235 files changed, 9526 insertions, 5895 deletions

diff --git a/.gitignore b/.gitignore
index f30fe710..8d4a68d6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,5 @@
 **/result
 **/result-*
-**/#*#
-**/.#*
 **/.gup
 .direnv
 
diff --git a/.sops.yaml b/.sops.yaml
index 7b0507ee..a65dca8e 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -8,6 +8,12 @@ creation_rules:
   - path_regex: ^hosts/surtr/email/ca
     key_groups:
       - age: [ *admin_gkleen ]
+  - path_regex: ^home-modules/lmu-hausschrift/
+    key_groups:
+      - age: [ *admin_gkleen ]
+  - path_regex: ^accounts/gkleen@sif/
+    key_groups:
+      - age: [ *admin_gkleen ]
   - path_regex: surtr\/?[^\/]*$
     key_groups:
       - age: [ *admin_gkleen, *machine_surtr ]
@@ -26,3 +32,6 @@ creation_rules:
   - path_regex: ^hosts/sif/
     key_groups:
       - age: [ *admin_gkleen, *machine_sif ]
+  - path_regex: ^modules/nix-access-tokens/
+    key_groups:
+      - age: [ *admin_gkleen, *machine_sif, *machine_surtr, *machine_vidhar ]
diff --git a/_sources/generated.json b/_sources/generated.json
index 06346969..62c68113 100644
--- a/_sources/generated.json
+++ b/_sources/generated.json
@@ -20,23 +20,9 @@
         },
         "version": "8ef9a5b73e5d1063cf912c70027c655fb19d1109"
     },
-    "batman-adv": {
-        "cargoLocks": null,
-        "date": null,
-        "extract": null,
-        "name": "batman-adv",
-        "passthru": null,
-        "pinned": false,
-        "src": {
-            "sha256": "sha256-VYyIkH5IFfKN6EOHZxSx6AaepD3a22/hhmLhqkle5Z0=",
-            "type": "tarball",
-            "url": "https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2024.4.tar.gz"
-        },
-        "version": "2024.4"
-    },
     "bpf-examples": {
         "cargoLocks": null,
-        "date": "2024-01-31",
+        "date": "2025-08-18",
         "extract": null,
         "name": "bpf-examples",
         "passthru": null,
@@ -48,12 +34,12 @@
             "name": null,
             "owner": "xdp-project",
             "repo": "bpf-examples",
-            "rev": "5343ed3377471c7b7ef2237526c8bdc0f00a0cef",
-            "sha256": "sha256-vKVI8pQ17BNWLKm8wwpyNkLslnB9E2CAZTS6EP5lDT0=",
+            "rev": "f19bc1a9402b6fb014e3b7114f06ffba5abdf5cc",
+            "sha256": "sha256-syYoC3XOJTUaL/Db0T10mSUak83qAl6Tx2fE6k4XLpI=",
             "sparseCheckout": [],
             "type": "github"
         },
-        "version": "5343ed3377471c7b7ef2237526c8bdc0f00a0cef"
+        "version": "f19bc1a9402b6fb014e3b7114f06ffba5abdf5cc"
     },
     "emacs-scratch_el": {
         "cargoLocks": null,
@@ -90,12 +76,12 @@
             "name": null,
             "owner": "Mange",
             "repo": "emoji-data",
-            "rev": "v2.6",
-            "sha256": "sha256-6nBiT9q139P1pXLqkV1JejE0s2rZn1gUbNsejXJR6RU=",
+            "rev": "v2.7",
+            "sha256": "sha256-bUFh0Q7xcnKTBgVBUJU8BH6zzq1Y3krLfJJAgx5TqKs=",
             "sparseCheckout": [],
             "type": "github"
         },
-        "version": "v2.6"
+        "version": "v2.7"
     },
     "lesspipe": {
         "cargoLocks": null,
@@ -105,11 +91,31 @@
         "passthru": null,
         "pinned": false,
         "src": {
-            "sha256": "sha256-s6oV77sOPYAd8CA51KZK6nydWIh8oK2+SUpPfm7yehg=",
+            "sha256": "sha256-V+fB5KkbBRhVSDgB/e7oVEyMKQ7HbR82XQYlqxcLZyQ=",
             "type": "tarball",
-            "url": "https://github.com/wofr06/lesspipe/archive/refs/tags/v2.16.tar.gz"
+            "url": "https://github.com/wofr06/lesspipe/archive/refs/tags/v2.19.tar.gz"
+        },
+        "version": "2.19"
+    },
+    "mako": {
+        "cargoLocks": null,
+        "date": "2025-04-17",
+        "extract": null,
+        "name": "mako",
+        "passthru": null,
+        "pinned": false,
+        "src": {
+            "deepClone": false,
+            "fetchSubmodules": false,
+            "leaveDotGit": false,
+            "name": null,
+            "rev": "84637d1cb42def0ef74d6ec961e05c3900b4c23f",
+            "sha256": "sha256-5Mv0P/SoUiJIiYvGm5wvNZhtz2ytwsqqRc3Pk3ju0WA=",
+            "sparseCheckout": [],
+            "type": "git",
+            "url": "https://github.com/emersion/mako"
         },
-        "version": "2.16"
+        "version": "84637d1cb42def0ef74d6ec961e05c3900b4c23f"
     },
     "mpv-autosave": {
         "cargoLocks": null,
@@ -196,7 +202,7 @@
     },
     "mpv-reload": {
         "cargoLocks": null,
-        "date": "2024-03-22",
+        "date": "2025-02-07",
         "extract": null,
         "name": "mpv-reload",
         "passthru": null,
@@ -208,16 +214,16 @@
             "name": null,
             "owner": "4e6",
             "repo": "mpv-reload",
-            "rev": "1a6a9383ba1774708fddbd976e7a9b72c3eec938",
-            "sha256": "sha256-BshxCjec/UNGyiC0/g1Rai2NvG2qOIHXDDEUYwwdij0=",
+            "rev": "60e6fb1c578aa9af80d725857dac8e439095b033",
+            "sha256": "sha256-elA9bi5ov5MbehLD1kyS4Z8zKgTc+8dcOPq32muRGcE=",
             "sparseCheckout": [],
             "type": "github"
         },
-        "version": "1a6a9383ba1774708fddbd976e7a9b72c3eec938"
+        "version": "60e6fb1c578aa9af80d725857dac8e439095b033"
     },
     "mpv-subselect": {
         "cargoLocks": null,
-        "date": "2024-08-31",
+        "date": "2025-04-04",
         "extract": null,
         "name": "mpv-subselect",
         "passthru": null,
@@ -227,13 +233,13 @@
             "fetchSubmodules": false,
             "leaveDotGit": false,
             "name": null,
-            "rev": "9b0043ba6042ba01fdd2533281313b70cbc98be4",
-            "sha256": "sha256-ZLWwkwrFaOg7PnuC23VaZ0P3zMhm1JmVf0eH9lqO0BY=",
+            "rev": "26d24a0fd1d69988eaedda6056a2c87d0a55b6cb",
+            "sha256": "sha256-+eVga4b7KIBnfrtmlgq/0HNjQVS3SK6YWVXCPvOeOOc=",
             "sparseCheckout": [],
             "type": "git",
             "url": "https://github.com/CogentRedTester/mpv-sub-select"
         },
-        "version": "9b0043ba6042ba01fdd2533281313b70cbc98be4"
+        "version": "26d24a0fd1d69988eaedda6056a2c87d0a55b6cb"
     },
     "mpv-youtube-quality": {
         "cargoLocks": null,
@@ -255,6 +261,36 @@
         },
         "version": "1f8c31457459ffc28cd1c3f3c2235a53efad7148"
     },
+    "netbootxyz-efi": {
+        "cargoLocks": null,
+        "date": null,
+        "extract": null,
+        "name": "netbootxyz-efi",
+        "passthru": null,
+        "pinned": false,
+        "src": {
+            "name": null,
+            "sha256": "sha256-ipbZJ0mPCuwzb/TDtXXUBTuWOcSsKGAJ1GEGIgB2G7E=",
+            "type": "url",
+            "url": "https://github.com/netbootxyz/netboot.xyz/releases/download/2.0.88/netboot.xyz.efi"
+        },
+        "version": "2.0.88"
+    },
+    "netbootxyz-lkrn": {
+        "cargoLocks": null,
+        "date": null,
+        "extract": null,
+        "name": "netbootxyz-lkrn",
+        "passthru": null,
+        "pinned": false,
+        "src": {
+            "name": null,
+            "sha256": "sha256-igy3O30noS25dU7ZnHuKrWqLLkjjd/L46IdCTd038dI=",
+            "type": "url",
+            "url": "https://github.com/netbootxyz/netboot.xyz/releases/download/2.0.88/netboot.xyz.lkrn"
+        },
+        "version": "2.0.88"
+    },
     "postfix-mta-sts-resolver": {
         "cargoLocks": null,
         "date": null,
@@ -263,11 +299,11 @@
         "passthru": null,
         "pinned": false,
         "src": {
-            "sha256": "sha256-wpBbT/KXd2iU6Jn6Y/6i5C+Wv3OsUTjFcJDhUm6w46I=",
+            "sha256": "sha256-DrPWxAlzdtb5K0Z+yVi+rL1h7CyLj0/Fiio8B2H/Ssg=",
             "type": "tarball",
-            "url": "https://github.com/Snawoot/postfix-mta-sts-resolver/archive/refs/tags/v1.4.0.tar.gz"
+            "url": "https://github.com/Snawoot/postfix-mta-sts-resolver/archive/refs/tags/v1.5.0.tar.gz"
         },
-        "version": "1.4.0"
+        "version": "1.5.0"
     },
     "postfwd": {
         "cargoLocks": null,
@@ -291,11 +327,11 @@
         "passthru": null,
         "pinned": false,
         "src": {
-            "sha256": "sha256-mA84Bnq5JF0BGfqHhcCzTef5nDotLgQuiyg3/zOPqTE=",
+            "sha256": "sha256-JDKt+MzxxyaFWnzuq/7FfT/JPUknH/RRw4Cb8XDOtlk=",
             "type": "tarball",
-            "url": "https://github.com/hansmi/prometheus-lvm-exporter/archive/refs/tags/v0.3.3.tar.gz"
+            "url": "https://github.com/hansmi/prometheus-lvm-exporter/archive/refs/tags/v0.6.0.tar.gz"
         },
-        "version": "0.3.3"
+        "version": "0.6.0"
     },
     "psql-versioning": {
         "cargoLocks": null,
@@ -359,6 +395,26 @@
         },
         "version": "0.2.1"
     },
+    "swayosd": {
+        "cargoLocks": null,
+        "date": "2025-07-07",
+        "extract": null,
+        "name": "swayosd",
+        "passthru": null,
+        "pinned": false,
+        "src": {
+            "deepClone": false,
+            "fetchSubmodules": false,
+            "leaveDotGit": false,
+            "name": null,
+            "rev": "73aed75146b81aaf67c4301353790ff5a17aed1f",
+            "sha256": "sha256-p31HNelptAw7Sk0NmYP4FkoUCdA5uAsrXC20JJp24Vw=",
+            "sparseCheckout": [],
+            "type": "git",
+            "url": "https://github.com/ErikReider/SwayOSD"
+        },
+        "version": "73aed75146b81aaf67c4301353790ff5a17aed1f"
+    },
     "tomorrow-night-paradise-theme": {
         "cargoLocks": null,
         "date": "2012-06-04",
@@ -381,7 +437,7 @@
     },
     "v4l2loopback": {
         "cargoLocks": null,
-        "date": "2024-11-26",
+        "date": "2025-08-18",
         "extract": null,
         "name": "v4l2loopback",
         "passthru": null,
@@ -393,16 +449,16 @@
             "name": null,
             "owner": "umlaeute",
             "repo": "v4l2loopback",
-            "rev": "e750af9eb17d729b8c5257a4bcd2faba2b28029c",
-            "sha256": "sha256-ePA1LcxQInrLLpbZ7Wljv75lWl6V6s9KkdMp0tF1vhk=",
+            "rev": "5eaa59e7c41d0e6f35a6c14c3b756d94d25f58ed",
+            "sha256": "sha256-YcSpNfItvUdPVirlDyGdYuCnVvxHhh780x+OI5VNZmE=",
             "sparseCheckout": [],
             "type": "github"
         },
-        "version": "e750af9eb17d729b8c5257a4bcd2faba2b28029c"
+        "version": "5eaa59e7c41d0e6f35a6c14c3b756d94d25f58ed"
     },
     "xcompose": {
         "cargoLocks": null,
-        "date": "2022-09-14",
+        "date": "2025-06-05",
         "extract": null,
         "name": "xcompose",
         "passthru": null,
@@ -414,12 +470,12 @@
             "name": null,
             "owner": "kragen",
             "repo": "xcompose",
-            "rev": "cd8d3e622f547ec9f83d7f64f51d4a27ee812681",
-            "sha256": "sha256-fkl2lDv/DdrqPjVsEUKSRD3BNGwTjTsA0ovI8akFI6U=",
+            "rev": "4d8eab4d05a19537ce79294ae0459fdae78ffb20",
+            "sha256": "sha256-vKY4u5Z2IL111orLLkkF4AoVzqluKG/VQhNUUCqO/k8=",
             "sparseCheckout": [],
             "type": "github"
         },
-        "version": "cd8d3e622f547ec9f83d7f64f51d4a27ee812681"
+        "version": "4d8eab4d05a19537ce79294ae0459fdae78ffb20"
     },
     "yt-dlp": {
         "cargoLocks": null,
@@ -430,10 +486,10 @@
         "pinned": false,
         "src": {
             "name": null,
-            "sha256": "sha256-dD2+CB6ocb4/X/CD4s2V2oZt6nc/xwrmsQmDjPv3KsQ=",
+            "sha256": "sha256-2oc7z0JBd6tcO3AfqU6kzawXvzrsXvN7kfUwyQ3ve88=",
             "type": "url",
-            "url": "https://pypi.org/packages/source/y/yt_dlp/yt_dlp-2024.12.6.tar.gz"
+            "url": "https://pypi.org/packages/source/y/yt_dlp/yt_dlp-2025.8.20.tar.gz"
         },
-        "version": "2024.12.6"
+        "version": "2025.8.20"
     }
 }
\ No newline at end of file
diff --git a/_sources/generated.nix b/_sources/generated.nix
index b07979a7..4368c98a 100644
--- a/_sources/generated.nix
+++ b/_sources/generated.nix
@@ -16,25 +16,17 @@
     };
     date = "2021-05-30";
   };
-  batman-adv = {
-    pname = "batman-adv";
-    version = "2024.4";
-    src = fetchTarball {
-      url = "https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-2024.4.tar.gz";
-      sha256 = "sha256-VYyIkH5IFfKN6EOHZxSx6AaepD3a22/hhmLhqkle5Z0=";
-    };
-  };
   bpf-examples = {
     pname = "bpf-examples";
-    version = "5343ed3377471c7b7ef2237526c8bdc0f00a0cef";
+    version = "f19bc1a9402b6fb014e3b7114f06ffba5abdf5cc";
     src = fetchFromGitHub {
       owner = "xdp-project";
       repo = "bpf-examples";
-      rev = "5343ed3377471c7b7ef2237526c8bdc0f00a0cef";
+      rev = "f19bc1a9402b6fb014e3b7114f06ffba5abdf5cc";
       fetchSubmodules = true;
-      sha256 = "sha256-vKVI8pQ17BNWLKm8wwpyNkLslnB9E2CAZTS6EP5lDT0=";
+      sha256 = "sha256-syYoC3XOJTUaL/Db0T10mSUak83qAl6Tx2fE6k4XLpI=";
     };
-    date = "2024-01-31";
+    date = "2025-08-18";
   };
   emacs-scratch_el = {
     pname = "emacs-scratch_el";
@@ -50,22 +42,36 @@
   };
   emoji-data = {
     pname = "emoji-data";
-    version = "v2.6";
+    version = "v2.7";
     src = fetchFromGitHub {
       owner = "Mange";
       repo = "emoji-data";
-      rev = "v2.6";
+      rev = "v2.7";
       fetchSubmodules = true;
-      sha256 = "sha256-6nBiT9q139P1pXLqkV1JejE0s2rZn1gUbNsejXJR6RU=";
+      sha256 = "sha256-bUFh0Q7xcnKTBgVBUJU8BH6zzq1Y3krLfJJAgx5TqKs=";
     };
   };
   lesspipe = {
     pname = "lesspipe";
-    version = "2.16";
+    version = "2.19";
     src = fetchTarball {
-      url = "https://github.com/wofr06/lesspipe/archive/refs/tags/v2.16.tar.gz";
-      sha256 = "sha256-s6oV77sOPYAd8CA51KZK6nydWIh8oK2+SUpPfm7yehg=";
+      url = "https://github.com/wofr06/lesspipe/archive/refs/tags/v2.19.tar.gz";
+      sha256 = "sha256-V+fB5KkbBRhVSDgB/e7oVEyMKQ7HbR82XQYlqxcLZyQ=";
+    };
+  };
+  mako = {
+    pname = "mako";
+    version = "84637d1cb42def0ef74d6ec961e05c3900b4c23f";
+    src = fetchgit {
+      url = "https://github.com/emersion/mako";
+      rev = "84637d1cb42def0ef74d6ec961e05c3900b4c23f";
+      fetchSubmodules = false;
+      deepClone = false;
+      leaveDotGit = false;
+      sparseCheckout = [ ];
+      sha256 = "sha256-5Mv0P/SoUiJIiYvGm5wvNZhtz2ytwsqqRc3Pk3ju0WA=";
     };
+    date = "2025-04-17";
   };
   mpv-autosave = {
     pname = "mpv-autosave";
@@ -118,29 +124,29 @@
   };
   mpv-reload = {
     pname = "mpv-reload";
-    version = "1a6a9383ba1774708fddbd976e7a9b72c3eec938";
+    version = "60e6fb1c578aa9af80d725857dac8e439095b033";
     src = fetchFromGitHub {
       owner = "4e6";
       repo = "mpv-reload";
-      rev = "1a6a9383ba1774708fddbd976e7a9b72c3eec938";
+      rev = "60e6fb1c578aa9af80d725857dac8e439095b033";
       fetchSubmodules = false;
-      sha256 = "sha256-BshxCjec/UNGyiC0/g1Rai2NvG2qOIHXDDEUYwwdij0=";
+      sha256 = "sha256-elA9bi5ov5MbehLD1kyS4Z8zKgTc+8dcOPq32muRGcE=";
     };
-    date = "2024-03-22";
+    date = "2025-02-07";
   };
   mpv-subselect = {
     pname = "mpv-subselect";
-    version = "9b0043ba6042ba01fdd2533281313b70cbc98be4";
+    version = "26d24a0fd1d69988eaedda6056a2c87d0a55b6cb";
     src = fetchgit {
       url = "https://github.com/CogentRedTester/mpv-sub-select";
-      rev = "9b0043ba6042ba01fdd2533281313b70cbc98be4";
+      rev = "26d24a0fd1d69988eaedda6056a2c87d0a55b6cb";
       fetchSubmodules = false;
       deepClone = false;
       leaveDotGit = false;
       sparseCheckout = [ ];
-      sha256 = "sha256-ZLWwkwrFaOg7PnuC23VaZ0P3zMhm1JmVf0eH9lqO0BY=";
+      sha256 = "sha256-+eVga4b7KIBnfrtmlgq/0HNjQVS3SK6YWVXCPvOeOOc=";
     };
-    date = "2024-08-31";
+    date = "2025-04-04";
   };
   mpv-youtube-quality = {
     pname = "mpv-youtube-quality";
@@ -156,12 +162,28 @@
     };
     date = "2020-02-10";
   };
+  netbootxyz-efi = {
+    pname = "netbootxyz-efi";
+    version = "2.0.88";
+    src = fetchurl {
+      url = "https://github.com/netbootxyz/netboot.xyz/releases/download/2.0.88/netboot.xyz.efi";
+      sha256 = "sha256-ipbZJ0mPCuwzb/TDtXXUBTuWOcSsKGAJ1GEGIgB2G7E=";
+    };
+  };
+  netbootxyz-lkrn = {
+    pname = "netbootxyz-lkrn";
+    version = "2.0.88";
+    src = fetchurl {
+      url = "https://github.com/netbootxyz/netboot.xyz/releases/download/2.0.88/netboot.xyz.lkrn";
+      sha256 = "sha256-igy3O30noS25dU7ZnHuKrWqLLkjjd/L46IdCTd038dI=";
+    };
+  };
   postfix-mta-sts-resolver = {
     pname = "postfix-mta-sts-resolver";
-    version = "1.4.0";
+    version = "1.5.0";
     src = fetchTarball {
-      url = "https://github.com/Snawoot/postfix-mta-sts-resolver/archive/refs/tags/v1.4.0.tar.gz";
-      sha256 = "sha256-wpBbT/KXd2iU6Jn6Y/6i5C+Wv3OsUTjFcJDhUm6w46I=";
+      url = "https://github.com/Snawoot/postfix-mta-sts-resolver/archive/refs/tags/v1.5.0.tar.gz";
+      sha256 = "sha256-DrPWxAlzdtb5K0Z+yVi+rL1h7CyLj0/Fiio8B2H/Ssg=";
     };
   };
   postfwd = {
@@ -174,10 +196,10 @@
   };
   prometheus-lvm-exporter = {
     pname = "prometheus-lvm-exporter";
-    version = "0.3.3";
+    version = "0.6.0";
     src = fetchTarball {
-      url = "https://github.com/hansmi/prometheus-lvm-exporter/archive/refs/tags/v0.3.3.tar.gz";
-      sha256 = "sha256-mA84Bnq5JF0BGfqHhcCzTef5nDotLgQuiyg3/zOPqTE=";
+      url = "https://github.com/hansmi/prometheus-lvm-exporter/archive/refs/tags/v0.6.0.tar.gz";
+      sha256 = "sha256-JDKt+MzxxyaFWnzuq/7FfT/JPUknH/RRw4Cb8XDOtlk=";
     };
   };
   psql-versioning = {
@@ -218,6 +240,20 @@
       sha256 = "sha256-7d/0fepOvdswuBGJCCMULB2kXOFBLP78yqX4NmByCF8=";
     };
   };
+  swayosd = {
+    pname = "swayosd";
+    version = "73aed75146b81aaf67c4301353790ff5a17aed1f";
+    src = fetchgit {
+      url = "https://github.com/ErikReider/SwayOSD";
+      rev = "73aed75146b81aaf67c4301353790ff5a17aed1f";
+      fetchSubmodules = false;
+      deepClone = false;
+      leaveDotGit = false;
+      sparseCheckout = [ ];
+      sha256 = "sha256-p31HNelptAw7Sk0NmYP4FkoUCdA5uAsrXC20JJp24Vw=";
+    };
+    date = "2025-07-07";
+  };
   tomorrow-night-paradise-theme = {
     pname = "tomorrow-night-paradise-theme";
     version = "70225a5bf90d495e13a9260bfdc268632ece0801";
@@ -234,34 +270,34 @@
   };
   v4l2loopback = {
     pname = "v4l2loopback";
-    version = "e750af9eb17d729b8c5257a4bcd2faba2b28029c";
+    version = "5eaa59e7c41d0e6f35a6c14c3b756d94d25f58ed";
     src = fetchFromGitHub {
       owner = "umlaeute";
       repo = "v4l2loopback";
-      rev = "e750af9eb17d729b8c5257a4bcd2faba2b28029c";
+      rev = "5eaa59e7c41d0e6f35a6c14c3b756d94d25f58ed";
       fetchSubmodules = true;
-      sha256 = "sha256-ePA1LcxQInrLLpbZ7Wljv75lWl6V6s9KkdMp0tF1vhk=";
+      sha256 = "sha256-YcSpNfItvUdPVirlDyGdYuCnVvxHhh780x+OI5VNZmE=";
     };
-    date = "2024-11-26";
+    date = "2025-08-18";
   };
   xcompose = {
     pname = "xcompose";
-    version = "cd8d3e622f547ec9f83d7f64f51d4a27ee812681";
+    version = "4d8eab4d05a19537ce79294ae0459fdae78ffb20";
     src = fetchFromGitHub {
       owner = "kragen";
       repo = "xcompose";
-      rev = "cd8d3e622f547ec9f83d7f64f51d4a27ee812681";
+      rev = "4d8eab4d05a19537ce79294ae0459fdae78ffb20";
       fetchSubmodules = false;
-      sha256 = "sha256-fkl2lDv/DdrqPjVsEUKSRD3BNGwTjTsA0ovI8akFI6U=";
+      sha256 = "sha256-vKY4u5Z2IL111orLLkkF4AoVzqluKG/VQhNUUCqO/k8=";
     };
-    date = "2022-09-14";
+    date = "2025-06-05";
   };
   yt-dlp = {
     pname = "yt-dlp";
-    version = "2024.12.6";
+    version = "2025.8.20";
     src = fetchurl {
-      url = "https://pypi.org/packages/source/y/yt_dlp/yt_dlp-2024.12.6.tar.gz";
-      sha256 = "sha256-dD2+CB6ocb4/X/CD4s2V2oZt6nc/xwrmsQmDjPv3KsQ=";
+      url = "https://pypi.org/packages/source/y/yt_dlp/yt_dlp-2025.8.20.tar.gz";
+      sha256 = "sha256-2oc7z0JBd6tcO3AfqU6kzawXvzrsXvN7kfUwyQ3ve88=";
     };
   };
 }
diff --git a/accounts/gkleen@eostre.nix b/accounts/gkleen@eostre.nix
index 72818d44..28daf3fd 100644
--- a/accounts/gkleen@eostre.nix
+++ b/accounts/gkleen@eostre.nix
@@ -1,16 +1,16 @@
 { flake, userName, pkgs, ... }:
 {
   imports = with flake.nixosModules.userProfiles.${userName}; [
-    zsh utils tmux
+    utils
   ];
 
   config = {
     home-manager.users.${userName} = {
       home.stateVersion = "20.09";
 
-      nixpkgs.config = {
-        allowUnfree = true;
-      };
+      # nixpkgs.config = {
+      #   allowUnfree = true;
+      # };
 
       home.packages = with pkgs; [
         thunderbird libreoffice element-desktop keepassxc vlc
diff --git a/accounts/gkleen@installer.nix b/accounts/gkleen@installer.nix
index c7a418f8..5fe1db38 100644
--- a/accounts/gkleen@installer.nix
+++ b/accounts/gkleen@installer.nix
@@ -1,7 +1,11 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 
 {
-  home-manager.users.${userName} = { config, ... } : {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName} = { config, ... } : {
     home.stateVersion = config.home.version.release;
   };
 }
diff --git a/accounts/gkleen@sif/default.nix b/accounts/gkleen@sif/default.nix
index f2df467a..64434bb8 100644
--- a/accounts/gkleen@sif/default.nix
+++ b/accounts/gkleen@sif/default.nix
@@ -4,33 +4,6 @@ with lib;
 
 let
   cfg = config.home-manager.users.${userName};
-  emacsScratch = pkgs.stdenv.mkDerivation (sources.emacs-scratch_el // rec {
-    phases = [ "installPhase" ];
-
-    installPhase = ''
-      mkdir -p $out/share/emacs/site-lisp
-      cp $src/scratch.el $out/share/emacs/site-lisp/default.el
-    '';
-  });
-  muteScript = pkgs.stdenv.mkDerivation {
-    name = "mute";
-    src = ./scripts/mute.zsh;
-
-    buildInputs = with pkgs; [ makeWrapper ];
-
-    phases = [ "installPhase" ];
-
-    installPhase = ''
-      mkdir -p $out/bin
-      install -m 0755 $src $out/bin/mute
-      wrapProgram $out/bin/mute \
-        --prefix PATH : ${pkgs.zsh}/bin \
-        --prefix PATH : ${pkgs.findutils}/bin \
-        --prefix PATH : ${pkgs.util-linux}/bin \
-        --prefix PATH : ${pkgs.coreutils}/bin \
-        --prefix PATH : ${pkgs.pulseaudio}/bin
-    '';
-  };
   wrapElectron = { package, bin ? package.meta.mainProgram or package.pname or (pkgs.lib.strings.nameFromURL package.name "-"), outBin ? bin, sandbox ? true }: pkgs.symlinkJoin {
     name = "${package.name}-wrapped";
     buildInputs = with pkgs; [ makeWrapper ];
@@ -47,10 +20,6 @@ let
     '';
   };
 
-  wrappedChrome = wrapElectron { package = pkgs.google-chrome; outBin = "google-chrome"; };
-  wrappedZulip = wrapElectron { package = pkgs.zulip; bin = "zulip"; outBin = "zulip"; };
-  wrappedElementDesktop = wrapElectron { package = pkgs.element-desktop; bin = "element-desktop"; };
-  wrappedRocketChatDesktop = wrapElectron { package = pkgs.rocketchat-desktop; bin = "rocketchat-desktop"; outBin = "rocketchat"; };
   wrappedYTMDesktop = wrapElectron { package = pkgs.ytmdesktop; sandbox = false; };
 
   wrappedKeepassxc = pkgs.symlinkJoin {
@@ -63,7 +32,7 @@ let
         text = ''
           [D-BUS Service]
           Name=org.keepassxc.KeePassXC.MainWindow
-          Exec=${pkgs.coreutils}/bin/false
+          Exec=${lib.getExe' pkgs.coreutils "false"}
           SystemdService=keepassxc.service
         '';
       })
@@ -73,35 +42,46 @@ let
         text = ''
           [D-BUS Service]
           Name=org.freedesktop.secrets
-          Exec=${pkgs.coreutils}/bin/false
+          Exec=${lib.getExe' pkgs.coreutils "false"}
           SystemdService=keepassxc.service
         '';
       })
     ];
   };
 
-  lockCommand = "${config.systemd.package}/bin/systemctl --user start gtklock.service";
+  lockCommand = "${lib.getExe' config.systemd.package "systemctl"} --user start gtklock.service";
+
+  editor = pkgs.symlinkJoin {
+    inherit (cfg.services.emacs.package) name;
+    buildInputs = with pkgs; [ makeWrapper ];
+    paths = [ cfg.services.emacs.package ];
+    postBuild = ''
+      wrapProgram $out/bin/emacsclient \
+        --inherit-argv0 \
+        --add-flags ${lib.escapeShellArg (lib.escapeShellArgs cfg.services.emacs.client.arguments)}
+    '';
+  };
 in {
   imports = with flake.nixosModules.userProfiles.${userName}; [
-    mpv yt-dlp (args: import ./xcompose.nix (inputs // args))
+    zsh tmux mpv yt-dlp (args: import ./xcompose.nix (inputs // args))
   ];
 
   config = {
-    services.displayManager.defaultSession = "Hyprland"; # "none+xmonad";
-
     home-manager.users.${userName} = {
       imports = [
         ./libvirt
-        flakeInputs.nix-index-database.hmModules.nix-index
+        ./niri
+        ./synadm
+        flakeInputs.nix-index-database.homeModules.nix-index
         flakeInputs.impermanence.nixosModules.home-manager.impermanence
       ];
 
       home.stateVersion = "20.09";
 
-      nixpkgs.config = {
-        allowUnfree = true;
-        zathura.useMupdf = false;
-      };
+      # nixpkgs.config = {
+      #   allowUnfree = true;
+      #   zathura.useMupdf = false;
+      # };
 
       nix.registry = {
         "flk" = {
@@ -111,14 +91,14 @@ in {
           };
           to = {
             type = "git";
-            url = "file:///home/gkleen/config/nixos-flakes";
+            url = "file:///home/gkleen/projects/machines";
           };
         };
       };
 
       programs = {
         ssh = {
-          matchBlocks = import ./ssh-hosts.nix { inherit pkgs; }; # customUtils.nixImport { dir = ./ssh-hosts; };
+          matchBlocks = import ./ssh-hosts.nix inputs; # customUtils.nixImport { dir = ./ssh-hosts; };
           extraConfig = ''
             Match host uniworx3.ifi.lmu.de,uniworx4.ifi.lmu.de,uniworx5.ifi.lmu.de,uni2workgw.ifi.lmu.de,blackbeard.tcs.ifi.lmu.de,gitlab2.rz.ifi.lmu.de,oregon.tcs.ifi.lmu.de !exec "nc -z -w 1 %h %p &>/dev/null"
               ProxyJump remote.cip.ifi.lmu.de
@@ -136,8 +116,8 @@ in {
               ''}
 
             Match host *.mathinst.loc,*.math.lmu.de !host ssh.math.lmu.de !exec "nc -z -w 1 %h %p &>/dev/null"
-              # ProxyCommand ${pkgs.socat}/bin/socat - SOCKS4A:127.0.0.1:%h:%p,socksport=8118
-              ProxyJump ssh.math.lmu.de
+              ProxyCommand ${lib.getExe pkgs.socat} - SOCKS4A:127.0.0.1:%h:%p,socksport=8118
+              # ProxyJump ssh.math.lmu.de
 
             Match host *.cipmath.loc !host cip04.cipmath.loc,mgmt-cls01.cipmath.loc !exec "nc -z -w 1 %h %p &>/dev/null"
               ProxyJump cip04
@@ -154,22 +134,31 @@ in {
 
         emacs = {
           enable = true;
-                package = pkgs.emacs29-pgtk;
+                package = pkgs.emacs-pgtk;
           extraPackages = epkgs: with epkgs; [
             evil evil-dvorak undo-tree magit haskell-tng-mode nix-mode
             yaml-mode json-mode shakespeare-mode smart-mode-line
-            highlight-parentheses highlight-symbol ag sass-mode lua-mode
-            fira-code-mode use-package wanderlust # notmuch
-            use-package-ensure-system-package git-gutter emacsScratch
-            edit-server mediawiki editorconfig typescript-mode
-            markdown-mode nftables-mode rustic lsp-mode lsp-ui
-            direnv company projectile tomorrow-night-paradise-theme
+            highlight-parentheses highlight-symbol ag sass-mode
+            lua-mode fira-code-mode use-package wanderlust # notmuch
+            git-gutter scratch edit-server mediawiki editorconfig
+            typescript-mode markdown-mode nftables-mode rustic
+            lsp-mode lsp-ui direnv company projectile
+            tomorrow-night-paradise-theme
             treesit-grammars.with-all-grammars magit-delta scad-mode
           ];
           overrides = self: super: {
             tomorrow-night-paradise-theme = super.trivialBuild {
               inherit (sources.tomorrow-night-paradise-theme) pname version src;
             };
+            scratch = pkgs.stdenv.mkDerivation {
+              inherit (sources.emacs-scratch_el) pname version src;
+
+              phases = [ "unpackPhase" "installPhase" ];
+
+              installPhase = ''
+                install -Dt $out/share/emacs/site-lisp scratch.el
+              '';
+            };
           };
         };
         firefox = {
@@ -183,8 +172,14 @@ in {
             };
           };
         };
+        chromium.enable = true;
 
-        zathura.enable = true;
+        zathura = {
+          enable = true;
+          options = {
+            scroll-page-aware = true;
+          };
+        };
         imv.enable = true;
 
         mpv.config = {
@@ -193,13 +188,93 @@ in {
           gpu-api = "vulkan";
         };
 
-        zsh.initExtra = ''
-          source ${./zshrc}
+        zsh.initContent = let
+          zshrc = pkgs.resholve.mkDerivation {
+            pname = "zshrc";
+            version = "0.0.0";
+
+            src = ./zshrc;
+
+            dontUnpack = true;
+            dontConfigure = true;
+            dontBuild = true;
+
+            installPhase = ''
+              mkdir -p $out/share
+              install "$src" $out/share/zshrc
+            '';
+
+            solutions = {
+              default = {
+                scripts = [ "share/zshrc" ];
+                interpreter = "none";
+                inputs = with pkgs; [
+                  coreutils
+                  rpm
+                  binutils
+                  squashfsTools
+                  unzip
+                  cfg.programs.git.package
+                  magickWrapped
+                  curl
+                  file
+                  gnutar
+                  cpio
+                  magic-wormhole
+                  cfg.programs.zsh.package
+                  fuse
+                  util-linux
+                  findutils
+                  qrencode
+                  tty-clock
+                  cfg.programs.jq.package
+                  eza
+                  less
+                  config.systemd.package
+                  config.programs.ssh.package
+                  gnused
+                  miniserve
+                  p7zip
+                ];
+                execer = with pkgs; [
+                  "cannot:${lib.getExe' rpm "rpm2cpio"}"
+                  "cannot:${lib.getExe' squashfsTools "unsquashfs"}"
+                  "cannot:${lib.getExe' unzip "unzip"}"
+                  "cannot:${lib.getExe cfg.programs.git.package}"
+                  "cannot:${lib.getExe cpio}"
+                  "cannot:${lib.getExe' magic-wormhole "wormhole"}"
+                  "cannot:${lib.getExe' fuse "fusermount"}"
+                  "cannot:${lib.getExe less}"
+                  "cannot:${lib.getExe' config.systemd.package "systemctl"}"
+                  "cannot:${lib.getExe config.programs.ssh.package}"
+                  "cannot:${lib.getExe' p7zip "7z"}"
+                ];
+                wrapper = with pkgs; [
+                  "${lib.getExe' magickWrapped "magick"}:${lib.getExe' imagemagick "magick"}"
+                ];
+                fake = {
+                  builtin = ["print"];
+                  external = ["sudo" "umount"];
+                };
+              };
+            };
+          };
+          magickWrapped = pkgs.symlinkJoin {
+            inherit (pkgs.imagemagick) name;
+            paths = [ pkgs.imagemagick ];
+
+            buildInputs = with pkgs; [ makeWrapper ];
+            postBuild = ''
+              wrapProgram $out/bin/magick \
+                --prefix PATH : ${lib.makeBinPath (with pkgs; [ ghostscript ])}
+            '';
+          };
+        in ''
+          source ${zshrc}/share/zshrc
         '';
         zsh.dirHashes = let
           flakeHashes = mapAttrs' (n: v: nameValuePair (inputNames.${n} or n) (toString v)) flakeInputs;
           inputNames = {
-            "nixpkgs" = "nixos";
           };
         in flakeHashes // {
           u2w = "$HOME/projects/uni2work";
@@ -209,6 +284,17 @@ in {
           flk = "$HOME/projects/machines";
           rz = "$HOME/projects/rz";
           pro = "$HOME/projects/pro";
+          media = "$HOME/media";
+        };
+        jq.colors = {
+          arrays = "1;37";
+          "false" = "0;37";
+          "null" = "2;37";
+          numbers = "0;37";
+          objectKeys = "1;34";
+          objects = "1;37";
+          strings = "0;32";
+          "true" = "0;37";
         };
 
         obs-studio = {
@@ -219,7 +305,7 @@ in {
         gh = {
           enable = true;
           settings = {
-            editor = "${config.home-manager.users.${userName}.programs.emacs.package}/bin/emacsclient";
+            editor = lib.getExe' editor "emacsclient";
             gitProtocol = "ssh";
           };
         };
@@ -227,7 +313,7 @@ in {
         kitty = {
           enable = true;
           font = {
-            package = pkgs.fira;
+            package = pkgs.nerd-fonts.fira-mono;
             name = "Fira Mono";
             size = 10;
           };
@@ -245,309 +331,23 @@ in {
             # notify_on_cmd_finish = "invisible 120";
           };
           keybindings = {
-            "kitty_mod+n" = "detach_window";
+            "kitty_mod+n" = "new_os_window_with_cwd";
             "kitty_mod+m" = "detach_window ask";
-          };
-        };
-        waybar = {
-                enable = true;
-          systemd = {
-                  enable = true;
-            target = "hyprland-session.target";
-          };
-                settings = let
-            windowRewrites = {
-              "(.*) — Mozilla Firefox" = "$1";
-              "(.*) - Mozilla Thunderbird" = "$1";
-              "(.*) - mpv" = "$1";
-            };
-            iconSize = 11;
-          in [
-            {
-              layer = "top";
-              position = "top";
-              height = 14;
-              output = [ "eDP-1" "DP-2" "DP-3" ];
-              modules-left = [ "hyprland/workspaces" ];
-              modules-center = [ "hyprland/window" ];
-              modules-right = [ "custom/worktime" "custom/worktime-today" "custom/weather" "custom/keymap" "privacy" "tray" "wireplumber" "backlight" "battery" "idle_inhibitor" "clock" ];
-
-              "custom/weather" = {
-                format = "{}";
-                tooltip = true;
-                interval = 3600;
-                exec = "${lib.getExe pkgs.wttrbar} --hide-conditions --custom-indicator \"<span font=\\\"Symbols Nerd Font Mono\\\" size=\\\"120%\\\">{ICON}</span> {FeelsLikeC}°\"";
-                return-type = "json";
-              };
-              "custom/keymap" = {
-                format = "{}";
-                tooltip = true;
-                return-type = "json";
-                exec = pkgs.writers.writePython3 "keymap" {} ''
-                  import os
-                  import socket
-                  import re
-                  import subprocess
-                  import json
-
-
-                  def output(keymap):
-                      short = keymap
-                      if keymap == "English (programmer Dvorak)":
-                          short = "dvp"
-                      elif keymap == "English (US)":
-                          short = "<span color=\"#ffffff\">us</span>"
-                      print(json.dumps({'text': short, 'tooltip': keymap}, separators=(',', ':')), flush=True)  # noqa: E501
-
-
-                  r = subprocess.run(["hyprctl", "devices", "-j"], check=True, stdout=subprocess.PIPE, text=True)  # noqa: E501
-                  for keyboard in json.loads(r.stdout)['keyboards']:
-                      if keyboard['name'] != "at-translated-set-2-keyboard":
-                          continue
-                      output(keyboard['active_keymap'])
-
-                  sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-                  sock.connect(os.environ["XDG_RUNTIME_DIR"] + "/hypr/" + os.environ["HYPRLAND_INSTANCE_SIGNATURE"] + "/.socket2.sock")  # noqa: E501
-                  expected = re.compile(r'^activelayout>>at-translated-set-2-keyboard,(?P<keymap>.+)$')  # noqa: E501
-                  for line in sock.makefile(buffering=1, encoding='utf-8'):
-                      if match := expected.match(line):
-                          output(match.group("keymap"))
-                '';
-                on-click = "hyprctl switchxkblayout at-translated-set-2-keyboard next";
-              };
-              "custom/worktime" = {
-                interval = 60;
-                exec = getExe pkgs.worktime;
-                tooltip = false;
-              };
-              "custom/worktime-today" = {
-                interval = 60;
-                exec = "${getExe pkgs.worktime} today";
-                tooltip = false;
-              };
-              "hyprland/workspaces" = {
-                all-outputs = true;
-              };
-              "hyprland/window" = {
-                separate-outputs = true;
-                icon = true;
-                icon-size = 14;
-                rewrite = windowRewrites;
-              };
-              clock = {
-                  interval = 1;
-                  # timezone = "Europe/Berlin";
-                  format = "W{:%V-%u %F %H:%M:%S%Ez}";
-                  tooltip-format = "<tt><small>{calendar}</small></tt>";
-                  calendar = {
-                    mode = "year";
-                    mode-mon-col = 3;
-                    weeks-pos = "left";
-                    on-scroll = 1;
-                    format = {
-                      months = "<span color='#ffead3'><b>{}</b></span>";
-                      days = "{}";
-                      weeks = "<span color='#99ffdd'><b>{}</b></span>";
-                      weekdays = "<span color='#ffcc66'><b>{}</b></span>";
-                      today = "<span color='#ff6699'><b>{}</b></span>";
-                    };
-                  };
-              };
-              battery = {
-                format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
-                icon-size = iconSize - 2;
-                states = { warning = 30; critical = 15; };
-                format-icons = ["&#xf008e;" "&#xf007a;" "&#xf007b;" "&#xf007c;" "&#xf007d;" "&#xf007e;" "&#xf007f;" "&#xf0080;" "&#xf0081;" "&#xf0082;" "&#xf0079;" ];
-                format-charging = "&#xf0084;";
-                format-plugged = "&#xf06a5;";
-                tooltip-format = "{capacity}% {timeTo}";
-                interval = 20;
-              };
-              tray = {
-                icon-size = 16;
-                # show-passive-items = true;
-                spacing = 1;
-              };
-              privacy = {
-                icon-spacing = 7;
-                icon-size = iconSize;
-                modules = [
-                  { type = "screenshare"; }
-                  { type = "audio-in"; }
-                ];
-              };
-              idle_inhibitor = {
-                format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
-                icon-size = iconSize;
-                format-icons = { activated = "&#xf0208;"; deactivated = "&#xf0209;"; };
-                timeout = 120;
-              };
-              backlight = {
-                format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
-                icon-size = iconSize;
-                tooltip-format = "{percent}%";
-                format-icons = ["&#xf00da;" "&#xf00db;" "&#xf00dc;" "&#xf00dd;" "&#xf00de;" "&#xf00df;" "&#xf00e0;"];
-                on-scroll-up = "lightctl -d -e4 -n1 up";
-                on-scroll-down = "lightctl -d -e4 -n1 down";
-              };
-              wireplumber = {
-                format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
-                icon-size = iconSize;
-                tooltip-format = "{volume}% {node_name}";
-                format-icons = ["&#xf057f;" "&#xf0580;" "&#xf057e;"];
-                format-muted = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">&#xf075f;</span>";
-                # ignored-sinks = ["Easy Effects Sink"];
-                on-scroll-up = "volumectl -d -u up";
-                on-scroll-down = "volumectl -d -u down";
-                on-click = "volumectl -d toggle-mute";
-              };
-            }
-            {
-              layer = "top";
-              position = "top";
-              height = 14;
-              output = [ "!eDP-1" "!DP-2" "!DP-3" ];
-              modules-left = [ "hyprland/workspaces" ];
-              modules-center = [ "hyprland/window" ];
-              modules-right = [ "clock" ];
-
-              "hyprland/workspaces" = {
-                all-outputs = false;
-              };
-              "hyprland/window" = {
-                separate-outputs = true;
-                icon = true;
-                icon-size = 14;
-                rewrite = windowRewrites;
-              };
-              clock = {
-                  interval = 1;
-                  # timezone = "Europe/Berlin";
-                  format = "{:%H:%M}";
-                  tooltip-format = "W{:%V-%u %F %H:%M:%S%Ez}";
-              };
-            }
-          ];
-          style = ''
-            @define-color white #ffffff;
-            @define-color grey #555555;
-            @define-color blue #1a8fff;
-            @define-color green #23fd00;
-            @define-color orange #f28a21;
-            @define-color red #f2201f;
-
-            * {
-              border: none;
-              font-family: "Fira Sans Nerd Font";
-              font-size: 10pt;
-              min-height: 0;
-            }
-
-            window#waybar {
-              background-color: rgba(0, 0, 0, 0.66);
-              color: @white;
-            }
-
-            .modules-left {
-              margin-left: 9px;
-            }
-            .modules-right {
-              margin-right: 9px;
-            }
-
-            .module {
-              margin: 0 5px;
-            }
-
-            #workspaces button {
-              color: @grey;
-            }
-            #workspaces button.hosting-monitor {
-              color: @white;
-            }
-            #workspaces button.visible {
-              color: @blue;
-            }
-            #workspaces button.active {
-              color: @green;
-            }
-            #workspaces button.urgent {
-              color: @red;
-            }
-
-            #custom-weather, #custom-keymap, #custom-worktime, #custom-worktime-today {
-              color: @grey;
-              margin: 0 5px;
-            }
-            #custom-weather, #custom-worktime-today {
-              margin-right: 3px;
-            }
-            #custom-keymap, #custom-weather {
-              margin-left: 3px;
-            }
-
-            #tray {
-              margin: 0;
-            }
-            #battery, #idle_inhibitor, #backlight, #wireplumber {
-              color: @grey;
-              margin: 0 5px 0 2px;
-            }
-            #idle_inhibitor {
-              margin-right: 2px;
-              margin-left: 3px;
-            }
-            #battery {
-              margin-right: 3px;
-            }
-            #battery.discharging {
-              color: @white;
-            }
-            #battery.warning {
-              color: @orange;
-            }
-            #battery.critical {
-              color: @red;
-            }
-            #battery.charging {
-              color: @white;
-            }
-            #idle_inhibitor.activated {
-              color: @white;
-            }
-
-            #idle_inhibitor {
-              padding-top: 1px;
-            }
-
-            #privacy {
-              color: @red;
-              margin: -1px 2px 0px 5px;
-            }
-            #clock {
-              /* margin-right: 5px; */
-            }
-          '';
-              };
-        wpaperd = {
-          enable = true;
-          settings.default = {
-            path = "~/.wallpapers";
-            duration = "8h";
-            mode = "center";
+            "kitty_mod+enter" = "new_window_with_cwd";
+            "kitty_mod+t" = "new_tab_with_cwd";
           };
         };
         fuzzel = {
           enable = true;
           settings = {
             main = {
-              terminal = lib.getExe pkgs.kitty;
+              terminal = lib.getExe cfg.programs.kitty.package;
               layer = "overlay";
               icon-theme = "Paper";
               font = "Fira Sans";
             };
             colors = {
-              background = "000000aa";
+              background = "000000cc";
               text = "cdd6f4ff";
               match = "94e2d5ff";
               selection = "585b70ff";
@@ -560,34 +360,46 @@ in {
             };
           };
         };
+        pandoc = {
+          enable = true;
+          extraAbbreviations = ["i.A." "d.h." "D.h." "gdw."];
+        };
+        nushell = {
+          enable = true;
+          settings.show_banner = false;
+        };
+        fd.enable = true;
       };
 
       services = {
-        dunst = {
-          settings = import ./dunst-settings.nix inputs;
-          iconTheme = {
-            package = pkgs.paper-icon-theme;
-            name = "Paper";
-          };
+        wpaperd = {
           enable = true;
+          settings.default = {
+            path = "~/.wallpapers";
+            duration = "15m";
+            mode = "center";
+          };
         };
         emacs = {
           enable = true;
           socketActivation.enable = true;
           client = {
             enable = true;
-            arguments = mkForce ["--reuse-frame" "--alternate-editor" "\"\""];
+            arguments = mkForce ["--create-frame" "--alternate-editor" (lib.getExe cfg.services.emacs.package)];
           };
         };
         gpg-agent = {
           enable = true;
           enableSshSupport = true;
           extraConfig = ''
-            pinentry-program ${pkgs.pinentry-gtk2}/bin/pinentry
+            pinentry-program ${lib.getExe' pkgs.pinentry-gtk2 "pinentry"}
             grab
           '';
         };
-        xembed-sni-proxy.enable = true;
+        xembed-sni-proxy = {
+          enable = true;
+          package = pkgs.kdePackages.plasma-workspace;
+        };
         udiskie = {
           enable = true;
           automount = false;
@@ -598,6 +410,12 @@ in {
             notification_actions = {
               device_mounted = [];
             };
+            device_config = [
+              { loop_file = "/nix/store/*-etc-metadata.erofs"; is_mounted = false; ignore = true; }
+              { mount_path = "/run/nixos-etc-metadata"; ignore = true; }
+              { mount_path = "/run/nixos-etc-metadata.*"; ignore = true; }
+            ];
+            icon_names.media = ["drive-removable-media-symbolic"];
           };
         };
         network-manager-applet.enable = true;
@@ -614,7 +432,7 @@ in {
                 batch = "true";
                 log = "false";
                 repeat = "watch";
-                sshcmd = "${pkgs.openssh}/bin/ssh";
+                sshcmd = lib.getExe' pkgs.openssh "ssh";
                 ui = "text";
               };
             };
@@ -634,31 +452,17 @@ in {
           enable = true;
           events = [
             { event = "before-sleep"; command = lockCommand; }
-            { event = "after-resume"; command = "${cfg.wayland.windowManager.hyprland.package}/bin/hyprctl dispatch dpms on"; }
             { event = "lock"; command = lockCommand; }
           ];
           timeouts = [
-            { timeout = 300;
-              command = "${cfg.wayland.windowManager.hyprland.package}/bin/hyprctl dispatch dpms off";
-            }
-            { timeout = 330; command = lockCommand; }
+            { timeout = 600; command = lockCommand; }
           ];
           extraArgs = [
+            "-w"
             "idlehint" "30"
           ];
         };
         poweralertd.enable = true;
-        avizo = {
-          enable = true;
-          settings.default = {
-            time = "1.0";
-            background = "rgba(0, 0, 0, 0.8)";
-            border-color = "rgba(0, 0, 0, 1)";
-            bar-fg-color = "rgba(160, 160, 160, 1)";
-            bar-bg-color = "rgba(32, 32, 32, 0.96)";
-            # y-offset = "0.25";
-          };
-        };
       };
 
       home.pointerCursor = {
@@ -690,6 +494,13 @@ in {
         };
       };
 
+      qt.kde.settings = {
+        kwalletrc = {
+          KSecretD.Enabled = false;
+          Wallet."Default Wallet" = "store";
+        };
+      };
+
       xsession.preferStatusNotifierItems = true;
 
       xresources.properties = import ./xresources.nix;
@@ -698,18 +509,19 @@ in {
         packages = with pkgs; [
           fira fira-code pwvucontrol wrappedKeepassxc wl-clipboard-rs
           mumble pulseaudio-ctl pamixer libnotify screen-message
-          wrappedYTMDesktop libsForQt5.qt5ct playerctl evince
-          thunderbird zoom-us steam steam-run wireshark virt-manager
-          rclone cached-nix-shell worktime fira-code-symbols
-          libreoffice xournalpp google-chrome nixos-shell virt-viewer
-          freerdp gnome-icon-theme paper-icon-theme sshpassSecret
-          weechat element-desktop matrix-synapse-tools.synadm
-          flakeInputs.deploy-rs.packages.${config.nixpkgs.system}.deploy-rs
-          sieve-connect gimp inkscape udiskie glab nitrokey-app
+          wrappedYTMDesktop libsForQt5.qt5ct playerctl evince papers
+          thunderbird zoom-us xdg-desktop-portal steam steam-run
+          wireshark virt-manager rclone cached-nix-shell worktime
+          fira-code-symbols libreoffice xournalpp
+          nixos-shell virt-viewer freerdp gnome-icon-theme
+          paper-icon-theme sshpassSecret weechat element-desktop
+          sieve-connect gimp3 inkscape udiskie glab nitrokey-app
           pynitrokey gtklock wlrctl remmina openscad spice-record
-          libguestfs-with-appliance nerd-fonts.fira-mono
+          nerd-fonts.fira-mono
           nerd-fonts.symbols-only nerd-fonts.fira-code powerline-fonts
-        ];
+          swtpm (hunspell.withDicts (dicts: with dicts; [en_GB-large de_DE]))
+          libation libqalculate
+        ] ++ mapAttrsToList (_name: pkg: pkgs.callPackage pkg {}) (customUtils.nixImport { dir = ./utils; });
 
         file = {
           ".backup-munin".source = ./backup-patterns;
@@ -729,12 +541,9 @@ in {
           QT_QPA_PLATFORMTHEME = "qt5ct";
           LIBVIRT_DEFAULT_URI = "qemu:///system";
           STACK_XDG = 1;
-          EDITOR = pkgs.writeShellScript "editor" ''
-            args=("--reuse-frame" "--alternate-editor" "")
-            args+=("$@")
-            exec -a emacsclient ${cfg.services.emacs.package}/bin/emacsclient "''${args[@]}"
-          '';
-          RCLONE_PASSWORD_COMMAND = "${pkgs.libsecret}/bin/secret-tool lookup service rclone";
+          EDITOR = lib.getExe' editor "emacsclient";
+          RCLONE_PASSWORD_COMMAND = "${lib.getExe' pkgs.libsecret "secret-tool"} lookup service rclone";
+          SYSTEMD_TINT_BACKGROUND = "false";
         };
 
         extraProfileCommands = ''
@@ -743,18 +552,11 @@ in {
       };
 
       xdg.configFile = {
-        "dunst/dunstrc.d" = {
-          source = ./dunstrc.d;
-          recursive = true;
-          onChange = ''
-            ${pkgs.systemd}/bin/systemctl --user try-restart dunst
-          '';
-        };
         "wireplumber" = {
           source = ./wireplumber;
           recursive = true;
           onChange = ''
-            ${pkgs.systemd}/bin/systemctl --user try-restart wireplumber
+            ${lib.getExe' config.systemd.package "systemctl"} --user try-restart wireplumber
           '';
         };
         "stack/config.yaml" = {
@@ -768,6 +570,8 @@ in {
               idle-hide = true;
               follow-focus = true;
               start-hidden = true;
+              time-format = "%H:%M:%S";
+              date-format = "%Y-%m-%d";
             };
           };
         };
@@ -776,37 +580,36 @@ in {
             General = {
               dot_as_separator = 0;
             };
+            Mode = {
+              calculate_as_you_type = 1;
+            };
           };
         };
-        "emacs/init.el".source = ./emacs.el;
+        "emacs/init.el".source = pkgs.substitute {
+          src = ./emacs.el;
+          substitutions = [
+            "--subst-var-by" "ksshaskpass" (lib.getExe pkgs.kdePackages.ksshaskpass)
+          ];
+        };
+        "systemd/user/xdg-desktop-portal.service.d/after-graphical-session.conf".text = ''
+          [Unit]
+          After=graphical-session.target
+        '';
+        "systemd/user/home-manager.service.d/before-graphical-session.conf".text = ''
+          [Unit]
+          Before=graphical-session-pre.target
+        '';
+        "pdfpc/pdfpcrc".text = ''
+          mouse 8 prev
+          mouse 9 next
+        '';
       };
 
       xdg.dataFile = {
-        "pandoc/abbreviations" = {
-          source = pkgs.runCommand "pandoc-abbreviations" {
-            buildInputs = [ pkgs.pandoc pkgs.coreutils ];
-          } (let
-            germanAbbrevs = pkgs.fetchFromGitHub {
-              owner = "jfilter";
-              repo = "german-abbreviations";
-              rev = "8eb9dae93b6f05d7c53374cd217ab2dc89558e0c";
-              sha256 = "SaD3tSqzen6Y3SPICe6/9vhe4iMHlArZ3kFQaEk7Hps=";
-            };
-          in ''
-            cat \
-              <(pandoc --print-default-data-file=abbreviations) \
-              <(grep -E '^[^ ]+\.$' ${germanAbbrevs}/german_abbreviations.txt) \
-              ${pkgs.writeText "abbrevs.txt" ''
-                i.A.
-                d.h.
-                D.h.
-                gdw.
-              ''} \
-              | sort | uniq >$out
-          '');
-        };
         "dbus-1/services/org.keepassxc.KeePassXC.service".source = "${wrappedKeepassxc}/share/dbus-1/services/org.keepassxc.KeePassXC.service";
         "dbus-1/services/org.freedesktop.secrets.service.service".source = "${wrappedKeepassxc}/share/dbus-1/services/org.freedesktop.secrets.service.service";
+        "dbus-1/services/org.kde.kwalletd6.service".source = "${pkgs.kdePackages.kwallet}/share/dbus-1/services/org.kde.kwalletd6.service";
+        "dbus-1/services/org.kde.kwalletd5.service".source = "${pkgs.kdePackages.kwallet}/share/dbus-1/services/org.kde.kwalletd5.service";
         "emoji-data/list.txt".source = pkgs.stdenv.mkDerivation {
           inherit (sources.emoji-data) pname src;
           version = lib.removePrefix "v" sources.emoji-data.version;
@@ -892,19 +695,68 @@ in {
           name = "Rainbow";
           exec = toString (pkgs.writeShellScript "rainbow" ''
             exec -- \
-              ${config.systemd.package}/bin/systemd-run --wait --user --slice-inherit \
+              ${lib.getExe' config.systemd.package "systemd-run"} --wait --user --slice-inherit \
               --property 'CPUAccounting=yes' --property 'CPUQuotaPeriodSec=50ms' \
-              --property 'Environment=DSCP=46' \
-              -- ${pkgs.dscp}/bin/dscp ${pkgs.google-chrome}/bin/google-chrome-stable \
-              --force-device-scale-factor=1.5 \
+              -E DSCP=46 -E NIXOS_OZONE_WL \
+              -- ${lib.getExe pkgs.dscp} ${lib.getExe cfg.programs.chromium.package} \
               --class=Rainbow \
-              --kiosk "https://web.openrainbow.com" \
-              --user-data-dir=''${HOME}/.config/google-chrome-rainbow
+              --app="https://web.openrainbow.com" \
+              --user-data-dir=''${HOME}/.config/chromium-rainbow
           '');
           icon = pkgs.fetchurl {
             url = "https://web.openrainbow.com/rb/2.139.17/assets/skins/rainbow/images/homepage/logo__rainbow.svg";
             hash = "sha256-5fmo8rDqVDpzkGaPjk4Y+SsSZpAsY7VUQSFW6WdHwuU=";
           };
+          settings = {
+            StartupWMClass = "Rainbow";
+          };
+        };
+        kimai = {
+          name = "Kimai";
+          exec = toString (pkgs.writeShellScript "kimai" ''
+            exec -- \
+              ${lib.getExe cfg.programs.chromium.package} \
+              --class=Kimai \
+              --app="https://kimai.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/chromium-kimai
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.kimai.org/images/kimai_logo.png";
+            hash = "sha256-lnlOttzR2SwXA70R+egJUkeKr4U5V0avqTk8uX4bqfs=";
+          };
+          settings = {
+            StartupWMClass = "Kimai";
+            StartupNotify = "true";
+          };
+        };
+        audiobookshelf = {
+          name = "Audiobookshelf";
+          exec = toString (pkgs.writeShellScript "audiobookshelf" ''
+            exec -- \
+              ${lib.getExe cfg.programs.chromium.package} \
+              --class=Audiobookshelf \
+              --app="https://audiobookshelf.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/chromium-audiobookshelf
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.audiobookshelf.org/Logo.png";
+            hash = "sha256-JGPk+WNT1C4DC4lSMb0K0YmAMT5LvmSOeO0QRzkc7Lk=";
+          };
+          settings = {
+            StartupWMClass = "Audiobookshelf";
+            StartupNotify = "true";
+          };
+        };
+        thunderbird-lmu = {
+          name = "Thunderbird (LMU)";
+          exec = "thunderbird --name thunderbird -P lmu %U";
+          icon = "thunderbird";
+          genericName = "Email Client";
+          categories = [ "Network" "Chat" "Email" "Feed" "GTK" "News" ];
+          settings = {
+            StartupWMClass = "thunderbird";
+            StartupNotify = "true";
+          };
         };
       };
 
