profiles/core.nix b/user-profiles/core.nix
index a8af48b3..57fb7628 100644
--- a/user-profiles/core.nix
+++ b/user-profiles/core.nix
@@ -5,7 +5,11 @@ with lib;
 {
  config = {
    users.users.${userName} = {}; # Just make sure the user is created
-    home-manager.users.${userName} = {};
+    home-manager.users.${userName} = let sysConfig = config; in { config, ... }: {
+      config.nix.settings = {
+        inherit (sysConfig.nix.settings) use-xdg-base-directories;
+      };
+    };
    systemd.services."home-manager-${utils.escapeSystemdPath userName}" = lib.mkIf (!config.home-manager.enableSystemd) {
      restartIfChanged = false; # only run once on startup, deploy to running system with deploy-rs
diff --git a/user-profiles/feeds/alot.config b/user-profiles/feeds/alot.config
deleted file mode 100644
index a14d4539..00000000
--- a/user-profiles/feeds/alot.config
+++ /dev/null
@@ -1,50 +0,0 @@
-attachment_prefix="~/Downloads"
-bug_on_exit=true
-editor_cmd="false"
-tabwidth=2
-timestamp_format="%a %d %b %H:%M:%S %Y UTC%z"
-auto_remove_unread=True
-#initial_command="search ( tag:inbox ) AND NOT ( tag:killed )"
-initial_command="search ( tag:inbox ) AND NOT ( is:link OR is:media OR is:killed )"
-[accounts]
-  [[private]]
-    realname = @realname@
-    address = @address@
-[bindings]
-j = 
-k =
-'g g' =
-G =
-I = search ( tag:inbox ) AND NOT ( is:killed )
-U = search ( tag:inbox ) AND NOT ( is:link OR is:media OR is:killed )
-V = search ( tag:inbox AND is:media OR ( is:live AND date:12h.. AND NOT is:unread ) ) AND NOT ( is:killed )
-W = search ( is:media ) AND NOT ( tag:inbox OR is:killed OR is:highlight )
-L = search ( tag:inbox AND is:link ) AND NOT ( is:killed )
-h = move first
-t = move up
-n = move down
-s = move last
-        [[search]]
-                a =
-                s = 
- 
-                u = toggletags unread
-                i = toggletags inbox
-                j = untag unread,inbox
-                r = toggletags later
-        [[thread]]
-    s =
-                S =
-                n =
-                'g j' =
-    'g k' =
-    'g l' =
-                w = save
-                W = save --all
-    'g h' = move parent
-                'g t' = move next sibling
-    'g n' = move previous sibling
-    'g s' = move first reply
-\ No newline at end of file
diff --git a/user-profiles/feeds/default.nix b/user-profiles/feeds/default.nix
deleted file mode 100644
index 82be90c7..00000000
--- a/user-profiles/feeds/default.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ config, flakeInputs, pkgs, lib, userName, customUtils, ... }:
-{
-  home-manager.users.${userName} = {...}: {
-    imports = [
-      (customUtils.overrideModuleArgs
-        (import ./module.nix)
-        (inputs: inputs // { inherit flakeInputs; inherit (config.nixpkgs) system; })
-      )
-    ];
-  };
-}
diff --git a/user-profiles/feeds/imm-notmuch-insert.py b/user-profiles/feeds/imm-notmuch-insert.py
deleted file mode 100644
index b7eed292..00000000
--- a/user-profiles/feeds/imm-notmuch-insert.py
+++ /dev/null
@@ -1,52 +0,0 @@
-#!@python@/bin/python
-import json
-import sys
-import subprocess
-from io import BytesIO
-from email.message import EmailMessage
-import configparser
-from os import environ
-from datetime import *
-from dateutil.tz import *
-from dateutil.parser import isoparse
-from html2text import html2text
-def main():
-    notmuchConfig = configparser.ConfigParser()