@@ -920,23 +772,6 @@ in {
           color-scheme = "prefer-dark";
         };
       };
-
-      wayland.windowManager.hyprland = {
-        enable = true;
-        settings = import ./hyprland.nix inputs;
-      };
-
-      xdg.portal = {
-        enable = true;
-        xdgOpenUsePortal = true;
-        config = {
-          common.default = [ "gtk" ];
-          hyprland.default = [ "gtk" "hyprland" ];
-        };
-        extraPortals = with pkgs; [
-          xdg-desktop-portal-gtk xdg-desktop-portal-wlr xdg-desktop-portal-hyprland
-        ];
-      };
     };
   };
 }
diff --git a/accounts/gkleen@sif/dunst-settings.nix b/accounts/gkleen@sif/dunst-settings.nix
deleted file mode 100644
index 72687aea..00000000
--- a/accounts/gkleen@sif/dunst-settings.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{ pkgs, ... }:
-{
-  global = {
-    font = "Fira Sans 12";
-    markup = "full";
-    format = "<i>%s</i> %p\\n%b";
-    alignment = "left";
-    # geometry = "1216x10-32+64";
-    width = 500;
-    height = 100;
-    offset = "4x4";
-    origin = "top-right";
-    shrink = true;
-    monitor = 0;
-    follow = "none";
-    padding = 6;
-    horizontal_padding = 6;
-    separator_height = 1;
-    separator_color = "frame";
-    idle_threshold = 0;
-
-    transparency = 10;
-
-    frame_width = 1;
-    frame_color = "#999999";
-
-    word_wrap = true;
-    show_age_threshold = 15;
-    show_indicators = false;
-    icon_position = "right";
-    min_icon_size = 25;
-    max_icon_size = 25;
-    sort = false;
-    sticky_history = false;
-
-    dmenu = "fuzzel --dmenu";
-    browser = "${pkgs.xdg-utils}/bin/xdg-open";
-  };
-  # shortcuts = {
-  #   close = "ctrl+space";
-  #   close_all = "ctrl+shift+space";
-  #   history = "ctrl+comma";
-  #   context = "ctrl+period";
-  # };
-}
diff --git a/accounts/gkleen@sif/dunstrc.d/00-urgency_low.conf b/accounts/gkleen@sif/dunstrc.d/00-urgency_low.conf
deleted file mode 100644
index 98c94b64..00000000
--- a/accounts/gkleen@sif/dunstrc.d/00-urgency_low.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-[urgency_low]
-background="#000000aa"
-foreground="#999999"
-timeout=5
\ No newline at end of file
diff --git a/accounts/gkleen@sif/dunstrc.d/01-urgency_normal.conf b/accounts/gkleen@sif/dunstrc.d/01-urgency_normal.conf
deleted file mode 100644
index f8fa8e2d..00000000
--- a/accounts/gkleen@sif/dunstrc.d/01-urgency_normal.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-[urgency_normal]
-background="#000000aa"
-foreground="#ffffff"
-timeout=15
\ No newline at end of file
diff --git a/accounts/gkleen@sif/dunstrc.d/02-urgency_critical.conf b/accounts/gkleen@sif/dunstrc.d/02-urgency_critical.conf
deleted file mode 100644
index a08bf4b1..00000000
--- a/accounts/gkleen@sif/dunstrc.d/02-urgency_critical.conf
+++ /dev/null
@@ -1,4 +0,0 @@
-[urgency_critical]
-background="#900000aa"
-foreground="#ffffff"
-timeout=0
diff --git a/accounts/gkleen@sif/dunstrc.d/10-brightness.conf b/accounts/gkleen@sif/dunstrc.d/10-brightness.conf
deleted file mode 100644
index c54595ab..00000000
--- a/accounts/gkleen@sif/dunstrc.d/10-brightness.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-[brightness]
-appname="brightness"
-set_stack_tag="brightness"
-set_transient=yes
-history_ignore=yes
diff --git a/accounts/gkleen@sif/dunstrc.d/10-pulseaudio-ctl.conf b/accounts/gkleen@sif/dunstrc.d/10-pulseaudio-ctl.conf
deleted file mode 100644
index 074f4535..00000000
--- a/accounts/gkleen@sif/dunstrc.d/10-pulseaudio-ctl.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-[pulseaudio-ctl]
-body="Current is *"
-history_ignore=yes
-set_stack_tag="volume"
-summary="Volume *"
diff --git a/accounts/gkleen@sif/dunstrc.d/20-element.conf b/accounts/gkleen@sif/dunstrc.d/20-element.conf
deleted file mode 100644
index 5ff6031e..00000000
--- a/accounts/gkleen@sif/dunstrc.d/20-element.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-[element-im]
-appname=Element
-timeout=0
\ No newline at end of file
diff --git a/accounts/gkleen@sif/dunstrc.d/20-kitty.conf b/accounts/gkleen@sif/dunstrc.d/20-kitty.conf
deleted file mode 100644
index b27ee27e..00000000
--- a/accounts/gkleen@sif/dunstrc.d/20-kitty.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-[kitty]
-appname=kitty
-urgency=low
diff --git a/accounts/gkleen@sif/dunstrc.d/20-mail.conf b/accounts/gkleen@sif/dunstrc.d/20-mail.conf
deleted file mode 100644
index cb568e01..00000000
--- a/accounts/gkleen@sif/dunstrc.d/20-mail.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-[element]
-appname="notmuch"
-timeout=0
\ No newline at end of file
diff --git a/accounts/gkleen@sif/dunstrc.d/20-zulip.conf b/accounts/gkleen@sif/dunstrc.d/20-zulip.conf
deleted file mode 100644
index d7fbd32c..00000000
--- a/accounts/gkleen@sif/dunstrc.d/20-zulip.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-[zulip]
-appname="Zulip"
-timeout=0
\ No newline at end of file
diff --git a/accounts/gkleen@sif/emacs.el b/accounts/gkleen@sif/emacs.el
index b1b1b198..3beefba6 100644
--- a/accounts/gkleen@sif/emacs.el
+++ b/accounts/gkleen@sif/emacs.el
@@ -14,7 +14,7 @@
 (setq package-archives nil)
 (package-initialize)
 (require 'use-package)
-(use-package use-package-ensure-system-package :ensure t)
+;; (use-package use-package-ensure-system-package :ensure t)
 
 (require 'evil)
 (evil-mode 1)
@@ -51,7 +51,7 @@
 
 ;; (require 'scratch)
 (global-set-key (kbd "C-x B") 'scratch-create)
-(setq initial-major-mode 'scratch-mode)
+;; (setq initial-major-mode 'scratch-mode)
 (setq initial-scratch-message "")
 
 (global-set-key (kbd "C-x K") 'kill-current-buffer)
@@ -228,6 +228,7 @@ necessarily running."
   (global-set-key (kbd "C-x k") 'kill-buffer-with-special-emacsclient-handling))
 
 (add-hook 'server-switch-hook 'install-emacsclient-wrapped-kill-buffer)
+(add-hook 'server-switch-hook #'raise-frame)
 
 (defun move-file (new-location)
   "Write this file to NEW-LOCATION, and delete the old one."
@@ -253,3 +254,5 @@ necessarily running."
 (bind-key "C-x C-m" #'move-file)
 
 (let ((ssh_auth_sock (string-chop-newline (shell-command-to-string "gpgconf --list-dirs agent-ssh-socket")))) (setenv "SSH_AUTH_SOCK" ssh_auth_sock))
+(setenv "SSH_ASKPASS_REQUIRE" "prefer")
+(setenv "SSH_ASKPASS" "@ksshaskpass@")
diff --git a/accounts/gkleen@sif/firefox-chrome.css b/accounts/gkleen@sif/firefox-chrome.css
index 8900e2b9..726f1e4b 100644
--- a/accounts/gkleen@sif/firefox-chrome.css
+++ b/accounts/gkleen@sif/firefox-chrome.css
@@ -4,6 +4,21 @@
     font-size:12px;
 }
 
+#sidebar-main:has([expanded]) {
+    min-width:20em !important;
+    max-width:20em !important;
+}
+
+#sidebar, #sidebar-box {
+    min-width:35em !important;
+    max-width:35em !important;
+}
+
+#sidebar-box {
+    margin-right: var(--space-small);
+}
+
+/*
 #sidebar {
     min-width:20em !important;
     max-width:20em !important;
@@ -19,8 +34,21 @@
 }
 
 #toolbar-menubar[inactive="true"] + #TabsToolbar {
-  visibility: collapse !important;
+    visibility: collapse !important;
 }
 
 #sidebar-box[sidebarcommand="tabcenter-reborn_ariasuni-sidebar-action"] #sidebar-header { visibility: collapse !important; }
 #sidebar-box[sidebarcommand="_3c078156-979c-498b-8990-85f7987dd929_-sidebar-action"] #sidebar-header { visibility: collapse !important; }
+*/
+
+.titlebar-buttonbox-container{ display: none; }
+#vertical-spacer { display: none; }
+#tabbrowser-tabs[orient="vertical"] .tab-background {
+    border-radius: var(--border-radius-small) !important;
+}
+hbox:has(> #tabs-newtab-button) {
+    display: none;
+}
+#sidebar-main .tools-and-extensions {
+    justify-content: space-around !important;
+}
diff --git a/accounts/gkleen@sif/hyprland.nix b/accounts/gkleen@sif/hyprland.nix
deleted file mode 100644
index 52dee24f..00000000
--- a/accounts/gkleen@sif/hyprland.nix
+++ /dev/null
@@ -1,424 +0,0 @@
-{ pkgs, lib, config, userName, ... }:
-let
-  cfg = config.home-manager.users.${userName};
-in {
-  monitor = [
-    ",preferred,auto,auto"
-    "eDP-1,3840x2160@60,auto,1.5"
-  ];
-
-  "$terminal" = "kitty";
-  "$menu" = "fuzzel";
-
-  exec-once = [
-    "wpaperd"
-  ];
-
-  env = [
-    "NIXOS_OZONE_WL,1"
-    "QT_QPA_PLATFORM,wayland"
-    "QT_WAYLAND_DISABLE_WINDOWDECORATION,1"
-    "GDK_BACKEND,wayland"
-    "GDK_SCALE,0.66"
-    "QT_AUTO_SCREEN_SCALE_FACTOR,1"
-    "SDL_VIDEODRIVER,wayland"
-    # "AQ_DRM_DEVICES,/dev/dri/by-path/pci-0000:01:00.0-card"
-    "__NV_PRIME_RENDER_OFFLOAD,1"
-    "__NV_PRIME_RENDER_OFFLOAD_PROVIDER,NVIDIA-G0"
-    "__GLX_VENDOR_LIBRARY_NAME,nvidia"
-    "__VK_LAYER_NV_optimus,NVIDIA_only"
-  ];
-
-  xwayland.force_zero_scaling = true;
-
-  general = {
-    gaps_in = 3;
-    gaps_out = 9;
-    "col.active_border" = "rgba(33ccffee) rgba(00ff95ee) 45deg";
-    "col.inactive_border" = "rgba(595959aa)";
-
-    resize_on_border = false;
-
-    allow_tearing = false;
-
-    layout = "dwindle";
-  };
-
-  decoration = {
-    rounding = 5;
-    dim_special = 0.0;
-  };
-
-  animations = {
-    enabled = true;
-    bezier = "myBezier, 0.05, 0.9, 0.1, 1.05";
-    animation = [
-      "windows, 1, 1, default, popin 80%"
-      "windowsMove, 0"
-      # "windows, 1, 7, myBezier"
-      # "windowsOut, 1, 7, myBezier, popin 80%"
-      "border, 1, 10, default"
-      "borderangle, 1, 8, default"
-      "fade, 1, 1, default"
-      "workspaces, 1, 1, default, fade"
-      # "workspaces, 1, 6, default"
-    ];
-  };
-
-  dwindle = {
-    pseudotile = false;
-    preserve_split = true;
-  };
-
-  master = {
-    new_status = "master";
-  };
-
-  misc = {
-    disable_hyprland_logo = true;
-    disable_splash_rendering = true;
-    # focus_on_activate = true;
-    mouse_move_enables_dpms = true;
-    key_press_enables_dpms = true;
-    new_window_takes_over_fullscreen = 1;
-    exit_window_retains_fullscreen = true;
-  };
-
-  cursor = {
-    hide_on_key_press = true;
-  };
-
-  input = {
-    kb_layout = "us,us";
-    kb_variant = "dvp,";
-    kb_model = "";
-    kb_options = "compose:caps,grp:win_space_toggle";
-    kb_rules = "";
-
-    follow_mouse = 1;
-
-    sensitivity = 0;
-
-    touchpad = {
-      natural_scroll = false;
-    };
-  };
-
-  device = [
-    { name = "synaptics-tm3512-010";
-      sensitivity = 0.4;
-    }
-    { name = "tpps/2-elan-trackpoint";
-      sensitivity = 0.2;
-    }
-    { name = "logitech-ergo-m575";
-      sensitivity = 1.333;
-    }
-  ];
-
-  gestures = {
-    workspace_swipe = false;
-  };
-
-  dwindle = {
-    # no_gaps_when_only = 1;
-  };
-
-  "$mainMod" = "SUPER";
-
-  bind = [
-    "$mainMod, return, exec, $terminal"
-    "$mainMod, Q, killactive"
-    "$mainMod SHIFT, Q, exec, hyprctl kill"
-    "$mainMod, V, togglefloating"
-    "$mainMod, D, exec, $menu"
-    "$mainMod SHIFT, D, exec, $menu --list-executables-in-path"
-    # "$mainMod, J, togglesplit,"
-
-    "$mainMod SHIFT, L, exec, loginctl lock-session"
-    "$mainMod SHIFT, E, exit"
-
-    "$mainMod, left, movefocus, l"
-    "$mainMod, right, movefocus, r"
-    "$mainMod, up, movefocus, u"
-    "$mainMod, down, movefocus, d"
-    "$mainMod SHIFT, left, swapwindow, l"
-    "$mainMod SHIFT, right, swapwindow, r"
-    "$mainMod SHIFT, up, swapwindow, u"
-    "$mainMod SHIFT, down, swapwindow, d"
-
-    "$mainMod, T, cyclenext"
-
-    "$mainMod, G, focusmonitor, 0"
-    "$mainMod, C, focusmonitor, 1"
-    "$mainMod, R, focusmonitor, 2"
-    "$mainMod, L, focusmonitor, 3"
-
-    "$mainMod CTRL, G, movecurrentworkspacetomonitor, 0"
-    "$mainMod CTRL, C, movecurrentworkspacetomonitor, 1"
-    "$mainMod CTRL, R, movecurrentworkspacetomonitor, 2"
-    "$mainMod CTRL, L, movecurrentworkspacetomonitor, 3"
-
-    "$mainMod, F, fullscreen, 1"
-    "$mainMod SHIFT, F, fullscreen, 0"
-    "$mainMod CTRL SHIFT, F, fullscreenstate, 1, 2"
-
-    "$mainMod, code:14, workspace, 1"
-    "$mainMod, code:17, workspace, 2"
-    "$mainMod, code:13, workspace, 3"
-    "$mainMod, code:18, workspace, 4"
-    "$mainMod, code:12, workspace, 5"
-    "$mainMod, code:19, workspace, 6"
-    "$mainMod, code:11, workspace, 7"
-    "$mainMod, code:20, workspace, 8"
-    "$mainMod, code:15, workspace, 9"
-    "$mainMod, code:16, workspace, 10"
-
-    "$mainMod SHIFT, code:14, movetoworkspacesilent, 1"
-    "$mainMod SHIFT, code:17, movetoworkspacesilent, 2"
-    "$mainMod SHIFT, code:13, movetoworkspacesilent, 3"
-    "$mainMod SHIFT, code:18, movetoworkspacesilent, 4"
-    "$mainMod SHIFT, code:12, movetoworkspacesilent, 5"
-    "$mainMod SHIFT, code:19, movetoworkspacesilent, 6"
-    "$mainMod SHIFT, code:11, movetoworkspacesilent, 7"
-    "$mainMod SHIFT, code:20, movetoworkspacesilent, 8"
-    "$mainMod SHIFT, code:15, movetoworkspacesilent, 9"
-    "$mainMod SHIFT, code:16, movetoworkspacesilent, 10"
-
-    "$mainMod, semicolon, exec, dunstctl close"
-    "$mainMod SHIFT, semicolon, exec, dunstctl close-all"
-    "$mainMod, period, exec, dunstctl context"
-    "$mainMod, comma, exec, dunstctl history-pop"
-
-    "$mainMod ALT, E, exec, emacsclient -c"
-    "$mainMod ALT, Y, exec, ${pkgs.writeShellScript "yt-dlp" ''
-       export PATH="${lib.makeBinPath (with pkgs; [ wl-clipboard-rs socat ])}:$PATH"
-       socat STDIO UNIX-CONNECT:"$XDG_RUNTIME_DIR"/yt-dlp.sock <<<$'{ "urls": ["'"$(wl-paste)"$'"] }'
-    ''}"
-    "$mainMod ALT, L, exec, ${pkgs.writeShellScript "mpv" ''
-       export PATH="${lib.makeBinPath (with pkgs; [ wl-clipboard-rs ])}:$PATH"
-       exec mpv "$(wl-paste)"
-    ''}"
-
-    ", Print, exec, ${pkgs.writeShellScript "screenshot" ''
-      export PATH="${lib.makeBinPath (with pkgs; [ grim slurp wl-clipboard-rs coreutils ])}:$PATH"
-
-      outFile="$HOME/screenshots/$(date +"%Y-%m-%dT%H:%M:%S").png"
-      grim -g "$(slurp -b 00000080 -c FFFFFFFF -s 00000000 -w 1)" "$outFile"
-      wl-copy --type image/png <"$outFile"
-    ''}"
-    "SHIFT, Print, exec, ${pkgs.writeShellScript "screenshot" ''
-      export PATH="${lib.makeBinPath (with pkgs; [ grim jq wl-clipboard-rs coreutils ])}:$PATH"
-
-      outFile="$HOME/screenshots/$(date +"%Y-%m-%dT%H:%M:%S").png"
-      grim -o "$(hyprctl monitors -j | jq -r '.[] | select(.focused) | .name')" "$outFile"
-      wl-copy --type image/png <"$outFile"
-    ''}"
-    "CTRL SHIFT, Print, exec, ${pkgs.runCommand "picker" {
-      buildInputs = [ pkgs.makeWrapper ];
-    } ''
-      makeWrapper ${lib.getExe pkgs.hyprpicker} $out \
-        --prefix PATH : ${lib.makeBinPath [pkgs.wl-clipboard-rs]}
-    ''} -a"
-    "$mainMod, M, exec, ${pkgs.writeShellScript "qalc-fuzzel" ''
-      export PATH="${lib.makeBinPath (with pkgs; [ wl-clipboard-rs libqalculate cfg.programs.fuzzel.package coreutils findutils libnotify gnugrep ])}:$PATH"
-
-      RESULTS_DIR="$HOME/.cache/qalc-fuzzel"
-      prev() {
-        FOUND=false
-        while IFS= read -r line; do
-          [[ -n "$line" ]] || continue
-          FOUND=true
-          echo $line
-        done < <(export LC_ALL=C.UTF-8; echo; find "$RESULTS_DIR" -type f -printf $'%T@ %p\n' | sort -n | cut -d' ' -f2- | xargs -r cat)
-        $FOUND || echo
-      }
-      FUZZEL_RES=$(prev | fuzzel --dmenu --prompt "qalc> ") || exit $?
-      if [[ "$FUZZEL_RES" =~ .*\ =\ .* ]]; then
-        QALC_RES="$FUZZEL_RES"
-        QALC_RET=0
-      else
-        QALC_RES=$(qalc "$FUZZEL_RES" 2>&1)
-        QALC_RET=$?
-      fi
-      [[ -n "$QALC_RES" ]] || exit 1
-      EXISTING=false
-      fgrep -xrl "$QALC_RES" "$RESULTS_DIR" | xargs -r touch
-      [[ ''${PIPESTATUS[0]} -eq 0 ]] && EXISTING=true
-      if [[ $QALC_RET -eq 0 ]] && ! $EXISTING; then
-        RES_FILE="$RESULTS_DIR"/$(date -uIs).$(tr -Cd 'a-zA-Z0-9' </dev/random | head -c 10)
-        cat >"$RES_FILE" <<<"$QALC_RES"
-      fi
-      [[ "$QALC_RES" =~ .*\ =\ (.*) ]] && QALC_RES="''${BASH_REMATCH[1]}"
-      [[ $QALC_RET -eq 0 ]] && wl-copy "$QALC_RES"
-      notify-send "$QALC_RES"
-    ''}"
-    "$mainMod, E, exec, ${pkgs.writeShellScript "emoji-fuzzel" ''
-      export PATH="${lib.makeBinPath (with pkgs; [ cfg.programs.fuzzel.package wtype wl-clipboard-rs ])}:$PATH"
-
-      FUZZEL_RES=$(fuzzel --dmenu --prompt "emoji> " <$HOME/.local/share/emoji-data/list.txt) || exit $?
-      [[ -n "$FUZZEL_RES" ]] || exit 1
-      wl-copy "$(cut -d ':' -f 1 <<<"$FUZZEL_RES" | tr -d '\n')" && wtype -k XF86Paste
-    ''}"
-    "$mainMod, B, exec, ${pkgs.writeShellScript "bring" ''
-      export PATH="${lib.makeBinPath (with pkgs; [ cfg.programs.fuzzel.package gawk gojq cfg.wayland.windowManager.hyprland.package ])}:$PATH"
-
-      state="$(hyprctl -j clients)"
-      active_window="$(hyprctl -j activewindow)"
-      active_workspace="$(hyprctl -j activeworkspace | gojq -r '.id')"
-
-      current_addr="$(echo "$active_window" | gojq -r '.address')"
-
-      window="$(echo "$state" |
-          gojq -r '.[] | select(.workspace.id == '"$active_workspace"') | select(.monitor != -1 ) | "\(.title)\t\(.address)"' |
-          fuzzel --log-level=warning --dmenu)"
-
-      addr="$(echo "$window" | awk -F $'\t' '{print $2}')"
-
-      if [[ "$addr" = "$current_addr" ]]; then
-          exit 0
-      fi
-
-      fullscreen_on_same_ws="$(echo "$state" | gojq -r '.[] | select(.fullscreen == true) | select(.workspace.id == '"$active_workspace"') | .address')"
-
-      if [[ "$window" != "" ]]; then
-          if [[ "$fullscreen_on_same_ws" == "" ]]; then
-              hyprctl dispatch focuswindow address:"''${addr}"
-          else
-              # If we want to focus app_A and app_B is fullscreen on the same workspace,
-              # app_A will get focus, but app_B will remain on top.
-              # This monstrosity is to make sure app_A will end up on top instead.
-              # XXX: doesn't handle fullscreen 0, but I don't care.
-              hyprctl --batch "dispatch focuswindow address:''${fullscreen_on_same_ws}; dispatch fullscreen 1; dispatch focuswindow address:''${addr}; dispatch fullscreen 1"
-          fi
-      fi
-    ''}"
-    "$mainMod SHIFT, B, exec, ${pkgs.writeShellScript "bring" ''
-      export PATH="${lib.makeBinPath (with pkgs; [ cfg.programs.fuzzel.package gawk gojq cfg.wayland.windowManager.hyprland.package ])}:$PATH"
-
-      state="$(hyprctl -j clients)"
-      active_window="$(hyprctl -j activewindow)"
-
-      current_addr="$(echo "$active_window" | gojq -r '.address')"
-
-      window="$(echo "$state" |
-          gojq -r '.[] | select(.monitor != -1 ) | "\(.title)\t\(.workspace.name)\t\(.address)"' |
-          fuzzel --log-level=warning --dmenu)"
-
-      addr="$(echo "$window" | awk -F $'\t' '{print $3}')"
-      ws="$(echo "$window" | awk -F $'\t' '{print $2}')"
-
-      if [[ "$addr" = "$current_addr" ]]; then
-          exit 0
-      fi
-
-      fullscreen_on_same_ws="$(echo "$state" | gojq -r ".[] | select(.fullscreen == true) | select(.workspace.name == \"$ws\") | .address")"
-
-      if [[ "$window" != "" ]]; then
-          if [[ "$fullscreen_on_same_ws" == "" ]]; then
-              hyprctl dispatch focuswindow address:"''${addr}"
-          else
-              # If we want to focus app_A and app_B is fullscreen on the same workspace,
-              # app_A will get focus, but app_B will remain on top.
-              # This monstrosity is to make sure app_A will end up on top instead.
-              # XXX: doesn't handle fullscreen 0, but I don't care.
-              hyprctl --batch "dispatch focuswindow address:''${fullscreen_on_same_ws}; dispatch fullscreen 1; dispatch focuswindow address:''${addr}; dispatch fullscreen 1"
-          fi
-      fi
-    ''}"
-
-    "$mainMod CTRL, return, togglespecialworkspace, term"
-    "$mainMod CTRL, e, togglespecialworkspace, edit"
-    "$mainMod CTRL, a, togglespecialworkspace, pwvucontrol"
-    "$mainMod CTRL, o, togglespecialworkspace, easyeffects"
-    "$mainMod CTRL, b, togglespecialworkspace, blueman"
-    "$mainMod CTRL, p, togglespecialworkspace, keepass"
-  ];
-  bindm = [
-    "$mainMod, mouse:272, movewindow"
-    "$mainMod, mouse:273, resizewindow"
-  ];
-  bindel = [
-    ", XF86MonBrightnessUp, exec, lightctl -d -e4 -n1 up"
-    ", XF86MonBrightnessDown, exec, lightctl -d -e4 -n1 down"
-    ", XF86AudioRaiseVolume, exec, volumectl -d -u up"
-    ", XF86AudioLowerVolume, exec, volumectl -d -u down"
-  ];
-  bindl = [
-    ", XF86AudioMute, exec, volumectl -d toggle-mute"
-    ", XF86AudioMicMute, exec, volumectl -d -m toggle-mute"
-    "$mainMod SHIFT, S, exec, systemctl suspend"
-
-    ", switch:off:Lid Switch,exec,hyprctl dispatch dpms on eDP-1"
-    ", switch:on:Lid Switch,exec,hyprctl dispatch dpms off eDP-1"
-
-    ", switch:off:Lid Switch,exec,${pkgs.writeShellScript "clamshell-off" ''
-      export PATH="${lib.makeBinPath (with pkgs; [ jq ])}:$PATH"
-      [[ $(hyprctl monitors -j | jq '.[] | select(.name == "eDP-1") | .disabled') = "true" ]] || exit 0
-
-      hyprctl keyword monitor "eDP-1,3840x2160@60,auto,1.5"
-    ''}"
-    ", switch:on:Lid Switch,exec,${pkgs.writeShellScript "clamshell-on" ''
-      export PATH="${lib.makeBinPath (with pkgs; [ jq ])}:$PATH"
-
-      [[ $(hyprctl monitors -j | jq 'reduce (.[] | select(.disabled == false)) as $_ (0; .+1)') -gt 1 ]] || exit 0
-
-      hyprctl keyword monitor "eDP-1,disable"
-    ''}"
-  ];
-
-  windowrulev2 = [
-    "suppressevent maximize fullscreen, class:.*"
-
-    # "maximize, class:^(Element|thunderbird)$"
-    "workspace special:pwvucontrol, class:^com\.saivert\.pwvucontrol$"
-    "workspace special:easyeffects, class:^com\.github\.wwmm\.easyeffects$"
-    "workspace special:blueman, class:^\.blueman-manager-wrapped$"
-    "workspace special:keepass silent, class:^org\.keepassxc\.KeePassXC$, title:^(?!Unlock Database.*)(?!.*(Access Request|Passkey credentials))"
-    # "group set always lock invade, class:^Element$"
-    "workspace 2, class:^firefox$"
-    "workspace 4, class:^evince$"
-    "workspace 4, class:^imv$"
-    "workspace 4, class:^org\.pwmt\.zathura$"
-    "workspace 10, class:^mpv$"
-    "workspace 1, class:^Element$"
-    "workspace 1, class:^thunderbird$"
-    "workspace 5, class:^virt-manager$"
-    "workspace 5, class:^qemu$"
-    "float, class:^org\.keepassxc\.KeePassXC$, title:Access Request$"
-    "center, class:^org\.keepassxc\.KeePassXC$, title:Access Request$"
-    "float, class:^org\.keepassxc\.KeePassXC$, title:Passkey credentials$"
-    "center, class:^org\.keepassxc\.KeePassXC$, title:Passkey credentials$"
-    "float, class:^org\.keepassxc\.KeePassXC$, title:^Unlock Database"
-    "center, class:^org\.keepassxc\.KeePassXC$, title:^Unlock Database"
-    "float, class:^xdg-desktop-portal-gtk$"
-    "center, class:^xdg-desktop-portal-gtk$"
-
-    "bordercolor rgba(ffaa33ee) rgba(bfff00ee) 45deg, fullscreen:1"
-    "bordercolor rgba(3366ffee) rgba(6a00ffee) 45deg, xwayland:1"
-    "bordercolor rgba(6633ffee) rgba(ea00ffee) 45deg, xwayland:1, fullscreen:1"
-  ];
-
-  workspace = [
-    "s[true], gapsout:100"
-
-    "special:term, on-created-empty:kitty"
-    "special:edit, on-created-empty:emacsclient -c"
-    "special:pwvucontrol, on-created-empty:pwvucontrol"
-    "special:easyeffects, on-created-empty:easyeffects"
-    "special:blueman, on-created-empty:blueman-manager"
-    "special:keepass, on-created-empty:keepassxc"
-
-    "1, defaultName:comm"
-    "2, defaultName:web"
-    "3, defaultName:work"
-    "4, defaultName:read"
-  ];
-
-  layerrule = [
-    "blur, waybar"
-    "blur, launcher"
-    "noanim, notifications"
-    "blur, notifications"
-  ];
-}
diff --git a/accounts/gkleen@sif/libvirt/default.nix b/accounts/gkleen@sif/libvirt/default.nix
index f86a68a2..4e5a9b90 100644
--- a/accounts/gkleen@sif/libvirt/default.nix
+++ b/accounts/gkleen@sif/libvirt/default.nix
@@ -7,6 +7,7 @@ with flakeInputs.nixVirt.lib;
   config = {
     virtualisation.libvirt = {
       enable = true;
+      swtpm.enable = true;
       connections."qemu:///session" = {
         domains = [
           { definition = domain.writeXML (updateManyAttrsByPath [
@@ -16,8 +17,8 @@ with flakeInputs.nixVirt.lib;
               memory = { count = 16; unit = "GiB"; };
               storage_vol = "/home/gkleen/.local/share/libvirt/images/lmmirzm-vmrz01.qcow2";
               nvram_path = "/home/gkleen/.local/share/libvirt/lmmirzm-vmrz01.nvram";
-              virtio_drive = false;
-              virtio_video = false;
+              virtio_drive = true;
+              virtio_video = true;
               install_virtio = false;
             }) {
               qemu-commandline.env = [
@@ -33,11 +34,12 @@ with flakeInputs.nixVirt.lib;
               os.bootmenu.enable = true;
               devices.graphics = {
                 listen.type = "address";
-                # gl.enable = true;
+                gl.enable = false;
               };
+              devices.video.model.acceleration.accel3d = false;
               devices.interface = {
-                # model.type = "virtio";
-                model.type = "e1000e";
+                model.type = "virtio";
+                # model.type = "e1000e";
                 type = "bridge";
                 mac.address = "52:54:00:b9:f3:ed";
                 source.bridge = "rz-0971";
@@ -47,6 +49,15 @@ with flakeInputs.nixVirt.lib;
                   type = "unix";
                   target = { type = "virtio"; name = "org.qemu.guest_agent.0"; };
                 }
+                {
+                  type = "spicevmc";
+                  target = { type = "virtio"; name = "com.redhat.spice.0"; };
+                }
+                {
+                  type = "spiceport";
+                  target = { type = "virtio"; name = "org.spice-space.webdav.0"; };
+                  source.channel = "org.spice-space.webdav.0";
+                }
               ];
               devices.tpm.model = "tpm-tis";
             }));
diff --git a/accounts/gkleen@sif/niri/default.nix b/accounts/gkleen@sif/niri/default.nix
new file mode 100644
index 00000000..35a3d799
--- /dev/null
+++ b/accounts/gkleen@sif/niri/default.nix
@@ -0,0 +1,1009 @@
+{ config, hostConfig, pkgs, lib, flakeInputs, ... }:
+let
+  cfg = config.programs.niri;
+
+  kdl = flakeInputs.niri-flake.lib.kdl;
+  sleaf = name: arg: kdl.node name [arg] [];
+
+  niri = cfg.package;
+  terminal = lib.getExe config.programs.kitty.package;
+  makoctl = lib.getExe' config.services.mako.package "makoctl";
+  loginctl = lib.getExe' hostConfig.systemd.package "loginctl";
+  systemctl = lib.getExe' hostConfig.systemd.package "systemctl";
+  swayosd-client = lib.getExe' config.services.swayosd.package "swayosd-client";
+
+  focus_or_spawn = pkgs.writeShellApplication {
+    name = "focus-or-spawn";
+    runtimeInputs = [ niri pkgs.gojq pkgs.gnugrep pkgs.socat ];
+    text = ''
+      window_select="$1"
+      shift
+      workspace_name="$1"
+      shift
+
+      workspaces_json="$(niri msg -j workspaces)"
+      workspace_output="$(jq -r --arg workspace_name "$workspace_name" '.[] | select(.name == $workspace_name) | .output' <<<"$workspaces_json")"
+      # active_workspace="$(jq -r --arg workspace_output "$workspace_output" '.[] | select(.output == $workspace_output and .is_active) | .id' <<<"$workspaces_json")"
+      active_output="$(jq -r '.[] | select(.is_focused) | .output' <<<"$workspaces_json")"
+      if [[ $workspace_output != "$active_output" ]]; then
+        niri msg action move-workspace-to-monitor --reference "$workspace_name" "$active_output"
+        # socat STDIO "$NIRI_SOCKET" <<<'{"Action":{"FocusWorkspace":{"reference":{"Id":'"''${active_workspace}"'}}}}'
+        # niri msg action move-workspace-to-index --reference "$workspace_name" 1
+      fi
+
+      while IFS=$'\n' read -r window_json; do
+        if [[ -n $(jq -c "$window_select" <<<"$window_json") ]]; then
+          if jq -e '.is_focused' <<<"$window_json" >/dev/null; then
+            niri msg action focus-workspace-previous
+          else
+            if [[ $(jq -r --arg workspace_name "$workspace_name" 'map(select(.name == $workspace_name)) | .[0].is_focused' <<<"$workspaces_json") != "true" ]] && [[ $(jq -r --arg workspace_name "$workspace_name" 'map(select(.name == $workspace_name)) | .[0].id' <<<"$workspaces_json") = $(jq -r '.workspace_id' <<<"$window_json") ]]; then
+                niri msg action focus-workspace "$workspace_name"
+            else
+                niri msg action focus-window --id "$(jq -r '.id' <<<"$window_json")"
+            fi
+          fi
+          exit 0
+        fi
+      done < <(niri msg -j windows | jq -c '.[]')
+
+      exec "$@"
+    '';
+  };
+  focus-or-spawn-action = config.lib.niri.actions.spawn (lib.getExe focus_or_spawn);
+
+  with_adjacent_workspace = pkgs.writeShellApplication {
+    name = "with-adjacent-workspace";
+    runtimeInputs = [ niri pkgs.gojq pkgs.socat ];
+    text = ''
+      blacklist="$1"
+      shift
+      direction="$1"
+      shift
+      action="$1"
+      shift
+
+      workspaces_json="$(niri msg -j workspaces)"
+      active_workspace="$(jq -r '.[] | select(.is_focused) | .id' <<<"$workspaces_json")"
+      workspace_output="$(jq -r --arg active_workspace "$active_workspace" '.[] | select(.id == ($active_workspace | tonumber)) | .output' <<<"$workspaces_json")"
+      workspace_idx="$(jq -r '.[] | select(.is_focused) | .idx' <<<"$workspaces_json")"
+
+      jq_script='map(select('
+      case "$direction" in
+        down)
+          # shellcheck disable=SC2016
+          jq_script=''${jq_script}'.idx > ($workspace_idx | tonumber)';;
+        up)
+          # shellcheck disable=SC2016
+          jq_script=''${jq_script}'.idx < ($workspace_idx | tonumber)';;
+      esac
+      # shellcheck disable=SC2016
+      jq_script=''${jq_script}' and .output == $workspace_output and ((.name == null) or (.name | test($blacklist) | not)))) | sort_by(.idx)'
+      [[ $direction == "up" ]] && jq_script=''${jq_script}' | reverse'
+      jq_script=''${jq_script}' | .[0]'
+
+      workspace_json=$(jq -c --arg blacklist "$blacklist" --arg workspace_output "$workspace_output" --arg workspace_idx "$workspace_idx" "$jq_script" <<<"$workspaces_json")
+      [[ -n $workspace_json && $workspace_json != null  ]] || exit 0
+      jq --arg active_workspace "$active_workspace" -c "$action" <<<"$workspace_json" | tee /dev/stderr | socat STDIO "$NIRI_SOCKET"
+    '';
+  };
+  with-adjacent-workspace-action = config.lib.niri.actions.spawn (lib.getExe with_adjacent_workspace) "^${lib.concatMapStringsSep "|" ({ name, ...}: name) cfg.scratchspaces}$";
+  focus-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"FocusWorkspace":{"reference":{"Id": .id}}}}'';
+  move-column-to-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}, "focus": true}}}'';
+
+  with_unnamed_workspace = pkgs.writeShellApplication {
+    name = "with-unnamed-workspace";
+    runtimeInputs = [ niri pkgs.gojq pkgs.socat ];
+    text = ''
+      action="$1"
+      shift
+
+      workspaces_json="$(niri msg -j workspaces)"
+      active_output="$(jq -r '.[] | select(.is_focused) | .output' <<<"$workspaces_json")"
+      active_workspace="$(jq -r '.[] | select(.is_focused) | .id' <<<"$workspaces_json")"
+
+      history_json="$(socat STDIO UNIX-CONNECT:"$XDG_RUNTIME_DIR"/niri-workspace-history.sock)"
+      workspace_json="$(jq -c --arg active_output "$active_output" --argjson history "$history_json" 'map(select(.output == $active_output and .name == null)) | map({"value": ., "history_idx": ((. as $workspace | ($history[$active_output] | index($workspace | .id))) as $active_idx | if $active_idx then $active_idx else ($history[$active_output] | length) + 1 end)}) | sort_by(.history_idx, .value.idx) | map(.value) | .[0]' <<<"$workspaces_json")"
+      [[ -n $workspace_json && $workspace_json != null ]] || exit 0
+      jq --arg active_workspace "$active_workspace" -c "$action" <<<"$workspace_json" | tee /dev/stderr | socat STDIO "$NIRI_SOCKET"
+    '';
+  };
+  with-unnamed-workspace-action = config.lib.niri.actions.spawn (lib.getExe with_unnamed_workspace);
+
+  with_empty_unnamed_workspace = pkgs.writeShellApplication {
+    name = "with-empty-unnamed-workspace";
+    runtimeInputs = [ niri pkgs.gojq pkgs.socat ];
+    text = ''
+      action="$1"
+      shift
+
+      workspaces_json="$(niri msg -j workspaces)"
+      active_output="$(jq '.[] | select(.is_focused) | .output' <<<"$workspaces_json")"
+      target_workspace_id="$(jq --argjson active_output "$active_output" 'map(select(.active_window_id == null and .name == null and .output == $active_output)) | sort_by(.idx) | .[0].id' <<<"$workspaces_json")"
+      jq --argjson workspace_id "$target_workspace_id" -nc "$action" | tee /dev/stderr | socat STDIO "$NIRI_SOCKET"
+    '';
+  };
+  with-empty-unnamed-workspace-action = config.lib.niri.actions.spawn (lib.getExe with_empty_unnamed_workspace);
+
+  with_select_window = pkgs.writeShellApplication {
+    name = "with-select-window";
+    runtimeInputs = [ niri pkgs.gojq pkgs.socat config.programs.fuzzel.package pkgs.gawk ];
+    text = ''
+      window_select="$1"
+      shift
+      action="$1"
+      shift
+
+      windows_json="$(niri msg -j windows)"
+      active_workspace="$(jq -r '.[] | select(.is_focused) | .workspace_id' <<<"$windows_json")"
+      window_ix="$(gojq -r --arg active_workspace "$active_workspace" '.[] | select('"$window_select"') | "\(.title)\u0000icon\u001f\(.app_id)"' <<<"$windows_json" | fuzzel --width=60 --log-level=warning --dmenu --index)"
+      # shellcheck disable=SC2016
+      window_json="$(gojq -rc --arg active_workspace "$active_workspace" --arg window_ix "$window_ix" 'map(select('"$window_select"')) | .[($window_ix | tonumber)]' <<<"$windows_json")"
+
+      [[ -z "$window_json" ]] && exit 1
+
+      jq -c "$action" <<<"$window_json" | socat STDIO "$NIRI_SOCKET"
+    '';
+  };
+  with-select-window-action = config.lib.niri.actions.spawn (lib.getExe with_select_window);
+
+  with_predicate_window = pred: pkgs.writeShellApplication {
+    name = "with-predicate-window";
+    runtimeInputs = [ niri pkgs.gojq pkgs.socat ];
+    text = ''
+      action="$1"
+      shift
+
+      windows_json="$(niri msg -j windows)"
+      window_json="$(gojq -rc 'map(select(${pred})) | .[0]' <<<"$windows_json")"
+
+      [[ -z "$window_json" || $window_json = "null" ]] && exit 1
+
+      jq -c "$action" <<<"$window_json" | socat STDIO "$NIRI_SOCKET"
+    '';
+  };
+
+  with-urgent-window-action = config.lib.niri.actions.spawn (lib.getExe (with_predicate_window ".is_urgent"));
+  with-focused-window-action = config.lib.niri.actions.spawn (lib.getExe (with_predicate_window ".is_focused"));
+in {
+  imports = [
+    ./waybar.nix
+    ./mako.nix
+    ./swayosd.nix
+  ];
+
+  options = {
+    programs.niri.scratchspaces = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule ({ config, ... }: {
+        options = {
+          name = lib.mkOption {
+            type = lib.types.str;
+          };
+          match = lib.mkOption {
+            type = lib.types.listOf (lib.types.attrsOf kdl.types.kdl-args);
+            default = [];
+          };
+          exclude = lib.mkOption {
+            type = lib.types.listOf (lib.types.attrsOf kdl.types.kdl-args);
+            default = [];
+          };
+          windowRuleExtra = lib.mkOption {
+            type = kdl.types.kdl-nodes;
+            default = [];
+          };
+          key = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+          moveKey = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = let
+              keys = lib.splitString "+" config.key;
+              defMoveKey = lib.concatStringsSep "+" (lib.flatten [
+                (lib.take (lib.length keys - 1) keys)
+                ["Shift"]
+                (lib.takeEnd 1 keys)
+              ]);
+            in if config.key == null then null else defMoveKey;
+          };
+          spawn = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
+            default = null;
+          };
+          app-id = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+          selector = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+        };
+
+        config = lib.mkMerge [
+          (lib.mkIf (config.app-id != null) {
+            match = lib.mkDefault [ { app-id = "^${lib.escapeRegex config.app-id}$"; } ];
+            selector = lib.mkDefault "select(.app_id == \"${config.app-id}\")";
+          })
+        ];
+      }));
+      default = [];
+    };
+  };
+
+  config = {
+    systemd.user.services.xwayland-satellite = {
+      Unit = {
+        BindsTo = [ "graphical-session.target" ];
+        PartOf = [ "graphical-session.target" ];
+        After = [ "graphical-session.target" ];
+        Requisite = [ "graphical-session.target" ];
+      };
+      Service = {
+        Type = "notify";
+        NotifyAccess = "all";
+        Environment = [ "DISPLAY=:0" ];
+        ExecStart = ''${lib.getExe pkgs.xwayland-satellite-unstable} ''${DISPLAY}'';
+        ExecStartPre = "${systemctl} --user import-environment DISPLAY";
+        StandardOutput = "journal";
+      };
+      Install = {
+        WantedBy = [ "graphical-session.target" ];
+      };
+    };
+
+    services.swayidle = {
+      events = [
+        { event = "after-resume"; command = "${lib.getExe niri} msg action power-on-monitors"; }
+      ];
+      timeouts = [
+        { timeout = 540;
+          command = "${lib.getExe niri} msg action power-off-monitors";
+        }
+      ];
+    };
+
+    systemd.user.sockets.niri-workspace-history = {
+      Socket = {
+        ListenStream = "%t/niri-workspace-history.sock";
+        SocketMode = "0600";
+      };
+    };
+    systemd.user.services.niri-workspace-history = {
+      Unit = {
+        BindsTo = [ "niri.service" ];
+        After = [ "niri.service" ];
+      };
+      Install = {
+        WantedBy = [ "niri.service" ];
+      };
+      Service = {
+        Type = "simple";
+        Sockets = [ "niri-workspace-history.socket" ];
+        ExecStart = pkgs.writers.writePython3 "niri-workspace-history" { flakeIgnore = ["E501"]; } ''
+          import os
+          import socket
+          import json
+          # import sys
+          from collections import defaultdict
+          from threading import Thread, Lock
+          from socketserver import StreamRequestHandler, ThreadingTCPServer
+          from contextlib import contextmanager
+          from io import TextIOWrapper
+
+
+          @contextmanager
+          def detaching(thing):
+              try:
+                  yield thing
+              finally:
+                  thing.detach()
+
+
+          workspace_history = defaultdict(list)
+          history_lock = Lock()
+
+
+          def monitor_niri():
+              workspaces = list()
+
+              def focus_workspace(output, workspace):
+                  with history_lock:
+                      workspace_history[output] = [workspace] + [ws for ws in workspace_history[output] if ws != workspace]
+                      # print(json.dumps(workspace_history), file=sys.stderr)
+
+              sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+              sock.connect(os.environ["NIRI_SOCKET"])
+              sock.send(b"\"EventStream\"\n")
+              for line in sock.makefile(buffering=1, encoding='utf-8'):
+                  if line_json := json.loads(line):
+                      if "WorkspacesChanged" in line_json:
+                          workspaces = line_json["WorkspacesChanged"]["workspaces"]
+                          for ws in workspaces:
+                              if ws["is_focused"]:
+                                  focus_workspace(ws["output"], ws["id"])
+                      if "WorkspaceActivated" in line_json:
+                          for ws in workspaces:
+                              if ws["id"] != line_json["WorkspaceActivated"]["id"]:
+                                  continue
+                              focus_workspace(ws["output"], ws["id"])
+                              break
+
+
+          class RequestHandler(StreamRequestHandler):
+              def handle(self):
+                  with detaching(TextIOWrapper(self.wfile, encoding='utf-8', write_through=True)) as out:
+                      with history_lock:
+                          json.dump(workspace_history, out)
+
+
+          class Server(ThreadingTCPServer):
+              def __init__(self):
+                  ThreadingTCPServer.__init__(self, ("", 8000), RequestHandler, bind_and_activate=False)
+                  self.socket = socket.fromfd(3, self.address_family, self.socket_type)
+
+
+          def run_server():
+              with Server() as server:
+                  server.serve_forever()
+
+
+          niri = Thread(target=monitor_niri)
+          niri.daemon = True
+          niri.start()
+
+          server_thread = Thread(target=run_server)
+          server_thread.daemon = True
+          server_thread.start()
+
+          while True:
+              server_thread.join(timeout=0.5)
+              niri.join(timeout=0.5)
+
+              if not (niri.is_alive() and server_thread.is_alive()):
+                  break
+        '';
+      };
+    };
+    systemd.user.services.niri-workspace-sort = {
+      Unit = {
+        BindsTo = [ "niri.service" ];
+        After = [ "niri.service" ];
+      };
+      Install = {
+        WantedBy = [ "niri.service" ];
+      };
+      Service = {
+        Type = "simple";
+        ExecStart = pkgs.writers.writePython3 "niri-workspace-sort" { flakeIgnore = ["E501"]; } ''
+          import os
+          import sys
+          import socket
+          import json
+
+          outputs = None
+          only = {'HDMI-A-1': {'bmr'}, 'eDP-1': {'vid'}}
+
+
+          class Niri(socket.socket):
+              def __init__(self):
+                  super().__init__(socket.AF_UNIX, socket.SOCK_STREAM)
+                  super().connect(os.environ["NIRI_SOCKET"])
+                  self.fh = super().makefile(mode='rw', buffering=1, encoding='utf-8')
+
+              def cmd(self, obj):
+                  print(json.dumps(obj, separators=(',', ':')), flush=True, file=self.fh)
+
+              def event_stream(self):
+                  self.cmd("EventStream")
+                  return self.fh
+
+
+          with Niri() as niri, Niri().event_stream() as niri_stream:
+              for line in niri_stream:
+                  workspaces = None
+                  if line_json := json.loads(line):
+                      if "WorkspacesChanged" in line_json:
+                          workspaces = line_json["WorkspacesChanged"]["workspaces"]
+
+                  if workspaces is None:
+                      continue
+
+                  old_outputs = outputs
+                  outputs = {ws["output"] for ws in workspaces}
+                  if old_outputs is None:
+                      print("Initial outputs: {}".format(outputs), file=sys.stderr)
+                      continue
+
+                  new_outputs = outputs - old_outputs
+                  if not new_outputs:
+                      continue
+                  print("New outputs: {}".format(new_outputs), file=sys.stderr)
+
+                  relevant_workspaces = list(filter(lambda ws: (ws["name"] is not None) or (ws["active_window_id"] is not None), workspaces))
+                  target_output = next(iter(outputs - set(only.keys())))
+                  if not target_output:
+                      continue
+                  for ws in relevant_workspaces:
+                      ws_ident = ws["name"] if ws["name"] is not None else (ws["output"], ws["idx"])
+                      if ws["output"] not in set(only.keys()):
+                          continue
+                      if ws_ident in only[ws["output"]]:
+                          continue
+
+                      print("{} -> {}".format(ws_ident, target_output), file=sys.stderr)
+                      niri.cmd({"Action": {"MoveWorkspaceToMonitor": {"reference": {"Id": ws["id"]}, "output": target_output}}})
+        '';
+        Restart = "on-failure";
+        RestartSec = 10;
+      };
+    };
+
+    programs.niri.scratchspaces = [
+      { name = "pwctl";
+        key = "Mod+Control+A";
+        spawn = ["pwvucontrol"];
+        app-id = "com.saivert.pwvucontrol";
+      }
+      { name = "kpxc";
+        exclude = [
+          { title = "^Unlock Database.*"; }
+          { title = "^Access Request.*"; }
+          { title = ".*Passkey credentials$"; }
+        ];
+        windowRuleExtra = with kdl; [
+          (sleaf "open-focused" false)
+        ];
+        key = "Mod+Control+P";
+        app-id = "org.keepassxc.KeePassXC";
+        spawn = [ "keepassxc" ];
+      }
+      { name = "bmgr";
+        key = "Mod+Control+B";
+        app-id = ".blueman-manager-wrapped";
+        spawn = [ "blueman-manager" ];
+      }
+      { name = "term";
+        key = "Mod+Control+Return";
+        app-id = "kitty-scratch";
+        spawn = [ "kitty" "--app-id" "kitty-scratch" ];
+      }
+      { name = "edit";
+        match = [ { title = "^scratch$"; app-id = "^emacs$"; } ];
+        key = "Mod+Control+E";
+        selector = "select(.app_id == \"emacs\" and .title == \"scratch\")";
+        spawn = [ "emacsclient" "-c" "--frame-parameters=(quote (name . \"scratch\"))" ];
+      }
+      { name = "eff";
+        key = "Mod+Control+O";
+        app-id = "com.github.wwmm.easyeffects";
+        spawn = [ "easyeffects" ];
+      }
+      { name = "time";
+        key = "Mod+Control+K";
+        app-id = "chrome-kimai.yggdrasil.li__-Default";
+        spawn = [ (toString (pkgs.resholve.writeScript "kimai" {
+          interpreter = pkgs.runtimeShell;
+          inputs = [ pkgs.dex ];
+          execer = [ "cannot:${lib.getExe pkgs.dex}" ];
+        } ''
+          exec dex $HOME/.local/state/nix/profile/share/applications/kimai.desktop
+        '')) ];
+        windowRuleExtra = with kdl; [
+          (sleaf "block-out-from" "screencast")
+        ];
+      }
+    ];
+    programs.niri.config =
+      let
+        inherit (kdl) node plain leaf flag;
+        optional-node = cond: v:
+          if cond
+          then v
+          else null;
+        opt-props = lib.filterAttrs (lib.const (value: value != null));
+        normalize-nodes = nodes: lib.remove null (lib.flatten nodes);
+      in
+        normalize-nodes [
+          (flag "prefer-no-csd")
+
+          (sleaf "screenshot-path" "~/screenshots/%Y-%m-%dT%H:%M:%S.png")
+
+          (plain "hotkey-overlay" [
+            (flag "skip-at-startup")
+          ])
+
+          (plain "input" [
+            (plain "keyboard" [
+              (sleaf "repeat-delay" 300)
+              (sleaf "repeat-rate" 50)
+
+              (plain "xkb" [
+                (sleaf "layout" "us,us")
+                (sleaf "variant" "dvp,")
+                (sleaf "options" "compose:caps,grp:win_space_toggle")
+              ])
+            ])
+
+            (flag "workspace-auto-back-and-forth")
+            # (sleaf "focus-follows-mouse" {})
+            # (flag "warp-mouse-to-focus")
+
+            # (plain "touchpad" [ (flag "off") ])
+            (plain "trackball" [
+              (sleaf "scroll-method" "on-button-down")
+              (sleaf "scroll-button" 278)
+            ])
+            (plain "touch" [
+              (sleaf "map-to-output" "eDP-1")
+            ])
+          ])
+
+          (plain "gestures" [
+            (plain "hot-corners" [(flag "off")])
+          ])
+
+          (plain "environment" (lib.mapAttrsToList sleaf {
+            NIXOS_OZONE_WL = "1";
+            QT_QPA_PLATFORM = "wayland";
+            QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
+            GDK_BACKEND = "wayland";
+            SDL_VIDEODRIVER = "wayland";
+            DISPLAY = ":0";
+            ELECTRON_OZONE_PLATFORM_HINT = "auto";
+            SSH_ASKPASS_REQUIRE = "prefer";
+            SSH_ASKPASS = lib.getExe pkgs.kdePackages.ksshaskpass;
+            SUDO_ASKPASS = lib.getExe pkgs.kdePackages.ksshaskpass;
+          }))
+
+          (node "output" ["eDP-1"] [
+            (sleaf "scale" 1.5)
+            (sleaf "position" { x = 0; y = 0; })
+          ])
+          (node "output" ["Ancor Communications Inc ASUS PB287Q 0x0000DD9B"] [
+            (sleaf "scale" 1.5)
+            (sleaf "position" { x = 2560; y = 0; })
+          ])
+          (node "output" ["HP Inc. HP 727pu CN4417143K"] [
+            (sleaf "mode" "2560x1440@119.998")
+            (sleaf "scale" 1)
+            (sleaf "position" { x = 2560; y = 0; })
+            (flag "variable-refresh-rate")
+          ])
+
+          (plain "debug" [
+            (sleaf "render-drm-device" "/dev/dri/by-path/pci-0000:00:02.0-render")
+          ])
+
+          (plain "animations" [
+            (sleaf "slowdown" 0.5)
+            (plain "workspace-switch" [(flag "off")])
+          ])
+
+          (plain "layout" [
+            (sleaf "gaps" 8)
+            (plain "struts" [
+              (sleaf "left" 26)
+              (sleaf "right" 26)
+              (sleaf "top" 0)
+              (sleaf "bottom" 0)
+            ])
+            (plain "border" [
+              (sleaf "width" 2)
+              (sleaf "active-gradient" {
+                from = "hsla(195 100% 45% 1)";
+                to = "hsla(155 100% 37.5% 1)";
+                angle = 29;
+                relative-to = "workspace-view";
+              })
+              (sleaf "inactive-gradient" {
+                from = "hsla(0 0% 27.7% 1)";
+                to = "hsla(0 0% 23% 1)";
+                angle = 29;
+                relative-to = "workspace-view";
+              })
+            ])
+            (plain "focus-ring" [
+              (flag "off")
+            ])
+
+            (plain "preset-column-widths" (map (prop: sleaf "proportion" prop) [
+              (1. / 4.) (1. / 3.) (1. / 2.) (2. / 3.) (3. / 4.) (1.)
+            ]))
+            (plain "default-column-width" [ (sleaf "proportion" (1. / 2.)) ])
+            (plain "preset-window-heights" (map (prop: sleaf "proportion" prop) [
+              (1. / 3.) (1. / 2.) (2. / 3.) (1.)
+            ]))
+
+            (flag "always-center-single-column")
+
+            (plain "tab-indicator" [
+              (sleaf "gap" 4)
+              (sleaf "width" 8)
+              (sleaf "gaps-between-tabs" 4)
+              (flag "place-within-column")
+              (sleaf "length" { total-proportion = 1.; })
+              (sleaf "active-gradient" {
+                from = "hsla(195 100% 60% 0.75)";
+                to = "hsla(155 100% 50% 0.75)";
+                angle = 29;
+                relative-to = "workspace-view";
+              })
+              (sleaf "inactive-gradient" {
+                from = "hsla(0 0% 42% 0.66)";
+                to = "hsla(0 0% 35% 0.66)";
+                angle = 29;
+                relative-to = "workspace-view";
+              })
+            ])
+          ])
+
+          (plain "cursor" [
+            (flag "hide-when-typing")
+          ])
+
+          (map (name:
+            (node "workspace" [name] [
+              (sleaf "open-on-output" "eDP-1")
+            ])
+          ) (map ({name, ...}: name) cfg.scratchspaces))
+          (map (name:
+            (sleaf "workspace" name)
+          ) ["comm" "web" "vid" "bmr"])
+
+          (plain "window-rule" [
+            (sleaf "clip-to-geometry" true)
+          ])
+
+          (plain "window-rule" [
+            (sleaf "match" { is-floating = true; })
+            (sleaf "geometry-corner-radius" 8)
+            (plain "shadow" [ (flag "on") ])
+          ])
+
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^org\\.keepassxc\\.KeePassXC$"; })
+            (sleaf "block-out-from" "screencast")
+          ])
+          (plain "window-rule" (normalize-nodes [
+            (map (title:
+              (sleaf "match" { app-id = "^org\\.keepassxc\\.KeePassXC$"; inherit title; })
+            ) ["^Unlock Database.*" "^Access Request.*" ".*Passkey credentials$" "Browser Access Request$"])
+            (sleaf "open-focused" true)
+            (sleaf "open-floating" true)
+          ]))
+
+          (map ({ name, match, exclude, windowRuleExtra, ... }:
+            (optional-node (match != []) (plain "window-rule" (normalize-nodes [
+              (map (sleaf "match") match)
+              (map (sleaf "exclude") exclude)
+              (sleaf "open-on-workspace" name)
+              (sleaf "open-maximized" true)
+              windowRuleExtra
+            ])))
+          ) cfg.scratchspaces)
+
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^emacs$"; })
+            (sleaf "match" { app-id = "^firefox$"; })
+            (plain "default-column-width" [(sleaf "proportion" (2. / 3.))])
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^kitty$"; })
+            (sleaf "match" { app-id = "^kitty-play$"; })
+            (plain "default-column-width" [(sleaf "proportion" (1. / 3.))])
+          ])
+
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^thunderbird$"; })
+            (sleaf "match" { app-id = "^Element$"; })
+            (sleaf "match" { app-id = "^chrome-web\.openrainbow\.com__-Default$"; })
+            (sleaf "open-on-workspace" "comm")
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^firefox$"; })
+            (sleaf "open-on-workspace" "web")
+            (sleaf "open-maximized" true)
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^mpv$"; })
+            (sleaf "open-on-workspace" "vid")
+            (plain "default-column-width" [(sleaf "proportion" 1.)])
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^kitty-play$"; })
+            (sleaf "open-on-workspace" "vid")
+            (sleaf "open-focused" false)
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^chrome-audiobookshelf\.yggdrasil\.li__-Default$"; })
+            (sleaf "match" { app-id = "^YouTube Music Desktop App$"; })
+            (sleaf "open-on-workspace" "vid")
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^pdfpc$"; })
+            (plain "default-column-width" [(sleaf "proportion" 1.)])
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^pdfpc$"; title = "^.*presentation.*$"; })
+            (plain "default-column-width" [(sleaf "proportion" 1.)])
+            (sleaf "open-fullscreen" true)
+            (sleaf "open-on-workspace" "bmr")
+            (sleaf "open-focused" false)
+          ])
+          (plain "window-rule" (normalize-nodes [
+            (map (sleaf "match") [
+              { app-id = "^Gimp-"; title = "^Quit GIMP$"; }
+              { app-id = "^org\\.kde\\.polkit-kde-authentication-agent-1$"; }
+              { app-id = "^xdg-desktop-portal-gtk$"; }
+            ])
+            (sleaf "open-floating" true)
+          ]))
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^org\\.pwmt\\.zathura$"; })
+            (sleaf "match" { app-id = "^evince$"; })
+            (sleaf "match" { app-id = "^org\\.gnome\\.Papers$"; })
+            (sleaf "default-column-display" "tabbed")
+          ])
+
+          (plain "layer-rule" [
+            (sleaf "match" { namespace = "^notifications$"; })
+            (sleaf "match" { namespace = "^waybar$"; })
+            (sleaf "match" { namespace = "^launcher$"; })
+            (sleaf "block-out-from" "screencast")
+          ])
+
+          (plain "binds"
+            (let
+              bind = name: cfg: node name [(lib.removeAttrs cfg ["action"])] (lib.mapAttrsToList leaf (lib.removeAttrs cfg.action ["__functor"]));
+            in
+              normalize-nodes [
+                (lib.mapAttrsToList bind (with config.lib.niri.actions; {
+                  "Mod+Slash".action = show-hotkey-overlay;
+
+                  "Mod+Return".action = spawn terminal;
+                  "Mod+Shift+Return".action =
+                    let
+                      nushellKitty = pkgs.symlinkJoin {
+                        name = "nushell-kitty";
+                        paths = [ config.programs.kitty.package ];
+                        buildInputs = [ pkgs.makeWrapper ];
+                        postBuild = ''
+                          wrapProgram $out/bin/kitty \
+                            --add-flags "--config ${pkgs.writeText "kitty.conf" ''
+                              include $HOME/${config.xdg.configFile."kitty/kitty.conf".target}
+                              shell ${lib.getExe config.programs.nushell.package}
+                            ''}"
+                        '';
+                      };
+                    in spawn (lib.getExe' nushellKitty "kitty");
+                  "Mod+Q".action = close-window;
+                  "Mod+O".action = spawn (lib.getExe config.programs.fuzzel.package);
+                  "Mod+Shift+O".action = spawn (lib.getExe config.programs.fuzzel.package) "--list-executables-in-path";
+
+                  "Mod+Alt+E".action = spawn (lib.getExe' config.services.emacs.package "emacsclient") "-c";
+                  "Mod+Alt+Y".action = spawn (lib.getExe (pkgs.writeShellApplication {
+                    name = "queue-yt-dlp";
+                    runtimeInputs = with pkgs; [ wl-clipboard-rs socat ];
+                    text = ''
+                      socat STDIO UNIX-CONNECT:"$XDG_RUNTIME_DIR"/yt-dlp.sock <<<$'{ "urls": ["'"$(wl-paste)"$'"] }'
+                    '';
+                  }));
+                  "Mod+Alt+L".action = spawn (lib.getExe (pkgs.writeShellApplication {
+                    name = "queue-yt-dlp";
+                    runtimeInputs = with pkgs; [ wl-clipboard-rs config.programs.kitty.package ];
+                    text = ''
+                      exec -- kitty --app-id kitty-play --directory "$HOME"/media mpv "$(wl-paste)"
+                    '';
+                  }));
+                  "Mod+Alt+M".action = spawn (lib.getExe' pkgs.screen-message "sm") "-n" "Fira Mono" "-a" "1" "-f" "#fff" "-b" "#000";
+
+                  "Mod+U".action = spawn (lib.getExe (pkgs.writeShellApplication {
+                    name = "qalc-fuzzel";
+                    runtimeInputs = with pkgs; [ wl-clipboard-rs libqalculate config.programs.fuzzel.package coreutils findutils libnotify gnugrep ];
+                    text = ''
+                      RESULTS_DIR="$HOME/.cache/qalc-fuzzel"
+                      prev() {
+                        FOUND=false
+                        while IFS= read -r line; do
+                          [[ -n "$line" ]] || continue
+                          FOUND=true
+                          echo "$line"
+                        done < <(export LC_ALL=C.UTF-8; echo; find "$RESULTS_DIR" -type f -printf $'%T@ %p\n' | sort -n | cut -d' ' -f2- | xargs -r cat)
+                        $FOUND || echo
+                      }
+                      FUZZEL_RES=$(prev | fuzzel --dmenu --prompt "qalc> " --width=60) || exit $?
+                      if [[ "$FUZZEL_RES" =~ .*\ =\ .* ]]; then
+                        QALC_RES="$FUZZEL_RES"
+                        QALC_RET=0
+                      else
+                        QALC_RES=$(qalc -set "autocalc off" "$FUZZEL_RES" 2>&1)
+                        QALC_RET=$?
+                      fi
+                      [[ -n "$QALC_RES" ]] || exit 1
+                      EXISTING=false
+                      set +o pipefail
+                      grep -Fxrl "$QALC_RES" "$RESULTS_DIR" | xargs -r touch
+                      [[ ''${PIPESTATUS[0]} -eq 0 ]] && EXISTING=true
+                      set -o pipefail
+                      if [[ $QALC_RET -eq 0 ]] && ! $EXISTING; then
+                        set +o pipefail
+                        RES_FILE="$RESULTS_DIR"/$(date -uIs).$(tr -Cd 'a-zA-Z0-9' </dev/random | head -c 10)
+                        set -o pipefail
+                        cat >"$RES_FILE" <<<"$QALC_RES"
+                      fi
+                      [[ "$QALC_RES" =~ .*\ =\ (.*) ]] && QALC_RES="''${BASH_REMATCH[1]}"
+                      [[ $QALC_RET -eq 0 ]] && wl-copy "$QALC_RES"
+                      notify-send "$QALC_RES"
+                    '';
+                  }));
+                  "Mod+Shift+U".action =
+                    let
+                      qalcKitty = pkgs.symlinkJoin {
+                        name = "qalc-kitty";
+                        paths = [ config.programs.kitty.package ];
+                        buildInputs = [ pkgs.makeWrapper ];
+                        postBuild = ''
+                          wrapProgram $out/bin/kitty \
+                            --add-flags "--config ${pkgs.writeText "kitty.conf" ''
+                              include $HOME/${config.xdg.configFile."kitty/kitty.conf".target}
+                              shell ${lib.getExe pkgs.libqalculate}
+                            ''}"
+                        '';
+                      };
+                    in spawn (lib.getExe' qalcKitty "kitty");
+                  "Mod+E".action = spawn (lib.getExe (pkgs.writeShellApplication {
+                    name = "emoji-fuzzel";
+                    runtimeInputs = with pkgs; [ config.programs.fuzzel.package wtype wl-clipboard-rs ];
+                    text = ''
+                      FUZZEL_RES=$(fuzzel --dmenu --prompt "emoji> " --cache "$HOME"/.cache/fuzzel-emoji --width=60 <"$HOME"/.local/share/emoji-data/list.txt) || exit $?
+                      [[ -n "$FUZZEL_RES" ]] || exit 1
+                      wl-copy "$(cut -d ':' -f 1 <<<"$FUZZEL_RES" | tr -d '\n')" && wtype -k XF86Paste
+                    '';
+                  }));
+                  "Print".action = screenshot;
+                  "Control+Print".action = screenshot-window;
+                  "Shift+Print".action = kdl.magic-leaf "screenshot-screen";
+                  "Mod+B".action = with-select-window-action ".workspace_id == ($active_workspace | tonumber)" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
+                  "Mod+Shift+B".action = with-select-window-action "true" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
+
+                  "Mod+Escape" = {
+                    allow-inhibiting = false;
+                    action = toggle-keyboard-shortcuts-inhibit;
+                  };
+
+                  "Mod+H".action = focus-column-left;
+                  "Mod+T".action = focus-window-down;
+                  "Mod+N".action = focus-window-up;
+                  "Mod+S".action = focus-column-right;
+
+                  "Mod+Shift+H".action = move-column-left;
+                  "Mod+Shift+T".action = move-window-down;
+                  "Mod+Shift+N".action = move-window-up;
+                  "Mod+Shift+S".action = move-column-right;
+
+                  "Mod+Control+H".action = focus-monitor-left;
+                  "Mod+Control+T".action = focus-monitor-down;
+                  "Mod+Control+N".action = focus-monitor-up;
+                  "Mod+Control+S".action = focus-monitor-right;
+
+                  "Mod+Shift+Control+H".action = move-workspace-to-monitor-left;
+                  "Mod+Shift+Control+T".action = move-workspace-to-monitor-down;
+                  "Mod+Shift+Control+N".action = move-workspace-to-monitor-up;
+                  "Mod+Shift+Control+S".action = move-workspace-to-monitor-right;
+
+                  "Mod+G".action = focus-adjacent-workspace "down";
+                  "Mod+C".action = focus-adjacent-workspace "up";
+
+                  "Mod+Shift+G".action = move-column-to-adjacent-workspace "down";
+                  "Mod+Shift+C".action = move-column-to-adjacent-workspace "up";
+
+                  "Mod+Shift+Control+G".action = move-workspace-down;
+                  "Mod+Shift+Control+C".action = move-workspace-up;
+
+                  "Mod+ParenLeft".action = focus-workspace "comm";
+                  "Mod+Shift+ParenLeft".action = kdl.magic-leaf "move-column-to-workspace" "comm";
+
+                  "Mod+ParenRight".action = focus-workspace "web";
+                  "Mod+Shift+ParenRight".action = kdl.magic-leaf "move-column-to-workspace" "web";
+
+                  "Mod+BraceRight".action = focus-workspace "read";
+                  "Mod+Shift+BraceRight".action = kdl.magic-leaf "move-column-to-workspace" "read";
+
+                  "Mod+BraceLeft".action = focus-workspace "mon";
+                  "Mod+Shift+BraceLeft".action = kdl.magic-leaf "move-column-to-workspace" "mon";
+
+                  "Mod+Asterisk".action = focus-workspace "vid";
+                  "Mod+Shift+Asterisk".action = kdl.magic-leaf "move-column-to-workspace" "vid";
+
+                  "Mod+Plus".action = with-unnamed-workspace-action ''{"Action":{"FocusWorkspace":{"reference":{"Id": .id}}}}'';
+                  "Mod+Shift+Plus".action = with-unnamed-workspace-action ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}, "focus": true}}}'';
+
+                  "Mod+M".action = consume-or-expel-window-left;
+                  "Mod+W".action = consume-or-expel-window-right;
+
+                  "Mod+Shift+M".action = toggle-column-tabbed-display;
+
+                  "Mod+R".action = switch-preset-column-width;
+                  "Mod+Shift+R".action = maximize-column;
+                  "Mod+Shift+Ctrl+R".action = switch-preset-window-height;
+                  "Mod+F".action = center-column;
+                  "Mod+Shift+F".action = toggle-windowed-fullscreen;
+                  "Mod+Ctrl+Shift+F".action = fullscreen-window;
+
+                  "Mod+V".action = switch-focus-between-floating-and-tiling;
+                  "Mod+Shift+V".action = toggle-window-floating;
+
+                  "Mod+Left".action = set-column-width "-10%";
+                  "Mod+Down".action = set-window-height "-10%";
+                  "Mod+Up".action = set-window-height "+10%";
+                  "Mod+Right".action = set-column-width "+10%";
+
+                  "Mod+Shift+Z" = {
+                    action = spawn (lib.getExe niri) "msg" "action" "power-off-monitors";
+                    allow-when-locked = true;
+                  };
+                  "Mod+Shift+L".action = spawn loginctl "lock-session";
+                  "Mod+Shift+E".action = quit;
+                  "Mod+Shift+Minus" = {
+                    action = spawn systemctl "suspend";
+                    allow-when-locked = true;
+                  };
+                  "Mod+Shift+Control+Minus" = {
+                    action = spawn systemctl "hibernate";
+                    allow-when-locked = true;
+                  };
+                  "Mod+Shift+P" = {
+                    action = spawn (lib.getExe pkgs.playerctl) "-a" "pause";
+                    allow-when-locked = true;
+                  };
+
+                  "XF86MonBrightnessUp" = {
+                    action = spawn swayosd-client "--brightness" "raise";
+                    allow-when-locked = true;
+                  };
+                  "XF86MonBrightnessDown" = {
+                    action = spawn swayosd-client "--brightness" "lower";
+                    allow-when-locked = true;
+                  };
+                  "XF86AudioRaiseVolume" = {
+                    action = spawn swayosd-client "--output-volume" "raise";
+                    allow-when-locked = true;
+                  };
+                  "XF86AudioLowerVolume" = {
+                    action = spawn swayosd-client "--output-volume" "lower";
+                    allow-when-locked = true;
+                  };
+                  "XF86AudioMute" = {
+                    action = spawn swayosd-client "--output-volume" "mute-toggle";
+                    allow-when-locked = true;
+                  };
+                  "XF86AudioMicMute" = {
+                    action = spawn swayosd-client "--input-volume" "mute-toggle";
+                    allow-when-locked = true;
+                  };
+
+                  "Mod+Semicolon".action = spawn makoctl "dismiss" "--group";
+                  "Mod+Shift+Semicolon".action = spawn makoctl "dismiss" "--all";
+                  "Mod+Period".action = spawn makoctl "menu" "--" (lib.getExe config.programs.fuzzel.package) "--dmenu";
+                  "Mod+Comma".action = spawn makoctl "restore";
+
+                  "Mod+Control+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"FocusWorkspace\":{\"reference\":{\"Id\": $workspace_id}}}}";
+                  "Mod+Control+Shift+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"MoveColumnToWorkspace\":{\"reference\":{\"Id\": $workspace_id}, \"focus\": true}}}";
+
+                  "Mod+X".action = set-dynamic-cast-window;
+                  "Mod+Shift+X".action = set-dynamic-cast-monitor;
+                  "Mod+Control+Shift+X".action = clear-dynamic-cast-target;
+
+                  "Mod+D".action = with-urgent-window-action "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
+                  "Mod+Shift+D".action = with-focused-window-action "{\"Action\":{\"UnsetUrgent\":{\"id\": .id}}}";
+
+                  "Mod+K".action = spawn (lib.getExe' pkgs.worktime "worktime-ui");
+                  "Mod+Shift+K".action = spawn (lib.getExe' pkgs.worktime "worktime-stop");
+                }))
+                (map ({ name, selector, spawn, key, ...}: if key != null && selector != null && spawn != null then bind key { action = focus-or-spawn-action selector name spawn; } else null) cfg.scratchspaces)
+                (map ({ name, moveKey, ...}: if moveKey != null then bind moveKey { action = kdl.magic-leaf "move-column-to-workspace" name; } else null) cfg.scratchspaces)
+              ]
+            ))
+        ];
+  };
+}
diff --git a/accounts/gkleen@sif/niri/mako.nix b/accounts/gkleen@sif/niri/mako.nix
new file mode 100644
index 00000000..703d5f7b
--- /dev/null
+++ b/accounts/gkleen@sif/niri/mako.nix
@@ -0,0 +1,112 @@
+{ config, lib, pkgs, ... }:
+{
+  config = {
+    services.mako = {
+      enable = true;
+      settings = {
+        font = "Fira Sans 10";
+        format = "<i>%s</i>\\n%b";
+        margin = "2";
+        max-visible = -1;
+        background-color = "#000000dd";
+        progress-color = "source #223544ff";
+        width = 384;
+        outer-margin = 1;
+        max-history = 100;
+        max-icon-size = 48;
+
+        grouped.format = "<b>(%g)</b> <i>%s</i>\\n%b";
+        "urgency=low".text-color = "#999999ff";
+        "urgency=critical".background-color = "#900000dd";
+        "app-name=Element".group-by = "summary";
+        "app-name=poweralertd" = {
+          history = false;
+          ignore-timeout = true;
+          default-timeout = 2000;
+        };
+        "app-name=worktime".history = false;
+        "mode=silent".invisible = true;
+      };
+      package = pkgs.symlinkJoin {
+        name = "${pkgs.mako.name}-wrapped";
+        paths = with pkgs; [ mako ];
+        inherit (pkgs.mako) meta;
+        postBuild = ''
+          rm -r $out/share/dbus-1
+        '';
+      };
+    };
+    systemd.user.services.mako = {
+      Unit = {
+        Description = "Mako notification daemon";
+        PartOf = [ "graphical-session.target" ];
+      };
+      Install = {
+        WantedBy = [ "graphical-session.target" ];
+      };
+      Service = {
+        Type = "dbus";
+        BusName = "org.freedesktop.Notifications";
+        ExecStart = lib.getExe config.services.mako.package;
+        RestartSec = 5;
+        Restart = "always";
+      };
+    };
+
+    systemd.user.services.mako-follows-focus = {
+      Unit = {
+        BindsTo = [ "niri.service" "mako.service" ];
+        After = [ "niri.service" "mako.service" ];
+      };
+      Service = {
+        Type = "simple";
+        Restart = "always";
+        ExecStart = pkgs.writers.writePython3 "mako-follows-focus" {
+          libraries = with pkgs.python3Packages; [];
+        } ''
+          import os
+          import socket
+          import json
+          import subprocess
+
+
+          current_output = None
+          workspaces = []
+
+
+          def output_changed(new_output):
+              global current_output
+
+              if current_output == new_output:
+                  return
+
+              current_output = new_output
+              subprocess.run(["makoctl", "reload"])
+
+
+          sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+          sock.connect(os.environ["NIRI_SOCKET"])
+          sock.send(b"\"EventStream\"\n")
+          for line in sock.makefile(buffering=1, encoding='utf-8'):
+              if line_json := json.loads(line):
+                  if "WorkspacesChanged" in line_json:
+                      workspaces = line_json["WorkspacesChanged"]["workspaces"]
+                      for workspace in workspaces:
+                          if not workspace["is_focused"]:
+                              continue
+                          output_changed(workspace["output"])
+                          break
+                  if "WorkspaceActivated" in line_json and line_json["WorkspaceActivated"]["focused"]:  # noqa: E501
+                      for workspace in workspaces:
+                          if not workspace["id"] == line_json["WorkspaceActivated"]["id"]:  # noqa: E501
+                              continue
+                          output_changed(workspace["output"])
+                          break
+        '';
+      };
+      Install = {
+        WantedBy = [ "mako.service" ];
+      };
+    };
+  };
+}
diff --git a/accounts/gkleen@sif/niri/swayosd.nix b/accounts/gkleen@sif/niri/swayosd.nix
new file mode 100644
index 00000000..54ebb302
--- /dev/null
+++ b/accounts/gkleen@sif/niri/swayosd.nix
@@ -0,0 +1,66 @@
+{ pkgs, ... }:
+{
+  config = {
+    services.swayosd = {
+      enable = true;
+      topMargin = 0.4769706078;
+      stylePath = pkgs.runCommand "style.css" {
+        passAsFile = [ "src" ];
+        src = ''
+          window#osd {
+            padding: 12px 20px;
+            border-radius: 999px;
+            border: none;
+            background: rgba(0, 0, 0, 0.87);
+
+            #container {
+              margin: 16px;
+            }
+
+            image,
+            label {
+              color: rgb(255, 255, 255);
+
+              &:disabled {
+                opacity: 1;
+                color: rgb(84, 84, 84);
+              }
+            }
+
+            progressbar {
+              min-height: 6px;
+              border-radius: 999px;
+              background: transparent;
+              border: none;
+
+              trough, progress {
+                min-height: inherit;
+                border-radius: inherit;
+                border: none;
+              }
+
+              trough {
+                background: rgb(127, 127, 127);
+              }
+              progress {
+                background: rgb(255, 255, 255);
+              }
+
+              &:disabled {
+                opacity: 1;
+
+                trough {
+                  background: rgb(19, 19, 19);
+                }
+                progress {
+                  background: rgb(38, 38, 38);
+                }
+              }
+            }
+          }
+        '';
+        buildInputs = with pkgs; [sass];
+      } "scss -C --sourcemap=none --style=compact $srcPath $out";
+    };
+  };
+}
diff --git a/accounts/gkleen@sif/niri/waybar.nix b/accounts/gkleen@sif/niri/waybar.nix
new file mode 100644
index 00000000..c02a9a76
--- /dev/null
+++ b/accounts/gkleen@sif/niri/waybar.nix
@@ -0,0 +1,358 @@
+{ lib, config, pkgs, ... }:
+let
+  swayosd-client = lib.getExe' config.services.swayosd.package "swayosd-client";
+in {
+  config = {
+    programs.waybar = {
+      enable = true;
+      systemd = {
+        enable = true;
+        target = "graphical-session.target";
+      };
+      settings = let
+        windowRewrites = {
+          "(.*) — Mozilla Firefox" = "$1";
+          "(.*) - Mozilla Thunderbird" = "$1";
+          "(.*) - mpv" = "$1";
+        };
+        iconSize = 11;
+      in [
+        {
+          layer = "top";
+          position = "top";
+          height = 21;
+          output = [ "eDP-1" "DP-2" "DP-3" ];
+          modules-left = [ "niri/workspaces" ];
+          modules-center = [ "niri/window" ];
+          modules-right = [ "custom/worktime" "custom/worktime-today"
+            "custom/weather"
+            "custom/keymap"
+            "privacy" "tray" "wireplumber" "backlight" "battery" "idle_inhibitor" "custom/mako" "custom/lid_inhibitor" "clock" ];
+
+          "custom/lid_inhibitor" = {
+            format = "{}";
+            return-type = "json";
+            exec = lib.getExe pkgs.waybar-systemd-inhibit;
+            on-click = lib.getExe' pkgs.waybar-systemd-inhibit "waybar-systemd-inhibit-toggle";
+          };
+          "custom/mako" = {
+            format = "{}";
+            return-type = "json";
+            exec = pkgs.writers.writePython3 "mako-silent" { libraries = [ pkgs.python3Packages.dbus-next ]; } ''
+              from dbus_next.aio import MessageBus
+
+              import asyncio
+
+              import json
+
+
+              loop = asyncio.new_event_loop()
+              asyncio.set_event_loop(loop)
+
+
+              async def main():
+                  bus = await MessageBus().connect()
+                  # the introspection xml would normally be included in your project, but
+                  # this is convenient for development
+                  introspection = await bus.introspect('org.freedesktop.Notifications', '/fr/emersion/Mako')  # noqa: E501
+
+                  obj = bus.get_proxy_object('org.freedesktop.Notifications', '/fr/emersion/Mako', introspection)  # noqa: E501
+                  mako = obj.get_interface('fr.emersion.Mako')
+                  properties = obj.get_interface('org.freedesktop.DBus.Properties')
+
+                  async def print_mode():
+                      modes = await mako.get_modes()
+                      is_silent = "silent" in modes
+                      icon = "&#xf009b;" if is_silent else "&#xf009a;"
+                      text = f"<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>"  # noqa: E501
+                      if is_silent:
+                          text = f"<span color=\"#ffffff\">{text}</span>"
+                      print(json.dumps({'text': text, 'tooltip': ', '.join(modes)}, separators=(',', ':')), flush=True)  # noqa: E501
+
+                  async def on_properties_changed(interface_name, changed_properties, invalidated_properties):  # noqa: E501
+                      if "Modes" not in invalidated_properties:
+                          return
+
+                      await print_mode()
+
+                  properties.on_properties_changed(on_properties_changed)
+                  await print_mode()
+
+                  await loop.create_future()
+
+
+              loop.run_until_complete(main())
+            '';
+            on-click = "makoctl mode -t silent";
+          };
+          "custom/weather" = {
+            format = "{}";
+            tooltip = true;
+            interval = 3600;
+            exec = "${lib.getExe pkgs.wttrbar} --hide-conditions --nerd --custom-indicator \"<span font=\\\"Symbols Nerd Font Mono\\\" size=\\\"100%\\\">{ICON}</span> {FeelsLikeC}°\"";
+            return-type = "json";
+          };
+          "custom/keymap" = {
+            format = "{}";
+            tooltip = true;
+            return-type = "json";
+            exec = pkgs.writers.writePython3 "keymap" {} ''
+              import os
+              import socket
+              import json
+
+
+              def output(keymap):
+                  short = keymap
+                  if keymap == "English (programmer Dvorak)":
+                      short = "dvp"
+                  elif keymap == "English (US)":
+                      short = "<span color=\"#ffffff\">us</span>"
+                  print(json.dumps({'text': short, 'tooltip': keymap}, separators=(',', ':')), flush=True)  # noqa: E501
+
+
+              keyboard_layouts = []
+
+              sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+              sock.connect(os.environ["NIRI_SOCKET"])
+              sock.send(b"\"EventStream\"\n")
+              for line in sock.makefile(buffering=1, encoding='utf-8'):
+                  if line_json := json.loads(line):
+                      if "KeyboardLayoutsChanged" in line_json:
+                          keyboard_layouts = line_json["KeyboardLayoutsChanged"]["keyboard_layouts"]["names"]  # noqa: E501
+                          output(keyboard_layouts[line_json["KeyboardLayoutsChanged"]["keyboard_layouts"]["current_idx"]])  # noqa: E501
+                      if "KeyboardLayoutSwitched" in line_json:
+                          output(keyboard_layouts[line_json["KeyboardLayoutSwitched"]["idx"]])  # noqa: E501
+            '';
+            on-click = "niri msg action switch-layout next";
+          };
+          "custom/worktime" = {
+            interval = 60;
+            exec = "${lib.getExe pkgs.worktime} time --waybar";
+            return-type = "json";
+          };
+          "custom/worktime-today" = {
+            interval = 60;
+            exec = "${lib.getExe pkgs.worktime} today --waybar";
+            return-type = "json";
+          };
+          "niri/workspaces" = {
+            ignore = map ({ name, ... }: name) config.programs.niri.scratchspaces;
+          };
+          "niri/window" = {
+            separate-outputs = true;
+            icon = true;
+            icon-size = 14;
+            rewrite = windowRewrites;
+          };
+          clock = {
+              interval = 1;
+              # timezone = "Europe/Berlin";
+              format = "W{:%V-%u %F %H:%M:%S%Ez}";
+              tooltip-format = "<tt><small>{calendar}</small></tt>";
+              calendar = {
+                mode = "year";
+                mode-mon-col = 3;
+                weeks-pos = "left";
+                on-scroll = 1;
+                format = {
+                  months = "<span color='#ffead3'><b>{}</b></span>";
+                  days = "{}";
+                  weeks = "<span color='#99ffdd'><b>{}</b></span>";
+                  weekdays = "<span color='#ffcc66'><b>{}</b></span>";
+                  today = "<span color='#ff6699'><b>{}</b></span>";
+                };
+              };
+          };
+          battery = {
+            format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
+            icon-size = iconSize - 2;
+            states = { warning = 30; critical = 15; };
+            format-icons = ["&#xf008e;" "&#xf007a;" "&#xf007b;" "&#xf007c;" "&#xf007d;" "&#xf007e;" "&#xf007f;" "&#xf0080;" "&#xf0081;" "&#xf0082;" "&#xf0079;" ];
+            format-charging = "&#xf0084;";
+            format-plugged = "&#xf06a5;";
+            tooltip-format = "{capacity}% {timeTo}";
+            interval = 20;
+          };
+          tray = {
+            icon-size = 16;
+            # show-passive-items = true;
+            spacing = 1;
+          };
+          privacy = {
+            icon-spacing = 7;
+            icon-size = iconSize;
+            modules = [
+              { type = "screenshare"; }
+              { type = "audio-in"; }
+            ];
+          };
+          idle_inhibitor = {
+            format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
+            icon-size = iconSize;
+            format-icons = { activated = "&#xf0208;"; deactivated = "&#xf0209;"; };
+            timeout = 120;
+          };
+          backlight = {
+            format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
+            icon-size = iconSize;
+            tooltip-format = "{percent}%";
+            format-icons = ["&#xf00da;" "&#xf00db;" "&#xf00dc;" "&#xf00dd;" "&#xf00de;" "&#xf00df;" "&#xf00e0;"];
+            on-scroll-up = "${swayosd-client} --brightness raise";
+            on-scroll-down = "${swayosd-client} --brightness lower";
+          };
+          wireplumber = {
+            format = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>";
+            icon-size = iconSize;
+            tooltip-format = "{volume}% {node_name}";
+            format-icons = ["&#xf057f;" "&#xf0580;" "&#xf057e;"];
+            format-muted = "<span font=\"Symbols Nerd Font Mono\" size=\"90%\">&#xf075f;</span>";
+            # ignored-sinks = ["Easy Effects Sink"];
+            on-scroll-up = "${swayosd-client} --output-volume raise";
+            on-scroll-down = "${swayosd-client} --output-volume lower";
+            on-click = "${swayosd-client} --output-volume mute-toggle";
+          };
+        }
+        {
+          layer = "top";
+          position = "top";
+          height = 14;
+          output = [ "!eDP-1" "!DP-2" "!DP-3" "*" ];
+          modules-left = [ "niri/workspaces" ];
+          modules-center = [ "niri/window" ];
+          modules-right = [ "clock" ];
+
+          "niri/workspaces" = {
+            ignore = map ({ name, ... }: name) config.programs.niri.scratchspaces;
+          };
+          "niri/window" = {
+            separate-outputs = true;
+            icon = true;
+            icon-size = 14;
+            rewrite = windowRewrites;
+          };
+          clock = {
+              interval = 1;
+              # timezone = "Europe/Berlin";
+              format = "{:%H:%M}";
+              tooltip-format = "W{:%V-%u %F %H:%M:%S%Ez}";
+          };
+        }
+      ];
+      style = ''
+        @define-color white #ffffff;
+        @define-color grey #555555;
+        @define-color blue #1a8fff;
+        @define-color green #23fd00;
+        @define-color orange #f28a21;
+        @define-color red #f2201f;
+
+        * {
+          border: none;
+          font-family: "Fira Sans";
+          font-size: 10pt;
+          min-height: 0;
+        }
+
+        window#waybar {
+          background-color: rgba(0, 0, 0, 0.66);
+          color: @white;
+        }
+
+        .modules-left {
+          margin-left: 38px;
+        }
+        .modules-right {
+          margin-right: 38px;
+        }
+
+        .module {
+          margin: 0 5px;
+        }
+
+        #workspaces button {
+          color: @white;
+          padding: 2px 5px;
+        }
+        #workspaces button.empty {
+          color: @grey;
+        }
+        #workspaces button.active {
+          color: @green;
+        }
+        #workspaces button.urgent {
+          color: @red;
+        }
+
+        #custom-weather, #custom-keymap, #custom-worktime, #custom-worktime-today {
+          color: @grey;
+          margin: 0 5px;
+        }
+        #custom-weather {
+          margin-right: 3px;
+        }
+        #custom-keymap {
+          margin-left: 3px;
+          margin-right: 3px;
+        }
+
+        #tray {
+          margin: 0;
+        }
+        #battery, #idle_inhibitor, #backlight, #wireplumber, #custom-mako, #custom-lid_inhibitor {
+          color: @grey;
+          margin: 0 5px 0 2px;
+        }
+        #idle_inhibitor {
+          margin-right: 4px;
+          margin-left: 6px;
+        }
+        #custom-mako {
+          margin-right: 4px;
+          margin-left: 3px;
+        }
+        #custom-lid_inhibitor {
+          margin-right: 3px;
+          margin-left: 3px;
+        }
+        #battery {
+          margin-right: 3px;
+        }
+        #battery.discharging {
+          color: @white;
+        }
+        #battery.warning {
+          color: @orange;
+        }
+        #battery.critical {
+          color: @red;
+        }
+        #battery.charging {
+          color: @white;
+        }
+        #idle_inhibitor.activated {
+          color: @white;
+        }
+        #custom-worktime.running, #custom-worktime-today.running {
+          color: @white;
+        }
+        #custom-worktime.over, #custom-worktime-today.over {
+          color: @orange;
+        }
+
+        #idle_inhibitor, #custom-lid_inhibitor {
+          padding-top: 1px;
+        }
+
+        #privacy {
+          color: @red;
+          margin: -1px 4px 0px 3px;
+        }
+        #clock {
+          /* margin-right: 5px; */
+          font-feature-settings: "tnum";
+        }
+      '';
+    };
+  };
+}
diff --git a/accounts/gkleen@sif/ssh-hosts.nix b/accounts/gkleen@sif/ssh-hosts.nix
index 107f1e76..a250509b 100644
--- a/accounts/gkleen@sif/ssh-hosts.nix
+++ b/accounts/gkleen@sif/ssh-hosts.nix
@@ -1,5 +1,12 @@
-{ pkgs, ... }:
-{
+{ lib, pkgs, ... }:
+let
+  autosshProxyPorts = {
+    "ssh.math.lmu.de" = 8118;
+    "mathw0h" = 8122;
+    "mathw0e" = 8124;
+  };
+  autosshProxy = host: "${lib.getExe pkgs.socat} - SOCKS4A:127.0.0.1:%h:%p,socksport=${toString autosshProxyPorts.${host}}";
+in {
   "git.ymir" =
     { hostname = "ymir.yggdrasil.li";
       user = "gitolite";
@@ -290,15 +297,15 @@
     };
   "mathw0d" =
     { hostname = "mathw0d.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mathw0e" =
     { hostname = "mathw0e.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mathw0f" =
     { hostname = "mathw0f.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mathw0g" =
     { hostname = "mathw0g.mathinst.loc";
@@ -306,8 +313,8 @@
   "mathw0h" =
     { hostname = "mathw0h.mathinst.loc";
     };
-  "proxy.mathw0g" =
-    { hostname = "mathw0g.mathinst.loc";
+  "proxy.ssh.math.lmu.de" =
+    { hostname = "ssh.math.lmu.de";
       extraOptions = {
         ControlPath = "none";
         ExitOnForwardFailure = "yes";
@@ -317,7 +324,17 @@
     };
   "proxy.mathw0h" =
     { hostname = "mathw0h.mathinst.loc";
-      proxyJump = "proxy.mathw0g";
+      proxyCommand = autosshProxy "ssh.math.lmu.de";
+      extraOptions = {
+        ControlPath = "none";
+        ExitOnForwardFailure = "yes";
+        ServerAliveCountMax = "15";
+        ServerAliveInterval = "2";
+      };
+    };
+  "proxy.mathw0e" =
+    { hostname = "mathw0e.mathinst.loc";
+      proxyCommand = autosshProxy "mathw0h";
       extraOptions = {
         ControlPath = "none";
         ExitOnForwardFailure = "yes";
@@ -327,7 +344,7 @@
     };
   "vrt-kvm06" =
     { hostname = "vrt-kvm06";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -336,7 +353,7 @@
     };
   "vrt-kvm05" =
     { hostname = "vrt-kvm05";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -345,7 +362,7 @@
     };
   "vrt-kvm04" =
     { hostname = "vrt-kvm04";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -354,7 +371,7 @@
     };
   "vrt-kvm02" =
     { hostname = "vrt-kvm02";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -363,7 +380,7 @@
     };
   "vrt-kvm03" =
     { hostname = "vrt-kvm03";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -372,7 +389,7 @@
     };
   "vrt-kvm01" =
     { hostname = "vrt-kvm01";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -381,39 +398,44 @@
     };
   "tts-www01" =
     { hostname = "tts-www01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "vpn-wg01" =
     { hostname = "vpn-wg01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "repo-apt01" =
     { hostname = "repo-apt01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "ldap-lmumr01" =
     { hostname = "ldap-lmumr01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "mail-mi01" =
     { hostname = "mail-mi01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mail-www02" =
     { hostname = "mail-www02.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "dpl-fai01" =
     { hostname = "dpl-fai01.mathinst.loc";
       user = "root";
     };
+  "dpl-fai02" =
+    { hostname = "dpl-fai02.mathinst.loc";
+      user = "root";
+      proxyJump = "mgmt01";
+    };
   "math05" =
     { hostname = "math05.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       extraOptions.KexAlgorithms = "+diffie-hellman-group1-sha1";
     };
   "switch01" =
@@ -439,20 +461,20 @@
     };
   "www-mi01" =
     { hostname = "www-mi01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "cip04" =
     { hostname = "cip04.cipmath.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mgmt-cls01" =
     { user = "root";
       hostname = "mgmt-cls01.cipmath.loc";
-      proxyJump = "ssh.math.lmu.de";
+      proxyCommand = autosshProxy "ssh.math.lmu.de";
     };
   "mgmt01" =
     { hostname = "mgmt01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "ssh-lb01" =
@@ -471,17 +493,17 @@
   "rdlx02" = { hostname = "rdlx02.mathinst.loc"; proxyJump = "mgmt01"; };
   "math0d" =
     { hostname = "math0d.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "dhcp01" =
     { hostname = "dhcp01.mathinst.loc";
       user = "root";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "dhcp02" =
     { hostname = "dhcp02.mathinst.loc";
       user = "root";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "cc-gpu-l01" =
     { hostname = "cc-gpu-l01.mathinst.loc";
@@ -546,7 +568,7 @@
       user = "root";
     };
   "nas*" =
-    { proxyJump = "mathw0e";
+    { proxyCommand = autosshProxy "mathw0e";
       user = "admin";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -554,9 +576,4 @@
         HostKeyAlgorithms = "+ecdsa-sha2-nistp256";
       };
     };
-  "game01" =
-    { hostname = "game01.yggdrasil.li";
-      user = "factorio";
-      identityFile = "~/.ssh/gkleen@sif.midgard.yggdrasil";
-    };
 }
diff --git a/accounts/gkleen@sif/synadm/default.nix b/accounts/gkleen@sif/synadm/default.nix
new file mode 100644
index 00000000..0a8e0d4c
--- /dev/null
+++ b/accounts/gkleen@sif/synadm/default.nix
@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  home.packages = with pkgs; [ synadm ];
+  sops.secrets."synadm.yaml" = {
+    format = "binary";
+    sopsFile = ./synadm_yaml;
+    path = config.xdg.configHome + "/synadm.yaml";
+  };
+}
diff --git a/accounts/gkleen@sif/synadm/synadm_yaml b/accounts/gkleen@sif/synadm/synadm_yaml
new file mode 100644
index 00000000..8d951ccc
--- /dev/null
+++ b/accounts/gkleen@sif/synadm/synadm_yaml
@@ -0,0 +1,15 @@
+{
+        "data": "ENC[AES256_GCM,data:qJy4Pmbbxja4jmW7OaHsD0mQZ7anZwLhiVmAgkavb+CqwWGDnUBXdz22/MHCbxng5NshcFSpBoCBhgY6B9V2bUiES6bH9AtMlDcs9ebKGMArBTUTnQ2MjWQGfQTqraWdNgy+n327uj9swwCH8EZXdYH/Hlv0t/re470W+VOHeXhGghQ3Y9IGz2sgfvMGr8QxaJNydZz85rgs5QUP/PglCwWIOw2mY1EX2vYwnmiAo49LmIEaxWvRi++KHaeBveDt0nlkJwzUlipL2VOKWxkgpK3yGucQn2mz+FRe1btp+4KGm8H17eUI9FO9sBwq,iv:kgM921ovwCgDYHQj3c5Rupy/8JxHehxUD2jb1k9Ik2Y=,tag:3TLQkJbv679VWy8V2TMugw==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bzVHUGNxZTF2WC9MYmZr\neGdVVzJXN3lGdEk3cTBER3J6UTFtcUJna2d3CjdNQmRXd2haZW1MYlJzNkk1dWVD\nVTFQc2gvS0JrejJ6SFh2MXpPWDZpRE0KLS0tIE0wTC85bEpvSnlGdGFkZVFhNjFZ\nbzRiZkxMWUg2ODNVUlBmNFlPNGRrZlkK1VXLJWcssv3ETyZSSM/Hhn5VIaI9iov9\nzShZA9Zx/FX6PYTuUMC29pJ57gKourcIxa/7HwSv/xYn1A6WcYfgSg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-18T11:03:42Z",
+                "mac": "ENC[AES256_GCM,data:yonJC68PhilAgEHNNJQ8nO53Qo3rx/LnfiOWfuMm24bOUIH9QM3WZZxpigd7bHI4eC4TqRb4LvcSi0nEURTRAhwiTqGNrWbpw2Iv3n5dhLEN9aTcetG5ZuhaXqfVUoML45/ovdBZG/0l8+XIHqxN2M/g/h4JwKoR/6lqzcrVhgo=,iv:xvxBJwy+E5zUdjhGPdZPdy7tnBIEj50hfiDJFsS3wNg=,tag:L4Fas36ZOg4h0QQwC4gjNA==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/accounts/gkleen@sif/systemd.nix b/accounts/gkleen@sif/systemd.nix
index 33bf7ef2..18c2315f 100644
--- a/accounts/gkleen@sif/systemd.nix
+++ b/accounts/gkleen@sif/systemd.nix
@@ -6,7 +6,7 @@ let
   cfg = config.home-manager.users.${userName};
 
   autossh-socks-script = pkgs.writeScript "autossh" ''
-    #!${pkgs.zsh}/bin/zsh -xe
+    #!${lib.getExe pkgs.zsh} -xe
 
     host="''${1%:*}"
     port="''${1#*:}"
@@ -15,31 +15,29 @@ let
     cmd=()
 
     if [[ -n "''${SSHPASS_SECRET}" ]]; then
-      cmd+=(${pkgs.sshpassSecret}/bin/sshpass-secret)
+      cmd+=(${lib.getExe' pkgs.sshpassSecret "sshpass-secret"})
       cmd+=("''${(@s/:/)SSHPASS_SECRET}")
       cmd+=(--)
     fi
 
-    cmd+=(${pkgs.openssh}/bin/ssh -vN -D localhost:''${port} "''${host}")
+    cmd+=(${lib.getExe' pkgs.openssh "ssh"} -vN -D 127.0.0.1:''${port} "''${host}")
 
     ( exec -a "''${cmd[1]}" -- ''${cmd} ) &
     pid=$!
 
     newpid=""
     i=200
-    while ! newpid=$(${pkgs.lsof}/bin/lsof -Pi @localhost:"''${port}" -sTCP:LISTEN -t); do
+    while ! newpid=$(${lib.getExe pkgs.lsof} -Pi @localhost:"''${port}" -sTCP:LISTEN -t); do
       if ! kill -0 "''${pid}"; then
         wait "''${pid}"
         exit $?
       fi
       [[ "''${i}" -gt 0 ]] || exit 1
       i=$((''${i} - 1))
-      ${pkgs.coreutils}/bin/sleep 0.1
+      ${lib.getExe' pkgs.coreutils "sleep"} 0.1
     done
 
-    ${config.systemd.package}/bin/systemd-notify --ready
-
-    wait "''${pid}" "''${newpid}"
+    ${lib.getExe' config.systemd.package "systemd-notify"} --pid=''${newpid} --ready
   '';
 in {
   tmpfiles.rules = [
@@ -48,11 +46,11 @@ in {
   ];
 
   services = {
-    sync-keepass = {
+    "sync-keepass@" = {
       Service = {
         Type = "oneshot";
         WorkingDirectory = "~";
-        ExecStart = toString (pkgs.writers.writePython3 "sync-keepass" {
+        ExecStart = "${pkgs.writers.writePython3 "sync-keepass" {
           libraries = with pkgs.python3Packages; [ python-dateutil ];
         } ''
           import json
@@ -61,13 +59,13 @@ in {
           from datetime import datetime
           from dateutil.tz import tzlocal
           from dateutil.parser import isoparse
-          from sys import stderr
+          from sys import stderr, argv
 
 
-          remote_fs = 'surtr'
-          remote_file = 'store.kdbx'
-          target_file = expanduser('~/store.kdbx')
-          meta_file = expanduser('~/.store.kdbx.json')
+          remote_fs = 'surtr' if argv[1] == 'store.kdbx' else 'mathcloud'
+          remote_file = argv[1]
+          target_file = expanduser(f'~/{argv[1]}')
+          meta_file = expanduser(f'~/.{argv[1]}.json')
 
           upload_time = None
           our_last_upload_time = None
@@ -117,22 +115,14 @@ in {
               do_upload()
           elif upload_time is not None and (mod_time is None or upload_time > mod_time) and (our_last_upload_time is None or upload_time > our_last_upload_time):  # noqa: E501
               do_download()
-        '');
+        ''} \"%I\"";
         Environment = [ "RCLONE_PASSWORD_COMMAND=\"${pkgs.coreutils}/bin/cat ${config.sops.secrets.gkleen-rclone.path}\"" "PATH=${pkgs.rclone}/bin" ];
       };
     };
     emacs = {
       Unit = {
-        After = ["graphical-session-pre.target"];
-      };
-    };
-    dunst = {
-      Service = {
-        ExecStart = lib.mkForce "${cfg.services.dunst.package}/bin/dunst";
-        Restart = "always";
-      };
-      Install = {
-        WantedBy = ["graphical-session.target"];
+        After = [ "graphical-session.target" ];
+        BindsTo = [ "graphical-session.target" ];
       };
     };
     keepassxc = {
@@ -144,8 +134,8 @@ in {
         Environment = [ "QT_QPA_PLATFORM=wayland" ];
       };
       Unit = {
-        Requires = ["graphical-session-pre.target"];
-        After = ["graphical-session-pre.target"];
+        After = [ "graphical-session.target" ];
+        BindsTo = [ "graphical-session.target" ];
       };
     };
     mpris-proxy = {
@@ -154,7 +144,7 @@ in {
       Service.ExecStart = "${pkgs.bluez}/bin/mpris-proxy";
       Install.WantedBy = [ "default.target" ];
     };
-    "autossh-socks@proxy.mathw0h:8119" = {
+    "autossh-socks@proxy.ssh.math.lmu.de:8119" = {
       Service = {
         Type = "notify";
         NotifyAccess = "all";
@@ -162,7 +152,7 @@ in {
         Restart = "always";
         RestartSec = "23s";
         ExecStart = "${autossh-socks-script} \"%I\"";
-        Environment = [ "SSHPASS_SECRET=gkleen@mathw0g.math.lmu.de" ];
+        Environment = [ "SSHPASS_SECRET=gkleen@ssh.math.lmu.de" ];
       };
       Unit = {
         StopWhenUnneeded = true;
@@ -183,6 +173,38 @@ in {
         StopWhenUnneeded = true;
       };
     };
+    "autossh-socks@proxy.mathw0h:8123" = {
+      Service = {
+        Type = "notify";
+        NotifyAccess = "all";
+        WorkingDirectory = "~";
+        Restart = "always";
+        RestartSec = "23s";
+        ExecStart = "${autossh-socks-script} \"%I\"";
+        Environment = [ "SSHPASS_SECRET=gkleen@mathw0h.mathinst.loc" ];
+      };
+      Unit = {
+        StopWhenUnneeded = true;
+        StartLimitInterval = "180s";
+        StartLimitBurst = 7;
+      };
+    };
+    "autossh-socks@proxy.mathw0e:8125" = {
+      Service = {
+        Type = "notify";
+        NotifyAccess = "all";
+        WorkingDirectory = "~";
+        Restart = "always";
+        RestartSec = "23s";
+        ExecStart = "${autossh-socks-script} \"%I\"";
+        Environment = [ "SSHPASS_SECRET=gkleen@mathw0e.mathinst.loc" ];
+      };
+      Unit = {
+        StopWhenUnneeded = true;
+        StartLimitInterval = "180s";
+        StartLimitBurst = 7;
+      };
+    };
     swayidle = {
       Service = {
         RuntimeDirectory = "swayidle";
@@ -193,8 +215,8 @@ in {
         WantedBy = ["graphical-session.target"];
       };
       Unit = {
-        Requires = ["graphical-session-pre.target"];
-        After = ["graphical-session-pre.target"];
+        After = [ "graphical-session.target" ];
+        PartOf = [ "graphical-session.target" ];
       };
       Service = {
         ExecStart = lib.getExe pkgs.psi-notify;
@@ -204,23 +226,10 @@ in {
         WatchdogSec = "2s";
       };
     };
-    polkit-gnome-authentication-agent-1 = {
-      Install = {
-        WantedBy = ["graphical-session.target"];
-      };
-      Unit = {
-        PartOf = ["graphical-session.target"];
-        Requires = ["graphical-session-pre.target"];
-        After = ["graphical-session-pre.target"];
-      };
-      Service = {
-        ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
-        Restart = "on-failure";
-      };
-    };
     gtklock = {
       Unit = {
         Requisite = ["graphical-session.target"];
+        After = [ "graphical-session.target" ];
         PartOf = ["graphical-session.target"];
       };
       Service = {
@@ -228,53 +237,55 @@ in {
         RuntimeDirectory = "gtklock";
         CacheDirectory = "gtklock";
         ExecStartPre = [
-          "${pkgs.libsForQt5.qt5.qttools.bin}/bin/qdbus org.keepassxc.KeePassXC.MainWindow /keepassxc org.keepassxc.KeePassXC.MainWindow.lockAllDatabases"
-          "${config.systemd.package}/bin/systemctl --user stop gpg-agent.service"
-          (pkgs.writeShellScript "generate-css" ''
-            set -x
-            export PATH="${lib.makeBinPath [cfg.programs.wpaperd.package pkgs.jq pkgs.coreutils pkgs.imagemagick pkgs.findutils]}:$PATH"
+          "-${lib.getExe' pkgs.libsForQt5.qt5.qttools.bin "qdbus"} org.keepassxc.KeePassXC.MainWindow /keepassxc org.keepassxc.KeePassXC.MainWindow.lockAllDatabases"
+          "-${lib.getExe' config.systemd.package "systemctl"} --user stop gpg-agent.service"
+          "-${lib.getExe pkgs.playerctl} -a pause"
+          "-${lib.getExe (pkgs.writeShellApplication {
+            name = "generate-css";
+            runtimeInputs = with pkgs; [cfg.services.wpaperd.package jq coreutils imagemagick findutils];
+            text = ''
+              declare -A monitors
+              monitors=()
+              while IFS= read -r entry; do
+                  path=$(jq -r ".path" <<<"$entry")
+                  [[ -z "$path" || ! -f "$path" ]] && continue
+                  blurred_path="$CACHE_DIRECTORY"/"$(b2sum -l 128 <<<"$path" | cut -d' ' -f1)"."''${path##*.}"
+                  monitor=$(jq -r ".display" <<<"$entry")
+                  if [[ ! -f "$blurred_path" ]]; then
+                      mkdir -p "$(dirname "$blurred_path")"
+                      magick "$path" -filter Gaussian -resize 6.25% -define filter:sigma=2.5 -resize 1600% "$blurred_path" &
+                  fi
+                  monitors+=([$monitor]="$blurred_path")
+              done < <(wpaperctl all-wallpapers -j | jq -c ".[]")
+              # wait
 