-    notmuchConfig.read(environ.get('NOTMUCH_CONFIG'))
-    callbackMessage = json.load(sys.stdin)
-    msg = EmailMessage()
-    authors = ', '.join(map(lambda author: author['name'], callbackMessage['feed_item']['authors']))
-    if authors:
-        msg['From'] = f"{callbackMessage['feed_definition']['title']} ({authors}) <imm@imm.invalid>"
-    else:
-        msg['From'] = f"{callbackMessage['feed_definition']['title']} <imm@imm.invalid>"
-    msg['To'] = f"{notmuchConfig['user']['name']} <{notmuchConfig['user']['primary_email']}>"
-    if 'title' in callbackMessage['feed_item'] and callbackMessage['feed_item']['title']:
-        msg['Subject'] = callbackMessage['feed_item']['title']
-    msg['Item-Identifier'] = f"{callbackMessage['feed_item']['identifier']}"
-    for link in callbackMessage['feed_item']['links']:
-        msg.add_header('Link', link['uri'])
-    date = None
-    if 'date' in callbackMessage['feed_item']:
-        date = isoparse(callbackMessage['feed_item']['date'])
-    else:
-        date = datetime.now(tzlocal())
-    msg['Date'] = date.strftime('%a, %e %b %Y %T %z')
-    if 'content' in callbackMessage['feed_item'] and callbackMessage['feed_item']['content']:
-        msg.set_content(html2text(callbackMessage['feed_item']['content']))
-        msg.add_alternative(callbackMessage['feed_item']['content'], subtype='html')
-    subprocess.run(
-        args=['notmuch', 'insert'],
-        check=True,
-        input=bytes(msg)
-    )
-if __name__ == '__main__':
-    sys.exit(main())
diff --git a/user-profiles/feeds/module.nix b/user-profiles/feeds/module.nix
deleted file mode 100644
index 63e827eb..00000000
--- a/user-profiles/feeds/module.nix
+++ /dev/null
@@ -1,236 +0,0 @@
-{ config, flakeInputs, pkgs, lib, system, ... }:
-with lib;
-let
-  inherit (flakeInputs.home-manager.lib) hm;
-  databasePath = "${config.xdg.dataHome}/feeds";
-  imm =
-    let
-      hlib = pkgs.haskell.lib;
-      haskellPackages = pkgs.haskellPackages.override {
-        overrides = finalHaskell: prevHaskell: {
-          uri-bytestring = finalHaskell.callCabal2nix "uri-bytestring" (pkgs.fetchFromGitHub {
-            owner = "gkleen";
-            repo = "uri-bytestring";
-            rev = "5f7f32c8274bc4d1b81d99582f5148fe3e8b637e";
-            sha256 = "XLanwyCDIlMuOkpE5LbTNOBfL+1kZX+URfj9Bhs1Nsc=";
-            fetchSubmodules = true;
-          }) {};
-          atom-conduit = finalHaskell.callCabal2nix "atom-conduit" (pkgs.fetchFromGitHub {
-            owner = "gkleen";
-            repo = "atom-conduit";
-            rev = "022f0182a02373f87c06a0a09817c8c41efe2425";
-            sha256 = "8yEyh3ymqkoM/YP+eBqPq1I5ofzj0Qn7ojL7IWx1DPo=";
-            fetchSubmodules = true;
-          }) {};
-          rss-conduit = finalHaskell.callCabal2nix "rss-condit" (pkgs.fetchFromGitHub {
-            owner = "gkleen";
-            repo = "rss-conduit";
-            rev = "dbb0960a8d3dc519f1607aa0223b3a25a49282ef";
-            sha256 = "Md1XApZWkdv4JvNoaVnjz0S85LbEC6w9U3PUcwXfu94=";
-            fetchSubmodules = true;
-          }) {};
-          beam-core = hlib.doJailbreak (finalHaskell.callCabal2nix "beam-core" "${beamSrc}/beam-core" {});
-          beam-migrate = hlib.doJailbreak (finalHaskell.callCabal2nix "beam-migrate" "${beamSrc}/beam-migrate" {});
-          beam-sqlite = hlib.doJailbreak (finalHaskell.callCabal2nix "beam-sqlite" "${beamSrc}/beam-sqlite" {});