-            declare -A monitors
-            monitors=()
-            while IFS= read -r entry; do
-                path=$(jq -r ".path" <<<"$entry")
-                [[ -z "$path" || ! -f "$path" ]] && continue
-                blurred_path="$CACHE_DIRECTORY"/"$(b2sum -l 128 <<<"$path" | cut -d' ' -f1)"."''${path##*.}"
-                monitor=$(jq -r ".display" <<<"$entry")
-                if [[ ! -f "$blurred_path" ]]; then
-                    mkdir -p "$(dirname "$blurred_path")"
-                    magick "$path" -filter Gaussian -resize 6.25% -define filter:sigma=2.5 -resize 1600% "$blurred_path" &
-                fi
-                monitors+=([$monitor]="$blurred_path")
-            done < <(wpaperctl all-wallpapers -j | jq -c ".[]")
-            wait
-
-            cp --no-preserve=mode ${pkgs.writeText "gtklock.css" ''
-              #window-box {
-                padding: 64px;
-                /* border: 1px solid black; */
-                border-radius: 4px;
-                box-shadow: rgba(0, 0, 0, 0.8) 0px 4px 12px;
-                /* background-color: white; */
-                background-color: rgba(0, 0, 0, 0.5);
+              cp --no-preserve=mode ${pkgs.writeText "gtklock.css" ''
+                #window-box {
+                  padding: 64px;
+                  /* border: 1px solid black; */
+                  border-radius: 4px;
+                  box-shadow: rgba(0, 0, 0, 0.8) 0px 4px 12px;
+                  /* background-color: white; */
+                  background-color: rgba(0, 0, 0, 0.5);
+                }
+              ''} "$RUNTIME_DIRECTORY"/style.css
+              for monitor in "''${!monitors[@]}"; do
+              cat >>"$RUNTIME_DIRECTORY"/style.css <<EOF
+              window#''${monitor} {
+                background-image: url("''${monitors[$monitor]}");
+                background-repeat: no-repeat;
+                background-size: 100% 100%;
+                background-origin: content-box;
               }
-            ''} "$RUNTIME_DIRECTORY"/style.css
-            for monitor in "''${!monitors[@]}"; do
-            cat >>"$RUNTIME_DIRECTORY"/style.css <<EOF
-            window#''${monitor} {
-              background-image: url("''${monitors[$monitor]}");
-              background-repeat: no-repeat;
-              background-size: 100% 100%;
-              background-origin: content-box;
-            }
-            EOF
-            done
-          '')
+              EOF
+              done
+            '';
+          })}"
         ];
         NotifyAccess = "all";
         ExecStart = ''${lib.getExe pkgs.gtklock} -s "''${RUNTIME_DIRECTORY}/style.css" -L ${pkgs.writeShellScript "after-lock" ''
-          ${cfg.wayland.windowManager.hyprland.package}/bin/hyprctl dispatch dpms off
-          ${config.systemd.package}/bin/systemd-notify --ready
+          ${lib.getExe cfg.programs.niri.package} msg action power-off-monitors
+          ${lib.getExe' config.systemd.package "systemd-notify"} --ready
         ''}'';
       };
     };
@@ -322,15 +333,62 @@ in {
         ExecStopPost = "${pkgs.coreutils}/bin/rm -rfv \"$CACHE_DIRECTORY\"";
       };
     };
+    # wpaperd = {
+    #   Install = {
+    #     WantedBy = ["graphical-session.target"];
+    #   };
+    #   Unit = {
+    #     After = [ "graphical-session.target" ];
+    #     PartOf = [ "graphical-session.target" ];
+    #   };
+    #   Service = {
+    #     ExecStart = lib.getExe cfg.services.wpaperd.package;
+    #     Type = "simple";
+    #     Restart = "always";
+    #     RestartSec = "2s";
+    #   };
+    # };
+    xembed-sni-proxy = {
+      Unit = {
+        PartOf = lib.mkForce ["tray.target"];
+        BindsTo = ["xwayland-satellite.service"];
+        After = ["xwayland-satellite.service"];
+      };
+    };
+    poweralertd = {
+      Unit = {
+        After = ["graphical-session.target"];
+      };
+    };
+    network-manager-applet = {
+      Unit = {
+        PartOf = lib.mkForce ["tray.target"];
+      };
+    };
+    udiskie = {
+      Unit = {
+        PartOf = lib.mkForce ["tray.target"];
+      };
+    };
+    blueman-applet = {
+      Unit = {
+        PartOf = lib.mkForce ["tray.target"];
+      };
+      Install = {
+        WantedBy = lib.mkForce ["tray.target"];
+      };
+    };
   } // listToAttrs (map ({host, port}: nameValuePair "proxy-to-autossh-socks@${toString port}" {
       Unit = {
-        Requires = ["autossh-socks@${host}:${toString (port + 1)}.service" "proxy-to-autossh-socks@${toString port}.socket"];
+        BindsTo = ["autossh-socks@${host}:${toString (port + 1)}.service" "proxy-to-autossh-socks@${toString port}.socket"];
         After = ["autossh-socks@${host}:${toString (port + 1)}.service" "proxy-to-autossh-socks@${toString port}.socket"];
       };
       Service = {
-        ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd --exit-idle-time=10s localhost:${toString (port + 1)}";
+        ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd --exit-idle-time=60s 127.0.0.1:${toString (port + 1)}";
+        Restart = "always";
+        RestartSec = "23s";
       };
-  }) [{ host = "proxy.mathw0h"; port = 8118; } { host = "proxy.vidhar"; port = 8120; }]);
+  }) [{ host = "proxy.ssh.math.lmu.de"; port = 8118; } { host = "proxy.vidhar"; port = 8120; } { host = "proxy.mathw0h"; port = 8122; } { host = "proxy.mathw0e"; port = 8124; }]);
   sockets = listToAttrs (map (port: nameValuePair "proxy-to-autossh-socks@${toString port}" {
     Socket = {
       ListenStream = "%I";
@@ -338,7 +396,7 @@ in {
     Install = {
       WantedBy = ["default.target"];
     };
-  }) [8118 8120]) // {
+  }) [8118 8120 8122 8124]) // {
     "yt-dlp" = {
       Socket = {
         SocketMode = "0600";
@@ -352,7 +410,7 @@ in {
     };
   };
   timers = {
-    sync-keepass = {
+    "sync-keepass@store.kdbx" = {
       Timer = {
         OnActiveSec = "1m";
         OnUnitActiveSec = "1m";
@@ -362,6 +420,16 @@ in {
         WantedBy = ["default.target"];
       };
     };
+    "sync-keepass@rz.kdbx" = {
+      Timer = {
+        OnActiveSec = "1d";
+        OnUnitActiveSec = "1d";
+      };
+
+      Install = {
+        WantedBy = ["default.target"];
+      };
+    };
   };
   targets = {
     graphical-session = {
@@ -372,6 +440,9 @@ in {
     };
     tray = {
       Unit = {
+        PartOf = [ "graphical-session.target" ];
+        Requires = [ "waybar.service" ];
+        After = [ "graphical-session.target" "waybar.service" ];
         Wants = ["blueman-applet.service" "udiskie.service" "network-manager-applet.service"];
       };
     };
diff --git a/accounts/gkleen@sif/taffybar/default.nix b/accounts/gkleen@sif/taffybar/default.nix
deleted file mode 100644
index 98366d8f..00000000
--- a/accounts/gkleen@sif/taffybar/default.nix
+++ /dev/null
@@ -1,2 +0,0 @@
-{ haskellPackages ? (import <nixpkgs> {}).haskellPackages }:
-haskellPackages.callCabal2nix "gkleen-sif-taffybar" ./. {}
diff --git a/accounts/gkleen@sif/taffybar/gkleen-sif-taffybar.cabal b/accounts/gkleen@sif/taffybar/gkleen-sif-taffybar.cabal
deleted file mode 100644
index e32cb473..00000000
--- a/accounts/gkleen@sif/taffybar/gkleen-sif-taffybar.cabal
+++ /dev/null
@@ -1,32 +0,0 @@
-name:                gkleen-sif-taffybar
-version:             0.0.0
-build-type:          Simple
-cabal-version:       >=1.10
-
-data-files:          taffybar.css
-
-executable taffybar
-  hs-source-dirs:      src
-  main-is:             taffybar.hs
-  ghc-options:         -threaded -rtsopts -with-rtsopts=-N -O2 -Wall
-  build-depends:       base
-                     , containers
-                     , directory
-                     , filepath
-                     , gtk3
-                     , taffybar
-                     , X11>=1.8
-                     , transformers
-                     , gi-gtk
-                     , time, time-locale-compat
-                     , text
-                     , HStringTemplate
-                     , gtk-sni-tray
-                     , hslogger
-  other-modules:       Paths_gkleen_sif_taffybar
-                     , System.Taffybar.Widget.Clock
-                     , System.Taffybar.Widget.TooltipBattery
-  default-language:    Haskell2010
-  default-extensions:  ScopedTypeVariables
-                     , LambdaCase
-                     , NamedFieldPuns
\ No newline at end of file
diff --git a/accounts/gkleen@sif/taffybar/src/System/Taffybar/Widget/Clock.hs b/accounts/gkleen@sif/taffybar/src/System/Taffybar/Widget/Clock.hs
deleted file mode 100644
index e8dc480f..00000000
--- a/accounts/gkleen@sif/taffybar/src/System/Taffybar/Widget/Clock.hs
+++ /dev/null
@@ -1,111 +0,0 @@
-{-# LANGUAGE OverloadedStrings #-}
-module System.Taffybar.Widget.Clock
-  ( textClockNew
-  , textClockNewWith
-  , defaultClockConfig
-  , ClockConfig(..)
-  , ClockUpdateStrategy(..)
-  ) where
-
-import           Control.Monad.IO.Class
-import           Data.Maybe
-import qualified Data.Text as T
-import qualified Data.Time.Clock as Clock
-import           Data.Time.Format
-import           Data.Time.LocalTime
-import qualified Data.Time.Locale.Compat as L
-import           GI.Gtk
-import           System.Taffybar.Widget.Generic.PollingLabel
-
-type ClockFormat = L.TimeLocale -> ZonedTime -> T.Text
-
--- | Create the widget. I recommend passing @Nothing@ for the TimeLocale
--- parameter. The format string can include Pango markup
--- (<http://developer.gnome.org/pango/stable/PangoMarkupFormat.html>).
-textClockNew ::
-  MonadIO m => Maybe L.TimeLocale -> ClockFormat -> Double -> m GI.Gtk.Widget
-textClockNew userLocale format interval =
-  textClockNewWith cfg
-  where
-    cfg = defaultClockConfig { clockTimeLocale = userLocale
-                             , clockFormat = format
-                             , clockUpdateStrategy = ConstantInterval interval
-                             }
-
-data ClockUpdateStrategy
-  = ConstantInterval Double
-  | RoundedTargetInterval Int Double
-  deriving (Eq, Ord, Show)
-
-data ClockConfig = ClockConfig
-  { clockTimeZone :: Maybe TimeZone
-  , clockTimeLocale :: Maybe L.TimeLocale
-  , clockFormat :: ClockFormat
-  , clockUpdateStrategy :: ClockUpdateStrategy
-  }
-
--- | A clock configuration that defaults to the current locale
-defaultClockConfig :: ClockConfig
-defaultClockConfig = ClockConfig
-  { clockTimeZone = Nothing
-  , clockTimeLocale = Nothing
-  , clockFormat = \locale zonedTime -> T.pack $ formatTime locale "%a %b %_d %r" zonedTime
-  , clockUpdateStrategy = RoundedTargetInterval 5 0.0
-  }
-
-systemGetTZ :: IO TimeZone
-systemGetTZ = getCurrentTimeZone
-
--- | A configurable text-based clock widget.  It currently allows for
--- a configurable time zone through the 'ClockConfig'.
---
--- See also 'textClockNew'.
-textClockNewWith :: MonadIO m => ClockConfig -> m Widget
-textClockNewWith ClockConfig
-                   { clockTimeZone = userZone
-                   , clockTimeLocale = userLocale
-                   , clockFormat = format
-                   , clockUpdateStrategy = updateStrategy
-                   } = liftIO $ do
-  let getTZ = maybe systemGetTZ return userZone
-      locale = fromMaybe L.defaultTimeLocale userLocale
-
-  let getUserZonedTime =
-        utcToZonedTime <$> getTZ <*> Clock.getCurrentTime
-
-      doTimeFormat = format locale
-
-      getRoundedTimeAndNextTarget = do
-        zonedTime <- getUserZonedTime
-        return $ case updateStrategy of
-          ConstantInterval interval ->
-            (doTimeFormat zonedTime, Nothing, interval)
-          RoundedTargetInterval roundSeconds offset ->
-            let roundSecondsDiffTime = fromIntegral roundSeconds
-                addTheRound = addLocalTime roundSecondsDiffTime
-                localTime = zonedTimeToLocalTime zonedTime
-                ourLocalTimeOfDay = localTimeOfDay localTime
-                seconds = round $ todSec ourLocalTimeOfDay
-                secondsFactor = seconds `div` roundSeconds
-                displaySeconds = secondsFactor * roundSeconds
-                baseLocalTimeOfDay =
-                  ourLocalTimeOfDay { todSec = fromIntegral displaySeconds }
-                ourLocalTime =
-                  localTime { localTimeOfDay = baseLocalTimeOfDay }
-                roundedLocalTime =
-                  if seconds `mod` roundSeconds > roundSeconds `div` 2
-                  then addTheRound ourLocalTime
-                  else ourLocalTime
-                roundedZonedTime =
-                  zonedTime { zonedTimeToLocalTime = roundedLocalTime }
-                nextTarget = addTheRound ourLocalTime
-                amountToWait = realToFrac $ diffLocalTime nextTarget localTime
-            in (doTimeFormat roundedZonedTime, Nothing, amountToWait - offset)
-
-  label <- pollingLabelWithVariableDelay getRoundedTimeAndNextTarget
-  ebox <- eventBoxNew
-  containerAdd ebox label
-  eventBoxSetVisibleWindow ebox False
-  widgetShowAll ebox
-  toWidget ebox
-
diff --git a/accounts/gkleen@sif/taffybar/src/System/Taffybar/Widget/TooltipBattery.hs b/accounts/gkleen@sif/taffybar/src/System/Taffybar/Widget/TooltipBattery.hs
deleted file mode 100644
index 9dc52774..00000000
--- a/accounts/gkleen@sif/taffybar/src/System/Taffybar/Widget/TooltipBattery.hs
+++ /dev/null
@@ -1,101 +0,0 @@
-{-# LANGUAGE OverloadedStrings   #-}
-{-# LANGUAGE ScopedTypeVariables #-}
-module System.Taffybar.Widget.TooltipBattery ( batteryIconTooltipNew ) where
-
-import           Control.Applicative
-import           Control.Monad
-import           Control.Monad.IO.Class
-import           Control.Monad.Trans.Reader
-import           Data.Int (Int64)
-import qualified Data.Text as T
-import           GI.Gtk
-import           Prelude
-import           StatusNotifier.Tray (scalePixbufToSize)
-import           System.Taffybar.Context
-import           System.Taffybar.Information.Battery
-import           System.Taffybar.Util
-import           System.Taffybar.Widget.Generic.AutoSizeImage
-import           System.Taffybar.Widget.Generic.ChannelWidget
-import           Text.Printf
-import           Text.StringTemplate
-import           Data.Function ((&))
-
--- | Just the battery info that will be used for display (this makes combining
--- several easier).
-data BatteryWidgetInfo = BWI
-  { seconds :: Maybe Int64
-  , percent :: Double
-  , status :: String
-  , rate :: Maybe Double
-  } deriving (Eq, Show)
-
--- | Format a duration expressed as seconds to hours and minutes
-formatDuration :: Int64 -> String
-formatDuration secs = let minutes, hours, minutes' :: Int64
-                          minutes = secs `div` 60
-                          (hours, minutes') = minutes `divMod` 60
-                       in printf "%02d:%02d" hours minutes'
-
-getBatteryWidgetInfo :: BatteryInfo -> BatteryWidgetInfo
-getBatteryWidgetInfo info =
-  let battPctNum :: Double
-      battPctNum = batteryPercentage info
-      battTime :: Maybe Int64
-      battTime =
-        case batteryState info of
-          BatteryStateCharging -> Just $ batteryTimeToFull info
-          BatteryStateDischarging -> Just $ batteryTimeToEmpty info
-          _ -> Nothing
-      battStatus :: String
-      battStatus =
-        case batteryState info of
-          BatteryStateCharging -> "↑"
-          BatteryStateDischarging -> "↓"
-          BatteryStateEmpty -> "⤓"
-          BatteryStateFullyCharged -> "⤒"
-          _ -> "?"
-      battRate :: Maybe Double
-      battRate | rawRate < 0.1 = Nothing
-               | otherwise = Just rawRate
-        where rawRate = batteryEnergyRate info
-  in BWI{ seconds = battTime, percent = battPctNum, status = battStatus, rate = battRate }
-
--- | Given (maybe summarized) battery info and format: provides the string to display
-formatBattInfo :: BatteryWidgetInfo -> String -> T.Text
-formatBattInfo info fmt =
-  let tpl = newSTMP fmt
-      tpl' = tpl
-        & setManyAttrib [ ("percentage", printf "%.0f" $ percent info)
-                        , ("status", status info)
-                        ]
-        & setManyAttrib [ ("time", formatDuration <$> seconds info)
-                        , ("rate", printf "%.0f" <$> rate info)
-                        ]
-  in render tpl'
-
-themeLoadFlags :: [IconLookupFlags]
-themeLoadFlags = [IconLookupFlagsGenericFallback, IconLookupFlagsUseBuiltin]
-
-batteryIconTooltipNew :: String -> TaffyIO Widget
-batteryIconTooltipNew format = do
-  DisplayBatteryChanVar (chan, _) <- setupDisplayBatteryChanVar ["IconName", "State", "Percentage", "TimeToFull", "TimeToEmpty", "EnergyRate"]
-  ctx <- ask
-  liftIO $ do
-    image <- imageNew
-    styleCtx <- widgetGetStyleContext =<< toWidget image
-    defaultTheme <- iconThemeGetDefault
-    let getCurrentBatteryIconNameStringTooltip = do
-          info <- runReaderT getDisplayBatteryInfo ctx
-          let iconNameString = T.pack $ batteryIconName info
-              tooltip = formatBattInfo (getBatteryWidgetInfo info) format
-          return (iconNameString, tooltip)
-        extractPixbuf info =
-          fst <$> iconInfoLoadSymbolicForContext info styleCtx
-        setIconForSize size = do
-          (name, tooltip) <- getCurrentBatteryIconNameStringTooltip
-          widgetSetTooltipMarkup image $ Just tooltip
-          iconThemeLookupIcon defaultTheme name size themeLoadFlags >>=
-            traverse extractPixbuf >>=
-              traverse (scalePixbufToSize size OrientationHorizontal)
-    updateImage <- autoSizeImage image setIconForSize OrientationHorizontal
-    toWidget =<< channelWidgetNew image chan (const $ postGUIASync updateImage)
diff --git a/accounts/gkleen@sif/taffybar/src/taffybar.hs b/accounts/gkleen@sif/taffybar/src/taffybar.hs
deleted file mode 100644
index 67ee942d..00000000
--- a/accounts/gkleen@sif/taffybar/src/taffybar.hs
+++ /dev/null
@@ -1,89 +0,0 @@
-{-# LANGUAGE OverloadedStrings #-}
-
-module Main where
-
-import System.Taffybar (startTaffybar)
-import System.Taffybar.Context (TaffybarConfig(..))
-import System.Taffybar.Hooks
-import System.Taffybar.SimpleConfig hiding (SimpleTaffyConfig(cssPaths))
-import System.Taffybar.Widget
-import qualified System.Taffybar.Widget.Clock as MyClock
-import System.Taffybar.Widget.TooltipBattery
-
-import Data.Time.Format
-import Data.Time.LocalTime
-import Data.Time.Calendar.WeekDate
-
-import qualified Data.Text as T
-
-import Control.Exception (SomeException, try)
-import Control.Monad.Trans.Reader (mapReaderT)
-
-import Paths_gkleen_sif_taffybar
-
-import System.Log.Logger
-
-
-main :: IO ()
-main = do
-  logger <- getLogger "System.Taffybar"
-  saveGlobalLogger $ setLevel INFO logger
-
-  myCssPath <- getDataFileName "taffybar.css"
-  startTaffybar taffybarConfig{ cssPaths = pure myCssPath }
-
-
-taffybarConfig :: TaffybarConfig
-taffybarConfig =
-  let myWorkspacesConfig =
-        defaultWorkspacesConfig
-        { maxIcons = Just 0
-        , widgetGap = 7
-        , showWorkspaceFn = \case
-            -- Workspace{ workspaceState = Empty } -> False
-            Workspace{ workspaceName } | workspaceName == "NSP" -> False
-            _other -> True
-        , getWindowIconPixbuf = \i d -> either (\(_ :: SomeException) -> Nothing) id <$> mapReaderT try (defaultGetWindowIconPixbuf i d)
-        , urgentWorkspaceState = True
-        }
-      workspaces = workspacesNew myWorkspacesConfig
-      clock = MyClock.textClockNewWith MyClock.defaultClockConfig
-        { MyClock.clockUpdateStrategy = MyClock.RoundedTargetInterval 1 0.0
-        , MyClock.clockFormat = \tl zt@ZonedTime{ zonedTimeToLocalTime = LocalTime{ localDay } }
-                                -> let date = formatTime tl "%Y-%m-%d" localDay
-                                       weekdate = "W" <> show2 woy <> "-" <> show dow
-                                         where (_, woy, dow) = toWeekDate localDay
-                                               show2 :: Int -> String
-                                               show2 x = replicate (2 - length s) '0' ++ s
-                                                 where s = show x
-                                       time = formatTime tl "%H:%M:%S%Ez" zt
-                                    in T.intercalate " " $ map T.pack [weekdate, date, time]
-        }
-      layout = layoutNew defaultLayoutConfig
-      windowsW = windowsNew defaultWindowsConfig
-        { getMenuLabel = truncatedGetMenuLabel 80
-        , getActiveLabel = truncatedGetActiveLabel 80
-        }
-      worktime = commandRunnerNew 60 "worktime" [] "worktime"
-      worktimeToday = commandRunnerNew 60 "worktime" ["today"] "worktime today"
-      -- See https://github.com/taffybar/gtk-sni-tray#statusnotifierwatcher
-      -- for a better way to set up the sni tray
-      -- tray = sniTrayThatStartsWatcherEvenThoughThisIsABadWayToDoIt
-      tray = sniTrayNew
-      myConfig = defaultSimpleTaffyConfig
-        { startWidgets =
-            workspaces : map (>>= buildContentsBox) [ layout, windowsW ]
-        , endWidgets = map (>>= buildContentsBox) $ reverse
-          -- , mpris2New
-          [ worktime, worktimeToday
-          , clock
-          , tray
-          , batteryIconTooltipNew "$status$ $percentage$%$if(time)$$if(rate)$ ($rate$W $time$)$else$ ($time$)$endif$$elseif(rate)$ ($rate$W)$endif$"
-          ]
-        , barPosition = Top
-        , barPadding = 2
-        , barHeight = ExactSize 28
-        , widgetSpacing = 10
-        }
-  in withBatteryRefresh $ withLogServer $
-     withToggleServer $ toTaffyConfig myConfig
diff --git a/accounts/gkleen@sif/taffybar/taffybar.css b/accounts/gkleen@sif/taffybar/taffybar.css
deleted file mode 100644
index 7a297465..00000000
--- a/accounts/gkleen@sif/taffybar/taffybar.css
+++ /dev/null
@@ -1,146 +0,0 @@
-@define-color transparent rgba(0.0, 0.0, 0.0, 0.0);
-@define-color white #808080;
-@define-color gray #202020;
-@define-color green #008000;
-@define-color yellow #808000;
-@define-color blue #000080;
-@define-color red #800000;
-@define-color black #000000;
-/* @define-color taffy-blue #0c7cd5; */
-@define-color taffy-blue @blue;
-
-@define-color active-window-color @white;
-@define-color urgent-window-color @taffy-blue;
-@define-color font-color @white;
-@define-color menu-background-color @black;
-@define-color menu-font-color @white;
-
-/* Top level styling */
-
-.taffy-window * {
-        /*
-                This removes any existing styling from UI elements. Taffybar will not
-                cohere with your gtk theme.
-        */
-        all: unset;
-
-        font-family: "Fira Sans", sans-serif;
-        font-size: 21px;
-        color: @font-color;
-}
-
-.taffy-box {
-        /* border-radius: 10px; */
-        background-color: @black;
-}
-
-.inner-pad {
-        /* padding-bottom: 5px; */
-        /* padding-top: 5px; */
-        padding-left: 2px;
-        padding-right: 2px;
-}
-
-.contents {
-        /* padding-bottom: 4px; */
-        /* padding-top: 4px; */
-        padding-right: 2px;
-        padding-left: 2px;
-        transition: background-color .5s;
-        border-radius: 5px;
-}
-
-/* Workspaces styling */
-
-.workspace-label {
-        padding-right: 3px;
-        padding-left: 2px;
-        font-size: 21px;
-}
-
-.workspace-label.active {
-        color: @green;
-}
-.workspace-label.visible {
-        color: @yellow;
-}
-.workspace-label.empty {
-        color: @gray;
-}
-.workspace-label.urgent {
-        color: @red;
-}
-
-.active .contents {
-        background-color: rgba(0.0, 0.0, 0.0, 0.5);
-}
-
-.visible .contents {
-        background-color: rgba(0.0, 0.0, 0.0, 0.2);
-}
-
-.window-icon-container {
-        transition: opacity .5s, box-shadow .5s;
-        opacity: 1;
-}
-
-/* This gives space for the box-shadow (they look like underlines) that follow.
-   This will actually affect all widgets, (not just the workspace icons), but
-   that is what we want since we want the icons to look the same. */
-.auto-size-image, .sni-tray {
-        padding-top: 3px;
-        padding-bottom: 3px;
-}
-
-.window-icon-container.active {
-        box-shadow: inset 0 -3px @white;
-}
-
-.window-icon-container.urgent {
-        box-shadow: inset 0 -3px @urgent-window-color;
-}
-
-.window-icon-container.inactive .window-icon {
-        padding: 0px;
-}
-
-.window-icon-container.minimized .window-icon {
-        opacity: .3;
-}
-
-.window-icon {
-        opacity: 1;
-        transition: opacity .5s;
-}
-
-/* Button styling */
-
-button {
-        background-color: @transparent;
-        border-width: 0px;
-        border-radius: 0px;
-}
-
-button:checked, button:hover .Contents:hover {
-        box-shadow: inset 0 -3px @taffy-blue;
-}
-
-/* Menu styling */
-
-/* The ".taffy-window" prefixed selectors are needed because if they aren't present,
-   the top level .Taffybar selector takes precedence */
-.taffy-window menuitem *,  menuitem * {
-        color: @menu-font-color;
-}
-
-.taffy-window menuitem, menuitem {
-        background-color: @menu-background-color;
-}
-
-.taffy-window menuitem:hover, menuitem:hover {
-        background-color: @taffy-blue;
-}
-
-.taffy-window menuitem:hover > label, menuitem:hover > label {
-        color: @white;
-}
diff --git a/accounts/gkleen@sif/utils/async-yt-dlp.nix b/accounts/gkleen@sif/utils/async-yt-dlp.nix
new file mode 100644
index 00000000..c3b82ec5
--- /dev/null
+++ b/accounts/gkleen@sif/utils/async-yt-dlp.nix
@@ -0,0 +1,57 @@
+{ writers, python3Packages, ... }:
+
+writers.writePython3Bin "async-yt-dlp" {
+  libraries = with python3Packages; [ yt-dlp ];
+  flakeIgnore = ["E501"];
+} ''
+import sys
+import os
+
+import yt_dlp
+import yt_dlp.options
+from collections import namedtuple
+import socket
+from pathlib import Path
+import json
+
+create_parser = yt_dlp.options.create_parser
+
+
+def parse_patched_options(opts):
+    patched_parser = create_parser()
+    patched_parser.defaults.update({
+        'ignoreerrors': False,
+        'retries': 0,
+        'fragment_retries': 0,
+        'extract_flat': False,
+        'concat_playlist': 'never',
+    })
+    yt_dlp.options.create_parser = lambda: patched_parser
+    try:
+        return yt_dlp.parse_options(opts)
+    finally:
+        yt_dlp.options.create_parser = create_parser
+
+
+default_opts = parse_patched_options([]).ydl_opts
+
+
+def cli_to_api(opts):
+    opts = parse_patched_options(opts)
+    urls = opts.urls
+    opts = opts.ydl_opts
+
+    diff = {k: v for k, v in opts.items() if default_opts[k] != v}
+    if 'postprocessors' in diff:
+        diff['postprocessors'] = [pp for pp in diff['postprocessors']
+                                  if pp not in default_opts['postprocessors']]
+    return namedtuple('Options', ('params', 'urls'))(diff, urls)
+
+
+if __name__ == '__main__':
+    opts = cli_to_api(sys.argv[1:])
+    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
+        sock.connect(str(Path(os.environ["XDG_RUNTIME_DIR"]) / "yt-dlp.sock").encode('utf-8'))
+        with sock.makefile(mode='w', buffering=1, encoding='utf-8') as fh:
+            json.dump(opts._asdict(), fh)
+''
diff --git a/accounts/gkleen@sif/utils/pdf2pdf.nix b/accounts/gkleen@sif/utils/pdf2pdf.nix
new file mode 100644
index 00000000..9f4cbc3e
--- /dev/null
+++ b/accounts/gkleen@sif/utils/pdf2pdf.nix
@@ -0,0 +1,8 @@
+pkgs@{ lib, resholve, zsh, ghostscript_headless, ... }:
+
+resholve.writeScriptBin "pdf2pdf" {
+  inputs = with pkgs; [ghostscript_headless];
+  interpreter = lib.getExe zsh;
+} ''
+  exec gs -dPDFSETTINGS=/prepress -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -dSAFER -dPreserveAnnots=false "-sOutputFile=''${2}" "''${1}"
+''
diff --git a/accounts/gkleen@sif/utils/sieve-edit.nix b/accounts/gkleen@sif/utils/sieve-edit.nix
new file mode 100644
index 00000000..f985a3f6
--- /dev/null
+++ b/accounts/gkleen@sif/utils/sieve-edit.nix
@@ -0,0 +1,24 @@
+pkgs@{ lib, resholve, zsh, sieve-connect, sops, ... }:
+
+resholve.writeScriptBin "sieve-edit" {
+  inputs = with pkgs; [sieve-connect sops];
+  interpreter = lib.getExe zsh;
+  execer = with pkgs; [
+    "cannot:${lib.getExe sieve-connect}"
+    "cannot:${lib.getExe sops}"
+  ];
+} ''
+  host=$1; shift
+  case "$host" in
+    surtr)
+      sieve-connect -s surtr.yggdrasil.li -m EXTERNAL --clientkey <(sops decrypt $HOME/projects/machines/hosts/surtr/email/ca/gkleen@sif.key) --clientcert $HOME/projects/machines/hosts/surtr/email/ca/gkleen@sif.crt --edit --remotesieve sieve
+      ;;
+    ymir)
+      sieve-connect -s ymir.yggdrasil.li -u gkleen --edit --remotesieve sieve
+      ;;
+    *)
+      echo "Unknown host: ‘$host’" >&2
+      return 2
+      ;;
+  esac
+''
diff --git a/accounts/gkleen@sif/xmonad/.gitignore b/accounts/gkleen@sif/xmonad/.gitignore
deleted file mode 100644
index c11891cd..00000000
--- a/accounts/gkleen@sif/xmonad/.gitignore
+++ /dev/null
@@ -1,4 +0,0 @@
-**/#*#
-**/.stack-work/
-/stack.yaml.lock
-/*.cabal
diff --git a/accounts/gkleen@sif/xmonad/default.nix b/accounts/gkleen@sif/xmonad/default.nix
deleted file mode 100644
index 8790c12f..00000000
--- a/accounts/gkleen@sif/xmonad/default.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-argumentPackages@{ ... }:
-
-let
-  # defaultPackages = (import ./stackage.nix {});
-  # haskellPackages = defaultPackages // argumentPackages;
-  haskellPackages = argumentPackages;
-in haskellPackages.callPackage ./xmonad-yggdrasil.nix {}
diff --git a/accounts/gkleen@sif/xmonad/lib/XMonad/Mpv.hs b/accounts/gkleen@sif/xmonad/lib/XMonad/Mpv.hs
deleted file mode 100644
index e6accdcc..00000000
--- a/accounts/gkleen@sif/xmonad/lib/XMonad/Mpv.hs
+++ /dev/null
@@ -1,127 +0,0 @@
-{-# LANGUAGE DeriveGeneric, OverloadedLists, OverloadedStrings, ViewPatterns, ExistentialQuantification, MultiWayIf #-}
-
-module XMonad.Mpv
-  ( MpvCommand(..), MpvResponse(..), MpvException(..)
-  , mpv
-  , mpvDir
-  , mpvAll, mpvOne
-  , mpvResponse
-  ) where
-
-import Data.Aeson
-
-import Data.Monoid
-
-import Network.Socket hiding (recv)
-import Network.Socket.ByteString
-
-import qualified Data.ByteString as BS
-import qualified Data.ByteString.Char8 as CBS
-import qualified Data.ByteString.Lazy as LBS
-
-import GHC.Generics (Generic)
-import Data.Typeable (Typeable)
-import Data.String (IsString(..))
-
-import Control.Exception
-
-import System.IO.Temp (getCanonicalTemporaryDirectory)
-
-import Control.Monad
-import Control.Exception (bracket)
-import Control.Monad.IO.Class (MonadIO(..))
-
-import System.FilePath
-import System.Directory (getDirectoryContents)
-
-import Data.List
-import Data.Either
-import Data.Maybe
-
-import Debug.Trace
-
-
-data MpvCommand
-  = forall a. ToJSON a => MpvSetProperty String a
-  | MpvGetProperty String
-data MpvResponse
-  = MpvError String
-  | MpvSuccess (Maybe Value)
-  deriving (Read, Show, Generic, Eq)
-data MpvException = MpvException String
-                  | MpvNoValue
-                  | MpvNoParse String
-  deriving (Generic, Typeable, Read, Show)
-instance Exception MpvException
-
-
-instance ToJSON MpvCommand where
-  toJSON (MpvSetProperty name val) = Array ["set_property", fromString name, toJSON val]
-  toJSON (MpvGetProperty name)     = Array ["get_property", fromString name]
-
-instance FromJSON MpvResponse where
-  parseJSON = withObject "response object" $ \obj -> do
-    mval <- obj .:? "data"
-    err <- obj .: "error"
-
-    let ret
-          | err == "success" = MpvSuccess mval
-          | otherwise        = MpvError err
-
-    return ret
-
-mpvSocket :: FilePath -> (Socket -> IO a) -> IO a
-mpvSocket sockPath = withSocketsDo . bracket mkSock close
-  where
-    mkSock = do
-      sock <- socket AF_UNIX Stream defaultProtocol
-      connect sock $ SockAddrUnix (traceId sockPath)
-      return sock
-
-mpvResponse :: FromJSON v => MpvResponse -> IO v
-mpvResponse (MpvError str) = throwIO $ MpvException str
-mpvResponse (MpvSuccess Nothing) = throwIO MpvNoValue
-mpvResponse (MpvSuccess (Just v)) = case fromJSON v of
-  Success v' -> return v'
-  Error str  -> throwIO $ MpvNoParse str
-
-mpv :: FilePath -> MpvCommand -> IO MpvResponse
-mpv sockPath cmd = mpvSocket sockPath $ \sock -> do
-  let message = (`BS.append` "\n") . LBS.toStrict . encode $ Object [("command", toJSON cmd)]
-  traceIO $ show message
-  sendAll sock message
-  let recvAll = do
-        prefix <- recv sock 4096
-        if
-          | (prefix', rest) <- CBS.break (== '\n') prefix
-          , not (BS.null rest) -> return prefix'
-          | BS.null prefix     -> return prefix
-          | otherwise          -> BS.append prefix <$> recvAll
-  response <- recvAll
-  traceIO  $ show response
-  either (ioError . userError) return . traceShowId $ eitherDecodeStrict' response
-
-mpvDir :: Exception e => FilePath -> (FilePath -> [(FilePath, Either e MpvResponse)] -> Maybe MpvCommand) -> IO [(FilePath, Either e MpvResponse)]
-mpvDir dir step = do
-  socks <- filter (".sock" `isSuffixOf`) <$> getDirectoryContents dir
-  go [] socks
-  where
-    go acc [] = return acc
-    go acc (sock:socks)
-      | Just cmd <- step sock acc = do
-          res <- try $ mpv (dir </> sock) cmd
-          go ((sock, res) : acc) socks
-      | otherwise =
-          go acc socks
-
-mpvAll :: FilePath -> MpvCommand -> IO [MpvResponse]
-mpvAll dir cmd = do
-  results <- map snd <$> (mpvDir dir (\_ _ -> Just cmd) :: IO [(FilePath, Either SomeException MpvResponse)])
-  mapM (either throwIO return) results
-
-mpvOne :: FilePath -> MpvCommand -> IO (Maybe MpvResponse)
-mpvOne dir cmd = listToMaybe . snd . partitionEithers . map snd <$> (mpvDir dir step :: IO [(FilePath, Either SomeException MpvResponse)])
-  where
-    step _ results
-      | any (isRight . snd) results = Nothing
-      | otherwise = Just cmd
diff --git a/accounts/gkleen@sif/xmonad/lib/XMonad/Prompt/MyPass.hs b/accounts/gkleen@sif/xmonad/lib/XMonad/Prompt/MyPass.hs
deleted file mode 100644
index 1caefae5..00000000
--- a/accounts/gkleen@sif/xmonad/lib/XMonad/Prompt/MyPass.hs
+++ /dev/null
@@ -1,94 +0,0 @@
-module XMonad.Prompt.MyPass
-  (
-    -- * Usages
-    -- $usages
-    mkPassPrompt
-  ) where
-
-import Control.Monad (liftM)
-import XMonad.Core
-import XMonad.Prompt ( XPrompt
-                     , showXPrompt
-                     , commandToComplete
-                     , nextCompletion
-                     , getNextCompletion
-                     , XPConfig
-                     , mkXPrompt
-                     , searchPredicate)
-import System.Directory (getHomeDirectory)
-import System.FilePath (takeExtension, dropExtension, combine)
-import System.Posix.Env (getEnv)
-import XMonad.Util.Run (runProcessWithInput)
-
--- $usages
--- You can use this module with the following in your @~\/.xmonad\/xmonad.hs@:
---
--- > import XMonad.Prompt.Pass
---
--- Then add a keybinding for 'passPrompt', 'passGeneratePrompt' or 'passRemovePrompt':
---
--- >   , ((modMask x , xK_p)                              , passPrompt xpconfig)
--- >   , ((modMask x .|. controlMask, xK_p)               , passGeneratePrompt xpconfig)
--- >   , ((modMask x .|. controlMask  .|. shiftMask, xK_p), passRemovePrompt xpconfig)
---
--- For detailed instructions on:
---
--- - editing your key bindings, see "XMonad.Doc.Extending#Editing_key_bindings".
---
--- - how to setup the password storage, see <http://git.zx2c4.com/password-store/about/>
---
-
-type Predicate = String -> String -> Bool
-
-getPassCompl :: [String] -> Predicate -> String -> IO [String]
-getPassCompl compls p s
-  | length s <= minL
-  , all ((> minL) . length) compls = return []
-  | otherwise = do return $ filter (p s) compls
-  where
-    minL = 3
-
-type PromptLabel = String
-
-data Pass = Pass PromptLabel
-
-instance XPrompt Pass where
-  showXPrompt       (Pass prompt) = prompt ++ ": "
-  commandToComplete _ c           = c
-  nextCompletion      _           = getNextCompletion
-
--- | Default password store folder in $HOME/.password-store
---
-passwordStoreFolderDefault :: String -> String
-passwordStoreFolderDefault home = combine home ".password-store"
-
--- | Compute the password store's location.
--- Use the PASSWORD_STORE_DIR environment variable to set the password store.
--- If empty, return the password store located in user's home.
---
-passwordStoreFolder :: IO String
-passwordStoreFolder =
-  getEnv "PASSWORD_STORE_DIR" >>= computePasswordStoreDir
-  where computePasswordStoreDir Nothing         = liftM passwordStoreFolderDefault getHomeDirectory
-        computePasswordStoreDir (Just storeDir) = return storeDir
-
--- | A pass prompt factory
---
-mkPassPrompt :: PromptLabel -> (String -> X ()) -> XPConfig -> X ()
-mkPassPrompt promptLabel passwordFunction xpconfig = do
-  passwords <- io (passwordStoreFolder >>= getPasswords)
-  mkXPrompt (Pass promptLabel) xpconfig (getPassCompl passwords $ searchPredicate xpconfig) passwordFunction
-
--- | Retrieve the list of passwords from the password storage 'passwordStoreDir
-getPasswords :: FilePath -> IO [String]
-getPasswords passwordStoreDir = do
-  files <- runProcessWithInput "find" [
-    passwordStoreDir,
-    "-type", "f",
-    "-name", "*.gpg",
-    "-printf", "%P\n"] []
-  return $ map removeGpgExtension $ lines files
-
-removeGpgExtension :: String -> String
-removeGpgExtension file | takeExtension file == ".gpg" = dropExtension file
-                        | otherwise                    = file
diff --git a/accounts/gkleen@sif/xmonad/lib/XMonad/Prompt/MyShell.hs b/accounts/gkleen@sif/xmonad/lib/XMonad/Prompt/MyShell.hs
deleted file mode 100644
index c268f87d..00000000
--- a/accounts/gkleen@sif/xmonad/lib/XMonad/Prompt/MyShell.hs
+++ /dev/null
@@ -1,105 +0,0 @@
-module XMonad.Prompt.MyShell
-       ( Shell (..)
-       , shellPrompt
-       , prompt
-       , safePrompt
-       , unsafePrompt
-       , getCommands
-       , getShellCompl
-       , split
-       ) where
-
-import Codec.Binary.UTF8.String (encodeString)
-import Control.Exception as E
-import Control.Monad (forM)
-import Data.List (isPrefixOf)
-import System.Directory (doesDirectoryExist, getDirectoryContents)
-import System.Environment (getEnv)
-import System.Posix.Files (getFileStatus, isDirectory)
-
-import XMonad hiding (config)
-import XMonad.Prompt
-import XMonad.Util.Run
-
-econst :: Monad m => a -> IOException -> m a
-econst = const . return
-
-data Shell = Shell String
-
-instance XPrompt Shell where
-    showXPrompt (Shell q)     = q
-    completionToCommand _ = escape
-
-shellPrompt :: String -> XPConfig -> X ()
-shellPrompt q c = do
-    cmds <- io getCommands
-    mkXPrompt (Shell q) c (getShellCompl cmds) spawn
-
-{- $spawns
-    See safe and unsafeSpawn in "XMonad.Util.Run".
-    prompt is an alias for safePrompt;
-    safePrompt and unsafePrompt work on the same principles, but will use
-    XPrompt to interactively query the user for input; the appearance is
-    set by passing an XPConfig as the second argument. The first argument
-    is the program to be run with the interactive input.
-    You would use these like this:
-
-    >     , ((modm,               xK_b), safePrompt "firefox" greenXPConfig)
-    >     , ((modm .|. shiftMask, xK_c), prompt ("xterm" ++ " -e") greenXPConfig)
-
-    Note that you want to use safePrompt for Firefox input, as Firefox
-    wants URLs, and unsafePrompt for the XTerm example because this allows
-    you to easily start a terminal executing an arbitrary command, like
-    'top'. -}
-
-prompt, unsafePrompt, safePrompt :: String -> FilePath -> XPConfig -> X ()
-prompt = unsafePrompt
-safePrompt q c config = mkXPrompt (Shell q) config (getShellCompl [c]) run
-    where run = safeSpawn c . return
-unsafePrompt q c config = mkXPrompt (Shell q) config (getShellCompl [c]) run
-    where run a = unsafeSpawn $ c ++ " " ++ a
-
-getShellCompl :: [String] -> String -> IO [String]
-getShellCompl cmds s | s == "" || last s == ' ' = return []
-                     | otherwise                = do
-    f     <- fmap lines $ runProcessWithInput "bash" [] ("compgen -A file -- "
-                                                        ++ s ++ "\n")
-    files <- case f of
-               [x] -> do fs <- getFileStatus (encodeString x)
-                         if isDirectory fs then return [x ++ "/"]
-                                           else return [x]
-               _   -> return f
-    return . uniqSort $ files ++ commandCompletionFunction cmds s
-
-commandCompletionFunction :: [String] -> String -> [String]
-commandCompletionFunction cmds str | '/' `elem` str = []
-                                   | otherwise      = filter (isPrefixOf str) cmds
-
-getCommands :: IO [String]
-getCommands = do
-    p  <- getEnv "PATH" `E.catch` econst []
-    let ds = filter (/= "") $ split ':' p
-    es <- forM ds $ \d -> do
-        exists <- doesDirectoryExist d
-        if exists
-            then getDirectoryContents d
-            else return []
-    return . uniqSort . filter ((/= '.') . head) . concat $ es
-
-split :: Eq a => a -> [a] -> [[a]]
-split _ [] = []
-split e l =
-    f : split e (rest ls)
-        where
-          (f,ls) = span (/=e) l
-          rest s | s == []   = []
-                 | otherwise = tail s
-
-escape :: String -> String
-escape []       = ""
-escape (x:xs)
-    | isSpecialChar x = '\\' : x : escape xs
-    | otherwise       = x : escape xs
-
-isSpecialChar :: Char -> Bool
-isSpecialChar =  flip elem " &\\@\"'#?$*()[]{};"
diff --git a/accounts/gkleen@sif/xmonad/lib/XMonad/Prompt/MySsh.hs b/accounts/gkleen@sif/xmonad/lib/XMonad/Prompt/MySsh.hs
deleted file mode 100644
index 998c533e..00000000
--- a/accounts/gkleen@sif/xmonad/lib/XMonad/Prompt/MySsh.hs
+++ /dev/null
@@ -1,246 +0,0 @@
-module XMonad.Prompt.MySsh
-    ( -- * Usage
-      -- $usage
-      sshPrompt,
-      Ssh,
-      Override (..),
-      mkOverride,
-      Conn (..),
-      moshCmd,
-      moshCmd',
-      sshCmd,
-      inTmux,
-      withEnv
-    ) where
-
-import XMonad
-import XMonad.Util.Run
-import XMonad.Prompt
-
-import System.Directory
-import System.Environment
-import qualified Control.Exception as E
-
-import Control.Monad
-import Data.Maybe
-
-import Text.Parsec.String
-import Text.Parsec
-import Data.Char (isSpace)
-
-econst :: Monad m => a -> E.IOException -> m a
-econst = const . return
-
--- $usage
--- 1. In your @~\/.xmonad\/xmonad.hs@:
---
--- > import XMonad.Prompt
--- > import XMonad.Prompt.Ssh
---
--- 2. In your keybindings add something like:
---
--- >   , ((modm .|. controlMask, xK_s), sshPrompt defaultXPConfig)
---
--- Keep in mind, that if you want to use the completion you have to
--- disable the "HashKnownHosts" option in your ssh_config
---
--- For detailed instruction on editing the key binding see
--- "XMonad.Doc.Extending#Editing_key_bindings".
-
-data Override = Override
-                { oUser :: Maybe String
-                , oHost :: String
-                , oPort :: Maybe Int
-                , oCommand :: Conn -> String
-                }
-
-mkOverride = Override { oUser = Nothing, oHost = "", oPort = Nothing, oCommand = sshCmd }
-sshCmd c = concat
-           [ "ssh -t "
-           , if isJust $ cUser c then (fromJust $ cUser c) ++ "@" else ""
-           , cHost c
-           , if isJust $ cPort c then " -p " ++ (show $ fromJust $ cPort c) else ""
-           , " -- "
-           , cCommand c
-           ]
-moshCmd c = concat
-            [ "mosh "
-            , if isJust $ cUser c then (fromJust $ cUser c) ++ "@" else ""
-            , cHost c
-            , if isJust $ cPort c then " --ssh=\"ssh -p " ++ (show $ fromJust $ cPort c) ++ "\"" else ""
-            , " -- "
-            , cCommand c
-            ]
-moshCmd' p c = concat
-            [ "mosh "
-            , "--server=" ++ p ++ " "
-            , if isJust $ cUser c then (fromJust $ cUser c) ++ "@" else ""
-            , cHost c
-            , if isJust $ cPort c then " --ssh=\"ssh -p " ++ (show $ fromJust $ cPort c) ++ "\"" else ""
-            , " -- "
-            , cCommand c
-            ]
-inTmux Nothing c
-  | null $ cCommand c = c { cCommand = "tmux new-session" }
-  | otherwise = c { cCommand = "tmux new-session \"" ++ (cCommand c) ++  "\"" }
-inTmux (Just h) c
-  | null $ cCommand c = c { cCommand = "tmux new-session -As " <> h }
-  | otherwise = c { cCommand = "tmux new-session \"" ++ (cCommand c) ++  "\"" }
-withEnv :: [(String, String)] -> Conn -> Conn
-withEnv envs c = c { cCommand = "env" ++ (concat $ map (\(n, v) -> ' ' : (n ++ "=" ++ v)) envs) ++ " " ++ (cCommand c) }
-             
-data Conn = Conn
-            { cUser :: Maybe String
-            , cHost :: String
-            , cPort :: Maybe Int
-            , cCommand :: String
-            } deriving (Eq, Show, Read)
-
-data Ssh = Ssh
-
-instance XPrompt Ssh where
-  showXPrompt       Ssh = "SSH to: "
-  commandToComplete _ c = c
-  nextCompletion      _ = getNextCompletion
-
-toConn :: String -> Maybe Conn
-toConn = toConn' . parse connParser "(unknown)"
-toConn' :: Either ParseError Conn -> Maybe Conn
-toConn' (Left _) = Nothing
-toConn' (Right a) = Just a
-
-connParser :: Parser Conn
-connParser = do
-  spaces
-  user' <- optionMaybe $ try $ do
-    str <- many1 $ satisfy (\c -> (not $ isSpace c) && (c /= '@'))
-    char '@'
-    return str
-  host' <- many1 $ satisfy (not . isSpace)
-  port' <- optionMaybe $ try $ do
-    space
-    string "-p"
-    spaces
-    int <- many1 digit
-    (space >> return ()) <|> eof
-    return $ (read int :: Int)
-  spaces
-  command' <- many anyChar
-  eof
-  return $ Conn
-         { cHost = host'
-         , cUser = user'
-         , cPort = port'
-         , cCommand = command'
-         }
-
-sshPrompt :: [Override] -> XPConfig -> X ()
-sshPrompt o c = do
-  sc <- io sshComplList
-  mkXPrompt Ssh c (mkComplFunFromList c sc) $ ssh o
-
-ssh :: [Override] -> String -> X ()
-ssh overrides str = do
-  let cmd = applyOverrides overrides str
-  liftIO $ putStr "SSH Command: "
-  liftIO $ putStrLn cmd
-  runInTerm "" cmd
-
-applyOverrides :: [Override] -> String -> String
-applyOverrides [] str = "ssh " ++ str
-applyOverrides (o:os) str = case (applyOverride o str) of
-  Just str -> str
-  Nothing -> applyOverrides os str
-
-applyOverride :: Override -> String -> Maybe String
-applyOverride o str = let
-  conn = toConn str
-  in
-   if isNothing conn then Nothing else
-     case (fromJust conn) `matches` o of
-       True -> Just $ (oCommand o) (fromJust conn)
-       False -> Nothing
-
-matches :: Conn -> Override -> Bool
-a `matches` b = and
-                [ justBool (cUser a) (oUser b) (==)
-                , (cHost a) == (oHost b)
-                , justBool (cPort a) (oPort b) (==)
-                ]
-
-justBool :: Eq a => Maybe a -> Maybe a -> (a -> a -> Bool) -> Bool
-justBool Nothing _ _ = True
-justBool _ Nothing _ = True
-justBool (Just a) (Just b) match = a `match` b
-
-sshComplList :: IO [String]
-sshComplList = uniqSort `fmap` liftM2 (++) sshComplListLocal sshComplListGlobal
-
-sshComplListLocal :: IO [String]
-sshComplListLocal = do
-  h <- getEnv "HOME"
-  s1 <- sshComplListFile $ h ++ "/.ssh/known_hosts"
-  s2 <- sshComplListConf $ h ++ "/.ssh/config"
-  return $ s1 ++ s2
-
-sshComplListGlobal :: IO [String]
-sshComplListGlobal = do
-  env <- getEnv "SSH_KNOWN_HOSTS" `E.catch` econst "/nonexistent"
-  fs <- mapM fileExists [ env
-                        , "/usr/local/etc/ssh/ssh_known_hosts"
-                        , "/usr/local/etc/ssh_known_hosts"
-                        , "/etc/ssh/ssh_known_hosts"
-                        , "/etc/ssh_known_hosts"
-                        ]
-  case catMaybes fs of
-    []    -> return []
-    (f:_) -> sshComplListFile' f
-
-sshComplListFile :: String -> IO [String]
-sshComplListFile kh = do
-  f <- doesFileExist kh
-  if f then sshComplListFile' kh
-       else return []
-
-sshComplListFile' :: String -> IO [String]
-sshComplListFile' kh = do
-  l <- readFile kh
-  return $ map (getWithPort . takeWhile (/= ',') . concat . take 1 . words)
-         $ filter nonComment
-         $ lines l
-
-sshComplListConf :: String -> IO [String]
-sshComplListConf kh = do
-  f <- doesFileExist kh
-  if f then sshComplListConf' kh
-       else return []
-
-sshComplListConf' :: String -> IO [String]
-sshComplListConf' kh = do
-  l <- readFile kh
-  return $ map (!!1)
-         $ filter isHost
-         $ map words
-         $ lines l
- where
-   isHost ws = take 1 ws == ["Host"] && length ws > 1
-
-fileExists :: String -> IO (Maybe String)
-fileExists kh = do
-  f <- doesFileExist kh
-  if f then return $ Just kh
-       else return Nothing
-
-nonComment :: String -> Bool
-nonComment []      = False
-nonComment ('#':_) = False
-nonComment ('|':_) = False -- hashed, undecodeable
-nonComment _       = True
-
-getWithPort :: String -> String
-getWithPort ('[':str) = host ++ " -p " ++ port
-    where (host,p) = break (==']') str
-          port = case p of
-                   ']':':':x -> x
-                   _         -> "22"
-getWithPort  str = str
diff --git a/accounts/gkleen@sif/xmonad/package.yaml b/accounts/gkleen@sif/xmonad/package.yaml
deleted file mode 100644
index f65137af..00000000
--- a/accounts/gkleen@sif/xmonad/package.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-name: xmonad-yggdrasil
-
-executables:
-  xmonad:
-    dependencies:
-      - base
-      - xmonad
-      - xmonad-contrib
-      - aeson
-      - bytestring
-      - text
-      - temporary
-      - filepath
-      - directory
-      - network
-      - unix
-      - utf8-string
-      - parsec
-      - process
-      - mtl
-      - X11
-      - transformers
-      - containers
-      - hostname
-      - libnotify
-      - taffybar
-
-    main: xmonad.hs
-    source-dirs:
-      - .
-      - lib
diff --git a/accounts/gkleen@sif/xmonad/stack.nix b/accounts/gkleen@sif/xmonad/stack.nix
deleted file mode 100644
index 17a49e04..00000000
--- a/accounts/gkleen@sif/xmonad/stack.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ ghc, nixpkgs ? import ./nixpkgs.nix {} }:
-
-let
-  haskellPackages = import ./stackage.nix { inherit nixpkgs; };
-  inherit (nixpkgs {}) pkgs;
-in pkgs.haskell.lib.buildStackProject {
-  inherit ghc;
-  inherit (haskellPackages) stack;
-  name = "stackenv";
-  buildInputs = (with pkgs;
-    [ xorg.libX11 xorg.libXrandr xorg.libXinerama xorg.libXScrnSaver xorg.libXext xorg.libXft
-      cairo
-      glib
-    ]) ++ (with haskellPackages;
-    [ 
-    ]);
-}
diff --git a/accounts/gkleen@sif/xmonad/stack.yaml b/accounts/gkleen@sif/xmonad/stack.yaml
deleted file mode 100644
index b8ed1147..00000000
--- a/accounts/gkleen@sif/xmonad/stack.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-nix:
-  enable: true
-  shell-file: stack.nix
-
-resolver: lts-13.21
-
-packages:
-  - .
-
-extra-deps: []
diff --git a/accounts/gkleen@sif/xmonad/xmonad-yggdrasil.nix b/accounts/gkleen@sif/xmonad/xmonad-yggdrasil.nix
deleted file mode 100644
index 7c853619..00000000
--- a/accounts/gkleen@sif/xmonad/xmonad-yggdrasil.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ mkDerivation, aeson, base, bytestring, containers, directory
-, filepath, hostname, hpack, mtl, network, parsec, process, lib
-, temporary, transformers, unix, utf8-string, X11, xmonad
-, xmonad-contrib, libnotify, taffybar
-}:
-mkDerivation {
-  pname = "xmonad-yggdrasil";
-  version = "0.0.0";
-  src = ./.;
-  isLibrary = false;
-  isExecutable = true;
-  libraryToolDepends = [ hpack ];
-  executableHaskellDepends = [
-    aeson base bytestring containers directory filepath hostname mtl
-    network parsec process temporary transformers unix utf8-string X11
-    xmonad xmonad-contrib libnotify taffybar
-  ];
-  preConfigure = "hpack";
-  license = "unknown";
-  hydraPlatforms = lib.platforms.none;
-}
diff --git a/accounts/gkleen@sif/xmonad/xmonad.hs b/accounts/gkleen@sif/xmonad/xmonad.hs
deleted file mode 100644
index a44d3bb7..00000000
--- a/accounts/gkleen@sif/xmonad/xmonad.hs
+++ /dev/null
@@ -1,939 +0,0 @@
-{-# LANGUAGE TupleSections, ViewPatterns, OverloadedStrings, FlexibleInstances, UndecidableInstances, MultiWayIf, NumDecimals #-}
-
-import XMonad
-import XMonad.Hooks.DynamicLog
-import XMonad.Hooks.ManageDocks
-import XMonad.Util.Run hiding (proc)
-import XMonad.Util.Loggers
-import XMonad.Util.EZConfig(additionalKeys)
-import System.IO
-import System.IO.Error
-import System.Environment
-import Data.Map (Map)
-import qualified Data.Map as Map
-import qualified XMonad.StackSet as W
-import System.Exit
-import Control.Monad.State (get)
--- import XMonad.Layout.Spiral
-import Data.Ratio
-import Data.List
-import Data.Char
-import Data.Maybe (fromMaybe, listToMaybe, maybeToList, catMaybes, isJust)
-import XMonad.Layout.Tabbed
-import XMonad.Prompt
-import XMonad.Prompt.Input
-import XMonad.Util.Scratchpad
-import XMonad.Util.NamedScratchpad
-import XMonad.Util.Ungrab
-import Control.Monad (sequence, liftM, liftM2, join, void)
-import XMonad.Util.WorkspaceCompare
-import XMonad.Layout.NoBorders
-import XMonad.Layout.PerWorkspace
-import XMonad.Layout.SimplestFloat
-import XMonad.Layout.Renamed
-import XMonad.Layout.Reflect
-import XMonad.Layout.OnHost
-import XMonad.Layout.Combo
-import XMonad.Layout.ComboP
-import XMonad.Layout.Column
-import XMonad.Layout.TwoPane
-import XMonad.Layout.IfMax
-import XMonad.Layout.LayoutBuilder
-import XMonad.Layout.WindowNavigation
-import XMonad.Layout.Dwindle
-import XMonad.Layout.TrackFloating
-import System.Process
-import System.Directory (removeFile)
-import System.Posix.Files
-import System.FilePath ((</>))
-import Control.Concurrent
-import System.Posix.Process (getProcessID)
-import System.IO.Error
-import System.IO
-import XMonad.Hooks.ManageHelpers hiding (CW)
-import XMonad.Hooks.UrgencyHook as U
-import XMonad.Hooks.EwmhDesktops
-import XMonad.StackSet (RationalRect (..))
-import Control.Monad (when, filterM, (<=<))
-import Graphics.X11.ExtraTypes.XF86
-import XMonad.Util.Cursor
-import XMonad.Actions.Warp
-import XMonad.Actions.FloatKeys
-import XMonad.Util.SpawnOnce
-import System.Directory
-import System.FilePath
-import XMonad.Actions.CopyWindow
-import XMonad.Hooks.ServerMode
-import XMonad.Actions.Commands
-import XMonad.Actions.CycleWS
-import XMonad.Actions.RotSlaves
-import XMonad.Actions.UpdatePointer
-import XMonad.Prompt.Window
-import Data.IORef
-import Data.Monoid
-import Data.String
-import qualified XMonad.Actions.PhysicalScreens as P
-
-import XMonad.Layout.IM
-
-import System.Taffybar.Support.PagerHints (pagerHints)
-
-import XMonad.Prompt.MyShell
-import XMonad.Prompt.MyPass
-import XMonad.Prompt.MySsh
-
-import XMonad.Mpv
-
-import Network.HostName
-
-import Control.Applicative ((<$>))
-
-import Libnotify as Notify hiding (appName)
-import qualified Libnotify as Notify (appName)
-import Libnotify (Notification)
--- import System.Information.Battery
-
-import Data.Int (Int32)
-
-import System.Posix.Process
-import System.Posix.Signals
-import System.Posix.IO as Posix
-import Control.Exception
-
-import System.IO.Unsafe
-
-import Control.Monad.Trans.Class
-import Control.Monad.Trans.Maybe
-
-import Data.Fixed (Micro)
-
-import qualified Data.Text as Text
-import Data.Ord (comparing)
-import Debug.Trace
-
-instance MonadIO m => IsString (m ()) where
-  fromString = spawn
-
-type KeyMap = Map (ButtonMask, KeySym) (X ())
-
-data Host = Host
-            { hName :: HostName
-            , hManageHook :: ManageHook
-            , hWsp :: Integer -> WorkspaceId
-            , hCoWsp :: String -> Maybe WorkspaceId
-            , hKeysMod :: XConfig Layout -> (KeyMap -> KeyMap)
-            , hScreens :: [P.PhysicalScreen]
-            , hKbLayouts :: [(String, Maybe String)]
-            , hCmds :: X [(String, X ())]
-            , hKeyUpKeys :: XConfig Layout -> KeyMap
-            }
-
-defaultHost = Host { hName = "unkown"
-                   , hManageHook = composeOne [manageScratchTerm]
-                   , hWsp = show
-                   , hCoWsp = const Nothing
-                   , hKeysMod = const id
-                   , hScreens = [0,1..]
-                   , hKbLayouts = [ ("us", Just "dvp")
-                                  , ("us", Nothing)
-                                  , ("de", Nothing)
-                                  ]
-                   , hCmds = return []
-                   , hKeyUpKeys = const Map.empty
-                   }
-
-browser :: String
-browser = "env MOZ_USE_XINPUT2=1 firefox"
-
-gray, darkGray, red, green :: String
-gray = "#808080"
-darkGray = "#202020"
-red = "#800000"
-green = "#008000"
-
-hostFromName :: HostName -> Host
-hostFromName h@("vali") = defaultHost { hName = h
-                                      , hManageHook = composeOne $ catMaybes [ Just manageScratchTerm
-                                                                             , assign "web"  $ className =? ".dwb-wrapped"
-                                                                             , assign "web"  $ className =? "Chromium"
-                                                                             , assign "work" $ className =? "Emacs"
-                                                                             , assign "media" $ className =? "mpv"
-                                                                             ]
-                                      , hWsp = hWsp
-                                      , hCoWsp = hCoWsp
-                                      , hKeysMod = \conf -> Map.union $ (Map.fromList $ join $ map (spawnBindings conf) [ (xK_d, ["chromium", "chromium $(xclip -o)"])
-                                                                                                                        , (xK_e, ["emacsclient -c"])
-                                                                                                                        ])
-                                                            `Map.union`
-                                                            ( Map.fromList [ ((XMonad.modMask conf .|. controlMask, xK_Return), scratchpadSpawnActionCustom $ (XMonad.terminal conf) ++ " -name scratchpad -title scratchpad -e tmux new-session -D -s scratch")
-                                                                           ] )
-                                      , hScreens = hScreens defaultHost
-                                      }
-  where
-    workspaceNames = Map.fromList [ (2, "web")
-                                  , (3, "work")
-                                  , (10, "media")
-                                  ]
-    hWsp = wspFromMap workspaceNames
-    hCoWsp = coWspFromMap workspaceNames
-    assign wsp test = (\wsp -> test -?> doShift wsp) <$> hCoWsp wsp
-hostFromName h
-  | h `elem` ["hel", "sif"] = defaultHost { hName = h
-                                          , hManageHook = namedScratchpadManageHook scratchpads <+> composeOne (catMaybes
-                                              [ assign "mpv"     $ className =? "mpv"
-                                              , assign "mpv"     $ stringProperty "WM_WINDOW_ROLE" =? "presentation"
-                                              , assign "read"    $ stringProperty "WM_WINDOW_ROLE" =? "presenter"
-                                              , assign "mpv"     $ className =? "factorio"
-                                              , assign "mpv"     $ resource =? "twitch"
-                                              , assign "web"     $ className =? "chromium-browser"
-                                              , assign "web"     $ className =? "Google-chrome"
-                                              , assign "work"    $ (appName =? "Devtools" <&&> className =? "firefox")
-                                              , assign "work"    $ className =? "Postman"
-                                              , assign "web"     $ (appName =? "Navigator" <&&> className =? "firefox")
-                                              , assign "comm"    $ (className =? "Emacs" <&&> title =? "Mail")
-                                              , assign "comm"    $ className =? "Zulip"
-                                              , assign "comm"    $ className =? "Element"
-                                              , assign "comm"    $ className =? "Rocket.Chat"
-                                              , assign "comm"    $ className =? "Discord"
-                                              , assign "comm"    $ className =? "Rainbow"
-                                              , assign "media"   $ resource =? "media"
-                                              , assign "monitor" $ className =? "Grafana"
-                                              , assign "monitor" $ className =? "Virt-viewer"
-                                              , assign "monitor" $ resource =? "htop"
-                                              , assign "monitor" $ resource =? "monitor"
-                                              , assign "monitor" $ className =? "xfreerdp"
-                                              , assign "monitor" $ className =? "org.remmina.Remmina"
-                                              , Just $ resource =? "htop" -?> centerFloat
-                                              , Just $ (className =? "Scp-dbus-service.py") -?> centerFloat
-                                              , Just $ resource =? "log" -?> centerFloat
-                                              , assign "work"    $ className =? "Alacritty"
-                                              , Just $ (appName =? "Edit with Emacs FRAME") -?> centerFloat
-                                              , assign' ["work", "uni"] $ (className =? "Emacs" <&&> appName /=? "Edit with Emacs FRAME")
-                                              , assign' ["work", "uni"] $ className =? "jetbrains-idea-ce"
-                                              , assign "read"    $ className =? "llpp"
-                                              , assign "read"    $ className =? "Evince"
-                                              , assign "read"    $ className =? "Zathura"
-                                              , assign "read"    $ className =? "MuPDF"
-                                              , assign "read"    $ className =? "Xournal"
-                                              , assign "read"    $ appName =? "libreoffice"
-                                              , assign "read"    $ appName =? "com-trollworks-gcs-app-GCS"
-                                              , assign "read"    $ appName =? "Tux.py"
-                                              , assign "read"    $ className =? "Gnucash"
-                                              , assign "comm"    $ className =? "Skype"
-                                              , assign "comm"    $ className =? "Daily"
-                                              , assign "comm"    $ className =? "Pidgin"
-                                              , assign "comm"    $ className =? "Thunderbird"
-                                              , assign "comm"    $ className =? "Slack"
-                                              , Just $ (resource =? "xvkbd") -?> doRectFloat $ RationalRect (1 % 8) (3 % 8) (6 % 8) (4 % 8)
-                                              , Just $ (stringProperty "_NET_WM_WINDOW_TYPE" =? "_NET_WM_WINDOW_TYPE_DIALOG") -?> doFloat
-                                              , Just $ (className =? "Dunst") -?> doFloat
-                                              , Just $ (className =? "Xmessage") -?> doCenterFloat
-                                              , Just $ (className =? "Nm-openconnect-auth-dialog") -?> centerFloat
-                                              , Just $ (className =? "Pinentry") -?> doCenterFloat
-                                              , Just $ (className =? "pinentry") -?> doCenterFloat
-                                              , Just $ (stringProperty "WM_WINDOW_ROLE" =? "GtkFileChooseDialog") -?> centerFloatSmall
-                                              , Just $ (className =? "Nvidia-settings") -?> doCenterFloat
-                                              , Just $ fmap ("Minetest" `isInfixOf`) title -?> doIgnore
-                                              , Just $ fmap ("Automachef" `isInfixOf`) title -?> doIgnore
-                                              , assign "call"    $ className =? "zoom"
-                                              ])
-                                          , hWsp = hWsp
-                                          , hCoWsp = hCoWsp
-                                          , hKeysMod = \conf -> Map.union $ (Map.fromList $ join $ map (spawnBindings conf) [ (xK_e, ["emacsclient -c"])
-                                                                                                                            , (xK_d, [fromString browser, "google-chrome" {- , "notmuch-links" -}])
-                                                                                                                            , (xK_c, [ inputPrompt xPConfigMonospace "dc" ?+ dc ])
-                                                                                                                            , (xK_g, ["pidgin"])
-                                                                                                                            , (xK_s, ["skype"])
-                                                                                                                            -- , (xK_p, [mkPassPrompt "Type password" pwType xPConfig, mkPassPrompt "Show password" pwShow xPConfig, mkPassPrompt "Copy password" pwClip xPConfig])
-                                                                                                                            , (xK_w, ["sudo rewacom"])
-                                                                                                                            , (xK_y, [ "tmux new-window -dt media /var/media/link.hs $(xclip -o)"
-                                                                                                                                     , "tmux new-window -dt media /var/media/download.hs $(xclip -o)"
-                                                                                                                                     , "tmux new-window -dt media /var/media/download.hs $(xclip -o -selection clipboard)"
-                                                                                                                                     ])
-                                                                                                                            , (xK_l, [ "tmux new-window -dt media mpv $(xclip -o)"
-                                                                                                                                     , "tmux new-window -dt media mpv $(xclip -o -selection clipboard)"
-                                                                                                                                     , "alacritty --class media -e tmuxp load /var/media"
-                                                                                                                                     ])
-                                                                                                                            {- , (xK_m, [ "emacsclient -c -F \"'(title . \\\"Mail\\\")\" -e '(notmuch)'"
-                                                                                                                                     , "emacsclient -c -F \"'(title . \\\"Mail\\\")\" -e '(notmuch-mua-new-mail)'"
-                                                                                                                                     , "emacsclient -c -F \"'(title . \\\"Mail\\\")\" -e \"(browse-url-mail \"$(xclip -o)\")\""
-                                                                                                                                     ]) -}
-                                                                                                                            , (xK_Return, ["keynav start,windowzoom", "keynav start"])
-                                                                                                                            , (xK_t, [inputPrompt xPConfigMonospace "fuzzytime timer" ?+ fuzzytime, fuzzytime "unset", work_fuzzytime])
-                                                                                                                            , (xK_a, [inputPrompt xPConfigMonospace "adjmix" ?+ adjmix])
-                                                                                                                            , (xK_s, [ inputPromptWithCompl xPConfigMonospace "start synergy" synergyCompl ?+ synergyStart
-                                                                                                                                     , inputPromptWithCompl xPConfigMonospace "stop synergy" synergyCompl ?+ synergyStop
-                                                                                                                                     ])
-                                                                                                                            , (xK_h, [ "alacritty --class htop -e htop"
-                                                                                                                                     , "alacritty --class log -e journalctl -xef"
-                                                                                                                                     ])
-                                                                                                                            , (xK_x, [ "autorandr -c"
-                                                                                                                                     , "autorandr -fl def"
-                                                                                                                                     ])
-                                                                                                                            , (xK_z, [ "zulip -- --force-device-scale-factor=2"
-                                                                                                                                     ])
-                                                                                                                            ])
-                                                                `Map.union`
-                                                                ( Map.fromList [ ((XMonad.modMask conf .|. controlMask, xK_Return), namedScratchpadAction scratchpads "term")
-                                                                               , ((XMonad.modMask conf .|. controlMask, xK_a), namedScratchpadAction scratchpads "pavucontrol")
-                                                                               , ((XMonad.modMask conf .|. controlMask, xK_o), namedScratchpadAction scratchpads "easyeffects")
-                                                                               , ((XMonad.modMask conf .|. controlMask .|. shiftMask, xK_o), namedScratchpadAction scratchpads "helvum")
-                                                                               , ((XMonad.modMask conf .|. controlMask, xK_w), namedScratchpadAction scratchpads "alarms")
-                                                                               , ((XMonad.modMask conf .|. controlMask, xK_b), namedScratchpadAction scratchpads "blueman")
-                                                                               , ((XMonad.modMask conf .|. controlMask, xK_p), namedScratchpadAction scratchpads "keepassxc")
-                                                                               , ((XMonad.modMask conf .|. controlMask, xK_t), namedScratchpadAction scratchpads "toggl")
-                                                                               , ((XMonad.modMask conf .|. controlMask, xK_e), namedScratchpadAction scratchpads "emacs")
-                                                                               , ((XMonad.modMask conf .|. controlMask, xK_m), namedScratchpadAction scratchpads "calendar")
-                                                                               , ((XMonad.modMask conf .|. controlMask, xK_f), namedScratchpadAction scratchpads "music")
-                                                                               , ((XMonad.modMask conf .|. mod1Mask, xK_Up), rotate U)
-                                                                               , ((XMonad.modMask conf .|. mod1Mask, xK_Down), rotate D)
-                                                                               , ((XMonad.modMask conf .|. mod1Mask, xK_Left), rotate L)
-                                                                               , ((XMonad.modMask conf .|. mod1Mask, xK_Right), rotate R)
-                                                                               , ((controlMask,               xK_space ), "dunstctl close"      )
-                                                                               , ((controlMask .|. shiftMask, xK_space ), "dunstctl close-all"  )
-                                                                               , ((controlMask,               xK_period), "dunstctl context"    )
-                                                                               , ((controlMask,               xK_comma ), "dunstctl history-pop")
-                                                                               -- , ((XMonad.modMask conf .|. shiftMask, xK_a), startMute "hel")
-                                                                               ] )
-                                          , hKeyUpKeys = \conf -> Map.fromList [ -- ((XMonad.modMask conf .|. shiftMask, xK_a), stopMute "hel")
-                                                                               ]
-                                          , hScreens = hScreens defaultHost
-                                          , hCmds = return [ ("prev-workspace", prevWS)
-                                                           , ("next-workspace", nextWS)
-                                                           , ("prev-window", rotAllDown)
-                                                           , ("next-window", rotAllUp)
-                                                           , ("banish", banishScreen LowerRight)
-                                                           , ("update-gpg-tty", safeSpawn "gpg-connect-agent" ["UPDATESTARTUPTTY", "/bye"])
-                                                           , ("rescreen", rescreen)
-                                                           , ("repanel", do
-                                                                 spawn "nm-applet"
-                                                                 spawn "blueman-applet"
-                                                                 spawn "pasystray"
-                                                                 spawn "kdeconnect-indicator"
-                                                                 spawn "dunst -print"
-                                                                 spawn "udiskie"
-                                                                 spawn "autocutsel -s PRIMARY"
-                                                                 spawn "autocutsel -s CLIPBOARD"
-                                                             )
-                                                           , ("pause", mediaMpv $ MpvSetProperty "pause" True)
-                                                           , ("unpause", mediaMpv $ MpvSetProperty "pause" False)
-                                                           , ("exit", io $ exitWith ExitSuccess)
-                                                           ]
-                                          }
-  where
-    withGdkScale act = void . xfork $ setEnv "GDK_SCALE" "2" >> act
-    workspaceNames = Map.fromList [ (1, "comm")
-                                  , (2, "web")
-                                  , (3, "work")
-                                  , (4, "read")
-                                  , (5, "monitor")
-                                  , (6, "uni")
-                                  , (8, "call")
-                                  , (9, "media")
-                                  , (10, "mpv")
-                                  ]
-    scratchpads = [ NS "term" "alacritty --class scratchpad --title scratchpad -e tmux new-session -AD -s scratch" (resource =? "scratchpad") centerFloat
-                  , NS "pavucontrol" "pavucontrol" (resource =? "pavucontrol") centerFloat
-                  , NS "helvum" "helvum" (resource =? "helvum") centerFloat
-                  , NS "easyeffects" "easyeffects" (resource =? "easyeffects") centerFloat
-                  , NS "alarms" "alarm-clock-applet" (className =? "Alarm-clock-applet" <&&> title =? "Alarms") centerFloat
-                  , NS "blueman" "blueman-manager" (className =? ".blueman-manager-wrapped") centerFloat
-                  , NS "keepassxc" "keepassxc" (className =? "KeePassXC") centerFloat
-                  , NS "toggl" "toggldesktop" (className =? "Toggl Desktop") centerFloat
-                  , NS "calendar" "minetime -- --force-device-scale-factor=1.6" (className =? "MineTime") centerFloat
-                  , NS "emacs" "emacsclient -c -F \"'(title . \\\"Scratchpad\\\")\"" (className =? "Emacs" <&&> title =? "Scratchpad") centerFloat
-                  , NS "music" "ytmdesktop" (className =? "youtube-music-desktop-app") centerFloat
-                  ]
-    centerFloat = customFloating $ RationalRect (1 % 16) (1 % 16) (7 % 8) (7 % 8)
-    centerFloatSmall = customFloating $ RationalRect (1 % 4) (1 % 4) (1 % 2) (1 % 2)
-    hWsp = wspFromMap workspaceNames
-    hCoWsp = coWspFromMap workspaceNames
-    assign wsp test = (\wsp -> test -?> doShift wsp) <$> hCoWsp wsp
-    assign' :: [String] -> Query Bool -> Maybe MaybeManageHook
-    assign' wsps test = do
-      wsIds <- mapM hCoWsp wsps
-      return $ test -?> go wsIds
-      where
-        go :: [WorkspaceId] -> ManageHook
-        go wsps = do
-          visWsps <- liftX $ (\wset -> W.tag . W.workspace <$> W.current wset : W.visible wset) <$> gets windowset
-          case (filter (`elem` visWsps) wsps, wsps) of
-            (wsp : _, _) -> doShift wsp
-            (_, wsp : _) -> doShift wsp
-            ([], [])     -> return mempty
-    rotate rot = do
-      safeSpawn "xrandr" ["--output", "eDP-1", "--rotate", xrandrDir]
-      mapM_ rotTouch touchscreens
-      where
-        xrandrDir = case rot of
-          U -> "normal"
-          L -> "left"
-          R -> "right"
-          D -> "inverted"
-        matrix = case rot of
-          U -> [ [ 1,  0,  0]
-               , [ 0,  1,  0]
-               , [ 0,  0,  1]
-               ]
-          L -> [ [ 0, -1,  1]
-               , [ 1,  0,  0]
-               , [ 0,  0,  1]
-               ]
-          R -> [ [ 0,  1,  0]
-               , [-1,  0,  1]
-               , [ 0,  0,  1]
-               ]
-          D -> [ [-1,  0,  1]
-               , [ 0, -1,  1]
-               , [ 0,  0,  1]
-               ]
-        touchscreens = [ "Wacom Co.,Ltd. Pen and multitouch sensor Finger touch"
-                       , "Wacom Co.,Ltd. Pen and multitouch sensor Pen stylus"
-                       , "Wacom Co.,Ltd. Pen and multitouch sensor Pen eraser"
-                       ]
-        rotTouch screen = do
-          safeSpawn "xinput" $ ["set-prop", screen, "Coordinate Transformation Matrix"] ++ map (\n -> show n ++ ",") (concat matrix)
-          safeSpawn "xinput" ["map-to-output", screen, "eDP-1"]
-    withPw f label = io . void . forkProcess $ do
-      uninstallSignalHandlers
-      void $ createSession
-      (dropWhileEnd isSpace -> pw) <- readCreateProcess (proc "pass" ["show", label]) ""
-      void $ f pw
-    pwType :: String -> X ()
-    pwType = withPw $ readCreateProcess (proc "xdotool" ["type", "--clearmodifiers", "--file", "-"])
-    pwClip label = safeSpawn "pass" ["show", "--clip", label]
-    pwShow :: String -> X ()
-    pwShow = withPw $ \pw -> do
-      xmessage <- fromMaybe "xmessage" <$> liftIO (lookupEnv "XMONAD_XMESSAGE")
-      readCreateProcess (proc xmessage ["-file", "-"]) pw
-    fuzzytime str = safeSpawn "fuzzytime" $ "timer" : words str
-    work_fuzzytime = io . void . forkProcess $ do
-      readCreateProcess (proc "worktime" []) "" >>= safeSpawn "fuzzytime" . ("timer" : ) . pure
-    adjmix str = safeSpawn "adjmix" $ words str
-    dc expr = void . xfork $ do
-      result <- readProcess "dc" [] $ expr ++ "f"
-      let
-        (first : rest) = filter (not . null) $ lines result
-        notification = Notify.summary first <> Notify.body (unlines rest) <> Notify.timeout Infinite <> Notify.urgency Normal <> Notify.appName "dc"
-      void $ Notify.display notification
-    synergyCompl = mkComplFunFromList' xPConfigMonospace ["mathw86"]
-    synergyStart host = safeSpawn "systemctl" ["--user", "start", "synergy-rtunnel@" ++ host ++ ".service"]
-    synergyStop host = safeSpawn "systemctl" ["--user", "stop", "synergy-rtunnel@" ++ host ++ ".service"]
-
-hostFromName _ = defaultHost
-
--- muteRef :: IORef (Maybe (String, Notification))
--- {-# NOINLINE muteRef #-}
--- muteRef = unsafePerformIO $ newIORef Nothing
-
--- startMute, stopMute :: String -> X ()
--- startMute sink = liftIO $ do
---   muted <- isJust <$> readIORef muteRef
---   when (not muted) $ do
---     let
---       notification = Notify.summary "Muted" <> Notify.timeout Infinite <> Notify.urgency Normal
---       level = "0.0dB"
---     -- level <- runProcessWithInput "ssh" ["bragi", "cat", "/dev/shm/mix/" ++ sink ++ "/level"] ""
---     -- callProcess "ssh" ["bragi", "adjmix", "-t", sink, "-o", "0"]
---     hPutStrLn stderr "Mute"
---     writeIORef muteRef . Just . (level, ) =<< Notify.display notification
--- stopMute sink = liftIO $ do
---   let
---     unmute (Just (level, notification)) = do
---       hPutStrLn stderr "Unmute"
---       -- callProcess "ssh" ["bragi", "adjmix", "-t", sink, "-o", level]
---       Notify.close notification
---     unmute Nothing = return ()
---   muted <- isJust <$> readIORef muteRef
---   when muted . join . atomicModifyIORef muteRef $ (Nothing, ) . unmute
-
-wspFromMap workspaceNames = \i -> case Map.lookup i workspaceNames of
-  Just str -> show i ++ " " ++ str
-  Nothing -> show i
-
-coWspFromMap workspaceNames = \str -> case filter ((== str) . snd) $ Map.toList workspaceNames of
-  [] -> Nothing
-  [(i, _)] -> Just $ wspFromMap workspaceNames i
-  _ -> Nothing
-
-spawnModifiers = [0, controlMask, shiftMask .|. controlMask]
-spawnBindings :: XConfig layout -> (KeySym, [X ()]) -> [((KeyMask, KeySym), X ())]
-spawnBindings conf (k, cmds) = zipWith (\m cmd -> ((modm .|. mod1Mask .|. m, k), cmd)) spawnModifiers cmds
-  where
-    modm = XMonad.modMask conf
-
-manageScratchTerm = (resource =? "scratchpad" <||> resource =? "keysetup") -?> doRectFloat $ RationalRect (1 % 16) (1 % 16) (7 % 8) (7 % 8)
-
-tabbedLayout t = renamed [Replace "Tabbed"] $ reflectHoriz $ t CustomShrink $ tabbedTheme
-tabbedLayoutHoriz t = renamed [Replace "Tabbed Horiz"] $ reflectVert $ t CustomShrink $ tabbedTheme
-tabbedTheme = def
-  { activeColor = "black"
-  , inactiveColor = "black"
-  , urgentColor = "black"
-  , activeBorderColor = gray
-  , inactiveBorderColor = darkGray
-  , urgentBorderColor = red
-  , activeTextColor = gray
-  , inactiveTextColor = gray
-  , urgentTextColor = gray
-  , decoHeight = 32
-  , fontName = "xft:Fira Sans:pixelsize=21"
-  }
-
-main :: IO ()
-main = do
-  arguments <- either (const []) id <$> tryIOError getArgs
-  case arguments of
-    ["--command", s] -> do
-      d   <- openDisplay ""
-      rw  <- rootWindow d $ defaultScreen d
-      a   <- internAtom d "XMONAD_COMMAND" False
-      m   <- internAtom d s False
-      allocaXEvent $ \e -> do
-        setEventType e clientMessage
-        setClientMessageEvent e rw a 32 m currentTime
-        sendEvent d rw False structureNotifyMask e
-        sync d False
-    _ -> do
-      -- batteryMon <- xfork $ monitorBattery Nothing Nothing
-      hostname <- getHostName
-      let
-        host = hostFromName hostname
-      setEnv "HOST" hostname
-      let myConfig = withHostUrgency . ewmhFullscreen . ewmh . pagerHints $ docks def
-            { manageHook = hManageHook host
-            , terminal = "alacritty"
-            , layoutHook = smartBorders . avoidStruts $ windowNavigation layout'
-            , logHook = do
-                dynamicLogString xmobarPP' >>= writeProps
-                updatePointer (99 % 100, 98 % 100) (0, 0)
-            , modMask = mod4Mask
-            , keys = \conf -> hKeysMod host conf $ myKeys' conf host
-            , workspaces = take (length numKeys) $ map wsp [1..]
-            , startupHook = setDefaultCursor xC_left_ptr
-            , normalBorderColor = darkGray
-            , focusedBorderColor = gray
-            , handleEventHook = serverModeEventHookCmd' (hCmds host) <+> keyUpEventHook
-            }
-          writeProps str = do
-            let encodeCChar = map $ fromIntegral . fromEnum
-                atoms = [ "_XMONAD_WORKSPACES"
-                        , "_XMONAD_LAYOUT"
-                        , "_XMONAD_TITLE"
-                        ]
-            (flip mapM_) (zip atoms (lines str)) $ \(atom', content) -> do
-              ustring <- getAtom "UTF8_STRING"
-              atom <- getAtom atom'
-              withDisplay $ \dpy -> io $ do
-                root <- rootWindow dpy $ defaultScreen dpy
-                changeProperty8 dpy root atom ustring propModeReplace $ encodeCChar content
-                sync dpy True
-          wsp = hWsp host
-          -- We can´t define per-host layout modifiers because we lack dependent types
-          layout' = onHost "skadhi" ( onWorkspace (wsp 1) (Full ||| withIM (1%5) (Title "Buddy List") tabbedLayout') $
-                                      onWorkspace (wsp 10) Full $
-                                      onWorkspace (wsp 2) (Full ||| tabbedLayout') $
-                                      onWorkspace (wsp 5) tabbedLayout' $
-                                      onWorkspace (wsp 8) (withIM (1%5) (Title "Friends") tabbedLayout') $
-                                      defaultLayouts
-                                    ) $
-                    onHost "vali"   ( onWorkspace (wsp 2) (Full ||| tabbedLayout' ||| combineTwo (TwoPane 0.01 0.57) Full tabbedLayout') $
-                                      onWorkspace (wsp 3) workLayouts $
-                                      defaultLayouts
-                                    ) $
-                    onHost "hel"    ( onWorkspace (wsp 1) (withIM (1 % 8) (Title "Buddy List") $ trackFloating tabbedLayout') $
-                                      onWorkspace (wsp 2) (tabbedLayout''' ||| Dwindle R CW 1 (5 % 100)) $
-                                      onWorkspace (wsp 3) workLayouts $
-                                      onWorkspace (wsp 6) workLayouts $
-                                      onWorkspace (wsp 4) (tabbedLayout' ||| tabbedLayoutHoriz' ||| Dwindle R CW 1 (5 % 100)) $
-                                      onWorkspace (wsp 5) (tabbedLayout''' ||| Dwindle R CW 1 (5 % 100)) $
-                                      onWorkspace (wsp 10) (tabbedLayout''' ||| combineTwoP (TwoPane (1 % 100) (3 % 4)) tabbedLayout''' tabbedLayout''' (ClassName "mpv") ||| Dwindle R CW 1 (5 % 100)) $
-                                      defaultLayouts
-                                    ) $
-                    onHost "sif"    ( onWorkspace (wsp 1) (withIM (1 % 8) (Title "Buddy List") $ trackFloating tabbedLayout') $
-                                      onWorkspace (wsp 2) (tabbedLayout''' ||| Dwindle R CW 1 (5 % 100)) $
-                                      onWorkspace (wsp 3) workLayouts $
-                                      onWorkspace (wsp 6) workLayouts $
-                                      onWorkspace (wsp 4) (tabbedLayout' ||| tabbedLayoutHoriz' ||| Dwindle R CW 1 (5 % 100)) $
-                                      onWorkspace (wsp 5) (tabbedLayout''' ||| Dwindle R CW 1 (5 % 100)) $
-                                      onWorkspace (wsp 8) tabbedLayout''' $
-                                      onWorkspace (wsp 10) (tabbedLayout''' ||| combineTwoP (TwoPane (1 % 100) (3 % 4)) tabbedLayout''' tabbedLayout''' (ClassName "mpv") ||| Dwindle R CW 1 (5 % 100)) $
-                                      defaultLayouts
-                                    ) $
-                    defaultLayouts
-          -- tabbedLayout''' = renamed [Replace "Tabbed'"] $ IfMax 1 (noBorders Full) (tabbedLayout tabbedBottomAlways)
-          tabbedLayout''' = tabbedLayout tabbedBottom
-          tabbedLayout' = tabbedLayout tabbedBottomAlways
-          tabbedLayoutHoriz' = tabbedLayoutHoriz tabbedLeftAlways
-          defaultLayouts = {- spiralWithDir East CW (1 % 2) -} Dwindle R CW 1 (5 % 100) ||| tabbedLayout' ||| Full
-          -- workLayouts = {- spiralWithDir East CW (1 % 2) -} Dwindle R CW (2 % 1) (5 % 100) ||| tabbedLayout' ||| Full
-          workLayouts = tabbedLayout' ||| (renamed [Replace "Combined"] $ combineTwoP (TwoPane (1 % 100) (1891 % 2560)) tabbedLayout''' (Column 1.6) (ClassName "Postman" `Or` ClassName "Emacs" `Or` ClassName "jetbrains-idea-ce" `Or` (Resource "Devtools" `And` ClassName "Firefox"))) ||| Full ||| Dwindle R CW 1 (5 % 100)
-          sqrtTwo = approxRational (sqrt 2) (1 / 2560)
-          xmobarPP' = xmobarPP { ppTitle = shorten 80
-                               , ppSort = (liftM2 (.)) getSortByIndex $ return scratchpadFilterOutWorkspace
-                               , ppUrgent = wrap "(" ")" . xmobarColor "#800000" ""
-                               , ppHiddenNoWindows = xmobarColor "#202020" "" . wrap "(" ")"
-                               , ppVisible = wrap "(" ")" . xmobarColor "#808000" ""
-                               , ppCurrent = wrap "(" ")" . xmobarColor "#008000" ""
-                               , ppHidden = wrap "(" ")"
-                               , ppWsSep = " "
-                               , ppSep = "\n"
-                               }
-          withHostUrgency = case hostname of
-            "sif" -> withUrgencyHookC urgencyHook' $ def { suppressWhen = U.Never, remindWhen = Every 2 }
-            _ -> id
-          urgencyHook' window = do
-            let blinkLight = (lightHigh >> threadDelay 0.5e6) `finally` lightLow
-                  where
-                    lightHigh =
-                      writeFile "/sys/class/leds/input0::capslock/brightness" =<< readFile "/sys/class/leds/input0::capslock/max_brightness"
-                    lightLow = writeFile "/sys/class/leds/input0::capslock/brightness" "0"
-            runQuery ((resource =? "comm" <||> resource =? "Pidgin" <||> className =? "Gajim" <||> className =? "Skype" <||> className =? "Thunderbird") --> void (xfork blinkLight)) window
-            urgencyHook (BorderUrgencyHook { urgencyBorderColor = red }) window
-          shutdown :: SomeException -> IO a
-          shutdown e = do
-            let pids = [ -- batteryMon
-                       ]
-            mapM_ (signalProcess sigTERM) pids
-            mapM_ (getProcessStatus False False) pids
-            throw e
-          keyUpEventHook :: Event -> X All
-          keyUpEventHook event = handle event >> return (All True)
-            where
-              handle (KeyEvent { ev_event_type = t, ev_state = m, ev_keycode = code })
-                | t == keyRelease = withDisplay $ \dpy -> do
-                    s  <- io $ keycodeToKeysym dpy code 0
-                    mClean <- cleanMask m
-                    ks <- asks $ hKeyUpKeys host . config
-                    userCodeDef () $ whenJust (Map.lookup (mClean, s) ks) id
-                | otherwise = return ()
-              handle _ = return ()
-      handle shutdown $ launch myConfig =<< getDirectories
-
-secs :: Int -> Int
-secs = (* 1000000)
-
--- monitorBattery :: Maybe BatteryContext -> Maybe Notification -> IO ()
--- monitorBattery Nothing n = do
---   ctx <- batteryContextNew
---   case ctx of
---     Nothing -> threadDelay (secs 10) >> monitorBattery Nothing n
---     Just _  -> monitorBattery ctx n
--- monitorBattery ctx@(Just ctx') n = do
---   batInfo <- getBatteryInfo ctx'
---   case batInfo of
---     Nothing -> threadDelay (secs 1) >> monitorBattery ctx n
---     Just batInfo -> do
---       let n'
---             | batteryState batInfo == BatteryStateDischarging
---             , timeLeft <= 1200
---             , timeLeft > 0 = Just $ summary "Discharging" <> hint "value" percentage <> urgency u <> body (duz timeLeft ++ "left")
---             | otherwise = Nothing
---           u
---             | timeLeft <= 600 = Critical
---             | timeLeft <= 1800 = Normal
---             | otherwise = Low
---           timeLeft = batteryTimeToEmpty batInfo
---           percentage :: Int32
---           percentage = round $ batteryPercentage batInfo
---           ts = [("s", 60), ("m", 60), ("h", 24), ("d", 365), ("y", 1)]
---           duz ms = ss
---             where (ss, _) = foldl (\(ss, x) (s, y) -> ((if rem x y > 0 then show (rem x y) ++ s ++ " " else "") ++ ss , quot x y)) ("", ms) ts
---       case n' of
---         Just n' -> Notify.display (maybe mempty reuse n <> Notify.appName "monitorBattery" <> n') >>= (\n -> threadDelay (secs 2) >> monitorBattery ctx (Just n))
---         Nothing -> threadDelay (secs 30) >> monitorBattery ctx n
-
-disableTouchpad, disableTrackpoint, enableTrackpoint, enableTouchpad :: X ()
-enableTouchpad = safeSpawn "xinput" ["enable", "SynPS/2 Synaptics TouchPad"]
-disableTouchpad = safeSpawn "xinput" ["disable", "SynPS/2 Synaptics TouchPad"]
-enableTrackpoint = safeSpawn "xinput" ["enable", "TPPS/2 IBM TrackPoint"]
-disableTrackpoint = safeSpawn "xinput" ["disable", "TPPS/2 IBM TrackPoint"]
-
-isDisabled :: String -> X Bool
-isDisabled str = do
-  out <- runProcessWithInput "xinput" ["list", str] ""
-  return $ "disabled" `isInfixOf` out
-
-
-spawnKeychain :: X ()
-spawnKeychain = do
-  home <- liftIO getHomeDirectory
-  let keys = (map ((home </>) . (".ssh/" ++)) ["id", "id-rsa"]) ++ ["6B13AA67"]
-  liftIO (maybe (return ()) (setEnv "SSH_ASKPASS") =<< findAskpass)
-  safeSpawn "keychain" . (["--agents", "gpg,ssh"] ++)=<< liftIO (filterM doesFileExist keys)
-  where
-    findAskpass = filter `liftM` readFile "/etc/zshrc"
-    filter = listToMaybe . catMaybes . map (stripPrefix "export SSH_ASKPASS=") . lines
-
-assimilateKeychain :: X ()
-assimilateKeychain = liftIO $ assimilateKeychain' >> return ()
-assimilateKeychain' = tryIOError $ do
-  -- pid <- getProcessID
-  -- tmpDir <- lookupEnv "TMPDIR"
-  -- let tmpDir' = fromMaybe "/tmp" tmpDir
-  --     tmpFile = tmpDir' </> "xmonad-keychain" ++ (show pid) ++ ".env"
-  env <- runProcessWithInput "sh" ["-c", "eval $(keychain --eval --noask --agents gpg,ssh); env"] "" -- > " ++ tmpFile] ""
-  -- env <- readFile tmpFile
-  let envVars = Map.fromList $ map (\(k, v) -> (k, tail' v)) $ map (span (/= '=')) $ envLines
-      envVars' = Map.filterWithKey (\k _ -> k `elem` transfer) envVars
-      transfer = ["SSH_AUTH_SOCK", "SSH_AGENT_PID", "GPG_AGENT_INFO"]
-      envLines = filter (elem '=') $ lines env :: [String]
-  sequence $ map (\(k, c) -> setEnv k c) $ Map.toList envVars'
-  -- removeFile tmpFile
-  where
-    tail' [] = []
-    tail' (x:xs) = xs
-
-
-numKeys = [xK_parenleft, xK_parenright, xK_braceright, xK_plus, xK_braceleft, xK_bracketright, xK_bracketleft, xK_exclam, xK_equal, xK_asterisk]
-
-instance Shrinker CustomShrink where
-  shrinkIt _ "" = [""]
-  shrinkIt s cs
-    | length cs >= 4 = cs : shrinkIt s ((reverse . drop 4 . reverse $ cs) ++ "...")
-    | otherwise = cs : shrinkIt s (init cs)
-
-xPConfig, xPConfigMonospace :: XPConfig
-xPConfig = def
-  { font = "xft:Fira Sans:pixelsize=21"
-  , height = 32
-  , bgColor = "black"
-  , fgColor = gray
-  , fgHLight = green
-  , bgHLight = "black"
-  , borderColor = gray
-  , searchPredicate = (\needle haystack -> all (`isInfixOf` map toLower haystack) . map (map toLower) $ words needle)
-  , position = Top
-  }
-xPConfigMonospace = xPConfig { font = "xft:Fira Code:pixelsize=21" }
-
-sshOverrides host = map (\h -> mkOverride { oHost = h, oCommand = moshCmd . inTmux host} )
-               [ "odin"
-               , "ymir"
-               , "surtr"
-               , "vidhar"
-               , "srv02.uniworx.de"
-               ]
-               ++
-               map (\h -> mkOverride { oHost = h, oCommand = moshCmd' "/run/current-system/sw/bin/mosh-server" . withEnv [("TERM", "xterm")] . inTmux host} )
-               [ "bragi", "bragi.asgard.yggdrasil"
-               ]
-               ++
-               map (\h -> mkOverride { oHost = h, oCommand = sshCmd . inTmux host } )
-               [ "uni2work-dev1", "srv01.uniworx.de"
-               ]
-               ++
-               map (\h -> mkOverride { oHost = h, oCommand = sshCmd . withEnv [("TERM", "xterm")] . inTmux host } )
-               [ "remote.cip.ifi.lmu.de"
-               , "uniworx3", "uniworx4", "uniworx5", "uniworxdb2"
-               , "testworx"
-               ]
-
-backlight :: (Rational -> Rational) -> X ()
-backlight f = void . xfork . liftIO $ do
-  [   _device
-    , _class
-    , read . Text.unpack -> currentBright
-    , _currentPercentage
-    , read . Text.unpack -> maximumBright
-    ] <- Text.splitOn "," . Text.pack <$> readProcess "brightnessctl" ["-m"] ""
-  let current = currentBright % maximumBright
-      new' = f current * fromIntegral maximumBright
-      new :: Integer
-      new | floor new' < 0 = 0
-          | ceiling new' > maximumBright = maximumBright
-          | new' >= maximumBright % 2 = ceiling new'
-          | otherwise = floor new'
-  callProcess "brightnessctl" ["-m", "s", show new]
-
-cycleThrough :: [Rational] -> (Rational -> Rational)
-cycleThrough opts current = fromMaybe currentOpt $ listToMaybe next'
-  where currentOpt = minimumBy (comparing $ abs . subtract current) opts
-        (_, _ : next') = break (== currentOpt) opts
-
-cycleKbLayout :: [(String, Maybe String)] -> X ()
-cycleKbLayout [] = return ()
-cycleKbLayout layouts = liftIO $ do
-  next <- (getNext . extract) `liftM` runProcessWithInput "setxkbmap" ["-query"] ""
-  let
-    args = case next of
-      (l, Just v) -> [l, v]
-      (l, Nothing) -> [l]
-  safeSpawn "setxkbmap" args
-  where
-    extract :: String -> Maybe (String, Maybe String)
-    extract str = listToMaybe $ do
-      ["layout:", l] <- str'
-      [(l, Just v) | ["variant:", v] <- str'] ++ pure (l, Nothing)
-      where
-        str' = map words $ lines str
-    getNext :: Maybe (String, Maybe String) -> (String, Maybe String)
-    getNext = maybe (head layouts) getNext'
-    getNext' x = case elemIndex x layouts of
-      Nothing -> getNext Nothing
-      Just i -> layouts !! ((i + 1) `mod` length layouts)
-
-mpvAll' :: MpvCommand -> IO [MpvResponse]
-mpvAll' = mpvAll "/var/media/.mpv-ipc"
-
-mpvOne' :: MpvCommand -> IO (Maybe MpvResponse)
-mpvOne' = mpvOne "/var/media/.mpv-ipc"
-
-mediaMpv :: MpvCommand -> X ()
-mediaMpv cmd = void . xfork $ print =<< mpvAll' cmd
-
-mediaMpvTogglePause :: X ()
-mediaMpvTogglePause = void . xfork $ do
-  paused <- mapM mpvResponse <=< mpvAll' $ MpvGetProperty "pause"
-  if
-    | and paused -> print <=< mpvAll' $ MpvSetProperty "pause" False
-    | otherwise  -> print <=< mpvOne' $ MpvSetProperty "pause" True
-
-myKeys' conf host = Map.fromList $
-    -- launch a terminal
-    [ ((modm,               xK_Return), spawn $ (XMonad.terminal conf) ++ " -e tmux")
-    , ((modm .|. shiftMask, xK_Return), spawn $ XMonad.terminal conf)
-
-    -- launch dmenu
-    --, ((modm,               xK_d     ), spawn "exe=`dmenu_path | dmenu` && eval \"exec $exe\"")
-    , ((modm,               xK_d     ), shellPrompt "Run: " xPConfigMonospace)
-    , ((modm .|. shiftMask, xK_d     ), prompt "Run in Terminal: " ("alacritty" ++ " -e") xPConfigMonospace)
-    , ((modm,               xK_at    ), sshPrompt (sshOverrides . Just $ hName host) xPConfigMonospace)
-
-    -- close focused window
-    , ((modm .|. shiftMask, xK_q     ), kill)
-    , ((modm .|. controlMask .|. shiftMask, xK_q     ), spawn "xkill")
-
-     -- Rotate through the available layout algorithms
-    , ((modm,               xK_space ), sendMessage NextLayout)
-
-    --  Reset the layouts on the current workspace to default
-    , ((modm .|. controlMask, xK_r   ), (setLayout $ XMonad.layoutHook conf) >> refresh)
-
-    -- Resize viewed windows to the correct size
-    , ((modm,               xK_r     ), refresh)
-
-    -- Move focus to the next window
-    , ((modm,               xK_t     ), windows W.focusDown)
-
-    -- Move focus to the previous window
-    , ((modm,               xK_n     ), windows W.focusUp  )
-
-    -- Move focus to the master window
-    , ((modm,               xK_m     ), windows W.focusMaster  )
-
-    -- Swap the focused window and the master window
-    , ((modm .|. shiftMask, xK_m     ), windows W.swapMaster)
-
-    -- Swap the focused window with the next window
-    , ((modm .|. shiftMask, xK_t     ), windows W.swapDown  )
-
-    -- Swap the focused window with the previous window
-    , ((modm .|. shiftMask, xK_n     ), windows W.swapUp    )
-
-    -- Swap the focused window with the previous window
-    , ((modm .|. shiftMask .|. controlMask, xK_m), sendMessage SwapWindow)
-
-    , ((modm,                 xK_Right), sendMessage $ Go R)
-    , ((modm,                 xK_Left ), sendMessage $ Go L)
-    , ((modm,                 xK_Up   ), sendMessage $ Go U)
-    , ((modm,                 xK_Down ), sendMessage $ Go D)
-    , ((modm .|. shiftMask  , xK_Right), sendMessage $ Move R)
-    , ((modm .|. shiftMask  , xK_Left ), sendMessage $ Move L)
-    , ((modm .|. shiftMask  , xK_Up   ), sendMessage $ Move U)
-    , ((modm .|. shiftMask  , xK_Down ), sendMessage $ Move D)
-    -- , ((modm .|. controlMask, xK_Right), withFocused $ keysMoveWindow (10, 0))
-    -- , ((modm .|. controlMask, xK_Left ), withFocused $ keysMoveWindow (-10, 0))
-    -- , ((modm .|. controlMask, xK_Up   ), withFocused $ keysMoveWindow (0, -10))
-    -- , ((modm .|. controlMask, xK_Down ), withFocused $ keysMoveWindow (0, 10))
-     -- Shrink the master area
-    , ((modm,               xK_h     ), sendMessage Shrink)
-
-    -- Expand the master area
-    , ((modm,               xK_s     ), sendMessage Expand)
-
-    -- Push window back into tiling
-    , ((modm .|. shiftMask, xK_space ), withFocused $ windows . W.sink)
-    , ((modm, xK_BackSpace), focusUrgent)
-    , ((modm .|. shiftMask, xK_BackSpace), clearUrgents)
-
-    -- Increment the number of windows in the master area
-    , ((modm              , xK_comma ), sendMessage (IncMasterN 1))
-
-    -- Deincrement the number of windows in the master area
-    , ((modm              , xK_period), sendMessage (IncMasterN (-1)))
-
-    , ((0, xF86XK_AudioRaiseVolume), safeSpawn "pamixer" ["-i", "2"])
-    , ((0, xF86XK_AudioLowerVolume), safeSpawn "pamixer" ["-d", "2"])
-    , ((0, xF86XK_AudioMute), safeSpawn "pamixer" ["-t"])
-    , ((0, xF86XK_AudioPause), mediaMpv $ MpvSetProperty "pause" False)
-    , ((0, {-xF86XK_AudioMicMute-} 269025202), safeSpawn "pulseaudio-ctl" ["mute-input"])
-    , ((0, xF86XK_AudioPlay), mediaMpvTogglePause)
-    , ((0, xK_Print), do
-          home <- liftIO getHomeDirectory
-          unGrab
-          safeSpawn "scrot" ["-s", "-F", home </> "screenshots" </> "%Y-%m-%dT%H:%M:%S.png", "-e", "xclip -selection clipboard -t image/png -i $f"]
-      )
-    , ((modm .|. mod1Mask, xK_space), mediaMpvTogglePause)
-
-    -- , ((0, xF86XK_MonBrightnessDown), backlight . cycleThrough $ reverse brCycle)
-    -- , ((0, xF86XK_MonBrightnessUp  ), backlight $ cycleThrough brCycle)
-    , ((modm .|. shiftMask                , xK_b), backlight . cycleThrough $ reverse brCycle)
-    , ((modm .|. shiftMask .|. controlMask, xK_b), backlight $ cycleThrough brCycle)
-
-    , ((modm                , xK_Escape), cycleKbLayout (hKbLayouts host))
-    , ((modm .|. controlMask, xK_Escape), safeSpawn "setxkbmap" $ fst (head $ hKbLayouts host) : maybeToList (snd . head $ hKbLayouts host))
-
-    -- Toggle the status bar gap
-    -- Use this binding with avoidStruts from Hooks.ManageDocks.
-    -- See also the statusBar function from Hooks.DynamicLog.
-    --
-    , ((modm              , xK_b     ), sendMessage ToggleStruts)
-
-    , ((modm .|. shiftMask, xK_p     ), safeSpawn "playerctl" ["-a", "pause"])
-
-    -- Quit xmonad
-    , ((modm .|. shiftMask, xK_e     ), io (exitWith ExitSuccess))
-
-    -- Restart xmonad
-    -- , ((modm .|. shiftMask .|. controlMask, xK_r     ), void . xfork $ recompile False >>= flip when (safeSpawn "xmonad" ["--restart"]))
-    , ((modm .|. shiftMask, xK_r     ), void . liftIO $ executeFile "xmonad" True [] Nothing)
-    , ((modm .|. shiftMask, xK_l     ), void . xfork $ do
-          sessId <- getEnv "XDG_SESSION_ID"
-          safeSpawn "loginctl" ["lock-session", sessId]
-      )
-    , ((modm .|. shiftMask, xK_s     ), safeSpawn "systemctl" ["suspend"])
-    , ((modm .|. shiftMask, xK_h     ), inputPromptWithCompl xPConfigMonospace "systemctl" powerActCompl ?+ powerAct)
-    , ((modm, xK_v ), windows copyToAll) -- @@ Make focused window always visible
-    , ((modm .|. shiftMask, xK_v ),  killAllOtherCopies) -- @@ Toggle window state back
-    , ((modm .|. shiftMask, xK_g     ), windowPrompt xPConfig Goto wsWindows)
-    , ((modm              , xK_g     ), windowPrompt xPConfig Bring allWindows)
-    ]
-    ++
-
-    --
-    -- mod-[1..9], Switch to workspace N
-    --
-    -- mod-[1..9], Switch to workspace N
-    -- mod-shift-[1..9], Move client to workspace N
-    --
-    [((m .|. modm, k), windows $ f i)
-    | (i, k) <- zip (XMonad.workspaces conf) $ numKeys
-    , (f, m) <- [(W.greedyView, 0), (W.shift, shiftMask)]
-    ]
-    ++
-    [((m .|. modm .|. controlMask, k), void . runMaybeT $
-         MaybeT (P.getScreen def i) >>= MaybeT . screenWorkspace >>= lift . windows . f
-     )
-    | (i, k) <- zip (hScreens host) [xK_g, xK_c, xK_r, xK_l]
-    , (f, m) <- [(W.view, 0), (W.shift, shiftMask)]
-    ]
-  where
-    modm = XMonad.modMask conf
-
-    brCycle = [0, 1 % 500, 1 % 250, 1 % 100, 1 % 10, 1 % 4, 1 % 2, 3 % 4, 1]
-
-    powerActWords = ["poweroff", "reboot", "hibernate", "suspend"]
-    powerActCompl = mkComplFunFromList' xPConfigMonospace powerActWords
-    powerAct act | act `elem` powerActWords = safeSpawn "systemctl" $ pure act
-                 | otherwise = return ()
diff --git a/accounts/gkleen@sif/zshrc b/accounts/gkleen@sif/zshrc
index 75a4497c..702990c3 100644
--- a/accounts/gkleen@sif/zshrc
+++ b/accounts/gkleen@sif/zshrc
@@ -2,17 +2,14 @@ dir() {
     curlArchive=false
     templateArchive=""
     repoUrl=""
-    nixShell=""
-    findNix=false
     dir=""
     forceShell=false
     wormhole=false
     gitWorktree=""
-    # notmuchMsg=""
-    quickserve=false
     modifyPDF=""
+    miniserve=false
 
-    while getopts ':t:a:s:Sd:ir:wqg:p:' arg; do
+    while getopts ':t:a:d:ir:wg:p:m' arg; do
         case $arg in
             "t") ;;
             "a")
@@ -23,16 +20,13 @@ dir() {
                     templateArchive=${OPTARG:a}
                 fi
                 ;;
-            "s") nixShell=${OPTARG:a} ;;
-            "S") findNix=true ;;
             "d") dir=${OPTARG} ;;
             "i") forceShell=true ;;
             "r") repoUrl=${OPTARG} ;;
             "w") wormhole=true ;;
             "g") gitWorktree=${OPTARG} ;;
-            # "n") notmuchMsg=${OPTARG} ;;
-            "q") quickserve=true ;;
             "p") modifyPDF=${OPTARG:a} ;;
+            "m") miniserve=true ;;
             *) printf "Invalid option: %s\n" $arg >&2; exit 2 ;;
         esac
     done
@@ -56,20 +50,34 @@ dir() {
         gitWorktree=""
     fi
 
+    miniservePIDFile=""
+    if [[ ${miniserve} = "true" ]]; then
+      miniservePIDFile=$(mktemp --tmpdir --suffix=.pid)
+    fi
+
     cleanup()
     {
-        cd ${modifyPDF:h}
-        [[ -n ${modifyPDF} ]] && nix shell nixos#imagemagick -c convert -verbose ${dir}/${modifyPDF:t:r}_*.png(on) ${modifyPDF}
+        if [[ -n ${modifyPDF} ]]; then
+           cd ${modifyPDF:h}
+           typeset -a pages
+           eval 'pages=(${dir}/${modifyPDF:t:r}_*.png(on))'
+           magick -verbose "$pages" ${modifyPDF}
+           modifyPDF=""
+        fi
+        if [[ -n ${miniservePIDFile} ]]; then
+           command kill --verbose -- $(cat ${miniservePIDFile}) && wait $(cat ${miniservePIDFile})
+           miniservePIDFile=""
+        fi
     }
 
     (
+        set -o localoptions -o localtraps
+        trap 'return 1' INT TERM
         trap cleanup EXIT
 
         cd ${dir}
         export dir;
 
-        ${findNix} && { nixShell=$(findNix) || return $? }
-
         [[ -n ${repoUrl} ]] && git clone -- ${repoUrl} .
 
         [[ -n ${modifyPDF} ]] && templateArchive=${modifyPDF}
@@ -82,23 +90,23 @@ dir() {
                 }
                 trap cleanup EXIT
 
-                if ${curlArchive}; then
+                if [[ $curlArchive = "true" ]]; then
                     archiveFile=$(mktemp -t "archive.XXXXXXXXXX.${templateArchive:t}")
 
-                    curl -L -o ${archiveFile} ${templateArchive}
+                    curl -SfL -o ${archiveFile} ${templateArchive}
 
                     templateArchive=${archiveFile}
                 fi
 
                 unpack=true
-                while ${unpack}; do
+                while [[ $unpack = "true" ]]; do
                     case $(file --brief --mime-type --dereference ${templateArchive}) in
                         application/zip)
                             unzip ${templateArchive}
                             unpack=false
                         ;;
                         application/vnd.debian.binary-package)
-                            nix shell nixos#binutils --command ar x ${templateArchive}
+                            ar x ${templateArchive}
                             mkdir control data
                             tar -C control -xvaf control.*
                             tar -C data -xvaf data.*
@@ -106,7 +114,7 @@ dir() {
                         ;;
                         application/x-rpm)
                             cpioArchive=$(mktemp -t "archive.XXXXXXXXXX.${templateArchive:t:r}.cpio")
-                            nix shell nixos#busybox --command rpm2cpio ${templateArchive} > ${cpioArchive}
+                            rpm2cpio ${templateArchive} > ${cpioArchive}
                             templateArchive=${cpioArchive}
                             unpack=true
                         ;;
@@ -115,15 +123,19 @@ dir() {
                             unpack=false
                         ;;
                         application/pdf)
-                            nix shell nixos#ghostscript nixos#imagemagick -c convert -verbose -density 400 ${templateArchive} ${modifyPDF:t:r}_%0d.png
+                            magick -verbose -density 400 ${templateArchive} ${modifyPDF:t:r}_%0d.png
                             unpack=false
                         ;;
                         application/octet-stream)
-                            if [[ $(file --brief --dereferenc ${templateArchive}) =~ Squashfs ]]; then
-                               nix shell nixos#squashfsTools -c unsquashfs -d . ${templateArchive}
+                            if [[ $(file --brief --dereference ${templateArchive}) =~ Squashfs ]]; then
+                               unsquashfs -d . ${templateArchive}
                                unpack=false
                             fi
                         ;;
+                        application/x-iso9660-image)
+                          7z x ${templateArchive}
+                          unpack=false
+                        ;;
                         *)
                             tar -xvaf ${templateArchive}
                             unpack=false
@@ -134,25 +146,21 @@ dir() {
         fi
 
 
-        ${wormhole} && wormhole receive --accept-file
+        [[ $wormhole = "true" ]] && wormhole receive --accept-file
 
 
-        if ${quickserve}; then
-          quickserve --root . --upload . --show-hidden --tar gz
+        if [[ ${#@} -gt 0 ]]; then
+            ${@}
         fi
 
+        cd $(pwd) # Needed for mounting to work
 
-        if [[ ${#@} -eq 0 ]] || ${forceShell}; then
-            if [[ ${#@} -gt 0 ]]; then
-                if [[ -z ${nixShell} ]]; then
-                    ${@}
-                else
-                    nix-shell ${nixShell} --run "${@}"
-                fi
-            fi
-
-            cd $(pwd) # Needed for mounting to work
+        if [[ ${miniserve} = "true" ]]; then
+           miniserve --random-route --hidden --enable-tar-gz --enable-zip . &
+           echo $! > "${miniservePIDFile}"
+        fi
 
+        if [[ ${#@} -eq 0 ]] && [[ ${miniserve} != "true" ]] || [[ $forceShell = "true" ]]; then
             isSingleDir() {
                 typeset -a contents
                 contents=(*(N) .*(N))
@@ -166,18 +174,9 @@ dir() {
             }
             while d=$(isSingleDir); do cd ${d}; done
 
-
-            if [[ -z ${nixShell} ]]; then
-                zsh
-            else
-                nix-shell ${nixShell} --run zsh
-            fi
-        else
-            if [[ -z ${nixShell} ]]; then
-                ${@}
-            else
-                nix-shell ${nixShell} --run "${@}"
-            fi
+            zsh
+        elif [[ ${miniserve} == "true" ]]; then
+            wait $(cat "${miniservePIDFile}")
         fi
     )
 }
@@ -185,27 +184,30 @@ dir() {
 tmpdir() {
     cleanup()
     {
-      cd /
+        cd /
         unmount() {
             printf "Unmounting %s\n" ${1} >&2
             fusermount -u ${1} || umount ${1} || sudo umount ${1}
         }
 
-        if mountpoint -q -- ${dir}; then
-            unmount ${dir} || return $?
-        else
-            while read -d $'\0' subDir; do
-                mountpoint -q -- ${subDir} || continue
-                unmount ${subDir} || return $?
-            done <<<$(find ${dir} -xdev -type d -print0 | sort -zr)
-        fi
-
-        rm -rfv --one-file-system -- ${dir}
+        if [[ -n ${dir} ]]; then
+            if mountpoint -q -- ${dir}; then
+                unmount ${dir} || return $?
+            else
+                while read -d $'\0' subDir; do
+                    mountpoint -q -- ${subDir} || continue
+                    unmount ${subDir} || return $?
+                done <<<$(find ${dir} -xdev -type d -print0 | sort -zr)
+            fi
+
+            rm -rfv --one-file-system -- ${dir}
+            dir=""
+        fi
     }
 
     local tmpdir=""
 
-    while getopts ':t:a:s:Sd:ir:wqg:p:' arg; do
+    while getopts ':t:a:d:ir:wg:p:m' arg; do
         case $arg in
             "t") tmpdir="=${OPTARG}" ;;
             "?"|":") printf "Invalid option: %s\n" $arg >&2; exit 2 ;;
@@ -213,6 +215,8 @@ tmpdir() {
     done
 
     (
+        set -o localoptions -o localtraps
+        trap 'return 1' INT TERM
         trap cleanup EXIT
 
 
@@ -231,17 +235,7 @@ clock() {
 }
 
 public-ip() {
-    curl -s -H 'Accept: application/json' $@ ifconfig.co | jq -r '.ip'
-}
-
-nix-ghci() {
-    pkgExpr=""
-    if [[ ${#@} -gt 0 ]]; then
-        pkgExpr="${1}"
-        shift
-    fi
-
-    nix-shell -p "with (import <nixpkgs> {}); pkgs.haskellPackages.ghcWithPackages (p: with p; [${pkgExpr}])" --run "ghci ${@}"
+    curl -sSf -H 'Accept: application/json' $@ ifconfig.co | jq -r '.ip'
 }
 
 swap() {
@@ -271,14 +265,6 @@ l() {
   ls --long --binary --git --time-style=iso --header $@
 }
 
-re() {
-  systemctl --restart $@
-}
-
-ure() {
-  systemctl --user --restart $@
-}
-
 ssh-installer() {
   ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityFile=~/.ssh/gkleen@sif.midgard.yggdrasil $@
 }
@@ -306,19 +292,7 @@ done < <(find ~/projects ~/uni -regextype posix-extended -maxdepth 2 -type d -re
        sed -zr 's|(.*/([0-9]{2}[ws])/(.+))|\1 \2 \3|' | \
        sort -z -r -k2 | sort -z -s -k3 | uniq -z -f 2)
 
-alias '..'='cd ..'
 alias rzadm=$'tmpdir -i sh -c \'mkdir adm; sshfs gkleen@mgmt01:/adm adm\''
-alias -g L='| less'
-alias -g S='&> /dev/null'
-alias -g G='| grep'
-alias -g B='&> /dev/null &'
-alias -g BB='&> /dev/null &!'
+alias mathcloud=$'tmpdir -i rclone mount --daemon mathcloud:// .'
 
 export DEFAULT_USER=gkleen
-
-bindkey -e
-bindkey ';5C' emacs-forward-word
-bindkey ';5D' emacs-backward-word
-bindkey '^[[1;5C' emacs-forward-word
-bindkey '^[[1;5D' emacs-backward-word
-bindkey '^H' backward-kill-word
diff --git a/accounts/gkleen@surtr.nix b/accounts/gkleen@surtr.nix
index 58c4f21d..8f678ac9 100644
--- a/accounts/gkleen@surtr.nix
+++ b/accounts/gkleen@surtr.nix
@@ -1,3 +1,7 @@
-{ userName, ... }: {
-  home-manager.users.${userName}.home.stateVersion = "20.09";
+{ flake, userName, ... }: {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName}.home.stateVersion = "20.09";
 }
diff --git a/accounts/gkleen@vidhar.nix b/accounts/gkleen@vidhar.nix
index 8509c2f4..3a37c4bd 100644
--- a/accounts/gkleen@vidhar.nix
+++ b/accounts/gkleen@vidhar.nix
@@ -1,4 +1,8 @@
 { flake, pkgs, userName, config, ... }: {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
   config = {
     users.users.${userName} = {
       uid = 1000;
diff --git a/accounts/mherold@eostre.nix b/accounts/mherold@eostre.nix
index 51e4529a..0e2f37aa 100644
--- a/accounts/mherold@eostre.nix
+++ b/accounts/mherold@eostre.nix
@@ -7,9 +7,9 @@
     home-manager.users.${userName} = {
       home.stateVersion = "20.09";
 