-          imm = finalHaskell.callCabal2nix "imm" (pkgs.fetchFromGitHub {
-            owner = "k0ral";
-            repo = "imm";
-            rev = "5033879667264cb44cee65671a66f6aa43f249e7";
-            sha256 = "PG22caLQmAGhLZP49HsazuNd8IFKKaTuhXIQBD8v4Fs=";
-            fetchSubmodules = true;
-          }) {};
-        };
-      };
-      beamSrc = pkgs.fetchFromGitHub {
-        owner = "haskell-beam";
-        repo = "beam";
-        rev = "efd464b079755a781c2bb7a2fc030d6c141bbb8a";
-        sha256 = "8nTuBP/vD0L/qMo4h3XNrGZvpIwXuMVdj40j5gvHU6w=";
-        fetchSubmodules = true;
-      };
-    in haskellPackages.imm;
-   immWrapped = pkgs.runCommand "${imm.name}-wrapped-${config.home.username}"
-    { nativeBuildInputs = with pkgs; [ makeWrapper ];
-    } ''
-      mkdir -p $out/bin
-      makeWrapper ${imm}/bin/imm $out/bin/imm \
-        --add-flags --callbacks=${notmuchCallbacks}
-    '';
-  notmuchCallbacks = pkgs.writeText "imm-callbacks-${config.home.username}.dhall" ''
-    [ { _executable = "${immNotmuchInsert}/bin/imm-notmuch-insert"
-      , _arguments = [] : List Text
-      }
-    ]
-  '';
-  immNotmuchInsert = pkgs.stdenv.mkDerivation rec {
-    name = "imm-notmuch-insert-${config.home.username}";
-    src = ./imm-notmuch-insert.py;
-    phases = [ "buildPhase" "checkPhase" "installPhase" "fixupPhase" ];
-    python = pkgs.python39.withPackages (ps: with ps; [ configparser python-dateutil html2text ]);
-    nativeBuildInputs = with pkgs; [ makeWrapper ];
-    buildPhase = ''
-      substituteAll $src imm-notmuch-insert
-    '';
-    doCheck = true;
-    checkPhase = ''
-      ${python}/bin/python -m py_compile imm-notmuch-insert
-    '';
-    installPhase = ''
-      install -m 0755 -D -t $out/bin \
-        imm-notmuch-insert
-    '';
-    fixupPhase = ''
-      wrapProgram $out/bin/imm-notmuch-insert \
-        --prefix PATH : ${pkgs.notmuch}/bin \
-        --set NOTMUCH_CONFIG ${configPath}
-    '';
-  };
-  mkIniKeyValue = key: value:
-    let
-      tweakVal = v:
-        if isString v then
-          v
-        else if isList v then
-          concatMapStringsSep ";" tweakVal v
-        else if isBool v then
-          (if v then "true" else "false")
-        else
-          toString v;
-    in "${key}=${tweakVal value}";
-  notmuchIni = {
-    database = { path = databasePath; };
-    maildir = { synchronize_flags = false; };
-    new = {
-      ignore = [];
-      tags = ["new"];
-    };
-    user = {
-      name = config.home.username;
-      primary_email = "${config.home.username}@imm.invalid";
-    };
-    search = { exclude_tags = ["deleted"]; };
-  };
-  configPath = pkgs.writeText "notmuchrc" (generators.toINI { mkKeyValue = mkIniKeyValue; } notmuchIni);
-  afewConfigDir = pkgs.symlinkJoin {
-    name = "afew-config";
-    paths = [
-      (pkgs.writeTextDir "config" ''
-         [InboxFilter]
-      '')
-    ];
-  };
-  notmuchHooksDir =
-    let
-      afewHook = pkgs.writeShellScript "afew" ''
-        exec -- ${pkgs.afew}/bin/afew -c ${afewConfigDir} -C ${configPath} --tag --new -vv
-      '';
-    in pkgs.linkFarm "notmuch-hooks" [
-      { name = "post-new";
-        path = afewHook;
-      }
-      { name = "post-insert";
-        path = afewHook;
-      }
-    ];
-  notmuchWrapped = pkgs.runCommand "${pkgs.notmuch.name}-wrapped-${config.home.username}"
-    { nativeBuildInputs = with pkgs; [ makeWrapper ];
-    } ''
-      mkdir -p $out/bin