-      nixpkgs.config = {
-        allowUnfree = true;
-      };
+      # nixpkgs.config = {
+      #   allowUnfree = true;
+      # };
 
       home.packages = with pkgs; [
         thunderbird libreoffice element-desktop keepassxc vlc
diff --git a/accounts/root@installer.nix b/accounts/root@installer.nix
index c7a418f8..5fe1db38 100644
--- a/accounts/root@installer.nix
+++ b/accounts/root@installer.nix
@@ -1,7 +1,11 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 
 {
-  home-manager.users.${userName} = { config, ... } : {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName} = { config, ... } : {
     home.stateVersion = config.home.version.release;
   };
 }
diff --git a/accounts/root@sif.nix b/accounts/root@sif.nix
index c9e129a0..bb816230 100644
--- a/accounts/root@sif.nix
+++ b/accounts/root@sif.nix
@@ -1,6 +1,10 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 {
-  home-manager.users.${userName} = {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName} = {
     home.stateVersion = "20.09";
 
     programs.ssh.matchBlocks = {
diff --git a/accounts/root@surtr.nix b/accounts/root@surtr.nix
index 58c4f21d..8f678ac9 100644
--- a/accounts/root@surtr.nix
+++ b/accounts/root@surtr.nix
@@ -1,3 +1,7 @@
-{ userName, ... }: {
-  home-manager.users.${userName}.home.stateVersion = "20.09";
+{ flake, userName, ... }: {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName}.home.stateVersion = "20.09";
 }
diff --git a/accounts/root@vidhar.nix b/accounts/root@vidhar.nix
index e82414a8..0fc56633 100644
--- a/accounts/root@vidhar.nix
+++ b/accounts/root@vidhar.nix
@@ -1,6 +1,11 @@
-{ config, userName, ... }:
+{ flake, config, userName, ... }:
+
 {
-  home-manager.users.${userName} = {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName} = {
     home.stateVersion = "20.09";
 
     programs.ssh.matchBlocks = {
diff --git a/flake.lock b/flake.lock
index 56b571ca..6046d92f 100644
--- a/flake.lock
+++ b/flake.lock
@@ -6,22 +6,28 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "poetry2nix": [
-          "poetry2nix"
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
+        "pyproject-build-systems": [
+          "pyproject-build-systems"
+        ],
+        "pyproject-nix": [
+          "pyproject-nix"
         ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix"
+        "uv2nix": [
+          "uv2nix"
+        ]
       },
       "locked": {
-        "lastModified": 1723124245,
-        "narHash": "sha256-ThDq7vOXo6G4+C5FHqUc64CeX2c5n36tln4ZlDao6s4=",
+        "lastModified": 1749560907,
+        "narHash": "sha256-zvAxxnJ5dcnjbuog0W6UvlthD1dLm5t4ZQI25jzNDW4=",
         "owner": "gkleen",
         "repo": "backup-utils",
-        "rev": "74e65090de63fc99f056098677cc490754e2708f",
+        "rev": "8ed6a1d7c2e337cb2e35ed68f6d852f0d1049908",
         "type": "gitlab"
       },
       "original": {
         "owner": "gkleen",
-        "ref": "v0.1.6",
+        "ref": "v0.1.7",
         "repo": "backup-utils",
         "type": "gitlab"
       }
@@ -33,26 +39,45 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "poetry2nix": [
-          "poetry2nix"
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix_2",
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": [
+          "pyproject-nix"
         ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix_2"
+        "uv2nix": [
+          "uv2nix"
+        ]
       },
       "locked": {
-        "lastModified": 1734281899,
-        "narHash": "sha256-9QdIl3sjHY4Xij9KrBUkW1KpLB+jyxlI12UHPitlawI=",
+        "lastModified": 1750599403,
+        "narHash": "sha256-MLQ7CISl00w1xq88TL2wukNq3ukzID4u7BVT4okbUik=",
         "owner": "gkleen",
         "repo": "ca",
-        "rev": "1e4ee9d25a5282ef7bc6774072229784fa0036f3",
+        "rev": "505a29233ada969b2eca76d616b0d7a8767dfb71",
         "type": "gitlab"
       },
       "original": {
         "owner": "gkleen",
-        "ref": "v3.1.3",
+        "ref": "v3.1.5",
         "repo": "ca",
         "type": "gitlab"
       }
     },
+    "crane": {
+      "locked": {
+        "lastModified": 1731098351,
+        "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "deploy-rs": {
       "inputs": {
         "flake-compat": [
@@ -66,11 +91,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1727447169,
-        "narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
+        "lastModified": 1749105467,
+        "narHash": "sha256-hXh76y/wDl15almBcqvjryB50B0BaiXJKk20f314RoE=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
+        "rev": "6bc76b872374845ba9d645a2f012b764fecd765f",
         "type": "github"
       },
       "original": {
@@ -115,11 +140,11 @@
     "flake-compat_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1733328505,
-        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -132,6 +157,22 @@
     "flake-compat_4": {
       "flake": false,
       "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_5": {
+      "flake": false,
+      "locked": {
         "lastModified": 1673956053,
         "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
         "owner": "edolstra",
@@ -168,11 +209,11 @@
         "nixpkgs-lib": "nixpkgs-lib_2"
       },
       "locked": {
-        "lastModified": 1726153070,
-        "narHash": "sha256-HO4zgY0ekfwO5bX0QH/3kJ/h4KvUDFZg8YpkNwIbg1U=",
+        "lastModified": 1749398372,
+        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "bcef6817a8b2aa20a5a6dbb19b43e63c5bf8619a",
+        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
         "type": "github"
       },
       "original": {
@@ -183,6 +224,27 @@
     },
     "flake-parts_3": {
       "inputs": {
+        "nixpkgs-lib": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730504689,
+        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_4": {
+      "inputs": {
         "nixpkgs-lib": "nixpkgs-lib_3"
       },
       "locked": {
@@ -202,11 +264,11 @@
     "flake-registry": {
       "flake": false,
       "locked": {
-        "lastModified": 1717415742,
-        "narHash": "sha256-HKvoLGZUsBpjkxWkdtctGYj6RH0bl6vcw0OjTOqyzJk=",
+        "lastModified": 1744623129,
+        "narHash": "sha256-nlQTQrHqM+ywXN0evDXnYEV6z6WWZB5BFQ2TkXsduKw=",
         "owner": "NixOS",
         "repo": "flake-registry",
-        "rev": "895a65f8d5acf848136ee8fe8e8f736f0d27df96",
+        "rev": "1322f33d5836ae757d2e6190239252cf8402acf6",
         "type": "github"
       },
       "original": {
@@ -296,6 +358,28 @@
     "gitignore_3": {
       "inputs": {
         "nixpkgs": [
+          "lanzaboote",
+          "pre-commit-hooks-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_4": {
+      "inputs": {
+        "nixpkgs": [
           "prometheus-borg-exporter",
           "pre-commit-hooks-nix",
           "nixpkgs"
@@ -322,11 +406,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722322032,
-        "narHash": "sha256-pnO44gA8GcJj3oCVeGmypSGLr10+usMbJXochJWdugw=",
+        "lastModified": 1753177987,
+        "narHash": "sha256-PkCc+YTrl0A/H6EV09DCr5yZpvQZ9DkuFXj/NNaEvHs=",
         "owner": "gkleen",
         "repo": "home-manager",
-        "rev": "55c1d61f06fd331f874178a6028f22be22ee7878",
+        "rev": "b493410fc6e427129a1caee8f50970d152a27daa",
         "type": "github"
       },
       "original": {
@@ -343,27 +427,27 @@
         ]
       },
       "locked": {
-        "lastModified": 1710245356,
-        "narHash": "sha256-8cQGUn+N1dTgklMWMejSLN2q8Oz+7Rnqsfaw2rt3bU4=",
+        "lastModified": 1749562430,
+        "narHash": "sha256-M5MqsIsf+o7yngakVUW4poBGZaghB6sUpw7SsWA55kU=",
         "owner": "gkleen",
         "repo": "home-manager",
-        "rev": "a14fe0c27d04dfa3d80abe2db743e9a7f4f2a33d",
+        "rev": "dca5a2df9f8a00cc34bea6ead249a8446f5f069e",
         "type": "github"
       },
       "original": {
         "owner": "gkleen",
-        "ref": "nixos-late-start-23.11",
+        "ref": "nixos-late-start-25.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1731242966,
-        "narHash": "sha256-B3C3JLbGw0FtLSWCjBxU961gLNv+BOOBC6WvstKLYMw=",
+        "lastModified": 1737831083,
+        "narHash": "sha256-LJggUHbpyeDvNagTUrdhe/pRVp4pnS6wVKALS782gRI=",
         "owner": "nix-community",
         "repo": "impermanence",
-        "rev": "3ed3f0eaae9fcc0a8331e77e9319c8a4abd8a71a",
+        "rev": "4b3e914cdf97a5b536a889e939fb2fd2b043a170",
         "type": "github"
       },
       "original": {
@@ -373,10 +457,36 @@
         "type": "github"
       }
     },
+    "lanzaboote": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": "flake-compat_4",
+        "flake-parts": "flake-parts_3",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix_3",
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1737639419,
+        "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
+        "owner": "nix-community",
+        "repo": "lanzaboote",
+        "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.4.2",
+        "repo": "lanzaboote",
+        "type": "github"
+      }
+    },
     "leapseconds": {
       "flake": false,
       "locked": {
-        "narHash": "sha256-5ZaoY/bScQS7EGJRHu6vj9XWhbObmxNEaGugaGU7+lg=",
+        "narHash": "sha256-FJgbafPB48+5sT+7ZB8pajSsfJoISEOoaJ0d/2Ya7o8=",
         "type": "file",
         "url": "https://data.iana.org/time-zones/tzdb/leap-seconds.list"
       },
@@ -385,6 +495,65 @@
         "url": "https://data.iana.org/time-zones/tzdb/leap-seconds.list"
       }
     },
+    "niri-flake": {
+      "inputs": {
+        "niri-stable": "niri-stable",
+        "niri-unstable": "niri-unstable",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable_3",
+        "xwayland-satellite-stable": "xwayland-satellite-stable",
+        "xwayland-satellite-unstable": "xwayland-satellite-unstable"
+      },
+      "locked": {
+        "lastModified": 1755424351,
+        "narHash": "sha256-xcorYLNdtLpb0wH5CPlUcpmYQUxeK95j1X855xQw+DY=",
+        "owner": "sodiboo",
+        "repo": "niri-flake",
+        "rev": "9aa137af01f05386e5bb5050e983750017007a66",
+        "type": "github"
+      },
+      "original": {
+        "owner": "sodiboo",
+        "ref": "main",
+        "repo": "niri-flake",
+        "type": "github"
+      }
+    },
+    "niri-stable": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1748151941,
+        "narHash": "sha256-z4viQZLgC2bIJ3VrzQnR+q2F3gAOEQpU1H5xHtX/2fs=",
+        "owner": "YaLTeR",
+        "repo": "niri",
+        "rev": "8ba57fcf25d2fc9565131684a839d58703f1dae7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "YaLTeR",
+        "ref": "v25.05.1",
+        "repo": "niri",
+        "type": "github"
+      }
+    },
+    "niri-unstable": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1755419373,
+        "narHash": "sha256-EFH3zbpyLYjEboNV2Lmkxf9joEuFCmeYX+MMLRPStpg=",
+        "owner": "YaLTeR",
+        "repo": "niri",
+        "rev": "a6febb86aa5af0df7bf2792ca027ef95a503d599",
+        "type": "github"
+      },
+      "original": {
+        "owner": "YaLTeR",
+        "repo": "niri",
+        "type": "github"
+      }
+    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -413,11 +582,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733629314,
-        "narHash": "sha256-U0vivjQFAwjNDYt49Krevs1murX9hKBFe2Ye0cHpgbU=",
+        "lastModified": 1755404379,
+        "narHash": "sha256-Q6ZxZDBmD/B988Jjbx7/NchxOKIpOKBBrx9Yb0zMzpQ=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "f1e477a7dd11e27e7f98b646349cd66bbabf2fb8",
+        "rev": "ebbc1c05f786ae39bb5e04e57bf2c10c44a649e3",
         "type": "github"
       },
       "original": {
@@ -427,6 +596,27 @@
         "type": "github"
       }
     },
+    "nix-monitored": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745680380,
+        "narHash": "sha256-Z8PknjkmIr/8ZCH+dmc2Pc+UltiOr7/oKg37PXuVvuU=",
+        "owner": "ners",
+        "repo": "nix-monitored",
+        "rev": "60f3baa4701d58eab86c2d1d9c3d7e820074d461",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ners",
+        "ref": "master",
+        "repo": "nix-monitored",
+        "type": "github"
+      }
+    },
     "nixVirt": {
       "inputs": {
         "nixpkgs": [
@@ -434,11 +624,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1732406038,
-        "narHash": "sha256-BYNBN+Rtc/SX6qI7m3nmryufRPn0ZYd40yHDo9VQaNE=",
+        "lastModified": 1748140003,
+        "narHash": "sha256-DNBZmuk1YRM2PmwbHzVdXumRjCUzQkMarg4iI/37rOQ=",
         "owner": "AshleyYakeley",
         "repo": "NixVirt",
-        "rev": "fe3aaa86d4458e4f84348941297f7ba82e2a9f67",
+        "rev": "5dfe108fd859b122f9a96981cb6bc12297653d6c",
         "type": "github"
       },
       "original": {
@@ -449,11 +639,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1733861262,
-        "narHash": "sha256-+jjPup/ByS0LEVIrBbt7FnGugJgLeG9oc+ivFASYn2U=",
+        "lastModified": 1755330281,
+        "narHash": "sha256-aJHFJWP9AuI8jUGzI77LYcSlkA9wJnOIg4ZqftwNGXA=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "cf737e2eba82b603f54f71b10cb8fd09d22ce3f5",
+        "rev": "3dac8a872557e0ca8c083cdcfc2f218d18e113b0",
         "type": "github"
       },
       "original": {
@@ -481,16 +671,16 @@
     },
     "nixpkgs-eostre": {
       "locked": {
-        "lastModified": 1701282334,
-        "narHash": "sha256-MxCVrXY6v4QmfTwIysjjaX0XUhqBbxTWWB4HXtDYsdk=",
+        "lastModified": 1748026580,
+        "narHash": "sha256-rWtXrcIzU5wm/C8F9LWvUfBGu5U5E7cFzPYT1pHIJaQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "057f9aecfb71c4437d2b27d3323df7f93c010b7e",
+        "rev": "11cb3517b3af6af300dd6c055aeda73c9bf52c48",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "23.11",
+        "ref": "25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -509,14 +699,17 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1725233747,
-        "narHash": "sha256-Ss8QWLXdr2JCBPcYChJhz4xJm+h/xjl4G0c0XlP6a74=",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/356624c12086a18f2ea2825fed34523d60ccc4e3.tar.gz"
+        "lastModified": 1748740939,
+        "narHash": "sha256-rQaysilft1aVMwF14xIdGS3sj1yHlI6oKQNBRTF40cc=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "656a64127e9d791a334452c6b6606d17539476e2",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/356624c12086a18f2ea2825fed34523d60ccc4e3.tar.gz"
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
       }
     },
     "nixpkgs-lib_3": {
@@ -571,22 +764,54 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1717179513,
-        "narHash": "sha256-vboIEwIQojofItm2xGCdZCzW96U85l9nDW3ifMuAIdM=",
+        "lastModified": 1730741070,
+        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "63dacb46bf939521bdc93981b4cbb7ecb58427a0",
+        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "24.05",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-stable_3": {
       "locked": {
+        "lastModified": 1755274400,
+        "narHash": "sha256-rTInmnp/xYrfcMZyFMH3kc8oko5zYfxsowaLv1LVobY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "ad7196ae55c295f53a7d1ec39e4a06d922f3b899",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable_4": {
+      "locked": {
+        "lastModified": 1748026580,
+        "narHash": "sha256-rWtXrcIzU5wm/C8F9LWvUfBGu5U5E7cFzPYT1pHIJaQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "11cb3517b3af6af300dd6c055aeda73c9bf52c48",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "25.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable_5": {
+      "locked": {
         "lastModified": 1678872516,
         "narHash": "sha256-/E1YwtMtFAu2KUQKV/1+KFuReYPANM2Rzehk84VxVoc=",
         "owner": "NixOS",
@@ -603,11 +828,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1733759999,
-        "narHash": "sha256-463SNPWmz46iLzJKRzO3Q2b0Aurff3U1n0nYItxq7jU=",
+        "lastModified": 1755615617,
+        "narHash": "sha256-HMwfAJBdrr8wXAkbGhtcby1zGFvs+StOp19xNsbqdOg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a73246e2eef4c6ed172979932bc80e1404ba2d56",
+        "rev": "20075955deac2583bb12f07151c2df830ef346b4",
         "type": "github"
       },
       "original": {
@@ -673,11 +898,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1731205797,
-        "narHash": "sha256-F7N1mxH1VrkVNHR3JGNMRvp9+98KYO4b832KS8Gl2xI=",
+        "lastModified": 1743690424,
+        "narHash": "sha256-cX98bUuKuihOaRp8dNV1Mq7u6/CQZWTPth2IJPATBXc=",
         "owner": "nix-community",
         "repo": "poetry2nix",
-        "rev": "f554d27c1544d9c56e5f1f8e2b8aff399803674e",
+        "rev": "ce2369db77f45688172384bbeb962bc6c2ea6f94",
         "type": "github"
       },
       "original": {
@@ -715,18 +940,14 @@
         "nixpkgs": [
           "ca-util",
           "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "ca-util",
-          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1726745158,
-        "narHash": "sha256-D5AegvGoEjt4rkKedmxlSEmC+nNLMBPWFxvmYnVLhjk=",
+        "lastModified": 1749636823,
+        "narHash": "sha256-WUaIlOlPLyPgz9be7fqWJA5iG6rHcGRtLERSCfUDne4=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "4e743a6920eab45e8ba0fbe49dc459f1423a4b74",
+        "rev": "623c56286de5a3193aa38891a6991b28f9bab056",
         "type": "github"
       },
       "original": {
@@ -737,11 +958,38 @@
     },
     "pre-commit-hooks-nix_3": {
       "inputs": {
-        "flake-compat": "flake-compat_4",
-        "flake-utils": "flake-utils_2",
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
         "gitignore": "gitignore_3",
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable_2"
+      },
+      "locked": {
+        "lastModified": 1731363552,
+        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks-nix_4": {
+      "inputs": {
+        "flake-compat": "flake-compat_5",
+        "flake-utils": "flake-utils_2",
+        "gitignore": "gitignore_4",
         "nixpkgs": "nixpkgs_3",
-        "nixpkgs-stable": "nixpkgs-stable_3"
+        "nixpkgs-stable": "nixpkgs-stable_5"
       },
       "locked": {
         "lastModified": 1685361114,
@@ -759,14 +1007,14 @@
     },
     "prometheus-borg-exporter": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_4",
         "nixpkgs": [
           "nixpkgs"
         ],
         "poetry2nix": [
           "poetry2nix"
         ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix_3"
+        "pre-commit-hooks-nix": "pre-commit-hooks-nix_4"
       },
       "locked": {
         "lastModified": 1722088088,
@@ -783,6 +1031,81 @@
         "type": "gitlab"
       }
     },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "ca-util",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "ca-util",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "ca-util",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1749519371,
+        "narHash": "sha256-UJONN7mA2stweZCoRcry2aa1XTTBL0AfUOY84Lmqhos=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "7c06967eca687f3482624250428cc12f43c92523",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-build-systems_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755484659,
+        "narHash": "sha256-2FfbqsaHVQd12XFFUAinIMAuGO3853LONmva1gT3vKw=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "9778e87c2361810ff15e287ca5895c9da4a0e900",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1754923840,
+        "narHash": "sha256-QSKpYg+Ts9HYF155ltlj40iBex39c05cpOF8gjoE2EM=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "023cd4be230eacae52635be09eef100c37ef78da",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "backup-utils": "backup-utils",
@@ -794,20 +1117,47 @@
         "home-manager": "home-manager",
         "home-manager-eostre": "home-manager-eostre",
         "impermanence": "impermanence",
+        "lanzaboote": "lanzaboote",
+        "niri-flake": "niri-flake",
         "nix-index-database": "nix-index-database",
+        "nix-monitored": "nix-monitored",
         "nixVirt": "nixVirt",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-eostre": "nixpkgs-eostre",
         "nixpkgs-pgbackrest": "nixpkgs-pgbackrest",
-        "nixpkgs-stable": "nixpkgs-stable_2",
+        "nixpkgs-stable": "nixpkgs-stable_4",
         "nvfetcher": "nvfetcher",
         "poetry2nix": "poetry2nix",
         "prometheus-borg-exporter": "prometheus-borg-exporter",
+        "pyproject-build-systems": "pyproject-build-systems_2",
+        "pyproject-nix": "pyproject-nix",
         "sops-nix": "sops-nix",
+        "uv2nix": "uv2nix",
         "waybar": "waybar"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "lanzaboote",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1731897198,
+        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
@@ -815,11 +1165,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733965552,
-        "narHash": "sha256-GZ4YtqkfyTjJFVCub5yAFWsHknG1nS/zfk7MuHht4Fs=",
+        "lastModified": 1754988908,
+        "narHash": "sha256-t+voe2961vCgrzPFtZxha0/kmFSHFobzF00sT8p9h0U=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "2d73fc6ac4eba4b9a83d3cb8275096fbb7ab4004",
+        "rev": "3223c7a92724b5d804e9988c6b447a0d09017d48",
         "type": "github"
       },
       "original": {
@@ -854,8 +1204,9 @@
         "type": "github"
       },
       "original": {
-        "id": "systems",
-        "type": "indirect"
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
       }
     },
     "treefmt-nix": {
@@ -879,6 +1230,29 @@
         "type": "github"
       }
     },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1755485731,
+        "narHash": "sha256-k8kxwVs8Oze6q/jAaRa3RvZbb50I/K0b5uptlsh0HXI=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "bebbd80bf56110fcd20b425589814af28f1939eb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
     "waybar": {
       "inputs": {
         "flake-compat": [
@@ -889,19 +1263,52 @@
         ]
       },
       "locked": {
-        "lastModified": 1734278650,
-        "narHash": "sha256-z9FiyHDbKC2nwfd/qsHCxLBEogzQj73zo85lW3zIlzY=",
+        "lastModified": 1752562190,
+        "narHash": "sha256-zWOMCNe56H2PHUd3rJZ6tklZUZBLgRo85jd9IlK1g9o=",
         "owner": "gkleen",
         "repo": "Waybar",
-        "rev": "5432f9c1697a8d2d3e1264a5ce820d7eac26e2c6",
+        "rev": "d008cd998369c40f2344a856caf39cdbbd7bd068",
         "type": "github"
       },
       "original": {
         "owner": "gkleen",
-        "ref": "feat/privacy-ignore",
+        "ref": "feat/niri-urgency",
         "repo": "Waybar",
         "type": "github"
       }
+    },
+    "xwayland-satellite-stable": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1748488455,
+        "narHash": "sha256-IiLr1alzKFIy5tGGpDlabQbe6LV1c9ABvkH6T5WmyRI=",
+        "owner": "Supreeeme",
+        "repo": "xwayland-satellite",
+        "rev": "3ba30b149f9eb2bbf42cf4758d2158ca8cceef73",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Supreeeme",
+        "ref": "v0.6",
+        "repo": "xwayland-satellite",
+        "type": "github"
+      }
+    },
+    "xwayland-satellite-unstable": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1755219541,
+        "narHash": "sha256-yKV6xHaPbEbh5RPxAJnb9yTs1wypr7do86hFFGQm1w8=",
+        "owner": "Supreeeme",
+        "repo": "xwayland-satellite",
+        "rev": "5a184d435927c3423f0ad189ea2b490578450fb7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Supreeeme",
+        "repo": "xwayland-satellite",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index cd50543e..b9382c6f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,9 +4,11 @@
   nixConfig = {
     extra-substituters = [
       "https://nix-community.cachix.org"
+      "https://niri.cachix.org"
     ];
     extra-trusted-public-keys = [
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
     ];
   };
 
@@ -27,13 +29,13 @@
       type = "github";
       owner = "NixOS";
       repo = "nixpkgs";
-      ref = "24.05";
+      ref = "25.05";
     };
     nixpkgs-eostre = {
       type = "github";
       owner = "NixOS";
       repo = "nixpkgs";
-      ref = "23.11";
+      ref = "25.05";
     };
     home-manager = {
       type = "github";
@@ -51,7 +53,7 @@
       type = "github";
       owner = "gkleen";
       repo = "home-manager";
-      ref = "nixos-late-start-23.11";
+      ref = "nixos-late-start-25.05";
       inputs = {
         nixpkgs.follows = "nixpkgs-eostre";
       };
@@ -123,25 +125,43 @@
         nixpkgs.follows = "nixpkgs";
       };
     };
+    pyproject-nix = {
+      url = "github:pyproject-nix/pyproject.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    uv2nix = {
+      url = "github:pyproject-nix/uv2nix";
+      inputs.pyproject-nix.follows = "pyproject-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    pyproject-build-systems = {
+      url = "github:pyproject-nix/build-system-pkgs";
+      inputs.pyproject-nix.follows = "pyproject-nix";
+      inputs.uv2nix.follows = "uv2nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     ca-util = {
       type = "gitlab";
       owner = "gkleen";
       repo = "ca";
-      ref = "v3.1.3";
+      ref = "v3.1.5";
       inputs = {
+        pyproject-nix.follows = "pyproject-nix";
+        uv2nix.follows = "uv2nix";
         nixpkgs.follows = "nixpkgs";
-        poetry2nix.follows = "poetry2nix";
       };
     };
     backup-utils = {
       type = "gitlab";
       owner = "gkleen";
       repo = "backup-utils";
-      ref = "v0.1.6";
+      ref = "v0.1.7";
       inputs = {
         nixpkgs.follows = "nixpkgs";
-        poetry2nix.follows = "poetry2nix";
+        pyproject-nix.follows = "pyproject-nix";
+        uv2nix.follows = "uv2nix";
+        pyproject-build-systems.follows = "pyproject-build-systems";
       };
     };
     prometheus-borg-exporter = {
@@ -170,7 +190,7 @@
       type = "github";
       owner = "gkleen";
       repo = "Waybar";
-      ref = "feat/privacy-ignore";
+      ref = "feat/niri-urgency";
       inputs = {
         nixpkgs.follows = "nixpkgs";
         flake-compat.follows = "flake-compat";
@@ -182,9 +202,36 @@
       repo = "NixVirt";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    niri-flake = {
+      type = "github";
+      owner = "sodiboo";
+      repo = "niri-flake";
+      ref = "main";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        # niri-unstable.url = "github:gkleen/niri";
+      };
+    };
+    nix-monitored = {
+      type = "github";
+      owner = "ners";
+      repo = "nix-monitored";
+      ref = "master";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
+    lanzaboote = {
+      type = "github";
+      owner = "nix-community";
+      repo = "lanzaboote";
+      ref = "v0.4.2";
+
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, nixpkgs, home-manager, sops-nix, deploy-rs, nvfetcher, ... }@inputs:
+  outputs = { self, nixpkgs, home-manager, sops-nix, deploy-rs, nvfetcher, niri-flake, ... }@inputs:
     let
       inherit (builtins) attrNames attrValues elemAt toJSON isNull pathExists;
       inherit (nixpkgs) lib;
@@ -267,9 +314,10 @@
       mkAccountModule = dir: path: accountName:
         let
           userName = accountUserName accountName;
+          hostName = accountHostName accountName;
         in overrideModule
              (import (dir + "/${path}"))
-             (inputs: inputs // { inherit userName; })
+             (inputs: inputs // { inherit userName hostName; })
              (outputs: { _file = dir + "/${path}"; }
                       // outputs
                       // { imports = [self.nixosModules.users.${userName} or ({...}: { imports = defaultUserProfiles userName; })] ++ (outputs.imports or []); });
@@ -285,7 +333,7 @@
       forAllUsers = genAttrs (unique (map accountUserName (attrNames self.nixosModules.accounts)));
 
       activateNixosConfigurations = forAllSystems (system: _pkgs: filterAttrs (_n: v: v != null) (mapAttrs' (hostName: nixosConfig: nameValuePair "${hostName}-activate" (if system == nixosConfig.config.nixpkgs.system then { type = "app"; program = "${nixosConfig.config.system.build.toplevel}/bin/switch-to-configuration"; } else null)) self.nixosConfigurations));
-      startVMs = forAllSystems (system: pkgs: mapAttrs' (hostName: nixosConfig: nameValuePair "run-${hostName}-vm" { type = "app"; program = "${nixosConfig.config.system.build.vm}/bin/run-${hostName}-vm"; }) (nixImport rec { dir = ./hosts; _import = mkNixosConfiguration [ { config.virtualisation.host.pkgs = pkgs; } ] dir; }));
+      # startVMs = forAllSystems (system: pkgs: mapAttrs' (hostName: nixosConfig: nameValuePair "run-${hostName}-vm" { type = "app"; program = "${nixosConfig.config.system.build.vm}/bin/run-${hostName}-vm"; }) (nixImport rec { dir = ./hosts; _import = mkNixosConfiguration [ { config.virtualisation.host.pkgs = pkgs; } ] dir; }));
       activateHomeManagerConfigurations = forAllSystems (system: _pkgs: filterAttrs (_n: v: v != null) (listToAttrs (concatLists (mapAttrsToList (hostName: nixosConfig: mapAttrsToList (userName: userCfg: nameValuePair "${userName}@${hostName}-activate" (if system == nixosConfig.config.nixpkgs.system then { type = "app"; program = "${userCfg.home.activationPackage}/activate"; } else null)) nixosConfig.config.home-manager.users) self.nixosConfigurations))));
       installerShells = system: pkgs: mapAttrs (installerName: config: pkgs.callPackage ./installer/shell.nix {
         inherit system installerName config;
@@ -322,18 +370,23 @@
         nixosConfigurations = installerNixosConfigurations // nixImport rec { dir = ./hosts; _import = mkNixosConfiguration [] dir; };
 
         homeModules = nixImport rec { dir = ./home-modules; };
-        homeConfigurations = listToAttrs (concatLists (mapAttrsToList (hostname: nixosConfig: mapAttrsToList (username: configuration: nameValuePair "${username}@${hostname}" { inherit (configuration.home) activationPackage; }) nixosConfig.config.home-manager.users) self.nixosConfigurations));
+        homeConfigurations = listToAttrs (concatLists (mapAttrsToList (hostname: nixosConfig: mapAttrsToList (username: nameValuePair "${username}@${hostname}") nixosConfig.config.home-manager.users) self.nixosConfigurations));
 
         overlays = mapAttrs (_name: path: mkOverlay path) overlayPaths;
 
-        packages = forAllSystems (system: systemPkgs: nixImport rec { dir = ./tools; _import = _path: name: import "${toString dir}/${name}" ({ inherit system; } // inputs); });
+        packages = forAllSystems (system: systemPkgs: nixImport rec { dir = ./tools; _import = name: _base: import (dir + "/${name}") ({ inherit system; } // inputs); });
 
         # packages = mapAttrs (_name: filterAttrs (_name: isDerivation)) packages;
         # packages' = mapAttrs (_name: filterAttrs (_name: value: !(isDerivation value))) packages;
 
         legacyPackages = forAllSystems (system: systemPkgs: systemPkgs.override { overlays = attrValues self.overlays; });
 
-        apps = foldr recursiveUpdate {} [startVMs activateNixosConfigurations activateHomeManagerConfigurations];
+        apps = foldr recursiveUpdate {} [
+          #startVMs
+          activateNixosConfigurations activateHomeManagerConfigurations
+        ];
+
+        lib = nixImport rec { dir = ./lib; _import = name: _base: import (dir + "/${name}") inputs; };
 
         devShells = forAllSystems (system: systemPkgs: { default = import ./shell.nix ({ inherit system; } // inputs); } // installerShells system systemPkgs);
 
@@ -358,10 +411,10 @@
             #   path = activateHomeManager (self.nixosConfigurations.${hostname}.config.nixpkgs.system) usercfg.home;
             # }) self.nixosConfigurations.${hostname}.config.home-manager.users);
           }) (nixImport { dir = ./hosts; _import = (_path: name: name); });
-          overrides = if pathExists ./deploy then nixImport { dir = ./deploy; _import = path: _name: import (./deploy + "/${path}") inputs; } else {};
+          overrides = if pathExists ./deploy then nixImport rec { dir = ./deploy; _import = path: _name: import (dir + "/${path}") inputs; } else {};
           filterEnabled = attrs: mapAttrs (_n: v: filterAttrs (n: _v: n != "enabled") v) (filterAttrs (_n: v: v.enabled or true) attrs);
         in mapAttrs (_n: v: if v ? "profiles" then v // { profiles = filterEnabled v.profiles; } else v) (filterEnabled (recursiveUpdate defaults overrides));
 
-        checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+        # checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
       };
 }
diff --git a/home-modules/nixpkgs-release-check.nix b/home-modules/nixpkgs-release-check.nix
new file mode 100644
index 00000000..baf2713a
--- /dev/null
+++ b/home-modules/nixpkgs-release-check.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  config.home.enableNixpkgsReleaseCheck = false;
+}
diff --git a/home-modules/pandoc/default.nix b/home-modules/pandoc/default.nix
new file mode 100644
index 00000000..1d16b621
--- /dev/null
+++ b/home-modules/pandoc/default.nix
@@ -0,0 +1,27 @@
+{ pkgs, lib, config, ... }:
+
+let
+  cfg = config.programs.pandoc;
+in {
+  options.programs.pandoc = {
+    germanAbbreviations = lib.mkEnableOption "importing german abbreviations" // { default = true; };
+    extraAbbreviations = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    xdg.dataFile = lib.mkIf (cfg.germanAbbreviations || cfg.extraAbbreviations != []) {
+      "pandoc/abbreviations".source = pkgs.runCommand "pandoc-abbreviations" {
+         buildInputs = [ pkgs.coreutils ];
+       } ''
+         cat \
+           <(${lib.getExe' cfg.finalPackage "pandoc"} --print-default-data-file=abbreviations) \
+           ${lib.optionalString cfg.germanAbbreviations ./german_abbreviations.txt} \
+           ${lib.optionalString (cfg.extraAbbreviations != []) (pkgs.writeText "abbrevs.txt" (lib.concatStringsSep "\n" cfg.extraAbbreviations))} \
+           | sort | uniq >$out
+       '';
+    };
+  };
+}
diff --git a/home-modules/pandoc/german_abbreviations.txt b/home-modules/pandoc/german_abbreviations.txt
new file mode 100644
index 00000000..fa4c9c87
--- /dev/null
+++ b/home-modules/pandoc/german_abbreviations.txt
@@ -0,0 +1,1423 @@
+&c.
+A.
+a.
+a.a.O.
+A.C.A.B.
+a.D.
+a.d.D.
+a.g.O.
+Abb.
+abchas.
+abds.
+Abf.
+Abfr.
+Abg.
+abgek.
+abh.
+Abh.
+Abk.
+ABl.
+Abl.
+Abm.
+abn.
+Abn.
+abr.
+Abr.
+Abs.
+abs.
+Abschn.
+Abst.
+Abt.
+abulg.
+abw.
+abwert.
+abzgl.
+accel.
+accresc.
+Add.
+Adj.
+adj.
+Adr.
+adv.
+Adv.
+adyg.
+ae.
+aengl.
+afghan.
+afr.
+afranz.
+afranzös.
+afries.
+afrik.
+afrk.
+afrs.
+afrz.
+afränk.
+ags.
+ahd.
+Ahd.
+aind.
+air.
+akad.
+Akk.
+akkad.
+akt.
+alb.
+alban.
+alem.
+alemann.
+all.
+allg.
+allj.
+allm.
+alltagsspr.
+alphanum.
+Alt.
+altai.
+altengl.
+altfranz.
+altfranzös.
+altfrz.
+altgr.
+althochdt.
+altis.
+altisländ.
+altpreuß.
+altröm.
+alttest.
+alëut.
+am.
+amer.
+amerik.
+amerikan.
+amhar.
+amt.
+amtl.
+Amtm.
+Amtsbl.
+Amtsdt.
+Amtsspr.
+an.
+anal.
+anat.
+Anat.
+anatom.
+andalus.
+ang.
+angelsächs.
+Angest.
+angest.
+angloamerik.
+anglofrz.
+angloind.
+Anh.
+Ank.
+Ankl.
+Anl.
+anl.
+Anm.
+Anm.d.Red.
+Ann.
+ann.
+annamit.
+anord.
+Anord.
+anschl.
+Anschl.
+Anschr.
+antarkt.
+Anthrop.
+anthrop.
+Anw.
+aobd.
+apl.
+Apostr.
+App.
+Apr.
+apreuß.
+ar.
+arab.
+aragon.
+aram.
+aran.
+architekt.
+archäol.
+arg.
+argent.
+arkt.
+armen.
+Art.
+Art.-Nr.
+Artt.
+as.
+aserbaidsch.
+aslaw.
+assyr.
+astron.
+asächs.
+At.-Gew.
+attr.
+Attr.
+Aufl.
+Aug.
+Ausg.
+ausgen.
+Aussch.
+ausschl.
+Ausspr.
+Ausst.
+austral.
+awar.
+awest.
+Az.
+aztek.
+b.
+B.
+Ba.-Wü.
+bab.
+babyl.
+bair.
+Bakt.
+Bal.
+balt.
+baltoslaw.
+Bankw.
+bas.
+baschk.
+bask.
+Bat.
+bauf.
+Bauw.
+bay.
+bayer.
+bayr.
+BayVBl.
+Bd.
+Bde.
+Bed.
+Begr.
+begr.
+beif.
+beil.
+Beil.
+Bem.
+ben.
+berbersprachl.
+Bergb.
+berlin.
+Berufsbez.
+bes.
+besch.
+Beschl.
+best.
+Best.-Nr.
+Betr.
+betr.
+Betriebswiss.
+Bev.
+Bez.
+bez.
+bezw.
+Bf.
+bfn.
+Bg.
+bgld.
+Bgld.
+Bhf.
+Bib.
+bibl.
+bildl.
+bildungsspr.
+Biol.
+biol.
+Bj.
+bl.
+Bl.
+Blk.
+Bln.
+Bodenk.
+bot.
+Bot.
+Br.-M.
+Br.-Mstr.
+bras.
+bret.
+breton.
+brit.
+Brm.
+brn.
+Bruchz.
+bsd.
+Bsp.
+bsplsw.
+bspw.
+BT-Drs.
+Btl.
+btto.
+Bttr.
+Buchw.
+buddh.
+bulg.
+bulgar.
+burjat.
+burmes.
+Bw.
+byzant.
+Bz.
+bzb.
+bzgl.
+bzw.
+böhm.
+Börsenw.
+C.
+ca.
+Carp.
+Cb.
+cf.
+chakass.
+chald.
+chant.
+chem.
+Chem.
+chilen.
+chin.
+Chr.
+christl.
+chron.
+Chron.
+Co.
+Comp.
+cresc.
+D.
+Dankb.
+dankwtw.
+das.
+dass.
+Dat.
+dbzgl.
+ders.
+des.
+desgl.
+Dez.
+dgl.
+Di.
+dial.
+dichter.
+dies.
+dim.
+Dim.
+Dimin.
+dimin.
+Dipl.
+Dipl.-Bibl.
+Dipl.-Ing.
+Dipl.-Kff.
+Dipl.-Kffr.
+Dipl.-Kfm.
+Dipl.-Kfr.
+Dipl.-Psych.
+Dir.
+Diss.
+Do.
+do.
+Do.-Gge.
+dominikan.
+dor.
+Doz.
+Dr.
+Drchf.
+Drcks.
+Dres.
+Drs.
+Drucks.
+dt.
+Dtl.
+dto.
+Dtzd.
+dz.
+Dz.
+dän.
+E.
+ebd.
+Ed.
+ed.
+ehem.
+eidg.
+eig.
+eigtl.
+Einf.
+einh.
+Einl.
+einschl.
+Einw.
+Eisenb.
+Elektrot.
+elektrotechn.
+em.
+engl.
+entspr.
+erb.
+erf.
+erg.
+Erg.
+erk.
+Erl.
+erm.
+Ers.-D.
+ersch.
+erschl.
+Erschl.
+Erschl.-Geb.
+Erschw.
+erschw.
+Erstauff.
+Erstausg.
+Ertr.
+Erw.
+Erw.-Bldg.
+erwähnw.
+Erzb.
+erzg.
+erzgeb.
+eskim.
+estn.
+etc.
+Etg.
+etrusk.
+etw.
+eur.
+europ.
+ev.
+evang.
+evtl.
+Ew.
+ewen.
+ewenk.
+exkl.
+Expl.
+Ez.
+f.
+F.
+Fa.
+fachspr.
+Fachspr.
+Fag.
+Fam.
+fam.
+Febr.
+fem.
+ff.
+Fig.
+fig.
+finanzmath.
+finn.
+finnougr.
+Flgh.
+fläm.
+Fn.
+fnhd.
+folg.
+Forts.
+Fortstzg.
+Fr.
+fr.
+fragm.
+franz.
+französ.
+Frdf.
+frdl.
+frdsprlg.
+Frfr.
+frfr.
+Frh.
+Frhf.
+Frhr.
+fries.
+friesl.
+Frk.
+Frl.
+Frm.
+frnhd.
+Frspr.
+frstl.
+Frt.
+frtr.
+Frwk.
+frz.
+fränk.
+frühnhd.
+Fs.
+Fsch.
+Fschr.
+Fsm.
+Ftm.
+Fut.
+fut.
+färö.
+förml.
+g.
+Ga.
+gall.
+galloroman.
+Gart.
+gaskogn.
+gbd.
+Gbd.
+Gbf.
+GBl.
+Gbl.
+geb.
+Geb.
+Geb.-T.
+Gebr.
+gebr.
+ged.
+gef.
+geg.
+gegr.
+geh.
+gek.
+gel.
+geleg.
+gem.
+gemeingerm.
+gen.
+Gen.
+geod.
+geogr.
+geograf.
+geograph.
+geol.
+geolog.
+geophys.
+georg.
+gep.
+ger.
+germ.
+Ges.
+ges.
+gesch.
+gespr.
+gest.
+get.
+Gew.
+gew.
+gez.
+Gfsch.
+Gft.
+gg.
+ggb.
+ggbfs.
+ggez.
+ggf.
+ggfls.
+ggfs.
+Ggs.
+ggü.
+Ghzg.
+Ghzgt.
+glchz.
+Gld.
+Glde.
+gldg.
+Gldr.
+Gled.
+gleichbed.
+gleichn.
+gleichz.
+Glfl.
+gls.
+gltd.
+gltg.
+glz.
+gm.
+got.
+gr.
+Gr.
+Gramm.
+grammat.
+graph.
+grch.
+Grchl.
+Grdb.
+Grdf.
+Grdfl.
+Grdg.
+Grdl.
+Grdr.
+grds.
+Grdst.
+griech.
+Grz.
+grönländ.
+Gstb.
+Gt.
+gyn.
+gynäk.
+gäl.
+H.-I.
+H.-Qu.
+hait.
+Handw.
+Hbf.
+hd.
+Hd.-Bibl.
+Hdb.
+hdbr.
+Hdbr.
+hdl.
+Hdl.
+Hdlbg.
+hebr.
+hess.
+hethit.
+Hf.
+Hg.
+hg.
+hindust.
+hinr.
+hins.
+Hinw.
+hist.
+HJber.
+Hkl.
+hl.
+hochd.
+hochspr.
+Hom.
+hor.
+Hpfl.
+hptpl.
+hpts.
+Hptst.
+hptw.
+Hptw.
+HQu.
+Hr.
+HReg.
+Hrn.
+Hrsg.
+hrsg.
+Hs.
+Hs.-Nr.
+hschr.
+Hschr.
+HSt.
+Hubbr.
+Hubr.
+Hw.
+Hyaz.
+hydr.
+hydrol.
+Hzm.
+i.
+I.E.
+i.g.O.
+i.Tr.
+iber.
+ibid.
+ide.
+Ident.
+ident.
+idg.
+ie.
+illyr.
+Imkerspr.
+imp.
+Imp.
+in.
+Ind.
+ind.
+indef.
+indekl.
+indian.
+indiff.
+indir.
+indiv.
+indog.
+indogerm.
+indogerman.
+indoiran.
+indon.
+indones.
+Inf.
+inf.
+Ing.
+Inh.
+inkl.
+inn.
+Ins.
+insb.
+insbes.
+int.
+intern.
+intrans.
+ir.
+iran.
+iron.
+isl.
+islam.
+isländ.
+it.
+ital.
+italien.
+j.
+J.
+Jahrh.
+jakut.
+Jan.
+jap.
+japan.
+jav.
+jem.
+jemen.
+Jg.
+jgdfr.
+Jh.
+Jhd.
+Jhdt.
+Jhg.
+Jhs.
+jidd.
+jmd.
+jmdm.
+jmdn.
+jmds.
+journ.
+jr.
+Jr.
+Jt.
+Jtsd.
+jugendspr.
+jugendsprachl.
+jugoslaw.
+Jul.
+jun.
+Jun.
+jur.
+Juw.
+jägersprachl.
+jährl.
+Jän.
+jüd.
+k.u.k.
+K.Ö.St.V.
+kalm.
+kanad.
+Kap.
+karib.
+kastil.
+katal.
+katalan.
+kath.
+kaufm.
+kaukas.
+kelt.
+Kgr.
+Kh.
+kindersprachl.
+kirchenlat.
+kirchenslaw.
+kirchl.
+kirg.
+Kl.
+klass.
+klass.-lat.
+klimatol.
+kol.
+Komm.
+Konj.
+Konv.
+Kop.
+kop.
+kopt.
+korean.
+Kr.
+kreol.
+kret.
+Krh.
+Krhs.
+Krim.-Ob.-Insp.
+krimgot.
+kriminaltechn.
+Krkhs.
+kroat.
+Krs.
+Ks.
+Kto.
+Kto.-Nr.
+kuban.
+kurd.
+Kurzw.
+Kw.
+l.
+L.-Abg.
+lab.
+LAbg.
+ladin.
+landsch.
+Landw.
+langfr.
+langj.
+langob.
+langobard.
+lapp.
+lat.
+latein.
+latinis.
+lautl.
+lautm.
+lbd.
+lbdg.
+Ldkr.
+led.
+leg.
+lett.
+lfd.
+Lfg.
+Lfm.
+Lfrg.
+Lg.
+lgfr.
+Lgft.
+lgj.
+lig.
+ling.
+lit.
+LL.M.
+lrh.
+lt.
+ltd.
+luth.
+luxemb.
+Lz.
+m.
+M.
+M.-Schr.
+m.a.W.
+ma.
+MA.
+Mag.
+malai.
+marinespr.
+marx.
+mask.
+math.
+Math.
+max.
+Max.
+mazedon.
+mbl.
+Mbl.
+MBl.
+Mbll.
+md.
+mdal.
+mdj.
+mdl.
+mdls.
+Mdt.
+me.
+mech.
+meckl.
+med.
+melanes.
+mengl.
+Merc.
+met.
+meteorol.
+meton.
+mex.
+mexik.
+mfr.
+mfranz.
+mfrk.
+mfrz.
+mfränk.
+mgl.
+Mgl.
+mglw.
+mhd.
+mhdt.
+Mi.
+mi.
+Mia.
+milit.
+Mill.
+min.
+Min.
+mind.
+Mio.
+mir.
+Mitgl.
+mitteld.
+mitteldt.
+mittelhochdt.
+Mittw.
+Mitw.
+mlat.
+Mme.
+Mmes.
+mnd.
+mndd.
+mniederd.
+mnl.
+Mo.
+mod.
+mong.
+Mrd.
+Mrz.
+Mschr.
+Msgr.
+Msp.
+mtl.
+mundartl.
+musik.
+MwSt.
+Myth.
+Mz.
+männl.
+möbl.
+n.
+Nachf.
+nachm.
+nat.
+nationalsoz.
+natsoz.
+Nbf.
+Nbfl.
+Nchf.
+nd.
+ndd.
+ndrl.
+neapolit.
+Neub.
+neunorweg.
+neutest.
+neutr.
+Nfl.
+ngl.
+ngr.
+nhbr.
+nhd.
+nicar.
+niederd.
+niederdt.
+niederl.
+niederld.
+niem.
+niger.
+nihil.
+nl.
+nlat.
+nmtl.
+Nom.
+nord.
+nordamerik.
+nordd.
+norddt.
+nordgerm.
+nordostd.
+nordostdt.
+nordwestd.
+nordwestdt.
+norm.
+norw.
+norweg.
+Nov.
+Nr.
+ntw.
+Ntw.
+Nutzfl.
+nw.
+näml.
+nö.
+nördl.
+o.
+O.K.
+ob.
+Ob.
+Obb.
+obb.
+obd.
+Oberlaus.
+obers.
+obersächs.
+obj.
+od.
+offiz.
+Offz.
+Ofr.
+ofrs.
+Okt.
+op.
+Orch.-Bes.
+org.
+Orig.
+orn.
+orth.
+Ortskl.
+Osch.
+osk.
+osman.
+ostd.
+ostdt.
+ostfr.
+ostfrz.
+ostgerm.
+ostidg.
+ostmdt.
+ostmitteld.
+ostniederd.
+ostpr.
+ostpreuß.
+ostw.
+osö.
+Ouv.
+oz.
+Oz.
+oö.
+OÖ.
+P.
+p.
+P.S.
+pa.
+palästin.
+par.
+parag.
+Paragr.
+Parl.
+Part.
+pass.
+Pat.
+pej.
+pers.
+peruan.
+Pet.
+Pf.
+Pfd.
+Pfg.
+Pfl.
+pharm.
+philos.
+Philos.
+phonolog.
+phryg.
+Phys.
+phys.
+phöniz.
+Pi.
+pik.
+Pkt.
+Pl.
+Plur.
+poet.
+Pol.
+pol.
+polit.
+poln.
+polynes.
+port.
+portug.
+Pos.
+pos.
+pp.
+ppa.
+preuß.
+Priv.-Doz.
+Prof.
+prot.
+Prot.
+prov.
+Prov.
+prov.-fr.
+provenz.
+Proz.
+Proz.-Bev.
+präd.
+prähist.
+Präs.
+Psych.
+psych.
+Päd.
+Q.
+q.v.
+Qmstr.
+Qt.
+qu.
+Qu.
+quadr.
+Quadr.
+qual.
+Qual.
+quant.
+Quant.
+Quar.
+Quart.
+Quat.
+quitt.
+Quitt.
+Quäst.
+r.
+r.-k.
+Rab.
+rad.
+Raff.
+Rak.
+Randb.
+Randbem.
+rat.
+Rat.
+Rb.
+rd.
+RdErl.
+Rdf.
+refl.
+Reg.
+Reg.-Bez.
+Regt.
+Rel.
+rel.
+relig.
+Rep.
+resp.
+Rg.-Präs.
+RGBl.
+rglm.
+Rgstr.
+Rgt.
+Rh.
+rh.
+rhein.
+rheinhess.
+rhet.
+rhfrk.
+Rhj.
+Rhld.
+Rhs.
+Ri.
+Richtl.
+rip.
+rk.
+roman.
+rotw.
+Rr.
+rrh.
+Rspr.
+Rtn.
+Rtt.
+rumän.
+russ.
+Rvj.
+rzp.
+rätorom.
+röm.
+röm.-kath.
+S.
+s.
+S.-Wk.
+Sa.
+Sachs.
+san.
+sanskr.
+Sat.
+sat.
+Sb.
+Sbd.
+sc.
+scherzh.
+Schill.
+schles.
+schott.
+schr.
+schriftl.
+Schussw.
+schwed.
+schweiz.
+Schwg.
+Schwp.
+schwäb.
+scil.
+Sdp.
+sek.
+sem.
+semit.
+sen.
+Sep.
+Sept.
+serb.
+serbokroat.
+Sg.
+sibir.
+Sing.
+singhal.
+Sir.
+sizilian.
+skand.
+slaw.
+slow.
+slowak.
+slowen.
+So.
+sod.
+sof.
+sog.
+sogen.
+sogl.
+soldatenspr.
+solv.
+somal.
+sorb.
+Sout.
+soz.
+soziol.
+span.
+spez.
+sportspr.
+Spr.
+sprachwiss.
+Spvg.
+Spvgg.
+spätahd.
+spätgriech.
+spätlat.
+spätmhd.
+Sr.
+ssp.
+St.
+St.-Nr.
+staatl.
+Std.
+stdl.
+stellv.
+Stellv.
+Stk.
+Str.
+str.
+Stud.
+stud.
+subsp.
+Subst.
+sumer.
+svw.
+Swk.
+syn.
+Syn.
+syr.
+sächs.
+südafrik.
+südd.
+süddt.
+südl.
+südostdt.
+südwestd.
+Süßw.
+Tab.
+Tabl.
+Taf.
+tamil.
+tatar.
+techn.
+Tel.
+telef.
+Temp.
+Terr.
+tessin.
+test.
+Tfx.
+tgl.
+Tgt.
+thrak.
+thür.
+thüring.
+Ti.
+tib.
+tirol.
+Tlr.
+tochar.
+trans.
+tsch.
+tschech.
+tschechoslowak.
+Tsd.
+tun.
+Tun.
+tunes.
+Tunes.
+tungus.
+turkotat.
+typogr.
+tägl.
+türk.
+u.
+u.a.
+Ubr.
+ue.
+ugr.
+ugs.
+ukrain.
+umbr.
+umg.
+unang.
+unbefl.
+Unf.
+unf.
+unfol.
+unfr.
+ung.
+ungar.
+ungebr.
+ungel.
+ungen.
+unges.
+ungl.
+Uni-Kl.
+Univ.
+unv.
+unverantw.
+unverb.
+unverbr.
+unverd.
+unverg.
+unverh.
+unverk.
+unverp.
+unversch.
+unverz.
+unverzgl.
+unvollst.
+unvorb.
+unvors.
+unzerbr.
+urgerm.
+urkdl.
+urspr.
+ursprüngl.
+Urt.
+usf.
+USt-IdNr.
+usw.
+uvm.
+v.
+va.
+Ver.
+Verf.
+Verg.
+vergl.
+Vergl.
+verh.
+Vers.
+vers.
+vert.
+Vfg.
+vgbl.
+vgl.
+Vgl.
+vh.
+viell.
+vj.
+Vj.
+vl.
+vlat.
+vlt.
+vmtl.
+volkst.
+Vors.
+vrstl.
+vrt.
+vs.
+vsl.
+vt.
+vulg.
+vulgärlat.
+Vwz.
+vzk.
+w.
+W.
+Wa.
+wal.
+wehrtgl.
+weibl.
+Weis.
+weißruss.
+werkt.
+westd.
+westdt.
+Westf.
+westfäl.
+westgerm.
+westl.
+westmitteld.
+westmitteldt.
+Wf.
+wf.
+Wfl.
+wg.
+wh.
+Whg.
+winzerspr.
+wirtschaftl.
+wiss.
+Wkst.
+Wkstf.
+wkts.
+wld.
+Wr.
+Ws.
+Wtb.
+Ww.
+Wwe.
+Wz.
+Xerogr.
+Xerok.
+Xyl.
+y.
+Y.
+yd.
+Yd.
+Yds.
+yds.
+Z.
+z.B.
+za.
+Zf.
+Zgm.
+zgs.
+zgst.
+zgw.
+Zi.
+Ziff.
+zit.
+Zit.
+zk.
+Zk.
+Zool.
+zool.
+Zssg.
+Zssgn.
+Ztr.
+Zub.
+zur.
+zus.
+zw.
+Zz.
+zz.
+zzgl.
+zzt.
+ägypt.
+Ökol.
+ökol.
+ökon.
+ökum.
+örtl.
+österr.
+Österr.
+östl.
+übers.
+übertr.
+überw.
+Überw.
+übl.
+üblw.
+Übn.
+übsch.
diff --git a/home-modules/pandoc/german_abbreviations.txt.gup b/home-modules/pandoc/german_abbreviations.txt.gup
new file mode 100755
index 00000000..abcab1da
--- /dev/null
+++ b/home-modules/pandoc/german_abbreviations.txt.gup
@@ -0,0 +1,35 @@
+#!/usr/bin/env nix
+#!nix shell --impure --expr ``
+#!nix with (import (builtins.getFlake ''nixpkgs'') {});
+#!nix python3.withPackages (ps: with ps; [ requests ])
+#!nix `` --command python3
+
+import requests
+import json
+import sys
+import re
+import subprocess
+
+def wiki_cont(url, params):
+    continue_params = None
+    while True:
+        req_params = params
+        if continue_params is not None:
+            req_params |= continue_params
+        json_data = requests.get(url, req_params).json()
+        if "query" in json_data:
+            yield json_data["query"]
+        if "continue" not in json_data:
+            break
+        else:
+            continue_params = json_data["continue"]
+
+out_re = re.compile(r"[^ ]*[^ 0-9][^ ]*\.")
+
+subprocess.run(["gup", "--always"], check=True)
+
+with open(sys.argv[1], 'w') as out:
+    for query in wiki_cont("https://de.wiktionary.org/w/api.php", {"action": "query", "list": "categorymembers", "cmtitle": "Kategorie:Abkürzung_(Deutsch)", "format": "json"}):
+        for item in map(lambda i: i["title"], query["categorymembers"]):
+            if out_re.fullmatch(item):
+                print(item, file=out)
diff --git a/hosts/eostre/default.nix b/hosts/eostre/default.nix
index fd4b15f2..d4113024 100644
--- a/hosts/eostre/default.nix
+++ b/hosts/eostre/default.nix
@@ -37,14 +37,10 @@ with lib;
         powerManagement.enable = true;
       };
 
-      opengl.enable = true;
+      graphics.enable = true;
     };
 
-    environment.etc."machine-id".text = "f457b21333f1491e916521151ff5d468";
-
     networking = {
-      hostId = "f457b213";
-
       domain = "lan.yggdrasil";
       search = [ "lan.yggdrasil" "yggdrasil" ];
 
@@ -83,19 +79,14 @@ with lib;
       ];
     };
 
-
-    services.xserver = {
+    services.displayManager.sddm = {
       enable = true;
-      displayManager.sddm = {
-        enable = true;
-        settings = {
-          Users.HideUsers = "gkleen";
-        };
+      wayland.enable = true;
+      settings = {
+        Users.HideUsers = "gkleen";
       };
-      desktopManager.plasma5.enable = true;
-
-      videoDrivers = [ "nvidia" ];
     };
+    services.desktopManager.plasma6.enable = true;
 
 
     services.openssh = {
diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix
index 7c8da63a..ed85ca17 100644
--- a/hosts/sif/default.nix
+++ b/hosts/sif/default.nix
@@ -12,11 +12,9 @@ let
 in {
   imports = with flake.nixosModules.systemProfiles; [
     ./hw.nix
-    ./mail ./libvirt
-    tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines
-    networkmanager
+    ./email ./libvirt ./greetd
+    tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines niri-unstable networkmanager lanzaboote
     flakeInputs.nixos-hardware.nixosModules.lenovo-thinkpad-p1
-    flakeInputs.impermanence.nixosModules.impermanence
     flakeInputs.nixVirt.nixosModules.default
   ];
 
@@ -34,8 +32,11 @@ in {
     boot = {
       initrd = {
         systemd = {
-          enable = false;
           emergencyAccess = config.users.users.root.hashedPassword;
+          extraBin = {
+            "vim" = lib.getExe pkgs.vim;
+            "grep" = lib.getExe pkgs.gnugrep;
+          };
         };
         luks.devices = {
           nvm0 = { device = "/dev/disk/by-uuid/bef17e86-d929-4a60-97cb-6bfa133face7"; bypassWorkqueues = true; };
@@ -49,12 +50,8 @@ in {
 
       blacklistedKernelModules = [ "nouveau" ];
 
-      # Use the systemd-boot EFI boot loader.
+      lanzaboote.configurationLimit = 15;
       loader = {
-        systemd-boot = {
-          enable = true;
-          configurationLimit = 15;
-        };
         efi.canTouchEfiVariables = true;
         timeout = null;
       };
@@ -62,16 +59,29 @@ in {
       plymouth.enable = true;
 
       kernelPackages = pkgs.linuxPackages_latest;
-      extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
-      kernelModules = ["v4l2loopback"];
       kernelPatches = [
         { name = "edac-config";
           patch = null;
-          extraConfig = ''
-            EDAC y
-            EDAC_IE31200 y
-          '';
+          structuredExtraConfig = with lib.kernel; {
+            EDAC = yes;
+            EDAC_IE31200 = yes;
+          };
         }
+        { name = "zswap-default";
+          patch = null;
+          structuredExtraConfig = with lib.kernel; {
+            ZSWAP_DEFAULT_ON = yes;
+            ZSWAP_SHRINKER_DEFAULT_ON = yes;
+          };
+        }
+      ];
+      consoleLogLevel = 3;
+      kernelParams = [
+        "quiet"
+        "boot.shell_on_fail"
+        "udev.log_priority=3"
+        "rd.systemd.show_status=auto"
+        "plymouth.use-simpledrm"
       ];
 
       tmp.useTmpfs = true;
@@ -94,6 +104,8 @@ in {
         server ptbtime2.ptb.de prefer iburst nts
         server ptbtime3.ptb.de prefer iburst nts
         server ptbtime4.ptb.de prefer iburst nts
+        pool ntppool1.time.nl prefer iburst nts
+        pool ntppool2.time.nl prefer iburst nts
 
         authselectmode require
         minsources 3
@@ -122,40 +134,16 @@ in {
         rulesetFile = ./ruleset.nft;
       };
 
-      # firewall = {
-      #   enable = true;
-      #   allowedTCPPorts = [ 22 # ssh
-      #                       8000 # quickserve
-      #                     ];
-      # };
-
-      # wlanInterfaces = {
-      #   wlan0 = {
-      #     device = "wlp82s0";
-      #   };
-      # };
-
-      # bonds = {
-      #   "lan" = {
-      #     interfaces = [ "wlan0" "enp0s31f6" "dock0" ];
-      #     driverOptions = {
-      #       miimon = "1000";
-      #       mode = "active-backup";
-      #       primary_reselect = "always";
-      #     };
-      #   };
-      # };
-
       useDHCP = false;
       useNetworkd = true;
-
-      # interfaces."tinc.yggdrasil" = {
-      #   virtual = true;
-      #   virtualType = config.services.tinc.networks.yggdrasil.interfaceType;
-      #   macAddress = "5c:93:21:c3:61:39";
-      # };
     };
 
+    environment.etc."NetworkManager/dnsmasq.d/dnssec.conf" = {
+      text = ''
+        conf-file=${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf
+        dnssec
+      '';
+    };
     environment.etc."NetworkManager/dnsmasq.d/libvirt_dnsmasq.conf" = {
       text = ''
         except-interface=virbr0
@@ -398,19 +386,6 @@ in {
     ];
 
     services = {
-      uucp = {
-        enable = true;
-        nodeName = "sif";
-        remoteNodes = {
-          "ymir" = {
-            publicKeys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6KNtsCOl5fsZ4rV7udTulGMphJweLBoKapzerWNoLY root@ymir"];
-            hostnames = ["ymir.yggdrasil.li" "ymir.niflheim.yggdrasil"];
-          };
-        };
-
-        defaultCommands = lib.mkForce [];
-      };
-
       avahi.enable = true;
 
       fwupd.enable = true;
@@ -429,8 +404,8 @@ in {
 
       logind = {
         lidSwitch = "suspend";
-        lidSwitchDocked = "lock";
-        lidSwitchExternalPower = "lock";
+        lidSwitchDocked = "ignore";
+        lidSwitchExternalPower = "ignore";
       };
 
       atd = {
@@ -439,7 +414,7 @@ in {
       };
 
       xserver = {
-        enable = true;
+        enable = false;
 
         xkb = {
           layout = "us";
@@ -465,47 +440,13 @@ in {
       };
       libinput.enable = true;
 
-      greetd = {
-        enable = true;
-      #   settings.default_session.command = let
-      #     cfg = config.programs.regreet;
-      #   in pkgs.writeShellScript "greeter" ''
-      #       modprobe -r nvidia_drm
+      envfs.enable = false;
 
-      #       exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}
-      #     '';
-      };
+      displayManager.defaultSession = "Niri";
     };
 
-    programs.regreet = {
-      enable = true;
-      theme = {
-        package = pkgs.equilux-theme;
-        name = "Equilux-compact";
-      };
-      iconTheme = {
-        package = pkgs.paper-icon-theme;
-        name = "Paper-Mono-Dark";
-      };
-      font = {
-        package = pkgs.fira;
-        name = "Fira Sans";
-        # size = 6;
-      };
-      cageArgs = [ "-s" "-m" "last" ];
-      settings = {
-        GTK.application_prefer_dark_theme = true;
-      };
-    };
-    programs.hyprland.enable = true;
-
     systemd.tmpfiles.settings = {
       "10-localtime"."/etc/localtime".L.argument = "/.bcachefs/etc/localtime";
-
-      "10-regreet"."/var/cache/regreet/cache.toml".C.argument = toString ((pkgs.formats.toml {}).generate "cache.toml" {
-        last_user = "gkleen";
-        user_to_last_sess.gkleen = "Hyprland";
-      });
     };
 
     users = {
@@ -614,15 +555,15 @@ in {
       };
 
       nvidia = {
-        open = true;
+        open = false;
         modesetting.enable = true;
         powerManagement.enable = true;
-        prime = {
-          nvidiaBusId = "PCI:1:0:0";
-          intelBusId = "PCI:0:2:0";
-          reverseSync.enable = true;
-          offload.enableOffloadCmd = true;
-        };
+        # prime = {
+        #   nvidiaBusId = "PCI:1:0:0";
+        #   intelBusId = "PCI:0:2:0";
+        #   reverseSync.enable = true;
+        #   offload.enableOffloadCmd = true;
+        # };
       };
 
       graphics = {
@@ -665,25 +606,6 @@ in {
 
     environment.etc."X11/xorg.conf.d/50-wacom.conf".source = lib.mkForce ./wacom.conf;
 
-    systemd.services."ac-plugged" = {
-      description = "Inhibit handling of lid-switch and sleep";
-
-      path = with pkgs; [ systemd coreutils ];
-
-      script = ''
-        exec systemd-inhibit --what=handle-lid-switch --why="AC is connected" --mode=block sleep infinity
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-      };
-    };
-
-    services.udev.extraRules = with pkgs; lib.mkAfter ''
-      SUBSYSTEM=="power_supply", ENV{POWER_SUPPLY_ONLINE}=="0", RUN+="${systemd}/bin/systemctl --no-block stop ac-plugged.service"
-      SUBSYSTEM=="power_supply", ENV{POWER_SUPPLY_ONLINE}=="1", RUN+="${systemd}/bin/systemctl --no-block start ac-plugged.service"
-    '';
-
     systemd.services."nix-daemon".serviceConfig = {
       MemoryAccounting = true;
       MemoryHigh = "50%";
@@ -696,6 +618,7 @@ in {
 
     services.dbus.packages = with pkgs;
       [ dbus dconf
+        xdg-desktop-portal-gtk
       ];
 
     services.udisks2.enable = true;
@@ -704,12 +627,8 @@ in {
       light.enable = true;
       wireshark.enable = true;
       dconf.enable = true;
-    };
-
-    zramSwap = {
-      enable = true;
-      algorithm = "zstd";
-      writebackDevice = "/dev/disk/by-label/swap";
+      niri.enable = true;
+      fuse.userAllowOther = true;
     };
 
     services.pcscd.enable = true;
@@ -729,6 +648,16 @@ in {
     environment.sessionVariables."GTK_USE_PORTAL" = "1";
     xdg.portal = {
       enable = true;
+      extraPortals = with pkgs; [ xdg-desktop-portal-gtk ];
+      config.niri = {
+        default = ["gnome" "gtk"];
+        "org.freedesktop.impl.portal.FileChooser" = ["gtk"];
+        "org.freedesktop.impl.portal.OpenFile" = ["gtk"];
+        "org.freedesktop.impl.portal.Access" = ["gtk"];
+        "org.freedesktop.impl.portal.Notification" = ["gtk"];
+        "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
+        "org.freedesktop.impl.portal.Inhibit" = ["none"];
+      };
     };
 
     environment.persistence."/.bcachefs" = {
@@ -736,35 +665,25 @@ in {
       directories = [
         "/nix"
         "/root"
+        "/home"
         "/var/log"
         "/var/lib/sops-nix"
         "/var/lib/nixos"
         "/var/lib/systemd"
-        "/home"
         "/var/lib/chrony"
         "/var/lib/fprint"
         "/var/lib/bluetooth"
         "/var/lib/upower"
         "/var/lib/postfix"
+        "/var/lib/regreet"
         "/etc/NetworkManager/system-connections"
-        { directory = "/var/uucp"; user = "uucp"; group = "uucp"; mode = "0700"; }
-        { directory = "/var/spool/uucp"; user = "uucp"; group = "uucp"; mode = "0750"; }
+        config.boot.lanzaboote.pkiBundle
       ];
       files = [
       ];
+      timezone = true;
     };
 
-    systemd.services.timezone = {
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = "${pkgs.coreutils}/bin/cp -vP /.bcachefs/etc/localtime /etc/localtime";
-        ExecStop = "${pkgs.coreutils}/bin/cp -vP /etc/localtime /.bcachefs/etc/localtime";
-      };
-    };
-    services.tzupdate.enable = true;
-
     security.pam.services.gtklock = {};
 
     home-manager.sharedModules = [ flakeInputs.nixVirt.homeModules.default ];
diff --git a/hosts/sif/email/default.nix b/hosts/sif/email/default.nix
new file mode 100644
index 00000000..bebf7980
--- /dev/null
+++ b/hosts/sif/email/default.nix
@@ -0,0 +1,111 @@
+{ config, lib, pkgs, ... }:
+{
+  services.postfix = {
+    enable = true;
+    enableSmtp = false;
+    enableSubmission = false;
+    setSendmail = true;
+    # networksStyle = "host";
+    settings.main = {
+      recpipient_delimiter = "+";
+      mydestination = [];
+      myhostname = "sif.midgard.yggdrasil";
+
+      mydomain = "yggdrasil.li";
+
+      local_transport = "error:5.1.1 No local delivery";
+      alias_database = [];
+      alias_maps = [];
+      local_recipient_maps = [];
+
+      inet_interfaces = "loopback-only";
+
+      message_size_limit = 0;
+
+      authorized_submit_users = "inline:{ gkleen= }";
+      authorized_flush_users = "inline:{ gkleen= }";
+      authorized_mailq_users = "inline:{ gkleen= }";
+
+      smtp_generic_maps = "inline:{ root=root+sif }";
+
+      mynetworks = ["127.0.0.0/8" "[::1]/128"];
+      smtpd_client_restrictions = ["permit_mynetworks" "reject"];
+      smtpd_relay_restrictions = ["permit_mynetworks" "reject"];
+
+      sender_dependent_default_transport_maps = ''regexp:${pkgs.writeText "sender_relay" ''
+        /@(cip|stud)\.ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtp.ifi.lmu.de
+        /@ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtpin1.ifi.lmu.de:587
+        /@math(ematik)?\.(lmu|uni-muenchen)\.de$/ smtps:smtp.math.lmu.de:465
+        /@(campus\.)?lmu\.de$/ smtp:postout.lrz.de
+      ''}'';
+      sender_bcc_maps = ''regexp:${pkgs.writeText "sender_bcc" ''
+        /^uni2work(-[^@]*)?@ifi\.lmu\.de$/ uni2work@ifi.lmu.de
+        /@ifi\.lmu\.de$/ gregor.kleen@ifi.lmu.de
+      ''}'';
+      relayhost = ["[surtr.yggdrasil.li]:465"];
+      default_transport = "relay";
+
+      smtp_sasl_auth_enable = true;
+      smtp_sender_dependent_authentication = true;
+      smtp_sasl_tls_security_options = "noanonymous";
+      smtp_sasl_mechanism_filter = ["plain"];
+      smtp_sasl_password_maps = "regexp:/run/credentials/postfix.service/sasl_passwd";
+      smtp_cname_overrides_servername = false;
+      smtp_always_send_ehlo = true;
+      smtp_tls_security_level = "dane";
+
+      smtp_tls_loglevel = "1";
+      smtp_dns_support_level = "dnssec";
+    };
+    settings.master = {
+      submission = {
+        type = "inet";
+        private = false;
+        command = "smtpd";
+        args = [
+          "-o" "syslog_name=postfix/$service_name"
+        ];
+      };
+      smtp = { };
+      smtps = {
+        type = "unix";
+        private = true;
+        privileged = true;
+        chroot = false;
+        command = "smtp";
+        args = [
+          "-o" "smtp_tls_wrappermode=yes"
+          "-o" "smtp_tls_security_level=encrypt"
+        ];
+      };
+      relay = {
+        command = "smtp";
+        args = [
+          "-o" "smtp_fallback_relay="
+          "-o" "smtp_tls_security_level=verify"
+          "-o" "smtp_tls_wrappermode=yes"
+          "-o" "smtp_tls_cert_file=${./relay.crt}"
+          "-o" "smtp_tls_key_file=/run/credentials/postfix.service/relay.key"
+        ];
+      };
+    };
+  };
+
+  systemd.services.postfix = {
+    serviceConfig.LoadCredential = [
+      "sasl_passwd:${config.sops.secrets."postfix-sasl-passwd".path}"
+      "relay.key:${config.sops.secrets."relay-key".path}"
+    ];
+  };
+
+  sops.secrets = {
+    postfix-sasl-passwd = {
+      key = "sasl-passwd";
+      sopsFile = ./secrets.yaml;
+    };
+    relay-key = {
+      format = "binary";
+      sopsFile = ./relay.key;
+    };
+  };
+}
diff --git a/hosts/sif/email/relay.crt b/hosts/sif/email/relay.crt
new file mode 100644
index 00000000..ac13e7cb
--- /dev/null
+++ b/hosts/sif/email/relay.crt
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBjDCCAQygAwIBAgIPQAAAAGgLfNoL/PSMAsutMAUGAytlcTAXMRUwEwYDVQQD
+DAx5Z2dkcmFzaWwubGkwHhcNMjUwNDI1MTIwOTQ1WhcNMzUwNDI2MTIxNDQ1WjAR
+MQ8wDQYDVQQDDAZna2xlZW4wKjAFBgMrZXADIQB3outi3/3F4YO7Q97WAAaMHW0a
+m+Blldrgee+EZnWnD6N1MHMwHwYDVR0jBBgwFoAUTtn+VjMw6Ge1f68KD8dT1CWn
+l3YwHQYDVR0OBBYEFFOa4rYZYMbXUVdKv98NB504GUhjMA4GA1UdDwEB/wQEAwID
+6DAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAUGAytlcQNzABC0
+0UgIt7gLZrU1TmzGoqPBris8R1DbKOJacicF5CU0MIIjHcX7mPFW8KtB4qm6KcPq
+kF6IaEPmgKpX3Nubk8HJik9vhIy9ysfINcVTvzXx8pO1bxbvREJRyA/apj10nzav
+yauId0cXHvN6g5RLAMsMAA==
+-----END CERTIFICATE-----
diff --git a/hosts/sif/email/relay.key b/hosts/sif/email/relay.key
new file mode 100644
index 00000000..412a44e0
--- /dev/null
+++ b/hosts/sif/email/relay.key
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:lBlTuzOS75pvRmcTKT4KhHMH44RlE2SvCFAUP+GfsXws1Uai7DZ1MmbhvxxCa+pcLW19+sQYxrXLRNZWby1yOeKBJ2UQeYV5LOk9LSL/WIE3FZkCo5Dv0O0gSFKjjb61WN22a4JnHbLWADf/mLT3GZv91XfvFDo=,iv:ho8wQH3UNzX9JPW5gVcUGtxZzdVwsMFus0Z4KYe5t48=,tag:dAgZyHOva2xVVhE1nTl+lg==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eTVRSUdFNUZGZmcxSUlT\nWmlsOGNyWXIzMGNTZjlKbXlhcEdZUXFRVkR3Cll0T0RMd0h2UW16QkR3SHlhYmNZ\nNDFrYXh3Rkp5NWsvcWc3UFJJaHVwT1UKLS0tIHhXVEI0VHBZVkpDQ1FzWENjMmJH\nb1FQWXVUUTBiZ1pKWG00MTNqVEo2SjAKK3VOU+QgRuxWYWEcrJiVMRFCprBICz4F\ngD+9zuPUzPezyJkYwTs+M+wX5GYkXppqm5W58yQLS2UDD38sr+SRjg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1fj65apkhfkrwyv5tx6zcs9nkjg8267fy733qph30sc7zfn7vapjqkd5kne",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWmJmZDVFazN2bDY1TkNG\nNXpJN2twMFFjZUxMTVdSNzJwQTFiYktrcGdrCjk4eFVHTko0bFVMSlFFWm9tbjMr\nbWNHMEQ1Rm1qUVhodlB1RGw2aDc4TUEKLS0tIERBK0J5NkN4OXJEZ1ZOZXhNc1Jm\naWNnUmZGbTIxdmNkYi9TZ2h2bGs3MVEKPQGaEf7M/5/xvSOfawpIp50fB3QfFSuz\nPgkrPMneaBeUx+uBYMyEFX4rpzLIBR3pnYMjAfoc+bjWaOtGQuEqyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-04-25T12:14:44Z",
+                "mac": "ENC[AES256_GCM,data:pObl2bJA93az9E3Ya+hA3ekI8TKKZ9NNTi0KzmWZBOiQwi9FuQYtpnmmT80L1KXWyOKJV6wGdAri3mNe/ue2S0TziSbQ/4+Dj4ubFKgkH7thb5q2dFyxw5FzhYzRQiXFqD/pxcNN9uL0lQI2Al0Eci0zX8Kcd1rAQ6RzLEoSmco=,iv:zo/3QFKTUEDxLy1k5yyU7Z1JMZ7cKdYUc6GHjaTTZKQ=,tag:f63Eja3lBfwJCYAOyEt56g==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/sif/mail/secrets.yaml b/hosts/sif/email/secrets.yaml
index 3c74b710..3c74b710 100644
--- a/hosts/sif/mail/secrets.yaml
+++ b/hosts/sif/email/secrets.yaml
diff --git a/hosts/sif/greetd/default.nix b/hosts/sif/greetd/default.nix
new file mode 100644
index 00000000..37ca13c5
--- /dev/null
+++ b/hosts/sif/greetd/default.nix
@@ -0,0 +1,49 @@
+{ pkgs, ... }:
+{
+  config = {
+    services.greetd = {
+      enable = true;
+    #   settings.default_session.command = let
+    #     cfg = config.programs.regreet;
+    #   in pkgs.writeShellScript "greeter" ''
+    #       modprobe -r nvidia_drm
+
+    #       exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}
+    #     '';
+    };
+    systemd.services.greetd.environment = {
+      XKB_DEFAULT_LAYOUT = "us,us";
+      XKB_DEFAULT_VARIANT = "dvp,";
+      XKB_DEFAULT_OPTIONS = "compose:caps,grp:win_space_toggle";
+    };
+    programs.regreet = {
+      enable = true;
+      theme = {
+        package = pkgs.equilux-theme;
+        name = "Equilux-compact";
+      };
+      iconTheme = {
+        package = pkgs.paper-icon-theme;
+        name = "Paper-Mono-Dark";
+      };
+      font = {
+        package = pkgs.fira;
+        name = "Fira Sans";
+        # size = 6;
+      };
+      cageArgs = [ "-s" "-m" "last" ];
+      settings = {
+        GTK.application_prefer_dark_theme = true;
+        widget.clock.format = "%F %H:%M:%S%:z";
+        background = {
+          path = pkgs.runCommand "wallpaper.png" {
+            buildInputs = with pkgs; [ imagemagick ];
+          } ''
+            magick ${./wallpaper.png} -filter Gaussian -resize 6.25% -define filter:sigma=2.5 -resize 1600% "$out"
+          '';
+          fit = "Cover";
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/sif/greetd/wallpaper.png b/hosts/sif/greetd/wallpaper.png
new file mode 100644
index 00000000..20fc761a
--- /dev/null
+++ b/hosts/sif/greetd/wallpaper.png
diff --git a/hosts/sif/hw.nix b/hosts/sif/hw.nix
index fc20ef7c..e567c37d 100644
--- a/hosts/sif/hw.nix
+++ b/hosts/sif/hw.nix
@@ -8,15 +8,28 @@
         options = [ "fmask=0033" "dmask=0022" ];
       };
     "/.bcachefs" =
-      { device = "/dev/mapper/sif-nvm0:/dev/mapper/sif-nvm1";
+      { options = [
+          "x-systemd.requires=/dev/disk/by-id/dm-name-sif-nvm0"
+          "x-systemd.requires=/dev/disk/by-id/dm-name-sif-nvm1"
+        ];
+        device = "/dev/disk/by-uuid/fe7bdaac-d2f3-4535-a635-e2fb97ef3802";
         fsType = "bcachefs";
         neededForBoot = true;
       };
     "/var/lib/sops-nix".neededForBoot = true;
     "/var/lib/systemd".neededForBoot = true;
   };
-  system.etc.overlay.enable = false;
-  systemd.sysusers.enable = false;
+  swapDevices = [
+    { label = "swap"; }
+  ];
+  # system.etc.overlay.enable = false;
+
+  boot.initrd.systemd.packages = [
+    (pkgs.writeTextDir "/etc/systemd/system/sysroot-.bcachefs.mount.d/block_scan.conf" ''
+      [Mount]
+      Environment=BCACHEFS_BLOCK_SCAN=1
+    '')
+  ];
 
   # boot.initrd.supportedFilesystems.bcachefs = true;
   # boot.initrd.systemd.units."dev-sif-nvm0:-dev-sif-nvm1.device".enable = false;
diff --git a/hosts/sif/libvirt/default.nix b/hosts/sif/libvirt/default.nix
index d0be7dff..9712d0d9 100644
--- a/hosts/sif/libvirt/default.nix
+++ b/hosts/sif/libvirt/default.nix
@@ -8,6 +8,7 @@ with flakeInputs.nixVirt.lib;
       qemu.swtpm.enable = true;
       allowedBridges = ["virbr0" "rz-0971" "rz-2403"];
     };
+    virtualisation.spiceUSBRedirection.enable = true;
     virtualisation.libvirt = {
       enable = true;
       swtpm.enable = true;
diff --git a/hosts/sif/mail/default.nix b/hosts/sif/mail/default.nix
deleted file mode 100644
index f36cd599..00000000
--- a/hosts/sif/mail/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{ config, pkgs, ... }:
-{
-  services.postfix = {
-    enable = true;
-    enableSmtp = true;
-    enableSubmission = false;
-    setSendmail = true;
-    networksStyle = "host";
-    hostname = "sif.midgard.yggdrasil";
-    destination = [];
-    relayHost = "uucp:ymir";
-    recipientDelimiter = "+";
-    masterConfig = {
-      uucp = {
-        type = "unix";
-        private = true;
-        privileged = true;
-        chroot = false;
-        command = "pipe";
-        args = [ "flags=Fqhu" "user=uucp" ''argv=${config.security.wrapperDir}/uux -z -a $sender - $nexthop!rmail ($recipient)'' ];
-      };
-      smtps = {
-        type = "unix";
-        private = true;
-        privileged = true;
-        chroot = false;
-        command = "smtp";
-        args = [ "-o" "smtp_tls_wrappermode=yes" "-o" "smtp_tls_security_level=encrypt" ];
-      };
-    };
-    config = {
-      default_transport = "uucp:ymir";
-
-      inet_interfaces = "loopback-only";
-
-      authorized_submit_users = ["!uucp" "static:anyone"];
-      message_size_limit = "0";
-
-      sender_dependent_default_transport_maps = ''regexp:${pkgs.writeText "sender_relay" ''
-        /@(cip|stud)\.ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtp.ifi.lmu.de
-        /@ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtpin1.ifi.lmu.de:587
-        /@math(ematik)?\.(lmu|uni-muenchen)\.de$/ smtps:smtp.math.lmu.de:465
-        /@(campus\.)?lmu\.de$/ smtp:postout.lrz.de
-      ''}'';
-      sender_bcc_maps = ''regexp:${pkgs.writeText "sender_bcc" ''
-        /^uni2work(-[^@]*)?@ifi\.lmu\.de$/ uni2work@ifi.lmu.de
-        /@ifi\.lmu\.de$/ gregor.kleen@ifi.lmu.de
-      ''}'';
-
-      smtp_sasl_auth_enable = true;
-      smtp_sender_dependent_authentication = true;
-      smtp_sasl_tls_security_options = "noanonymous";
-      smtp_sasl_mechanism_filter = ["plain"];
-      smtp_sasl_password_maps = "regexp:/var/db/postfix/sasl_passwd";
-      smtp_cname_overrides_servername = false;
-      smtp_always_send_ehlo = true;
-      smtp_tls_security_level = "dane";
-
-      smtp_tls_loglevel = "1";
-      smtp_dns_support_level = "dnssec";
-    };
-  };
-
-  sops.secrets.postfix-sasl-passwd = {
-    key = "sasl-passwd";
-    path = "/var/db/postfix/sasl_passwd";
-    owner = "postfix";
-    sopsFile = ./secrets.yaml;
-  };
-}
diff --git a/hosts/sif/ruleset.nft b/hosts/sif/ruleset.nft
index 2af8b2ee..62339f69 100644
--- a/hosts/sif/ruleset.nft
+++ b/hosts/sif/ruleset.nft
@@ -61,7 +61,7 @@ table inet filter {
   counter mosh-rx {}
   counter wg-rx {}
   counter yggdrasil-gre-rx {}
-  counter quickserve-rx {}
+  counter miniserve-rx {}
   counter ausweisapp2-rx {}
 
   counter established-rx {}
@@ -81,7 +81,7 @@ table inet filter {
   counter mosh-tx {}
   counter wg-tx {}
   counter yggdrasil-gre-tx {}
-  counter quickserve-tx {}
+  counter miniserve-tx {}
 
   counter tx {}
 
@@ -134,7 +134,7 @@ table inet filter {
     tcp dport 22 counter name ssh-rx accept
     udp dport 60000-61000 counter name mosh-rx accept
 
-    tcp dport 8000 counter name quickserve-rx accept
+    tcp dport 8080 counter name miniserve-rx accept
     udp dport 24727 counter name ausweisapp2-rx accept
 
     udp dport 51820-51822 counter name wg-rx accept
@@ -173,7 +173,7 @@ table inet filter {
     udp sport 51820-51822 counter name wg-tx
     iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-tx
 
-    tcp sport 8000 counter name quickserve-tx accept
+    tcp sport 8080 counter name miniserve-tx accept
 
     oifname virbr0 udp sport 67 counter name libvirt-dhcp accept
     oifname virbr0 udp sport 547 counter name libvirt-dhcp accept
diff --git a/hosts/surtr/audiobookshelf.nix b/hosts/surtr/audiobookshelf.nix
new file mode 100644
index 00000000..728851a4
--- /dev/null
+++ b/hosts/surtr/audiobookshelf.nix
@@ -0,0 +1,66 @@
+{ config, ... }:
+
+{
+  config = {
+    security.acme.rfc2136Domains = {
+      "audiobookshelf.yggdrasil.li" = {
+        restartUnits = ["nginx.service"];
+      };
+    };
+
+    services.nginx = {
+      upstreams."audiobookshelf" = {
+        servers = {
+          "[2a03:4000:52:ada:4:1::]:28982" = {};
+        };
+        extraConfig = ''
+          keepalive 8;
+        '';
+      };
+      virtualHosts = {
+        "audiobookshelf.yggdrasil.li" = {
+          kTLS = true;
+          http3 = true;
+          forceSSL = true;
+          sslCertificate = "/run/credentials/nginx.service/audiobookshelf.yggdrasil.li.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/audiobookshelf.yggdrasil.li.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/audiobookshelf.yggdrasil.li.chain.pem";
+          extraConfig = ''
+            charset utf-8;
+          '';
+
+          locations = {
+            "/".extraConfig = ''
+              proxy_pass http://audiobookshelf;
+
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+
+              proxy_redirect off;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Host $server_name;
+              proxy_set_header X-Forwarded-Proto $scheme;
+
+              client_max_body_size 0;
+              proxy_request_buffering off;
+              proxy_buffering off;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.services.nginx = {
+      serviceConfig = {
+        LoadCredential = [
+          "audiobookshelf.yggdrasil.li.key.pem:${config.security.acme.certs."audiobookshelf.yggdrasil.li".directory}/key.pem"
+          "audiobookshelf.yggdrasil.li.pem:${config.security.acme.certs."audiobookshelf.yggdrasil.li".directory}/fullchain.pem"
+          "audiobookshelf.yggdrasil.li.chain.pem:${config.security.acme.certs."audiobookshelf.yggdrasil.li".directory}/chain.pem"
+        ];
+      };
+    };
+  };
+}
diff --git a/hosts/surtr/bifrost/default.nix b/hosts/surtr/bifrost/default.nix
index fbfde757..52ab43f5 100644
--- a/hosts/surtr/bifrost/default.nix
+++ b/hosts/surtr/bifrost/default.nix
@@ -18,7 +18,7 @@ in {
             ListenPort = 51822;
           };
           wireguardPeers = [
-            { AllowedIPs = [ "2a03:4000:52:ada:4:1::/96" ];
+            { AllowedIPs = [ "2a03:4000:52:ada:4:1::/96" "2a03:4000:52:ada:6::/80" ];
               PublicKey = trim (readFile ../../vidhar/network/bifrost/vidhar.pub);
             }
           ];
@@ -34,6 +34,8 @@ in {
           routes = [
             { Destination = "2a03:4000:52:ada:4::/80";
             }
+            { Destination = "2a03:4000:52:ada:6::/80";
+            }
           ];
           linkConfig = {
             RequiredForOnline = false;
diff --git a/hosts/surtr/default.nix b/hosts/surtr/default.nix
index 223e1f10..1c66df2b 100644
--- a/hosts/surtr/default.nix
+++ b/hosts/surtr/default.nix
@@ -6,7 +6,8 @@ with lib;
   imports = with flake.nixosModules.systemProfiles; [
     tmpfs-root qemu-guest openssh rebuild-machines zfs
     ./zfs.nix ./dns ./tls ./http ./bifrost ./matrix ./postgresql
-    ./prometheus ./email ./vpn ./borg.nix ./etebase
+    ./prometheus ./email ./vpn ./borg.nix ./etebase ./immich.nix
+    ./paperless.nix ./hledger.nix ./audiobookshelf.nix ./kimai.nix
   ];
 
   config = {
@@ -14,9 +15,6 @@ with lib;
       system = "x86_64-linux";
     };
 
-    networking.hostId = "a64cf4d7";
-    environment.etc."machine-id".text = "a64cf4d793ab0a0ed3892ead609fc0bc";
-
     boot = {
       loader.grub = {
         enable = true;
@@ -24,12 +22,20 @@ with lib;
         device = "/dev/vda";
       };
 
-
       tmp.useTmpfs = true;
 
       zfs.devNodes = "/dev"; # /dev/vda2 does not show up in /dev/disk/by-id
 
       kernelModules = ["ptp_kvm"];
+      kernelPatches = [
+        { name = "zswap-default";
+          patch = null;
+          structuredExtraConfig = with lib.kernel; {
+            ZSWAP_DEFAULT_ON = yes;
+            ZSWAP_SHRINKER_DEFAULT_ON = yes;
+          };
+        }
+      ];
     };
 
     fileSystems = {
@@ -38,6 +44,9 @@ with lib;
           fsType = "vfat";
         };
     };
+    swapDevices = [
+      { label = "swap"; }
+    ];
 
     networking = {
       hostName = "surtr";
@@ -163,11 +172,6 @@ with lib;
       stateful = true;
     };
 
-    zramSwap = {
-      enable = true;
-      algorithm = "zstd";
-    };
-
     systemd.sysusers.enable = false;
     system.etc.overlay.mutable = true;
     boot.enableContainers = true;
diff --git a/hosts/surtr/dns/Gupfile b/hosts/surtr/dns/Gupfile
index ac96f620..70674cce 100644
--- a/hosts/surtr/dns/Gupfile
+++ b/hosts/surtr/dns/Gupfile
@@ -1,2 +1,2 @@
 key.gup:
-  keys/*.yaml
\ No newline at end of file
+  keys/*
\ No newline at end of file
diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index 53df798e..8aca2b97 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -157,7 +157,7 @@ in {
         ${concatMapStringsSep "\n" mkZone [
           { domain = "yggdrasil.li";
             addACLs = { "yggdrasil.li" = ["ymir_acme_acl"]; };
-            acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "app.etesync.yggdrasil.li"];
+            acmeDomains = ["surtr.yggdrasil.li" "yggdrasil.li" "etesync.yggdrasil.li" "immich.yggdrasil.li" "app.etesync.yggdrasil.li" "paperless.yggdrasil.li" "hledger.yggdrasil.li" "audiobookshelf.yggdrasil.li" "kimai.yggdrasil.li"];
           }
           { domain = "nights.email";
             addACLs = { "nights.email" = ["ymir_acme_acl"]; };
@@ -169,15 +169,9 @@ in {
           { domain = "kleen.li";
             addACLs = { "kleen.li" = ["ymir_acme_acl"]; };
           }
-          { domain = "xmpp.li";
-            addACLs = { "xmpp.li" = ["ymir_acme_acl"]; };
-          }
           { domain = "synapse.li";
             acmeDomains = ["element.synapse.li" "turn.synapse.li" "synapse.li"];
           }
-          { domain = "dirty-haskell.org";
-            addACLs = { "dirty-haskell.org" = ["ymir_acme_acl"]; };
-          }
           { domain = "praseodym.org";
             addACLs = { "praseodym.org" = ["ymir_acme_acl"]; };
           }
diff --git a/hosts/surtr/dns/key.gup b/hosts/surtr/dns/key.gup
index 32d4f7d6..5b5058b3 100644
--- a/hosts/surtr/dns/key.gup
+++ b/hosts/surtr/dns/key.gup
@@ -3,4 +3,4 @@
 keyName=${${2:t}%.yaml}_key
 
 keymgr -t ${keyName} > $1
-sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary --output-type=binary -e -i $1
\ No newline at end of file
+sops --input-type=binary --output-type=binary -e -i $1
diff --git a/hosts/surtr/dns/keys/audiobookshelf.yggdrasil.li_acme b/hosts/surtr/dns/keys/audiobookshelf.yggdrasil.li_acme
new file mode 100644
index 00000000..e3af9966
--- /dev/null
+++ b/hosts/surtr/dns/keys/audiobookshelf.yggdrasil.li_acme
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:5BLk/MZtQsLjpdKGiZjtOH1soIXB05MkEoPWyr5m27ho7H5udDjRZE0/OjvSlMzQNjFNJc+OwbeHwaJ8sPLCnXqoFHJXikAmi0gpdFC0uN0JGYCBT1EaK7j6yVHyiqFXo6xwVSCO/zP/fbjItiuqU+B4llGx5N2I4HQqRLFoW/35PZazkR15xI1zo8LeC8T+jm16apFQw2Ih/RqsJK7XlHqnXq9SzeA2qhgkCbJf6aJ6zDS7eQVFt7qHh2mVtV7Al++bZiIkJiNJ5SJO1ck18w2t9HwXBhfMFKXvfFW0I6kKur1qSJk=,iv:rxm5PwOzXDaK+nj2k3bUqlYbIFFA49ispyfamtQqU/A=,tag:7dOua39f+0JsLldLRLr1NQ==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwV1hIcWNNRVJXOG1xYlFK\nb1VxWG03dGVmS3dmQTltUTR0VmEzYjRFanlBCnE1M1BTZjNCQnpsNkU5ZlR5T3BR\nOHliWUV2bXMrK0w1K3JXbUE0dEhKdzgKLS0tIDdkUEZ4QUE0NUN2TXFYcklybjBS\nRVpxV2J6U1BnUng1dytWTGRkd0FrRGcKVaMCzcrX+BQqbmh95JEk3lRdfnv9uO8n\nwotKxp/+xX7GEF42BOzJ/mWcgyVjABlnWeVyaRxfpbCUrmNuFYO6XA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkZmRFR0gwc1pjVVorK0t6\nVHU4U0xob09Dd2J5QUJXbndZdWp3cytpYWhRCnFnMlZ0cjNGdXN1RWEvQlVHSE1M\nMEdzSjlEb2NkaE1zMEJJOTlCMC9FVFEKLS0tIGJiTEJSRVZZbVUzZVFGeXQwYm1w\ndWVYQVdoVlJnRENTYzhnQm1BcWVRdW8K0ECfLVQBQuZWFFFjdHLcJBz+CDzsOOwh\nOA38qxHD4EWfXR1c3G8RDbow7nB2MGc1Zohc7qhtuTj2wL0qhVKWqA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-09T17:07:16Z",
+                "mac": "ENC[AES256_GCM,data:K5I6YXQXCUPHFBNVlXIdLLKqiNPVZh95KoHni2m16SdAvTyBab79SZ5xNvotrtKXp0iISCogEgdMm+OWbxYywEiZ+sUsxgx6RE5nAXruZOiAwzuyUr88qgCHTBZnKzgaDZlbYOgWB+LCzr8s5JbcTD4G6/RaXYyqmx7igygubHA=,iv:Zbij4eoDqoP5XYhAsDGBGqlcP5ACQAY/QngTmrJYRzs=,tag:WYxhUEZwmXkQmnpyOuP2Bg==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/surtr/dns/keys/hledger.yggdrasil.li_acme b/hosts/surtr/dns/keys/hledger.yggdrasil.li_acme
new file mode 100644
index 00000000..b3f4cfb6
--- /dev/null
+++ b/hosts/surtr/dns/keys/hledger.yggdrasil.li_acme
@@ -0,0 +1,24 @@
+{
+        "data": "ENC[AES256_GCM,data:lCj8VYJL9z29FJ154XQtxKQLwwitCRGy4krJ6u8yw2FMzoHprEpFgm33+mFspxSKk/It2G8cfTGMZSeVkYJEHb66HNKHl0A2Fz3hwjpRjh1MZAw0wiZJlnS/LNqoGstQ2PJmTQTW3aJRMoT1GS7q/gSp/3rqySA5EOm0GgUiA3Vi7nGpkBenKDEbQbcIBXRdMOk66BCdiz5XGm/1VLQQLO9oVwY2KBnLaZSISohyGVhbIy7GT2ygoWHHxHn0c5CRVNvGNwesM1gO1NnTFrISLMWSrsDPaAtQ,iv:fa8LFjzqsf2ccfbEe5MOmerb7FzXb4xr24y1GWIMT1Q=,tag:7oQ54DKBb76Pbw1lmEHt+Q==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzcHJLRHh0VkpDNDU3cGZS\nMWFlVWpFemZ2RnpnSllDWU1EWGoyWUxyejNzClBGandzaFI5NXY1bG51Y3VxRk9r\nc29NbXBOaEZDblBuaVowemQydkxBdjgKLS0tICtVb2xkMmh4T0Q0cU4xQnBzZExI\namFRUnRYTWIyQ3RHNUVHWTFrUzhhK1UKqmATNmxlhkxM5PP1U6w7fSYVA8AgIRAt\nJ9WZrTffQfXMdw4RmjWcoVHFH39Fe4SteedxliCCcqjkjgSEB4Rgow==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjWlhpQWI4c0x0ZXRGYVE2\nR1dHZzZud0ZxQWsrREhJWUowWE1zem5FVFI0CkJBUnIwY1FGS3N2VnpuSkZjRllZ\ncVgyeVg4cTVjRitzL0RKb0ZQb3BsOEkKLS0tIGs3SDBkamVBNDhQUlh5dmVVZXJs\nM3VKdlFKc21GcFY0UUtiaHFvYWI4V0kKKuWYEncxe9NT2ZS3X3+l/gT4BQOrdCg8\nj2jGL+Yzy/356GO3PFTn2HHLam6KWDKaYB5TlK/zSohfUt5giQH2Lw==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-02-19T17:13:51Z",
+                "mac": "ENC[AES256_GCM,data:XsBdMCBjB+YuBMZQrjJ5uZtaYKSqsdWVvm+IEoJflCKPIhPk2rBZ3nY8KngXFbq2fWgsYyTM83kb2trEGIEHUPuERt+mgfCI3bSlylriwgsDWihCjyBecNE+BbdXE0+YcNl8pIwBU4M+3f2StQMH22YamToLJ9i9kfKcBrirDuU=,iv:VTIdBVY3kVBMYWhYUmrP2vZ9rpH90DzF68y1aDf2EAs=,tag:YkL+nw6LNXAceZtx9vgf6A==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.4"
+        }
+}
\ No newline at end of file
diff --git a/hosts/surtr/dns/keys/immich.yggdrasil.li_acme b/hosts/surtr/dns/keys/immich.yggdrasil.li_acme
new file mode 100644
index 00000000..c31234bd
--- /dev/null
+++ b/hosts/surtr/dns/keys/immich.yggdrasil.li_acme
@@ -0,0 +1,24 @@
+{
+        "data": "ENC[AES256_GCM,data:1i27jx1E4nn8/iXEN90tnQve0MX0HcXyYZoQfga1djcESDARd7kX78jncqnSdEMJPIQCyq2zmvOwEiAwyofIjSBSW2teoxD1PybSZdyvKwOnwLqpVWxgw6LORUoN5c1y4+WmnQa1SJ0a1WJwZ3cFRa3LP5JPbZzmNCZWEg+yGwVHNMsmrBSrjLRFC1NPIfX69lWGZl5VIMw2/SoSMDcOsSURWIpVSEYe9LNrc4/cKQQC/rmpXBg9ekIa8xd7NQTcDZA42bDIBQxJzqkUNV3JeIrl0C+eQw==,iv:MEDhvUvy0PfcLGim06VXkiIGgkNgaQcYqGhJraaGC6M=,tag:43CdGFe5JXOsMCHrvgl+BA==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLOU5OL0xxVVE2dzVOYnhP\nMUlhYlpyZGZSamU4QkpObHJLS1NJdjdwcmtjCks0OElnaHZvb3BSNnYySnVPcEUx\nazdNVUpZZGRNOVNBVTVUNUdnaC9DM00KLS0tIHUxU2dHMCt4d3hJbXlSNzBKUk1W\na05uZVRwVlMrbEZ2WEkvUy9PUVhmWXcKemRLnCC2mAkCEbZ3bC+iZmIWQCQsI+ew\ni4mmc/mUkGx8/61SR571NXIKmxSx2U5L2IK1pIKy6G/xMkPq+wDgUQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5VnNUV2lRR292ZmpNeU51\nQ2YxcnVnd21ybGdpd0I1QlJuSEQwNGZYTDJrCml0YUdxaWJHTEFNYWVIY01jWGk2\nZEJSQ0VZcVV1bU9VZ3dBbUh3a0N1ekUKLS0tIFhvNnRqcnRUZFNYOVhuWkFrZ3Vk\nMjU0YnNDODJRYk9lVENLUU9KU2dkWm8KHqtuNtC39S4oiQFRhNT2OOUOY9KQvDYW\nvtcdR8MSZDE7jsqgLgGS/8lIc0GBbIwYWghgFsLmn2Bkdh2q/VuO9w==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-01-03T15:31:39Z",
+                "mac": "ENC[AES256_GCM,data:NKUbtcQf2DfALfm9kwiirmwD3slfTh4HNIg8BT/xbySHfwsaFtmlZTkhavBNr+b5snR8opATVXnJPAoykxXq8q4G1yDeitnTw6x9KfwgyZKpbJANMTBZEwK+CnZbqYRas1bFC88+D0yWI1yUnle+NPQ8VUj+KxCiUNuWO80mWhE=,iv:2a7CawUQujcZuR1pmsm9L2KGKcrBRAOxiIWEKCkTCEM=,tag:j8caxyN2fvx2FnWXHkWKcw==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.2"
+        }
+}
\ No newline at end of file
diff --git a/hosts/surtr/dns/keys/kimai.yggdrasil.li_acme b/hosts/surtr/dns/keys/kimai.yggdrasil.li_acme
new file mode 100644
index 00000000..bdfb135a
--- /dev/null
+++ b/hosts/surtr/dns/keys/kimai.yggdrasil.li_acme
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:sKFt4pH0Xn7Qm6JFMg/2N7Ht7jtMJukfN+U3dQaoYXPbhRJ+heEtDpXV/WP4AlfbfpIOgTPW3mcmQCwKFNhS00vEsQA4728FfXZzDDmZCa3hwg51wDbL7XUOr0OePgzi86lt0Q193K6CkGqEAa1vFIb//ElEfBYIwdATbmcoAsM3mHhz58X7c1qf8LNuB93o/1N2xXXZI3NWOhOjlviTc2DAhffXDwlMJSYUhldnwtDKmLM1mooJzLgm2p9w7gRD7WPqEqZFq9uFDK69P9uX5T9hFHg=,iv:rAE4sYxxLou4tyD4RWTp3LjQP0cya95coy1MvwfEK/U=,tag:u4SSk8SZFlj0ks7d6tDocw==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2KzdNUWhEcDB6QmtUTnVh\nNS9Nc2I4UjAzekxhRXo1UmY3SklPejV1TURJCm9NY2lVOERoMDFKTU56Mmh1NHEr\naGV4M1RoVldHV0xyc3Z0MnVqakpjMFUKLS0tIEYxSk9OUm9kMkdtcG5POWRGQVkx\nY1FEaXYwMGo0L0Z0aTVTZDA5aUFDWEUKJ+e/7lR/rNPNVnIy+wkiKiAYMxWp4L7q\nwnSTx451vSnxv9j3JWB43Y7XQC08cisWDj06ULw8FnEbKYOvTYj9mQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwOTU3dUEzaXM5T1VkbDRO\nMm14OG1mUkk2bDRhdnBsMHBkc3kvUzlyNlQwCktFSHJhMnhoQ2J6bC9vUHNLWTRC\nRFpYeHo3N2xjWUhjQnRwQ2Nrc1pRUmsKLS0tIDdPeFBVdkxDd1JWSmcxQ0tLMTBD\ncHU3VExZOUhYUlJvbGNoK3FMK2VIbGMKFk94P9aBY04CPIi983f3Aalgh4fnU+/K\n2mxawSMf9jz8704N5XJfmr2hwNy8hqLIn8bjsEMAPTfE1YBGga4w0g==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-24T09:42:23Z",
+                "mac": "ENC[AES256_GCM,data:diCeJGvBmM0Ng722eKoFwDe7pqZrdLPSLn5j9LfdaFI64BAbSbA5bAq4NFXqdJ1vttarD2A5rEafYoXUxP8228x2GhNyWUGW5AWgBjVPUc59gjs4wYKR5HlkVMIadhTwNheEyoEjrxX40GNBgCG7X3ocOtOYKbKECp433gdAPDg=,iv:d+yJMWj2RyFnveo2ZNrpNeV+amXM+H7vdC0A2F7mwjA=,tag:yjibG2iusdprp0ORghYWhw==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/surtr/dns/keys/paperless.yggdrasil.li_acme b/hosts/surtr/dns/keys/paperless.yggdrasil.li_acme
new file mode 100644
index 00000000..bc4640db
--- /dev/null
+++ b/hosts/surtr/dns/keys/paperless.yggdrasil.li_acme
@@ -0,0 +1,24 @@
+{
+        "data": "ENC[AES256_GCM,data:wOl8KLHD0H+btq0A3UreyVF9bOXZsiTwWJkVH8GubyIQDyiDC8vQm+dfv0rz8TwcBWYpC4aMIPPflG2HsdYO4rKGQ/nBmWmxhNXjpnyRo8iKM1BGb5bxNe4eVcUVhI60NuRJDRLmtDp+0rYGT/MVYp0/mHBINsQCXWBPDoaN2PI2GSnRag/x0wcL27xgH6NDd8glcdCN5nCAPDvazA3LialkXXv7/cceA5Q/Ee6HGzPP0w212/UvBm07Z5tXnHiy5cTbAGTUBfIqC8n501jtaQhpMh/yzA1R8KwUrw==,iv:bLzsthCaanNikNS2Es4J1++E5lijEbjyW5hU4zzNBcg=,tag:eWfZ3AtcSAGv8jWXzqlAwQ==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNYWZKOHd2UmxWYVlIamk4\nZ04zQnAwcDdsSDBDWUZnekNva3BzRERyWXljCmNvUU1Fczc2aUN6VGl6NEJ6MGIx\nWHVpeVluWnRnbjNadGxkSmYyNE1rZzQKLS0tIGpkYVZQRDJGS21ZZHdlRk1MMm02\nQ09aanNXSWltNi9QeUNtUVQ2UEZybmMK6/qcNYLMcyKTmtROX+ZsRqDxMXwkXiAV\ndsdsWJ5+zSJuK5SEIh0fqEZ/t4pxnMcr1WieETgLSd+w0sNQS7EKPQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByRjdJOHdjamRHVjlZOTNV\nbTBuam5vNERIWTB6T0JkR2pLUnlQN1BGbUJNClhrZ2hPRWZtT3BERFNwdmNEMmVu\nT0dxcjNkNGIvMVJQWENoUmRhTGd6SXcKLS0tIDV6WDd1bks4K1VuVkgybjdMd0w0\nMHBsT3FmOWU0WnJsM2diQm1sTU1ON2MKtf5HZ0S1cLMx98vDKRKamS7aHIJZ0OnA\nzH4VoeVm+PKsOeqVfY+gMHLdaMEWLKYsz3B8bxIoL5pvnCdT1QAN2A==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-02-13T19:23:42Z",
+                "mac": "ENC[AES256_GCM,data:o7zNTjkohzAouYpJUGqf8DUfYf4/g3GZgc+4cf+PjI0OF8uc1WDCPvliBFe6pf/8QMhV5DFWd2SfszWnpnQhtiIVG/2BEk5sw3P6r/SUbSErakFYHueVQKp+9rdxK6uKcHUYhO46E332AwIxTuvNeHtSBMxx0kAwQPuuD/u3L4A=,iv:aiM0sGyGMk5lfBOpB2bDFCY+UfWwyUNixieww6eOSLs=,tag:MI7xJ7RsyZgQfF1SBVVmcQ==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.4"
+        }
+}
\ No newline at end of file
diff --git a/hosts/surtr/dns/zones/email.nights.soa b/hosts/surtr/dns/zones/email.nights.soa
index 913a88d4..34209a99 100644
--- a/hosts/surtr/dns/zones/email.nights.soa
+++ b/hosts/surtr/dns/zones/email.nights.soa
@@ -1,7 +1,7 @@
 $ORIGIN nights.email.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
+  2025060700 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -27,11 +27,7 @@ $TTL 3600
 
 _acme-challenge         IN      NS      ns.yggdrasil.li.
 
-ymir._domainkey         IN      TXT     ( 
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
+ymir._domainkey         IN      CNAME   ymir._domainkey.yggdrasil.li.
 
 _xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
 _xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
diff --git a/hosts/surtr/dns/zones/li.141.soa b/hosts/surtr/dns/zones/li.141.soa
index d42b4719..78d137bb 100644
--- a/hosts/surtr/dns/zones/li.141.soa
+++ b/hosts/surtr/dns/zones/li.141.soa
@@ -1,7 +1,7 @@
 $ORIGIN 141.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2024102100 ; serial
+  2025060701 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -45,11 +45,8 @@ ymir                    IN      AAAA    2a03:4000:6:d004::
 ymir                    IN      MX      0 ymir.yggdrasil.li
 ymir                    IN      TXT     "v=spf1 redirect=ymir.yggdrasil.li"
 
-ymir._domainkey         IN      TXT     ( 
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
+ymir._domainkey         IN      CNAME   ymir._domainkey.yggdrasil.li.
+surtr._domainkey        IN      CNAME   surtr._domainkey.yggdrasil.li.
 
 _xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
 _xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
@@ -59,5 +56,3 @@ _infinoted._tcp         IN      SRV     5 0 6523 ymir.yggdrasil.li.
 _submission._tcp        IN      SRV     5 0 25 ymir.yggdrasil.li.
 _imap._tcp              IN      SRV     5 0 143 ymir.yggdrasil.li.
 _imaps._tcp             IN      SRV     5 0 993 ymir.yggdrasil.li.
-
-_factorio._udp          IN      SRV     5 0 34197 game01.yggdrasil.li.
diff --git a/hosts/surtr/dns/zones/li.kleen.soa b/hosts/surtr/dns/zones/li.kleen.soa
index a1c7d35a..5dd3e697 100644
--- a/hosts/surtr/dns/zones/li.kleen.soa
+++ b/hosts/surtr/dns/zones/li.kleen.soa
@@ -1,7 +1,7 @@
 $ORIGIN kleen.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
+  2025060701 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -27,11 +27,8 @@ $TTL 3600
 
 _acme-challenge         IN      NS      ns.yggdrasil.li.
 
-ymir._domainkey         IN      TXT     ( 
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
+ymir._domainkey         IN      CNAME   ymir._domainkey.yggdrasil.li.
+surtr._domainkey        IN      CNAME   surtr._domainkey.yggdrasil.li.
 
 _xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
 _xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
diff --git a/hosts/surtr/dns/zones/li.synapse.soa b/hosts/surtr/dns/zones/li.synapse.soa
index 086d4a85..247cf025 100644
--- a/hosts/surtr/dns/zones/li.synapse.soa
+++ b/hosts/surtr/dns/zones/li.synapse.soa
@@ -1,7 +1,7 @@
 $ORIGIN synapse.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023092100 ; serial
+  2025060701 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
diff --git a/hosts/surtr/dns/zones/li.xmpp.soa b/hosts/surtr/dns/zones/li.xmpp.soa
deleted file mode 100644
index a9e98fb4..00000000
--- a/hosts/surtr/dns/zones/li.xmpp.soa
+++ /dev/null
@@ -1,43 +0,0 @@
-$ORIGIN xmpp.li.
-$TTL 3600
-@ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
-  10800      ; refresh
-  3600       ; retry
-  604800     ; expire
-  3600       ; min TTL
-)
-                        IN      NS      ns.yggdrasil.li.
-                        IN      NS      ns.inwx.de.
-                        IN      NS      ns2.inwx.de.
-                        IN      NS      ns3.inwx.eu.
-
-@                       IN      CAA     128 issue "letsencrypt.org; validationmethods=dns-01"
-@                       IN      CAA     128 iodef "mailto:caa@yggdrasil.li"
-
-@                       IN      A       188.68.51.254
-@                       IN      AAAA    2a03:4000:6:d004::
-@                       IN      MX      0 ymir.yggdrasil.li.
-@                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
-
-*                       IN      A       188.68.51.254
-*                       IN      AAAA    2a03:4000:6:d004::
-*                       IN      MX      0 ymir.yggdrasil.li.
-*                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
-
-_acme-challenge         IN      NS      ns.yggdrasil.li.
-
-ymir._domainkey         IN      TXT     ( 
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
-
-_xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
-_xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
-
-_infinoted._tcp         IN      SRV     5 0 6523 ymir.yggdrasil.li.
-
-_submission._tcp        IN      SRV     5 0 25 ymir.yggdrasil.li.
-_imap._tcp              IN      SRV     5 0 143 ymir.yggdrasil.li.
-_imaps._tcp             IN      SRV     5 0 993 ymir.yggdrasil.li.
diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa
index 092d23ec..500194ae 100644
--- a/hosts/surtr/dns/zones/li.yggdrasil.soa
+++ b/hosts/surtr/dns/zones/li.yggdrasil.soa
@@ -1,7 +1,7 @@
 $ORIGIN yggdrasil.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2024102100 ; serial
+  2025060700 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -69,12 +69,54 @@ _acme-challenge.app.etesync IN	NS	ns.yggdrasil.li.
 
 app.etesync             IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
 
+immich                 IN      A       202.61.241.61
+immich                 IN      AAAA    2a03:4000:52:ada::
+immich                 IN      MX      0 surtr.yggdrasil.li
+immich                 IN      TXT     "v=spf1 redirect=surtr.yggdrasil.li"
+_acme-challenge.immich  IN      NS      ns.yggdrasil.li.
+
+immich                  IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
+
+paperless                 IN      A       202.61.241.61
+paperless                 IN      AAAA    2a03:4000:52:ada::
+paperless                 IN      MX      0 surtr.yggdrasil.li
+paperless                 IN      TXT     "v=spf1 redirect=surtr.yggdrasil.li"
+_acme-challenge.paperless       IN      NS      ns.yggdrasil.li.
+
+paperless                       IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
+
+hledger                 IN      A       202.61.241.61
+hledger                 IN      AAAA    2a03:4000:52:ada::
+hledger                 IN      MX      0 surtr.yggdrasil.li
+hledger                 IN      TXT     "v=spf1 redirect=surtr.yggdrasil.li"
+_acme-challenge.hledger IN      NS      ns.yggdrasil.li.
+
+hledger                 IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
+
+audiobookshelf                 IN      A       202.61.241.61
+audiobookshelf                 IN      AAAA    2a03:4000:52:ada::
+audiobookshelf                 IN      MX      0 surtr.yggdrasil.li
+audiobookshelf                 IN      TXT     "v=spf1 redirect=surtr.yggdrasil.li"
+_acme-challenge.audiobookshelf  IN      NS      ns.yggdrasil.li.
+
+audiobookshelf                  IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
+
+kimai                 IN      A       202.61.241.61
+kimai                 IN      AAAA    2a03:4000:52:ada::
+kimai                 IN      MX      0 surtr.yggdrasil.li
+kimai                 IN      TXT     "v=spf1 redirect=surtr.yggdrasil.li"
+_acme-challenge.kimai   IN      NS      ns.yggdrasil.li.
+
+kimai                   IN      HTTPS   1 . alpn="h2,h3" ipv4hint="202.61.241.61" ipv6hint="2a03:4000:52:ada::"
+
 vidhar                  IN      AAAA    2a03:4000:52:ada:4:1::
 vidhar                  IN      MX      0 ymir.yggdrasil.li
 vidhar                  IN      TXT     "v=spf1 redirect=yggdrasil.li"
 
 mailout                 IN      A       188.68.51.254
 mailout                 IN      AAAA    2a03:4000:6:d004::
+mailout                 IN      A       202.61.241.61
+mailout                 IN      AAAA    2a03:4000:52:ada::
 mailout                 IN      MX      0 ymir.yggdrasil.li
 mailout                 IN      TXT     "v=spf1 redirect=yggdrasil.li"
 
@@ -96,6 +138,3 @@ _infinoted._tcp         IN      SRV     5 0 6523 ymir.yggdrasil.li.
 _submission._tcp        IN      SRV     5 0 25 ymir.yggdrasil.li.
 _imap._tcp              IN      SRV     5 0 143 ymir.yggdrasil.li.
 _imaps._tcp             IN      SRV     5 0 993 ymir.yggdrasil.li.
-
-game01                  IN      A       94.16.107.151
-game01                  IN      AAAA    2a03:4000:50:13d:34ee:a2ff:fed0:328f
diff --git a/hosts/surtr/dns/zones/org.dirty-haskell.soa b/hosts/surtr/dns/zones/org.dirty-haskell.soa
deleted file mode 100644
index 27f0d7f9..00000000
--- a/hosts/surtr/dns/zones/org.dirty-haskell.soa
+++ /dev/null
@@ -1,34 +0,0 @@
-$ORIGIN dirty-haskell.org.
-$TTL 3600
-@ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
-  10800      ; refresh
-  3600       ; retry
-  604800     ; expire
-  3600       ; min TTL
-)
-                        IN      NS      ns.yggdrasil.li.
-                        IN      NS      ns.inwx.de.
-                        IN      NS      ns2.inwx.de.
-                        IN      NS      ns3.inwx.eu.
-
-@                       IN      CAA     128 issue "letsencrypt.org; validationmethods=dns-01"
-@                       IN      CAA     128 iodef "mailto:caa@yggdrasil.li"
-
-@                       IN      A       188.68.51.254
-@                       IN      AAAA    2a03:4000:6:d004::
-@                       IN      MX      10 ymir.yggdrasil.li.
-@                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
-
-*                       IN      A       188.68.51.254
-*                       IN      AAAA    2a03:4000:6:d004::
-*                       IN      MX      0 ymir.yggdrasil.li.
-*                       IN      TXT     "v=spf1 redirect=yggdrasil.li"
-
-_acme-challenge         IN      NS      ns.yggdrasil.li.
-
-ymir._domainkey         IN      TXT     ( 
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
diff --git a/hosts/surtr/dns/zones/org.praseodym.soa b/hosts/surtr/dns/zones/org.praseodym.soa
index df505b4c..2b97ca19 100644
--- a/hosts/surtr/dns/zones/org.praseodym.soa
+++ b/hosts/surtr/dns/zones/org.praseodym.soa
@@ -1,7 +1,7 @@
 $ORIGIN praseodym.org.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. hostmaster.yggdrasil.li (
-  2023013000 ; serial
+  2025060701 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -32,11 +32,8 @@ surtr			IN	AAAA	2a03:4000:52:ada::
 surtr                   IN      MX      0 ymir.yggdrasil.li
 surtr                   IN      TXT     "v=spf1 redirect=yggdrasil.li"
 
-ymir._domainkey         IN      TXT     ( 
-  "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
-  "qzrC0RfN5kLZ9A7Gq2jB09vNxpXHYqABA0bJv88JiZM7hfkp9IafJZ+yCVMaBcJs4DAxnTjNAuFD9gm+qSFVY8+yeXqL6Qjo5PbruhyZRBW8RgRYT8t5n07XRglMGKKGMwOGLanrltcyXqB+GsDZBD36RAAwjFadnxdpDyRv4SgRP7ff2tKRrORYpmpN+mKdqw5j3J/nP6bXV1oAkyh9XQkPEIDi81WT87EZziTElDzVp6A2qFOxqucAovoRk24"
-  "7vlsns1FApFRsp9mja0UZNObyKD1M6tP9Ep7lS76tFGMk+WDvXRJH5LEsyCpu7sSyl1r/O0M4K+KldRCqLlZd7rf8F5P8T0dn1azk05g7F4p0N/y9GNdzXbPZ9u0eZdI7SEdh8ZoOZp7NVZiBFfbWLSS5ZtyA2kbBa4i7GJ/cuAbEKOmqAkeQPiu96TGIcyjkXjS6mTPI+9UmKZYZC+OM8XdJ02y5KRoonCc19ZS8CAwEAAQ=="
-)
+ymir._domainkey         IN      CNAME   ymir._domainkey.yggdrasil.li.
+surtr._domainkey        IN      CNAME   surtr._domainkey.yggdrasil.li.
 