-      makeWrapper ${pkgs.notmuch}/bin/notmuch $out/bin/notmuch-feeds \
-        --set NOTMUCH_CONFIG ${configPath}
-    '';
-  alotWrapped = pkgs.runCommand "${pkgs.alot.name}-wrapped-${config.home.username}"
-    { nativeBuildInputs = with pkgs; [ makeWrapper gnused ];
-    } ''
-      mkdir -p $out/bin
-      makeWrapper ${pkgs.alot}/bin/alot $out/bin/alot-feeds \
-        --prefix MAILCAPS : ${alotMailcaps} \
-        --add-flags --config=${alotConfig} \
-        --add-flags --notmuch-config=${configPath}
-      mkdir $out/share
-      ln -s ${pkgs.alot}/share/alot $out/share
-      mkdir -p $out/share/applications
-      sed -r 's/alot/alot-feeds/g' ${pkgs.alot}/share/applications/alot.desktop > $out/share/applications/alot-feeds.desktop
-      mkdir -p $out/share/zsh/site-functions
-      sed -r 's/alot/alot-feeds/g' ${pkgs.alot}/share/zsh/site-functions/_alot > $out/share/zsh/site-functions/_alot-feeds
-    '';
-  alotConfig = pkgs.runCommand "alot" {
-    realname = notmuchIni.user.name;
-    address = notmuchIni.user.primary_email;
-  } "substituteAll ${./alot.config} $out";
-  alotMailcaps = pkgs.writeText "mailcaps" ''
-    text/html; ${pkgs.lynx}/bin/lynx -dump -dont_wrap_pre -assume_charset=utf-8 -display_charset=utf-8 "%s"; nametemplate=%s.html; copiousoutput
-  '';
-in {
-  config = {
-    home.packages = [ immWrapped notmuchWrapped pkgs.notmuch.man alotWrapped ];
-    home.activation.createImm = hm.dag.entryAfter ["writeBoundary"] ''
-      $DRY_RUN_CMD mkdir -p $VERBOSE_ARG ${config.xdg.configHome}/imm
-    '';
-    
-    home.activation.createFeedsDatabase = hm.dag.entryAfter ["linkGeneration" "writeBoundary"] ''
-      $DRY_RUN_CMD mkdir -p -m 0750 $VERBOSE_ARG ${databasePath}
-      $DRY_RUN_CMD mkdir -p $VERBOSE_ARG ${databasePath}/new ${databasePath}/cur ${databasePath}/tmp
-      if ! [[ -d ${databasePath}/.notmuch ]]; then
-          NOTMUCH_VERBOSE_ARG="--quiet"
-          if [[ -v VERBOSE ]]; then
-            NOTMUCH_VERBOSE_ARG="--verbose"
-          fi
-          NOTMUCH_CONFIG=${configPath} $DRY_RUN_CMD ${pkgs.notmuch}/bin/notmuch new $NOTMUCH_VERBOSE_ARG
-      fi
-      $DRY_RUN_CMD ln -Tsf $VERBOSE_ARG ${notmuchHooksDir} ${databasePath}/.notmuch/hooks
-    '';
-    systemd.user.services."logrotate-imm" = {
-      Unit = {
-        Description = "Rotate imm logfile";
-      };
-      Service = {
-        Type = "oneshot";
-        ExecStart = ''
-          ${pkgs.logrotate}/bin/logrotate --state ${config.xdg.configHome}/imm/imm.logrotate ${pkgs.writeText "logrotate.conf" ''
-            ${config.xdg.configHome}/imm/imm.log {
-                rotate 5
-                size 1024k
-            }
-          ''}
-        '';
-      };
-    };
-    systemd.user.timers."logrotate-imm" = {
-      Timer = {
-        OnActiveSec = "6h";
-        OnUnitActiveSec = "6h";
-      };
-      Install = {
-        WantedBy = ["default.target"];
-      };
-    };
-  };
-}
diff --git a/user-profiles/mpv/default.nix b/user-profiles/mpv/default.nix
index 94f241c8..8cf330e8 100644
--- a/user-profiles/mpv/default.nix
+++ b/user-profiles/mpv/default.nix
@@ -105,7 +105,8 @@
      };
      config = {
        ytdl = true;
-        ytdl-raw-options = "sub-langs=\"${config.programs.yt-dlp.settings.sub-langs}\"";
+        ytdl-format = "ytdl";
+        # ytdl-raw-options = "sub-langs=\"${config.programs.yt-dlp.settings.sub-langs}\"";
        subs-with-matching-audio = false;
        audio-display = false;
        osd-font = "Fira Sans";
diff --git a/user-profiles/tmux/default.nix b/user-profiles/tmux/default.nix
index 11c53788..7ea0c0d5 100644
--- a/user-profiles/tmux/default.nix
+++ b/user-profiles/tmux/default.nix
@@ -1,10 +1,11 @@
 { userName, pkgs, lib, ... }:
 {
-  home-manager.users.${userName} = {
+  home-manager.users.${userName} = { config, ... }: {
    programs.tmux = {
      enable = true;
      clock24 = true;
      historyLimit = 50000;
+      mouse = true;
      extraConfig = lib.readFile (pkgs.stdenv.mkDerivation {
        name = "tmux.conf";
        src = ./tmux.conf;
@@ -13,11 +14,10 @@
        phases = [ "installPhase" ];
-        inherit (pkgs) zsh;
-        mandb = pkgs.man-db;
-        
        installPhase = ''
-          substituteAll $src $out
+          substitute $src $out \
+            --subst-var-by zsh ${lib.getExe config.programs.zsh.package} \
+            --subst-var-by man ${lib.getExe config.programs.man.package}
        '';
      });
    };
diff --git a/user-profiles/tmux/tmux.conf b/user-profiles/tmux/tmux.conf
index 415d13e7..9e658800 100644
--- a/user-profiles/tmux/tmux.conf
+++ b/user-profiles/tmux/tmux.conf
@@ -1,23 +1,20 @@
-set-option -g history-limit 50000
 set-option -g status-bg black
 set-option -g status-fg white
 set-option -g clock-mode-colour white
-set-option -g clock-mode-style 24
 set-option -g bell-action any
-set-option -g default-shell @zsh@/bin/zsh
+set-option -g default-shell @zsh@
 set-option -g update-environment 'DISPLAY SSH_ASKPASS SSH_AUTH_SOCK SSH_AGENT_PID SSH_CONNECTION WINDOWID XAUTHORITY PROMPT_INFO PATH PGHOST PGLOG'
-set-option -g mouse on
 set-option -g set-clipboard on
 set-option -g terminal-overrides 'rxvt-uni*:XT:Ms=\E]52;%p1%s;%p2%s\007'
 set-environment -g LESS " -R "
 ## determine if we should enable 256-colour support
-if "[[ ''${TERM} =~ 256color || ''${TERM} == fbterm || ''${TERM} =~ alacritty ]]" 'set -g default-terminal tmux-256color'
+if "[[ ''${TERM} =~ 256color || ''${TERM} == fbterm || ''${TERM} =~ alacritty || ''${TERM} =~ kitty ]]" 'set -g default-terminal tmux-256color'
 set-option -g status-right ""
-bind / command-prompt "split-window -h 'exec @mandb@/bin/man %%'"
+bind / command-prompt "split-window -h 'exec @man@ %%'"
 bind C clock-mode
 bind r switch-client -r
diff --git a/user-profiles/utils.nix b/user-profiles/utils.nix
index 13eb6033..edf6da11 100644
--- a/user-profiles/utils.nix
+++ b/user-profiles/utils.nix
@@ -1,19 +1,6 @@
 { userName, lib, pkgs, config, ... }:
 let
  cfg = config.home-manager.users.${userName};
-  wrappedLess = pkgs.less.overrideAttrs (oldAttrs: {
-    pname = "${oldAttrs.pname or "less"}-wrapper";
-    nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ (with pkgs; [makeWrapper]);
-    postInstall = ''
-      ${oldAttrs.postInstall or ""}
-      wrapProgram $out/bin/less \
-        --prefix PATH : ${lib.makeBinPath (with pkgs; [binutils])}
-    '';
-  });
 in {
  home-manager.users.${userName} = {
    programs = {
@@ -55,19 +42,25 @@ in {
      };
      jq.enable = true;
+      lesspipe.enable = true;
+      man.enable = true;
+      vim.enable = true;
    };
    home.sessionVariables = {
-      LESSCOLORIZER = "pygmentize -O style=rrt";
+      LESSCOLORIZER = "${lib.getExe' pkgs.python3Packages.pygments "pygmentize"} -O style=rrt";
    };
    home.packages = with pkgs; [
      autossh usbutils pciutils eza silver-searcher pwgen xkcdpass
-      unzip magic-wormhole qrencode tty-clock dnsutils openssl sshfs
+      unzip magic-wormhole dnsutils openssl sshfs
      psmisc mosh tree vnstat file pv bc zip nmap aspell
      aspellDicts.de aspellDicts.en borgbackup man-pages rsync socat
      inetutils yq cached-nix-shell persistent-nix-shell rage
-      smartmontools hdparm nix-output-monitor wrappedLess dscp
+      smartmontools hdparm nix-output-monitor less dscp
      iputils
    ];
  };
diff --git a/user-profiles/yt-dlp.nix b/user-profiles/yt-dlp.nix
index 9e77f734..eefa673f 100644
--- a/user-profiles/yt-dlp.nix
+++ b/user-profiles/yt-dlp.nix
@@ -7,17 +7,26 @@
        cookies-from-browser = "firefox::none";
        mark-watched = true;
        format = lib.concatStringsSep "/" [
+          "bestvideo*[width<=2560][height<=1440][fps<=60][vcodec!*=av01][width>=1920]+bestaudio"
+          "best[width<=2560][height<=1440][fps<=60][vcodec!*=av01][width>=1920]"
+          "bestvideo*[vcodec!*=av01][width>=1920]+bestaudio"
+          "best[vcodec!*=av01][width>=1920]"
+          "bestvideo*[width<=2560][height<=1440][fps<=60][vcodec!*=av01][height>=1080]+bestaudio"
+          "best[width<=2560][height<=1440][fps<=60][vcodec!*=av01][height>=1080]"
+          "bestvideo*[vcodec!*=av01][height>=1080]+bestaudio"
+          "best[vcodec!*=av01][height>=1080]"
          "bestvideo*[width<=2560][height<=1440][fps<=60]+bestaudio"
          "best[width<=2560][height<=1440][fps<=60]"
          "bestvideo*+bestaudio"
          "best"
        ];
-        embed-subs = true;
+        # embed-subs = true;
+        embed-thumbnail = true;
+        embed-metadata = true;
        # write-subs = true;
-        write-auto-subs = true;
+        # write-auto-subs = true;
-        sub-langs = "en(-(gb|us|orig))?,de(-(de|orig))?,-live_chat,-rechat";
+        # sub-langs = "en(-(gb|us|orig))?,de(-(de|orig))?,-live_chat,-rechat";
        prefer-free-formats = true;
-        embed-metadata = true;
        # downloader = "${pkgs.axel}/bin/axel";
        concurrent-fragments = 12;
        buffer-size = "16K";
@@ -28,7 +37,8 @@
        #   "youtube:formats=dashy"
        # ];
        remux-video = "mp4>mkv";
-        output = "\"%(title)s [%(uploader)s %(webpage_url)s].%(ext)s\"";
+        output = lib.mkDefault "\"%(modified_date>%Y%m%d,release_date>%Y%m%d,upload_date>%Y%m%d)s %(title)s [%(uploader)s %(webpage_url)s].%(ext)s\"";
+        audio-multistreams = true;
      };
    };
  };
diff --git a/user-profiles/zsh/default.nix b/user-profiles/zsh/default.nix
index 428e2459..ab523a52 100644
--- a/user-profiles/zsh/default.nix
+++ b/user-profiles/zsh/default.nix
@@ -1,38 +1,72 @@
 { userName, pkgs, customUtils, lib, config, ... }:
-let
+{
-  dotDir = ".config/zsh";
+  config = {
-  p10kZsh = "${dotDir}/.p10k.zsh";
+    home-manager.users.${userName} = let sysConfig = config; in { config, ... }: {
-  cfg = config.home-manager.users.${userName};
+      config = {
-in {
+        programs.zsh = {
-  home-manager.users.${userName} = {
+          dotDir = ".config/zsh";
-    programs.zsh = {
+          enable = true;
-      inherit dotDir;
+          autocd = true;
-      enable = true;
+          enableCompletion = true;
-      autocd = true;
+          enableVteIntegration = true;
-      enableCompletion = true;
+          history = {
+            append = true;
+            expireDuplicatesFirst = true;
+            extended = true;
+            findNoDups = true;
+          };
+          syntaxHighlighting.enable = true;
+          zsh-abbr = {
+            enable = true;
+            abbreviations = {
+              re = "systemctl restart";
+              ure = "systemctl --user restart";
+              st = "systemctl status";
+              ust = "systemctl --user status";
+            };
+            globalAbbreviations = {
+              "L" = "| less";
+              "S" = "&> /dev/null";
+              "G" = "| grep";
+              "B" = "&> /dev/null &";
+              "BB" = "&> /dev/null &!";
+              "J" = lib.mkIf config.programs.jq.enable "| jq '.'";
+            };
+          };
-      plugins = [
+          plugins = [
-        { name = "powerlevel10k";
+            { name = "powerlevel10k";
-          file = "share/zsh-powerlevel10k/powerlevel10k.zsh-theme";
+              file = "share/zsh-powerlevel10k/powerlevel10k.zsh-theme";
-          src = pkgs.zsh-powerlevel10k;
+              src = pkgs.zsh-powerlevel10k;
-        }
+            }
-      ];
+          ];
-      initExtraFirst = ''
+          initContent = lib.mkMerge [
-        if [[ $TERM == "dumb" ]]; then
+            (lib.mkBefore ''
-          unsetopt zle
+              if [[ $TERM == "dumb" ]]; then
-          PS1='$ '
+                unsetopt zle
-          return
+                PS1='$ '
-        fi
+                return
-      '';
+              fi
-      initExtraBeforeCompInit = ''
+            '')
-        source "${cfg.home.homeDirectory}/${p10kZsh}"
+            (lib.mkOrder 550 ''
-      '';
+              source "$HOME/${config.xdg.configFile."zsh/.p10k.zsh".target}"
-      initExtra = lib.mkAfter ''
+            '')
-        source ${./zshrc}
+            (lib.mkAfter ''
-        source "${pkgs.zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"
+              source ${./zshrc}
-      '';
+            '')
+          ];
+        };
+        xdg.configFile."zsh/.p10k.zsh".source = ./p10k.zsh;
+      };
    };
-    home.file.${p10kZsh}.source = ./p10k.zsh;
+    programs.zsh.enable = true;
+    environment.pathsToLink = [ "/share/zsh" ];
+    environment.shellAliases = lib.mkOverride 90 {};
+    nixpkgs.externalConfig.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+      "zsh-abbr"
+    ];
  };
 }
diff --git a/user-profiles/zsh/zshrc b/user-profiles/zsh/zshrc
index ed614182..af3aca64 100644
--- a/user-profiles/zsh/zshrc
+++ b/user-profiles/zsh/zshrc
@@ -33,9 +33,3 @@ zle -N self-insert url-quote-magic
 zle -N bracketed-paste bracketed-paste-magic
 setopt extended_glob
-alias -g L='| less'
-alias -g S='&> /dev/null'
-alias -g G='| grep'
-alias -g B='&> /dev/null &'
-alias -g BB='&> /dev/null &!'
diff --git a/users/gkleen/default.nix b/users/gkleen/default.nix
index 5cc32521..5ce93de7 100644
--- a/users/gkleen/default.nix
+++ b/users/gkleen/default.nix
@@ -1,7 +1,7 @@
 { flake, userName, pkgs, customUtils, lib, ... }:
 {
  imports = with flake.nixosModules.userProfiles.${userName}; [
-    zsh tmux utils direnv
+    utils direnv
  ];
  users.users.${userName} = {
diff --git a/users/root.nix b/users/root.nix
index b61f9cfd..ed1acd50 100644
--- a/users/root.nix
+++ b/users/root.nix
@@ -3,7 +3,7 @@ let
  haveGKleen = flake.nixosModules.accounts ? "gkleen@${hostName}";
 in {
  imports = with flake.nixosModules.userProfiles.${userName}; [
-    zsh tmux direnv utils
+    direnv utils
  ];
  users.users.${userName} = lib.mkIf haveGKleen {