 _xmpp-client._tcp       IN      SRV     5 0 5222 ymir.yggdrasil.li.
 _xmpp-server._tcp       IN      SRV     5 0 5269 ymir.yggdrasil.li.
diff --git a/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py b/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py
index 00182523..7c931559 100644
--- a/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py
+++ b/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py
@@ -28,10 +28,12 @@ class PolicyHandler(StreamRequestHandler):
 
         allowed = False
         user = None
+        relay_eligible = False
         if self.args['sasl_username']:
             user = self.args['sasl_username']
         if self.args['ccert_subject']:
             user = self.args['ccert_subject']
+            relay_eligible = True
 
         if user:
             with self.server.db_pool.connection() as conn:
@@ -44,10 +46,16 @@ class PolicyHandler(StreamRequestHandler):
 
                 with conn.cursor() as cur:
                     cur.row_factory = namedtuple_row
-                    cur.execute('SELECT "mailbox"."mailbox" as "user", "local", "extension", "domain" FROM "mailbox" INNER JOIN "mailbox_mapping" ON "mailbox".id = "mailbox_mapping"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s', params = {'user': user, 'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare=True)
-                    for record in cur:
-                        logger.debug('Received result: %s', record)
-                        allowed = True
+
+                    if relay_eligible:
+                        cur.execute('SELECT EXISTS(SELECT true FROM "mailbox" INNER JOIN "relay_access" ON "mailbox".id = "relay_access"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("domain" = %(domain)s OR %(domain)s ilike CONCAT(\'%%_.\', "domain"))) as "exists"', params = {'user': user, 'domain': domain})
+                        if (row := cur.fetchone()) is not None:
+                            allowed = row.exists
+
+                    if not allowed:
+                        cur.execute('SELECT EXISTS(SELECT true FROM "mailbox" INNER JOIN "mailbox_mapping" ON "mailbox".id = "mailbox_mapping"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s) as "exists"', params = {'user': user, 'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare=True)
+                        if (row := cur.fetchone()) is not None:
+                            allowed = row.exists
 
         action = '550 5.7.0 Sender address not authorized for current user'
         if allowed:
diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index 4196a8bc..a3e06ca6 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, flakeInputs, ... }:
+{ config, pkgs, lib, flake, flakeInputs, ... }:
 
 with lib;
 
@@ -15,7 +15,7 @@ let
 
       for file in $out/pipe/bin/*; do
         wrapProgram $file \
-          --set PATH "${pkgs.coreutils}/bin:${pkgs.rspamd}/bin"
+          --set PATH "${makeBinPath (with pkgs; [coreutils rspamd])}"
       done
     '';
   };
@@ -33,12 +33,28 @@ let
         });
       });
     };
+  internal-policy-server =
+    let
+      workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./internal-policy-server; };
+      pythonSet = flake.lib.pythonSet {
+        inherit pkgs;
+        python = pkgs.python312;
+        overlay = workspace.mkPyprojectOverlay {
+          sourcePreference = "wheel";
+        };
+      };
+      virtualEnv = pythonSet.mkVirtualEnv "internal-policy-server-env" workspace.deps.default;
+    in virtualEnv.overrideAttrs (oldAttrs: {
+      meta = (oldAttrs.meta or {}) // {
+        mainProgram = "internal-policy-server";
+      };
+    });
 
-  nftables-nologin-script = pkgs.writeScript "nftables-mail-nologin" ''
-    #!${pkgs.zsh}/bin/zsh
-
+  nftables-nologin-script = pkgs.resholve.writeScript "nftables-mail-nologin" {
+    inputs = with pkgs; [inetutils nftables gnugrep findutils];
+    interpreter = lib.getExe pkgs.zsh;
+  } ''
     set -e
-    export PATH="${lib.makeBinPath (with pkgs; [inetutils nftables])}:$PATH"
 
     typeset -a as_sets mnt_bys route route6
     as_sets=(${lib.escapeShellArgs config.services.email.nologin.ASSets})
@@ -51,7 +67,7 @@ let
             elif [[ "''${line}" =~ "^route6:\s+(.+)$" ]]; then
                 route6+=($match[1])
             fi
-        done < <(whois -h whois.radb.net "!i''${as_set},1" | egrep -o 'AS[0-9]+' | xargs -- whois -h whois.radb.net -- -i origin)
+        done < <(whois -h whois.radb.net "!i''${as_set},1" | grep -Eo 'AS[0-9]+' | xargs whois -h whois.radb.net -- -i origin)
     done
     for mnt_by in $mnt_bys; do
         while IFS=$'\n' read line; do
@@ -108,19 +124,20 @@ in {
     services.postfix = {
       enable = true;
       enableSmtp = false;
-      hostname = "surtr.yggdrasil.li";
-      recipientDelimiter = "";
       setSendmail = true;
       postmasterAlias = ""; rootAlias = ""; extraAliases = "";
-      destination = [];
-      sslCert = "/run/credentials/postfix.service/surtr.yggdrasil.li.pem";
-      sslKey = "/run/credentials/postfix.service/surtr.yggdrasil.li.key.pem";
-      networks = [];
-      config = let
-        relay_ccert = "texthash:${pkgs.writeText "relay_ccert" ""}";
-      in {
+      settings.main = {
+        recpipient_delimiter = "";
+        mydestination = [];
+        mynetworks = [];
+        myhostname = "surtr.yggdrasil.li";
+
         smtpd_tls_security_level = "may";
 
+        smtpd_tls_chain_files = [
+          "/run/credentials/postfix.service/surtr.yggdrasil.li.full.pem"
+        ];
+
         #the dh params
         smtpd_tls_dh1024_param_file = toString config.security.dhparams.params."postfix-1024".path;
         smtpd_tls_dh512_param_file = toString config.security.dhparams.params."postfix-512".path;
@@ -155,21 +172,14 @@ in {
 
         smtp_tls_connection_reuse = true;
 
-        tls_server_sni_maps = ''texthash:${pkgs.writeText "sni" (
-          concatMapStringsSep "\n\n" (domain:
-            concatMapStringsSep "\n" (subdomain: "${subdomain} /run/credentials/postfix.service/${removePrefix "." subdomain}.full.pem")
-              [domain "mailin.${domain}" "mailsub.${domain}" ".${domain}"]
-          ) emailDomains
-        )}'';
+        tls_server_sni_maps = "inline:{${concatMapStringsSep ", " (domain: "{ ${domain} = /run/credentials/postfix.service/${removePrefix "." domain}.full.pem }") (concatMap (domain: [domain "mailin.${domain}" "mailsub.${domain}" ".${domain}"]) emailDomains)}}";
 
         smtp_tls_policy_maps = "socketmap:unix:${config.services.postfix-mta-sts-resolver.settings.path}:postfix";
 
         local_recipient_maps = "";
 
-        # 10 GiB
-        message_size_limit = "10737418240";
-        # 10 GiB
-        mailbox_size_limit = "10737418240";
+        message_size_limit = 10 * 1024 * 1024 * 1024;
+        mailbox_size_limit = 10 * 1024 * 1024 * 1024;
 
         smtpd_delay_reject = true;
         smtpd_helo_required = true;
@@ -184,25 +194,26 @@ in {
             dbname = email
             query = SELECT action FROM virtual_mailbox_access WHERE lookup = '%s'
           ''}"
-          "check_ccert_access ${relay_ccert}"
           "reject_non_fqdn_helo_hostname"
           "reject_invalid_helo_hostname"
           "reject_unauth_destination"
           "reject_unknown_recipient_domain"
           "reject_unverified_recipient"
+          "check_policy_service unix:/run/postfix-internal-policy.sock"
         ];
         unverified_recipient_reject_code = "550";
         unverified_recipient_reject_reason = "Recipient address lookup failed";
         address_verify_map = "internal:address_verify_map";
         address_verify_positive_expire_time = "1h";
         address_verify_positive_refresh_time = "15m";
-        address_verify_negative_expire_time = "15s";
-        address_verify_negative_refresh_time = "5s";
-        address_verify_cache_cleanup_interval = "5s";
+        address_verify_negative_expire_time = "5m";
+        address_verify_negative_refresh_time = "1m";
+        address_verify_cache_cleanup_interval = "12h";
+        address_verify_poll_count = "\${stress?15}\${stress:30}";
         address_verify_poll_delay = "1s";
+        address_verify_sender_ttl = "30045s";
 
         smtpd_relay_restrictions = [
-          "check_ccert_access ${relay_ccert}"
           "reject_unauth_destination"
         ];
 
@@ -213,7 +224,7 @@ in {
         smtpd_client_event_limit_exceptions = "";
 
         milter_default_action = "accept";
-        smtpd_milters = [config.services.opendkim.socket "local:/run/rspamd/rspamd-milter.sock"];
+        smtpd_milters = [config.services.opendkim.socket "local:/run/rspamd/rspamd-milter.sock" "local:/run/postsrsd/postsrsd-milter.sock"];
         non_smtpd_milters = [config.services.opendkim.socket "local:/run/rspamd/rspamd-milter.sock"];
 
         alias_maps = "";
@@ -235,11 +246,6 @@ in {
           ::/0                silent-discard, dsn
         ''}";
 
-        sender_canonical_maps = "tcp:localhost:${toString config.services.postsrsd.forwardPort}";
-        sender_canonical_classes = "envelope_sender";
-        recipient_canonical_maps = "tcp:localhost:${toString config.services.postsrsd.reversePort}";
-        recipient_canonical_classes = ["envelope_recipient" "header_recipient"];
-
         virtual_mailbox_domains = ''pgsql:${pkgs.writeText "virtual_mailbox_domains.cf" ''
           hosts = postgresql:///email
           dbname = email
@@ -254,13 +260,26 @@ in {
         virtual_transport = "dvlmtp:unix:/run/dovecot-lmtp";
         smtputf8_enable = false;
 
-        authorized_submit_users = "inline:{ root= postfwd= }";
+        authorized_submit_users = "inline:{ root= postfwd= ${config.services.dovecot2.user}= }";
+        authorized_flush_users = "inline:{ root= }";
+        authorized_mailq_users = "inline:{ root= }";
 
         postscreen_access_list = "";
         postscreen_denylist_action = "drop";
         postscreen_greet_action = "enforce";
+
+        sender_bcc_maps = ''pgsql:${pkgs.writeText "sender_bcc_maps.cf" ''
+          hosts = postgresql:///email
+          dbname = email
+          query = SELECT value FROM sender_bcc_maps WHERE key = '%s'
+        ''}'';
+        recipient_bcc_maps = ''pgsql:${pkgs.writeText "recipient_bcc_maps.cf" ''
+          hosts = postgresql:///email
+          dbname = email
+          query = SELECT value FROM recipient_bcc_maps WHERE key = '%s'
+        ''}'';
       };
-      masterConfig = {
+      settings.master = {
         "465" = {
           type = "inet";
           private = false;
@@ -283,7 +302,7 @@ in {
             hosts = postgresql:///email
             dbname = email
             query = SELECT action FROM virtual_mailbox_access WHERE lookup = '%s' OR (lookup = regexp_replace('%s', '\+[^@]*@', '@') AND NOT EXISTS (SELECT 1 FROM virtual_mailbox_access WHERE lookup = '%s'))
-          ''},permit_tls_all_clientcerts,reject}''
+          ''},check_policy_service unix:/run/postfix-internal-policy.sock,permit_tls_all_clientcerts,reject}''
             "-o" "smtpd_relay_restrictions=permit_tls_all_clientcerts,reject"
             "-o" "{smtpd_data_restrictions = check_policy_service unix:/run/postfwd3/postfwd3.sock}"
             "-o" "unverified_sender_reject_code=550"
@@ -313,7 +332,7 @@ in {
             hosts = postgresql:///email
             dbname = email
             query = SELECT action FROM virtual_mailbox_access WHERE lookup = '%s' OR (lookup = regexp_replace('%s', '\+[^@]*@', '@') AND NOT EXISTS (SELECT 1 FROM virtual_mailbox_access WHERE lookup = '%s'))
-          ''},permit_sasl_authenticated,reject}''
+          ''},check_policy_service unix:/run/postfix-internal-policy.sock,permit_sasl_authenticated,reject}''
             "-o" "smtpd_relay_restrictions=permit_sasl_authenticated,reject"
             "-o" "{smtpd_data_restrictions = check_policy_service unix:/run/postfwd3/postfwd3.sock}"
             "-o" "unverified_sender_reject_code=550"
@@ -328,7 +347,10 @@ in {
           maxproc = 0;
           args = [
             "-o" "header_checks=pcre:${pkgs.writeText "header_checks_submission" ''
+              if /^Received: /
+              !/by surtr\.yggdrasil\.li/ STRIP
               /^Received: from [^ ]+ \([^ ]+ [^ ]+\)\s+(.*)$/ REPLACE Received: $1
+              endif
             ''}"
           ];
         };
@@ -364,17 +386,19 @@ in {
 
     services.postsrsd = {
       enable = true;
-      domain = "surtr.yggdrasil.li";
+      domains = [ "surtr.yggdrasil.li" ] ++ concatMap (domain: [".${domain}" domain]) emailDomains;
       separator = "+";
-      excludeDomains = [ "surtr.yggdrasil.li"
-                       ] ++ concatMap (domain: [".${domain}" domain]) emailDomains;
+      extraConfig = ''
+        socketmap = unix:/run/postsrsd/postsrsd-socketmap.sock
+        milter = unix:/run/postsrsd/postsrsd-milter.sock
+      '';
     };
 
     services.opendkim = {
       enable = true;
       user = "postfix"; group = "postfix";
       socket = "local:/run/opendkim/opendkim.sock";
-      domains = ''csl:${concatStringsSep "," (["surtr.yggdrasil.li"] ++ emailDomains)}'';
+      domains = ''csl:${concatStringsSep "," (["surtr.yggdrasil.li" "yggdrasil.li" "141.li" "kleen.li" "synapse.li" "praseodym.org"] ++ emailDomains)}'';
       selector = "surtr";
       configFile = builtins.toFile "opendkim.conf" ''
         Syslog true
@@ -478,32 +502,32 @@ in {
       };
     };
 
-    users.groups.${config.services.rspamd.group}.members = [ config.services.postfix.user "dovecot2" ];
+    users.groups.${config.services.rspamd.group}.members = [ config.services.postfix.user config.services.dovecot2.user ];
 
     services.redis.servers.rspamd.enable = true;
 
     users.groups.${config.services.redis.servers.rspamd.user}.members = [ config.services.rspamd.user ];
 
+    environment.systemPackages = with pkgs; [ dovecot_pigeonhole dovecot_fts_xapian ];
     services.dovecot2 = {
       enable = true;
       enablePAM = false;
-      sslServerCert = "/run/credentials/dovecot2.service/surtr.yggdrasil.li.pem";
-      sslServerKey = "/run/credentials/dovecot2.service/surtr.yggdrasil.li.key.pem";
+      sslServerCert = "/run/credentials/dovecot.service/surtr.yggdrasil.li.pem";
+      sslServerKey = "/run/credentials/dovecot.service/surtr.yggdrasil.li.key.pem";
       sslCACert = toString ./ca/ca.crt;
       mailLocation = "maildir:/var/lib/mail/%u/maildir:UTF-8:INDEX=/var/lib/dovecot/indices/%u";
-      modules = with pkgs; [ dovecot_pigeonhole dovecot_fts_xapian ];
       mailPlugins.globally.enable = [ "fts" "fts_xapian" ];
       protocols = [ "lmtp" "sieve" ];
       sieve = {
-        extensions = ["copy" "imapsieve" "variables" "imap4flags" "vacation"];
-        globalExtensions = ["copy" "imapsieve" "variables" "imap4flags" "vacation"];
+        extensions = ["copy" "imapsieve" "variables" "imap4flags" "vacation" "vacation-seconds" "vnd.dovecot.debug"];
+        globalExtensions = ["copy" "imapsieve" "variables" "imap4flags" "vacation" "vacation-seconds" "vnd.dovecot.debug"];
       };
       extraConfig = let
         dovecotSqlConf = pkgs.writeText "dovecot-sql.conf" ''
           driver = pgsql
           connect = dbname=email
-          password_query = SELECT (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN NULL ELSE "password" END) as password, (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN true WHEN password IS NULL THEN true ELSE NULL END) as nopassword, "user", quota_rule, 'dovecot2' as uid, 'dovecot2' as gid FROM imap_user WHERE "user" = '%n'
-          user_query = SELECT "user", quota_rule, 'dovecot2' as uid, 'dovecot2' as gid FROM imap_user WHERE "user" = '%n'
+          password_query = SELECT (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN NULL ELSE "password" END) as password, (CASE WHEN '%k' = 'valid' AND '%m' = 'EXTERNAL' THEN true WHEN password IS NULL THEN true ELSE NULL END) as nopassword, "user", quota_rule, '${config.services.dovecot2.user}' as uid, '${config.services.dovecot2.group}' as gid FROM imap_user WHERE "user" = '%n'
+          user_query = SELECT "user", quota_rule, '${config.services.dovecot2.user}' as uid, 'dovecot2' as gid FROM imap_user WHERE "user" = '%n'
           iterate_query = SELECT "user" FROM imap_user
         '';
       in ''
@@ -511,16 +535,16 @@ in {
 
         mail_plugins = $mail_plugins quota
 
-        first_valid_uid = ${toString config.users.users.dovecot2.uid}
-        last_valid_uid = ${toString config.users.users.dovecot2.uid}
-        first_valid_gid = ${toString config.users.groups.dovecot2.gid}
-        last_valid_gid = ${toString config.users.groups.dovecot2.gid}
+        first_valid_uid = ${toString config.users.users.${config.services.dovecot2.user}.uid}
+        last_valid_uid = ${toString config.users.users.${config.services.dovecot2.user}.uid}
+        first_valid_gid = ${toString config.users.groups.${config.services.dovecot2.group}.gid}
+        last_valid_gid = ${toString config.users.groups.${config.services.dovecot2.group}.gid}
 
         ${concatMapStringsSep "\n\n" (domain:
           concatMapStringsSep "\n" (subdomain: ''
             local_name ${subdomain} {
-              ssl_cert = </run/credentials/dovecot2.service/${subdomain}.pem
-              ssl_key = </run/credentials/dovecot2.service/${subdomain}.key.pem
+              ssl_cert = </run/credentials/dovecot.service/${subdomain}.pem
+              ssl_key = </run/credentials/dovecot.service/${subdomain}.key.pem
             }
           '') ["imap.${domain}" domain]
         ) emailDomains}
@@ -541,10 +565,10 @@ in {
         auth_debug = yes
 
         service auth {
-          user = dovecot2
+          user = ${config.services.dovecot2.user}
         }
         service auth-worker {
-          user = dovecot2
+          user = ${config.services.dovecot2.user}
         }
 
         userdb {
@@ -565,7 +589,7 @@ in {
             args = ${pkgs.writeText "dovecot-sql.conf" ''
               driver = pgsql
               connect = dbname=email
-              user_query = SELECT DISTINCT ON (extension IS NULL, local IS NULL) "user", quota_rule, 'dovecot2' as uid, 'dovecot2' as gid FROM lmtp_mapping WHERE CASE WHEN extension IS NOT NULL AND local IS NOT NULL THEN ('%n' :: citext) = local || '+' || extension AND domain = ('%d' :: citext) WHEN local IS NOT NULL THEN (local = ('%n' :: citext) OR ('%n' :: citext) ILIKE local || '+%%') AND domain = ('%d' :: citext) WHEN extension IS NOT NULL THEN ('%n' :: citext) ILIKE '%%+' || extension AND domain = ('%d' :: citext) ELSE domain = ('%d' :: citext) END ORDER BY (extension IS NULL) ASC, (local IS NULL) ASC
+              user_query = SELECT DISTINCT ON (extension IS NULL, local IS NULL) "user", quota_rule, '${config.services.dovecot2.user}' as uid, '${config.services.dovecot2.group}' as gid FROM lmtp_mapping WHERE CASE WHEN extension IS NOT NULL AND local IS NOT NULL THEN ('%n' :: citext) = local || '+' || extension AND domain = ('%d' :: citext) WHEN local IS NOT NULL THEN (local = ('%n' :: citext) OR ('%n' :: citext) ILIKE local || '+%%') AND domain = ('%d' :: citext) WHEN extension IS NOT NULL THEN ('%n' :: citext) ILIKE '%%+' || extension AND domain = ('%d' :: citext) ELSE domain = ('%d' :: citext) END ORDER BY (extension IS NULL) ASC, (local IS NULL) ASC
             ''}
 
             skip = never
@@ -635,7 +659,7 @@ in {
           quota_status_success = DUNNO
           quota_status_nouser = DUNNO
           quota_grace = 10%%
-          quota_max_mail_size = ${config.services.postfix.config.message_size_limit}
+          quota_max_mail_size = ${toString config.services.postfix.settings.main.message_size_limit}
           quota_vsizes = yes
         }
 
@@ -673,7 +697,7 @@ in {
         plugin {
           plugin = fts fts_xapian
           fts = xapian
-          fts_xapian = partial=2 full=20 attachments=1 verbose=1
+          fts_xapian = partial=3 full=20 attachments=1 verbose=1
 
           fts_autoindex = yes
 
@@ -688,12 +712,12 @@ in {
 
     systemd.services.dovecot-fts-xapian-optimize = {
       description = "Optimize dovecot indices for fts_xapian";
-      requisite = [ "dovecot2.service" ];
-      after = [ "dovecot2.service" ];
+      requisite = [ "dovecot.service" ];
+      after = [ "dovecot.service" ];
       startAt = "*-*-* 22:00:00 Europe/Berlin";
       serviceConfig = {
         Type = "oneshot";
-        ExecStart = "${pkgs.dovecot}/bin/doveadm fts optimize -A";
+        ExecStart = "${getExe' pkgs.dovecot "doveadm"} fts optimize -A";
         PrivateDevices = true;
         PrivateNetwork = true;
         ProtectKernelTunables = true;
@@ -754,31 +778,29 @@ in {
 
     security.acme.rfc2136Domains = {
       "surtr.yggdrasil.li" = {
-        restartUnits = [ "postfix.service" "dovecot2.service" ];
+        restartUnits = [ "postfix.service" "dovecot.service" ];
       };
     } // listToAttrs (map (domain: nameValuePair "spm.${domain}" { restartUnits = ["nginx.service"]; }) spmDomains)
     // listToAttrs (concatMap (domain: [
-      (nameValuePair domain { restartUnits = ["postfix.service" "dovecot2.service"]; })
+      (nameValuePair domain { restartUnits = ["postfix.service" "dovecot.service"]; })
       (nameValuePair "mailin.${domain}" { restartUnits = ["postfix.service"]; })
       (nameValuePair "mailsub.${domain}" { restartUnits = ["postfix.service"]; })
-      (nameValuePair "imap.${domain}" { restartUnits = ["dovecot2.service"]; })
+      (nameValuePair "imap.${domain}" { restartUnits = ["dovecot.service"]; })
       (nameValuePair "mta-sts.${domain}" { restartUnits = ["nginx.service"]; })
     ]) emailDomains);
 
     systemd.services.postfix = {
-      serviceConfig.LoadCredential = [
-        "surtr.yggdrasil.li.key.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/key.pem"
-        "surtr.yggdrasil.li.pem:${config.security.acme.certs."surtr.yggdrasil.li".directory}/fullchain.pem"
-      ] ++ concatMap (domain:
-        map (subdomain: "${subdomain}.full.pem:${config.security.acme.certs.${subdomain}.directory}/full.pem")
-          [domain "mailin.${domain}" "mailsub.${domain}"]
-      ) emailDomains;
+      serviceConfig.LoadCredential = let
+        tlsCredential = domain: "${domain}.full.pem:${config.security.acme.certs.${domain}.directory}/full.pem";
+      in [
+        (tlsCredential "surtr.yggdrasil.li")
+      ] ++ concatMap (domain: map tlsCredential [domain "mailin.${domain}" "mailsub.${domain}"]) emailDomains;
     };
 
-    systemd.services.dovecot2 = {
+    systemd.services.dovecot = {
       preStart = ''
         for f in /etc/dovecot/sieve_flag.d/*.sieve /etc/dovecot/sieve_before.d/*.sieve; do
-          ${pkgs.dovecot_pigeonhole}/bin/sievec $f
+          ${getExe' pkgs.dovecot_pigeonhole "sievec"} $f
         done
       '';
 
@@ -845,15 +867,16 @@ in {
               charset utf-8;
               source_charset utf-8;
             '';
-            root = pkgs.runCommand "mta-sts.${domain}" {} ''
-              mkdir -p $out/.well-known
-              cp ${pkgs.writeText "mta-sts.${domain}.txt" ''
+            root = pkgs.writeTextFile {
+              name = "mta-sts.${domain}";
+              destination = "/.well-known/mta-sts.txt";
+              text = ''
                 version: STSv1
                 mode: enforce
                 max_age: 2419200
                 mx: mailin.${domain}
-              ''} $out/.well-known/mta-sts.txt
-            '';
+              '';
+            };
           };
       }) emailDomains);
     };
@@ -870,7 +893,7 @@ in {
     systemd.services.spm = {
       serviceConfig = {
         Type = "notify";
-        ExecStart = "${pkgs.spm}/bin/spm-server";
+        ExecStart = getExe' pkgs.spm "spm-server";
         User = "spm";
         Group = "spm";
 
@@ -928,7 +951,7 @@ in {
       serviceConfig = {
         Type = "notify";
 
-        ExecStart = "${ccert-policy-server}/bin/ccert-policy-server";
+        ExecStart = getExe' ccert-policy-server "ccert-policy-server";
 
         Environment = [
           "PGDATABASE=email"
@@ -961,6 +984,53 @@ in {
     };
     users.groups."postfix-ccert-sender-policy" = {};
 
+    systemd.sockets."postfix-internal-policy" = {
+      requiredBy = ["postfix.service"];
+      wants = ["postfix-internal-policy.service"];
+      socketConfig = {
+        ListenStream = "/run/postfix-internal-policy.sock";
+      };
+    };
+    systemd.services."postfix-internal-policy" = {
+      after = [ "postgresql.service" ];
+      bindsTo = [ "postgresql.service" ];
+
+      serviceConfig = {
+        Type = "notify";
+
+        ExecStart = lib.getExe internal-policy-server;
+
+        Environment = [
+          "PGDATABASE=email"
+        ];
+
+        DynamicUser = false;
+        User = "postfix-internal-policy";
+        Group = "postfix-internal-policy";
+        ProtectSystem = "strict";
+        SystemCallFilter = "@system-service";
+        NoNewPrivileges = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        RestrictSUIDSGID = true;
+        KeyringMode = "private";
+        ProtectClock = true;
+        RestrictRealtime = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectHostname = true;
+        ReadWritePaths = ["/run/postgresql"];
+      };
+    };
+    users.users."postfix-internal-policy" = {
+      isSystemUser = true;
+      group = "postfix-internal-policy";
+    };
+    users.groups."postfix-internal-policy" = {};
+
     services.postfwd = {
       enable = true;
       cache = false;
diff --git a/hosts/surtr/email/internal-policy-server/.envrc b/hosts/surtr/email/internal-policy-server/.envrc
new file mode 100644
index 00000000..2c909235
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/.envrc
@@ -0,0 +1,4 @@
+use flake
+
+[[ -d ".venv" ]] || ( uv venv && uv sync )
+. .venv/bin/activate
diff --git a/hosts/surtr/email/internal-policy-server/.gitignore b/hosts/surtr/email/internal-policy-server/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/hosts/surtr/email/internal-policy-server/internal_policy_server/__init__.py b/hosts/surtr/email/internal-policy-server/internal_policy_server/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/internal_policy_server/__init__.py
diff --git a/hosts/surtr/email/internal-policy-server/internal_policy_server/__main__.py b/hosts/surtr/email/internal-policy-server/internal_policy_server/__main__.py
new file mode 100644
index 00000000..04f1a59a
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/internal_policy_server/__main__.py
@@ -0,0 +1,106 @@
+from systemd.daemon import listen_fds
+from sdnotify import SystemdNotifier
+from socketserver import StreamRequestHandler, ThreadingMixIn
+from systemd_socketserver import SystemdSocketServer
+import sys
+from threading import Thread
+from psycopg_pool import ConnectionPool
+from psycopg.rows import namedtuple_row
+
+import logging
+
+
+class PolicyHandler(StreamRequestHandler):
+    def handle(self):
+        logger.debug('Handling new connection...')
+
+        self.args = dict()
+
+        line = None
+        while line := self.rfile.readline().removesuffix(b'\n'):
+            if b'=' not in line:
+                break
+
+            key, val = line.split(sep=b'=', maxsplit=1)
+            self.args[key.decode()] = val.decode()
+
+        logger.info('Connection parameters: %s', self.args)
+
+        allowed = False
+        user = None
+        if self.args['sasl_username']:
+            user = self.args['sasl_username']
+        if self.args['ccert_subject']:
+            user = self.args['ccert_subject']
+
+        with self.server.db_pool.connection() as conn:
+            local, domain = self.args['recipient'].split(sep='@', maxsplit=1)
+            extension = None
+            if '+' in local:
+                local, extension = local.split(sep='+', maxsplit=1)
+
+            logger.debug('Parsed recipient address: %s', {'local': local, 'extension': extension, 'domain': domain})
+
+            with conn.cursor() as cur:
+                cur.row_factory = namedtuple_row
+                cur.execute('SELECT id, internal FROM "mailbox_mapping" WHERE ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s', params = {'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare = True)
+                if (row := cur.fetchone()) is not None:
+                    if not row.internal:
+                        logger.debug('Recipient mailbox is not internal')
+                        allowed = True
+                    elif user:
+                        cur.execute('SELECT EXISTS(SELECT true FROM "mailbox_mapping_access" INNER JOIN "mailbox" ON "mailbox".id = "mailbox_mapping_access"."mailbox" WHERE mailbox_mapping = %(mailbox_mapping)s AND "mailbox"."mailbox" = %(user)s) as "exists"', params = { 'mailbox_mapping': row.id, 'user': user }, prepare = True)
+                        if (row := cur.fetchone()) is not None:
+                            allowed = row.exists
+                else:
+                    logger.debug('Recipient is not local')
+                    allowed = True
+
+        action = '550 5.7.0 Recipient mailbox mapping not authorized for current user'
+        if allowed:
+            action = 'DUNNO'
+
+        logger.info('Reached verdict: %s', {'allowed': allowed, 'action': action})
+        self.wfile.write(f'action={action}\n\n'.encode())
+
+class ThreadedSystemdSocketServer(ThreadingMixIn, SystemdSocketServer):
+    def __init__(self, fd, RequestHandlerClass):
+        super().__init__(fd, RequestHandlerClass)
+
+        self.db_pool = ConnectionPool(min_size=1)
+        self.db_pool.wait()
+
+def main():
+    global logger
+    logger = logging.getLogger(__name__)
+    console_handler = logging.StreamHandler()
+    console_handler.setFormatter( logging.Formatter('[%(levelname)s](%(name)s): %(message)s') )
+    if sys.stderr.isatty():
+        console_handler.setFormatter( logging.Formatter('%(asctime)s [%(levelname)s](%(name)s): %(message)s') )
+    logger.addHandler(console_handler)
+    logger.setLevel(logging.DEBUG)
+
+    # log uncaught exceptions
+    def log_exceptions(type, value, tb):
+        global logger
+
+        logger.error(value)
+        sys.__excepthook__(type, value, tb) # calls default excepthook
+
+    sys.excepthook = log_exceptions
+
+    fds = listen_fds()
+    servers = [ThreadedSystemdSocketServer(fd, PolicyHandler) for fd in fds]
+
+    if servers:
+        for server in servers:
+            Thread(name=f'Server for fd{server.fileno()}', target=server.serve_forever).start()
+    else:
+        return 2
+
+    SystemdNotifier().notify('READY=1')
+
+    return 0
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/hosts/surtr/email/internal-policy-server/pyproject.toml b/hosts/surtr/email/internal-policy-server/pyproject.toml
new file mode 100644
index 00000000..c697cd01
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/pyproject.toml
@@ -0,0 +1,18 @@
+[project]
+name = "internal-policy-server"
+version = "0.1.0"
+requires-python = ">=3.12"
+dependencies = [
+    "psycopg>=3.2.9",
+    "psycopg-binary>=3.2.9",
+    "psycopg-pool>=3.2.6",
+    "sdnotify>=0.3.2",
+    "systemd-socketserver>=1.0",
+]
+
+[project.scripts]
+internal-policy-server = "internal_policy_server.__main__:main"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
diff --git a/hosts/surtr/email/internal-policy-server/uv.lock b/hosts/surtr/email/internal-policy-server/uv.lock
new file mode 100644
index 00000000..f7a4e729
--- /dev/null
+++ b/hosts/surtr/email/internal-policy-server/uv.lock
@@ -0,0 +1,119 @@
+version = 1
+revision = 2
+requires-python = ">=3.12"
+
+[[package]]
+name = "internal-policy-server"
+version = "0.1.0"
+source = { editable = "." }
+dependencies = [
+    { name = "psycopg" },
+    { name = "psycopg-binary" },
+    { name = "psycopg-pool" },
+    { name = "sdnotify" },
+    { name = "systemd-socketserver" },
+]
+
+[package.metadata]
+requires-dist = [
+    { name = "psycopg", specifier = ">=3.2.9" },
+    { name = "psycopg-binary", specifier = ">=3.2.9" },
+    { name = "psycopg-pool", specifier = ">=3.2.6" },
+    { name = "sdnotify", specifier = ">=0.3.2" },
+    { name = "systemd-socketserver", specifier = ">=1.0" },
+]
+
+[[package]]
+name = "psycopg"
+version = "3.2.9"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+    { name = "tzdata", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/27/4a/93a6ab570a8d1a4ad171a1f4256e205ce48d828781312c0bbaff36380ecb/psycopg-3.2.9.tar.gz", hash = "sha256:2fbb46fcd17bc81f993f28c47f1ebea38d66ae97cc2dbc3cad73b37cefbff700", size = 158122, upload-time = "2025-05-13T16:11:15.533Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/44/b0/a73c195a56eb6b92e937a5ca58521a5c3346fb233345adc80fd3e2f542e2/psycopg-3.2.9-py3-none-any.whl", hash = "sha256:01a8dadccdaac2123c916208c96e06631641c0566b22005493f09663c7a8d3b6", size = 202705, upload-time = "2025-05-13T16:06:26.584Z" },
+]
+
+[[package]]
+name = "psycopg-binary"
+version = "3.2.9"
+source = { registry = "https://pypi.org/simple" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/29/6f/ec9957e37a606cd7564412e03f41f1b3c3637a5be018d0849914cb06e674/psycopg_binary-3.2.9-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:be7d650a434921a6b1ebe3fff324dbc2364393eb29d7672e638ce3e21076974e", size = 4022205, upload-time = "2025-05-13T16:07:48.195Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/ba/497b8bea72b20a862ac95a94386967b745a472d9ddc88bc3f32d5d5f0d43/psycopg_binary-3.2.9-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:6a76b4722a529390683c0304501f238b365a46b1e5fb6b7249dbc0ad6fea51a0", size = 4083795, upload-time = "2025-05-13T16:07:50.917Z" },
+    { url = "https://files.pythonhosted.org/packages/42/07/af9503e8e8bdad3911fd88e10e6a29240f9feaa99f57d6fac4a18b16f5a0/psycopg_binary-3.2.9-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:96a551e4683f1c307cfc3d9a05fec62c00a7264f320c9962a67a543e3ce0d8ff", size = 4655043, upload-time = "2025-05-13T16:07:54.857Z" },
+    { url = "https://files.pythonhosted.org/packages/28/ed/aff8c9850df1648cc6a5cc7a381f11ee78d98a6b807edd4a5ae276ad60ad/psycopg_binary-3.2.9-cp312-cp312-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:61d0a6ceed8f08c75a395bc28cb648a81cf8dee75ba4650093ad1a24a51c8724", size = 4477972, upload-time = "2025-05-13T16:07:57.925Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/bd/8e9d1b77ec1a632818fe2f457c3a65af83c68710c4c162d6866947d08cc5/psycopg_binary-3.2.9-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad280bbd409bf598683dda82232f5215cfc5f2b1bf0854e409b4d0c44a113b1d", size = 4737516, upload-time = "2025-05-13T16:08:01.616Z" },
+    { url = "https://files.pythonhosted.org/packages/46/ec/222238f774cd5a0881f3f3b18fb86daceae89cc410f91ef6a9fb4556f236/psycopg_binary-3.2.9-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:76eddaf7fef1d0994e3d536ad48aa75034663d3a07f6f7e3e601105ae73aeff6", size = 4436160, upload-time = "2025-05-13T16:08:04.278Z" },
+    { url = "https://files.pythonhosted.org/packages/37/78/af5af2a1b296eeca54ea7592cd19284739a844974c9747e516707e7b3b39/psycopg_binary-3.2.9-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:52e239cd66c4158e412318fbe028cd94b0ef21b0707f56dcb4bdc250ee58fd40", size = 3753518, upload-time = "2025-05-13T16:08:07.567Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/ac/8a3ed39ea069402e9e6e6a2f79d81a71879708b31cc3454283314994b1ae/psycopg_binary-3.2.9-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:08bf9d5eabba160dd4f6ad247cf12f229cc19d2458511cab2eb9647f42fa6795", size = 3313598, upload-time = "2025-05-13T16:08:09.999Z" },
+    { url = "https://files.pythonhosted.org/packages/da/43/26549af068347c808fbfe5f07d2fa8cef747cfff7c695136172991d2378b/psycopg_binary-3.2.9-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:1b2cf018168cad87580e67bdde38ff5e51511112f1ce6ce9a8336871f465c19a", size = 3407289, upload-time = "2025-05-13T16:08:12.66Z" },
+    { url = "https://files.pythonhosted.org/packages/67/55/ea8d227c77df8e8aec880ded398316735add8fda5eb4ff5cc96fac11e964/psycopg_binary-3.2.9-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:14f64d1ac6942ff089fc7e926440f7a5ced062e2ed0949d7d2d680dc5c00e2d4", size = 3472493, upload-time = "2025-05-13T16:08:15.672Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/02/6ff2a5bc53c3cd653d281666728e29121149179c73fddefb1e437024c192/psycopg_binary-3.2.9-cp312-cp312-win_amd64.whl", hash = "sha256:7a838852e5afb6b4126f93eb409516a8c02a49b788f4df8b6469a40c2157fa21", size = 2927400, upload-time = "2025-05-13T16:08:18.652Z" },
+    { url = "https://files.pythonhosted.org/packages/28/0b/f61ff4e9f23396aca674ed4d5c9a5b7323738021d5d72d36d8b865b3deaf/psycopg_binary-3.2.9-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:98bbe35b5ad24a782c7bf267596638d78aa0e87abc7837bdac5b2a2ab954179e", size = 4017127, upload-time = "2025-05-13T16:08:21.391Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/00/7e181fb1179fbfc24493738b61efd0453d4b70a0c4b12728e2b82db355fd/psycopg_binary-3.2.9-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:72691a1615ebb42da8b636c5ca9f2b71f266be9e172f66209a361c175b7842c5", size = 4080322, upload-time = "2025-05-13T16:08:24.049Z" },
+    { url = "https://files.pythonhosted.org/packages/58/fd/94fc267c1d1392c4211e54ccb943be96ea4032e761573cf1047951887494/psycopg_binary-3.2.9-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:25ab464bfba8c401f5536d5aa95f0ca1dd8257b5202eede04019b4415f491351", size = 4655097, upload-time = "2025-05-13T16:08:27.376Z" },
+    { url = "https://files.pythonhosted.org/packages/41/17/31b3acf43de0b2ba83eac5878ff0dea5a608ca2a5c5dd48067999503a9de/psycopg_binary-3.2.9-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0e8aeefebe752f46e3c4b769e53f1d4ad71208fe1150975ef7662c22cca80fab", size = 4482114, upload-time = "2025-05-13T16:08:30.781Z" },
+    { url = "https://files.pythonhosted.org/packages/85/78/b4d75e5fd5a85e17f2beb977abbba3389d11a4536b116205846b0e1cf744/psycopg_binary-3.2.9-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b7e4e4dd177a8665c9ce86bc9caae2ab3aa9360b7ce7ec01827ea1baea9ff748", size = 4737693, upload-time = "2025-05-13T16:08:34.625Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/95/7325a8550e3388b00b5e54f4ced5e7346b531eb4573bf054c3dbbfdc14fe/psycopg_binary-3.2.9-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7fc2915949e5c1ea27a851f7a472a7da7d0a40d679f0a31e42f1022f3c562e87", size = 4437423, upload-time = "2025-05-13T16:08:37.444Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/db/cef77d08e59910d483df4ee6da8af51c03bb597f500f1fe818f0f3b925d3/psycopg_binary-3.2.9-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a1fa38a4687b14f517f049477178093c39c2a10fdcced21116f47c017516498f", size = 3758667, upload-time = "2025-05-13T16:08:40.116Z" },
+    { url = "https://files.pythonhosted.org/packages/95/3e/252fcbffb47189aa84d723b54682e1bb6d05c8875fa50ce1ada914ae6e28/psycopg_binary-3.2.9-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:5be8292d07a3ab828dc95b5ee6b69ca0a5b2e579a577b39671f4f5b47116dfd2", size = 3320576, upload-time = "2025-05-13T16:08:43.243Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/cd/9b5583936515d085a1bec32b45289ceb53b80d9ce1cea0fef4c782dc41a7/psycopg_binary-3.2.9-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:778588ca9897b6c6bab39b0d3034efff4c5438f5e3bd52fda3914175498202f9", size = 3411439, upload-time = "2025-05-13T16:08:47.321Z" },
+    { url = "https://files.pythonhosted.org/packages/45/6b/6f1164ea1634c87956cdb6db759e0b8c5827f989ee3cdff0f5c70e8331f2/psycopg_binary-3.2.9-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:f0d5b3af045a187aedbd7ed5fc513bd933a97aaff78e61c3745b330792c4345b", size = 3477477, upload-time = "2025-05-13T16:08:51.166Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/1d/bf54cfec79377929da600c16114f0da77a5f1670f45e0c3af9fcd36879bc/psycopg_binary-3.2.9-cp313-cp313-win_amd64.whl", hash = "sha256:2290bc146a1b6a9730350f695e8b670e1d1feb8446597bed0bbe7c3c30e0abcb", size = 2928009, upload-time = "2025-05-13T16:08:53.67Z" },
+]
+
+[[package]]
+name = "psycopg-pool"
+version = "3.2.6"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/cf/13/1e7850bb2c69a63267c3dbf37387d3f71a00fd0e2fa55c5db14d64ba1af4/psycopg_pool-3.2.6.tar.gz", hash = "sha256:0f92a7817719517212fbfe2fd58b8c35c1850cdd2a80d36b581ba2085d9148e5", size = 29770, upload-time = "2025-02-26T12:03:47.129Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/47/fd/4feb52a55c1a4bd748f2acaed1903ab54a723c47f6d0242780f4d97104d4/psycopg_pool-3.2.6-py3-none-any.whl", hash = "sha256:5887318a9f6af906d041a0b1dc1c60f8f0dda8340c2572b74e10907b51ed5da7", size = 38252, upload-time = "2025-02-26T12:03:45.073Z" },
+]
+
+[[package]]
+name = "sdnotify"
+version = "0.3.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/d8/9fdc36b2a912bf78106de4b3f0de3891ff8f369e7a6f80be842b8b0b6bd5/sdnotify-0.3.2.tar.gz", hash = "sha256:73977fc746b36cc41184dd43c3fe81323e7b8b06c2bb0826c4f59a20c56bb9f1", size = 2459, upload-time = "2017-08-02T20:03:44.395Z" }
+
+[[package]]
+name = "systemd-python"
+version = "235"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/10/9e/ab4458e00367223bda2dd7ccf0849a72235ee3e29b36dce732685d9b7ad9/systemd-python-235.tar.gz", hash = "sha256:4e57f39797fd5d9e2d22b8806a252d7c0106c936039d1e71c8c6b8008e695c0a", size = 61677, upload-time = "2023-02-11T13:42:16.588Z" }
+
+[[package]]
+name = "systemd-socketserver"
+version = "1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "systemd-python" },
+]
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d8/4f/b28b7f08880120a26669b080ca74487c8c67e8b54dcb0467a8f0c9f38ed6/systemd_socketserver-1.0-py3-none-any.whl", hash = "sha256:987a8bfbf28d959e7c2966c742ad7bad482f05e121077defcf95bb38267db9a8", size = 3248, upload-time = "2020-04-26T05:26:40.661Z" },
+]
+
+[[package]]
+name = "typing-extensions"
+version = "4.13.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f6/37/23083fcd6e35492953e8d2aaaa68b860eb422b34627b13f2ce3eb6106061/typing_extensions-4.13.2.tar.gz", hash = "sha256:e6c81219bd689f51865d9e372991c540bda33a0379d5573cddb9a3a23f7caaef", size = 106967, upload-time = "2025-04-10T14:19:05.416Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/8b/54/b1ae86c0973cc6f0210b53d508ca3641fb6d0c56823f288d108bc7ab3cc8/typing_extensions-4.13.2-py3-none-any.whl", hash = "sha256:a439e7c04b49fec3e5d3e2beaa21755cadbbdc391694e28ccdd36ca4a1408f8c", size = 45806, upload-time = "2025-04-10T14:19:03.967Z" },
+]
+
+[[package]]
+name = "tzdata"
+version = "2025.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/95/32/1a225d6164441be760d75c2c42e2780dc0873fe382da3e98a2e1e48361e5/tzdata-2025.2.tar.gz", hash = "sha256:b60a638fcc0daffadf82fe0f57e53d06bdec2f36c4df66280ae79bce6bd6f2b9", size = 196380, upload-time = "2025-03-23T13:54:43.652Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5c/23/c7abc0ca0a1526a0774eca151daeb8de62ec457e77262b66b359c3c7679e/tzdata-2025.2-py2.py3-none-any.whl", hash = "sha256:1a403fada01ff9221ca8044d701868fa132215d84beb92242d9acd2147f667a8", size = 347839, upload-time = "2025-03-23T13:54:41.845Z" },
+]
diff --git a/hosts/surtr/hledger.nix b/hosts/surtr/hledger.nix
new file mode 100644
index 00000000..e44933c3
--- /dev/null
+++ b/hosts/surtr/hledger.nix
@@ -0,0 +1,66 @@
+{ config, ... }:
+
+{
+  config = {
+    security.acme.rfc2136Domains = {
+      "hledger.yggdrasil.li" = {
+        restartUnits = ["nginx.service"];
+      };
+    };
+
+    services.nginx = {
+      upstreams."hledger" = {
+        servers = {
+          "[2a03:4000:52:ada:4:1::]:5000" = {};
+        };
+        extraConfig = ''
+          keepalive 8;
+        '';
+      };
+      virtualHosts = {
+        "hledger.yggdrasil.li" = {
+          kTLS = true;
+          http3 = true;
+          forceSSL = true;
+          sslCertificate = "/run/credentials/nginx.service/hledger.yggdrasil.li.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/hledger.yggdrasil.li.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/hledger.yggdrasil.li.chain.pem";
+          extraConfig = ''
+            charset utf-8;
+          '';
+
+          locations = {
+            "/".extraConfig = ''
+              proxy_pass http://hledger;
+
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+
+              proxy_redirect off;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Host $server_name;
+              proxy_set_header X-Forwarded-Proto $scheme;
+
+              client_max_body_size 0;
+              proxy_request_buffering off;
+              proxy_buffering off;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.services.nginx = {
+      serviceConfig = {
+        LoadCredential = [
+          "hledger.yggdrasil.li.key.pem:${config.security.acme.certs."hledger.yggdrasil.li".directory}/key.pem"
+          "hledger.yggdrasil.li.pem:${config.security.acme.certs."hledger.yggdrasil.li".directory}/fullchain.pem"
+          "hledger.yggdrasil.li.chain.pem:${config.security.acme.certs."hledger.yggdrasil.li".directory}/chain.pem"
+        ];
+      };
+    };
+  };
+}
diff --git a/hosts/surtr/immich.nix b/hosts/surtr/immich.nix
new file mode 100644
index 00000000..61a55e77
--- /dev/null
+++ b/hosts/surtr/immich.nix
@@ -0,0 +1,66 @@
+{ config, ... }:
+
+{
+  config = {
+    security.acme.rfc2136Domains = {
+      "immich.yggdrasil.li" = {
+        restartUnits = ["nginx.service"];
+      };
+    };
+
+    services.nginx = {
+      upstreams."immich" = {
+        servers = {
+          "[2a03:4000:52:ada:4:1::]:2283" = {};
+        };
+        extraConfig = ''
+          keepalive 8;
+        '';
+      };
+      virtualHosts = {
+        "immich.yggdrasil.li" = {
+          kTLS = true;
+          http3 = true;
+          forceSSL = true;
+          sslCertificate = "/run/credentials/nginx.service/immich.yggdrasil.li.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/immich.yggdrasil.li.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/immich.yggdrasil.li.chain.pem";
+          extraConfig = ''
+            charset utf-8;
+          '';
+
+          locations = {
+            "/".extraConfig = ''
+              proxy_pass http://immich;
+
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+
+              proxy_redirect off;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Host $server_name;
+              proxy_set_header X-Forwarded-Proto $scheme;
+
+              client_max_body_size 0;
+              proxy_request_buffering off;
+              proxy_buffering off;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.services.nginx = {
+      serviceConfig = {
+        LoadCredential = [
+          "immich.yggdrasil.li.key.pem:${config.security.acme.certs."immich.yggdrasil.li".directory}/key.pem"
+          "immich.yggdrasil.li.pem:${config.security.acme.certs."immich.yggdrasil.li".directory}/fullchain.pem"
+          "immich.yggdrasil.li.chain.pem:${config.security.acme.certs."immich.yggdrasil.li".directory}/chain.pem"
+        ];
+      };
+    };
+  };
+}
diff --git a/hosts/surtr/kimai.nix b/hosts/surtr/kimai.nix
new file mode 100644
index 00000000..454b3d80
--- /dev/null
+++ b/hosts/surtr/kimai.nix
@@ -0,0 +1,68 @@
+{ config, ... }:
+
+{
+  config = {
+    security.acme.rfc2136Domains = {
+      "kimai.yggdrasil.li" = {
+        restartUnits = ["nginx.service"];
+      };
+    };
+
+    services.nginx = {
+      upstreams."kimai" = {
+        servers = {
+          "[2a03:4000:52:ada:6::2]:80" = {};
+        };
+        extraConfig = ''
+          keepalive 8;
+        '';
+      };
+      virtualHosts = {
+        "kimai.yggdrasil.li" = {
+          kTLS = true;
+          http3 = true;
+          forceSSL = true;
+          sslCertificate = "/run/credentials/nginx.service/kimai.yggdrasil.li.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/kimai.yggdrasil.li.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/kimai.yggdrasil.li.chain.pem";
+          extraConfig = ''
+            charset utf-8;
+          '';
+
+          locations = {
+            "/".extraConfig = ''
+              proxy_pass http://kimai;
+
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+
+              proxy_redirect off;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Host $server_name;
+              proxy_set_header X-Forwarded-Proto $scheme;
+
+              client_max_body_size 0;
+              proxy_request_buffering off;
+              proxy_buffering off;
+
+              proxy_read_timeout 300;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.services.nginx = {
+      serviceConfig = {
+        LoadCredential = [
+          "kimai.yggdrasil.li.key.pem:${config.security.acme.certs."kimai.yggdrasil.li".directory}/key.pem"
+          "kimai.yggdrasil.li.pem:${config.security.acme.certs."kimai.yggdrasil.li".directory}/fullchain.pem"
+          "kimai.yggdrasil.li.chain.pem:${config.security.acme.certs."kimai.yggdrasil.li".directory}/chain.pem"
+        ];
+      };
+    };
+  };
+}
diff --git a/hosts/surtr/paperless.nix b/hosts/surtr/paperless.nix
new file mode 100644
index 00000000..7bc4397c
--- /dev/null
+++ b/hosts/surtr/paperless.nix
@@ -0,0 +1,66 @@
+{ config, ... }:
+
+{
+  config = {
+    security.acme.rfc2136Domains = {
+      "paperless.yggdrasil.li" = {
+        restartUnits = ["nginx.service"];
+      };
+    };
+
+    services.nginx = {
+      upstreams."paperless" = {
+        servers = {
+          "[2a03:4000:52:ada:4:1::]:28981" = {};
+        };
+        extraConfig = ''
+          keepalive 8;
+        '';
+      };
+      virtualHosts = {
+        "paperless.yggdrasil.li" = {
+          kTLS = true;
+          http3 = true;
+          forceSSL = true;
+          sslCertificate = "/run/credentials/nginx.service/paperless.yggdrasil.li.pem";
+          sslCertificateKey = "/run/credentials/nginx.service/paperless.yggdrasil.li.key.pem";
+          sslTrustedCertificate = "/run/credentials/nginx.service/paperless.yggdrasil.li.chain.pem";
+          extraConfig = ''
+            charset utf-8;
+          '';
+
+          locations = {
+            "/".extraConfig = ''
+              proxy_pass http://paperless;
+
+              proxy_http_version 1.1;
+              proxy_set_header Upgrade $http_upgrade;
+              proxy_set_header Connection "upgrade";
+
+              proxy_redirect off;
+              proxy_set_header Host $host;
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header X-Forwarded-Host $server_name;
+              proxy_set_header X-Forwarded-Proto $scheme;
+
+              client_max_body_size 0;
+              proxy_request_buffering off;
+              proxy_buffering off;
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.services.nginx = {
+      serviceConfig = {
+        LoadCredential = [
+          "paperless.yggdrasil.li.key.pem:${config.security.acme.certs."paperless.yggdrasil.li".directory}/key.pem"
+          "paperless.yggdrasil.li.pem:${config.security.acme.certs."paperless.yggdrasil.li".directory}/fullchain.pem"
+          "paperless.yggdrasil.li.chain.pem:${config.security.acme.certs."paperless.yggdrasil.li".directory}/chain.pem"
+        ];
+      };
+    };
+  };
+}
diff --git a/hosts/surtr/postgresql/default.nix b/hosts/surtr/postgresql/default.nix
index 583e4443..3786ea7c 100644
--- a/hosts/surtr/postgresql/default.nix
+++ b/hosts/surtr/postgresql/default.nix
@@ -89,6 +89,10 @@ in {
       "d /var/spool/pgbackrest 0750 postgres postgres - -"
     ];
 
+    systemd.services.postgresql.serviceConfig = {
+      ReadWritePaths = [ "/var/spool/pgbackrest" "/var/lib/pgbackrest/archive/surtr" ];
+    };
+
     systemd.services.migrate-postgresql = {
       after = [ "postgresql.service" ];
       bindsTo = [ "postgresql.service" ];
@@ -276,6 +280,64 @@ in {
           CREATE VIEW imap_user ("user", "password", quota_rule) AS SELECT mailbox.mailbox AS "user", "password", quota_rule FROM mailbox_quota_rule INNER JOIN mailbox ON mailbox_quota_rule.mailbox = mailbox.mailbox;
 
           COMMIT;
+
+          BEGIN;
+          SELECT _v.register_patch('013-internal', ARRAY['000-base'], null);
+
+          ALTER TABLE mailbox_mapping ADD COLUMN internal bool NOT NULL DEFAULT false;
+          CREATE TABLE mailbox_mapping_access (
+            id uuid PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
+            mailbox_mapping uuid REFERENCES mailbox_mapping(id),
+            mailbox uuid REFERENCES mailbox(id)
+          );
+          CREATE USER "postfix-internal-policy";
+          GRANT CONNECT ON DATABASE "email" TO "postfix-internal-policy";
+          ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO "postfix-internal-policy";
+          GRANT SELECT ON ALL TABLES IN SCHEMA public TO "postfix-internal-policy";
+
+          COMMIT;
+
+          BEGIN;
+          SELECT _v.register_patch('014-relay', ARRAY['000-base'], null);
+
+          CREATE TABLE relay_access (
+            id uuid PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
+            mailbox uuid REFERENCES mailbox(id),
+            domain citext NOT NULL CONSTRAINT domain_non_empty CHECK (domain <> ''')
+          );
+
+          COMMIT;
+
+          BEGIN;
+          SELECT _v.register_patch('015-relay-unique', ARRAY['000-base', '014-relay'], null);
+
+          CREATE UNIQUE INDEX relay_unique ON relay_access (mailbox, domain);
+
+          COMMIT;
+
+          BEGIN;
+          SELECT _v.register_patch('015-sender_bcc', null, null);
+
+          CREATE TABLE sender_bcc_maps (
+            id uuid PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
+            key text NOT NULL CONSTRAINT key_not_empty CHECK (key <> '''),
+            value text NOT NULL CONSTRAINT value_not_empty CHECK (value <> '''),
+            CONSTRAINT key_unique UNIQUE (key)
+          );
+
+          COMMIT;
+
+          BEGIN;
+          SELECT _v.register_patch('016-recipient_bcc', null, null);
+
+          CREATE TABLE recipient_bcc_maps (
+            id uuid PRIMARY KEY NOT NULL DEFAULT gen_random_uuid(),
+            key text NOT NULL CONSTRAINT key_not_empty CHECK (key <> '''),
+            value text NOT NULL CONSTRAINT value_not_empty CHECK (value <> '''),
+            CONSTRAINT recipient_bcc_maps_key_unique UNIQUE (key)
+          );
+
+          COMMIT;
         ''}
 
         psql etebase postgres -eXf ${pkgs.writeText "etebase.sql" ''
diff --git a/hosts/surtr/tls/default.nix b/hosts/surtr/tls/default.nix
index b1c05888..b25bd2ea 100644
--- a/hosts/surtr/tls/default.nix
+++ b/hosts/surtr/tls/default.nix
@@ -41,7 +41,7 @@ in {
 
       acceptTerms = true;
       # DNS challenge is slow
-      preliminarySelfsigned = true;
+      # preliminarySelfsigned = true;
       defaults = {
         email = "phikeebaogobaegh@141.li";
         # We don't like NIST curves and Let's Encrypt doesn't support
diff --git a/hosts/surtr/tls/tsig_key.gup b/hosts/surtr/tls/tsig_key.gup
index 3d81b603..46a3789e 100644
--- a/hosts/surtr/tls/tsig_key.gup
+++ b/hosts/surtr/tls/tsig_key.gup
@@ -1,6 +1,6 @@
 #!/usr/bin/env zsh
 
-keyFile=../dns/keys/${2:t}_acme.yaml
+keyFile=../dns/keys/${2:t}_acme
 gup -u $keyFile
 sops -d --input-type=binary --output-type=binary ${keyFile} | yq -r '.key[0].secret' > $1
-sops -p '7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8,30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51' --input-type=binary -e -i $1
\ No newline at end of file
+sops --input-type=binary -e -i $1
diff --git a/hosts/surtr/tls/tsig_keys/audiobookshelf.yggdrasil.li b/hosts/surtr/tls/tsig_keys/audiobookshelf.yggdrasil.li
new file mode 100644
index 00000000..8dd610dd
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/audiobookshelf.yggdrasil.li
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:r9jhdTlbDnCMq1QLJutn76uz1Ml8MFs7fXYRSiVYh1gafcXXsUZBq5+qqoQI,iv:un/luttuKpCiMf53fa2SRY0ffttGiYwT8DuHCKEnnEI=,tag:SkNULZSulQmP99aB/Ec+Fw==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkZGJzaEsrSU4raHlTVDVB\nczRnWVlSTTRuNXU0T3F1RTkxKytXeVJRdGpFCk9WMzNBR1NaTTMzN3BGQ2JmTjVt\nRU4rSWxCYjJPYVRzLzR0OVRYQm45TUkKLS0tIDNyMnpPN2VKUFFadTkveXRYeWps\nYUNaTjRJLzdWUnREaUVIWkpFV0FTZ2MKJS0K49SdkLW4p67FlgboHy/OVvCiUA7g\nuv5b+yotkQmh5xJwr7CUvwRewqJh56mg1yhWmE8wzpgLZMIjRXcQCQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQQ1h3M1lXTXVNd0d6cmtU\nU2JtUzFFblJudmEycnJONkkwME9wWm5jWVFzCnRYVEFWaVNvSW9GZ05TRWF4L2ho\nanltVytEU3ZOdHk1VHY5aGJDUkdDdmcKLS0tIEtzOFVkbmpjbWN5d0c1VEpxc1Rr\nSzJwclYxeC9TVWNaK2gwUmJSY0x1ZVUKTNivp5iS+1tzVMjMn17/ncvHcELhjQ/B\n0OVz4VpKM2wv6CjEcIMxmchqT8p8GFYVRrKUdqO2GEKOoe8ANtidWA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-09T17:07:16Z",
+                "mac": "ENC[AES256_GCM,data:SwS+8UQnPgHORobKLu+u2pNaMdKIvR+etUed8btbbne/IX/Wpxt0qyPYXNNGGRkN3KAxTHWjRRdrKU1bkuTU3ER1c94T935ExDESKJLVjzaEF5VSWCqLyUNCMsY2ANw84UES2swK4YI4zF1CP7rD8tKFFld78IWZoeQ7XNGDMRA=,iv:neLvamISgQ5+aqW1iRj9xJoXq1weNNyy7KCFG2+WRQE=,tag:66SDO61WnKU6DVElo9CImg==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/surtr/tls/tsig_keys/hledger.yggdrasil.li b/hosts/surtr/tls/tsig_keys/hledger.yggdrasil.li
new file mode 100644
index 00000000..ab6cdd68
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/hledger.yggdrasil.li
@@ -0,0 +1,24 @@
+{
+        "data": "ENC[AES256_GCM,data:Yd70QIj9DE6a5IN+Mf2M5p95vkRMHRg9BXaM686W7BRtthOw9m54/5FK6JWr,iv:cIOIKinkqFFPgTZdewWVY0h6kM5hGfVzuA4iYNhwK5c=,tag:Ds/oI+TOERbIdcGbI4WoEg==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1NnJ4SmsvSlh3ZlliSm9C\nNG45clh3NEZWZ05jaHhVK0xqTVRFL2wxN1ZrCk5hL2p2ZjhtcDBjTEZscXFTNkY5\nemVZSUUwV2V5cFBTdWo4RWxsM2xROVEKLS0tIDBFSFlkUVJ0ajJEUENlelVFKzVk\ndnJhMURMU2o3WVBKZGNVRXBiNytqUFEKHivcSTYy5D770C0h7RsmLBmkIG9+MDoV\ngJHvfkGzXPKwmDTMKdHbIk+ctI+u0/1jMn/K2Q9OFnOIYxP3gHiFag==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArYUNCQ1U2MXpQdmM4SHR0\nTnJWZlFGTUQ1NjVqZ3Z2MGt5NFpBVFp0b0YwCkdseitkbzI1RkZyL3V5Z1pNMG9R\nVnEzRUxrTDQrS3BiMXB1QUFPeUcxZUkKLS0tIGJFODkwNFY3c0tBLzFBNjFiYjJk\nZW82bTdia2F1NHpNSG1IYmhWb1ZCTHMK9ovFx3+x5PrV4y6+RH5XA5DK2wRPXlAt\ncxxpRZIlmnvhZXIeCYE9yhHFmz3uAn0Oib1RUDblca9FlnF9tyYD6g==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-02-19T17:13:51Z",
+                "mac": "ENC[AES256_GCM,data:ReRuK9qdZV8AbMzA9Yur0AZW+1RF3aRnfBvsKJkQtXsFdkmJQ4QkRGtL27RmjFdvQ3kXBIyhib7hYA60AJ0amduYrSScY0dtz8AurjyE4f2BGQ9/QeKRBfKXHxLvj4/xWNvS4+PVdGKkKbqIs8isz9n77WQQ3lTHop2K/TjaTuQ=,iv:gUhDK9oeUHdpQ2Fp8mFDIgPFo2JjHE0jjooL7FmvmrE=,tag:2lkwSl3j3oqamdLbM9wbow==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.4"
+        }
+}
\ No newline at end of file
diff --git a/hosts/surtr/tls/tsig_keys/immich.yggdrasil.li b/hosts/surtr/tls/tsig_keys/immich.yggdrasil.li
new file mode 100644
index 00000000..73104cc1
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/immich.yggdrasil.li
@@ -0,0 +1,24 @@
+{
+        "data": "ENC[AES256_GCM,data:COfmT91I4+yiPhN3Hi7BTqMHyKhdKtwlzT9vNgTZc7FWTHhfuTtCHQo/rhX0,iv:RDs//AT8peUhKwIRdchCScUr/PlEzyMzQPB90S4k3g4=,tag:Lh4BULmQ6+hC+Ed8s9k0Hw==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVEQvU29uWnVjMS8xcGp1\nam5hZVN3ejAxaGdpVWNia0VxT0I3dzR4YlV3ClczOGd0ZDJmUDhqb2dEdm5VeUdX\nRlR1WDNYUU9qaTYrRzhYMXBTV1JjV1UKLS0tIHBONU55RWtRSkR6K2NTNFZrUEZj\nbktqY0xBdGtiZWFFV3JUUVZTOC9YV2MKI4Ytz1NZ9+Og0GzIt/bh6L3aJUeR476g\nyRNifW4eOHf4Ne02ElpEoq6woInkxk8Ou/SJVIRmEOhjwm+qbV17gQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVOVNydWcyYjFrZDR2WStu\nWkJQd3VTTGtqVzdLVFR1eFdPZXBtVFBzVXc4ClREQVpKeXlhWlBFQzVFL0VGME5K\nUUhoa3A1YWdvSkZVV1FQcUh5L3RoUmMKLS0tIHE4c3A1OTNXVk9xZHJPZTlSMlQ4\nZnZUTXdjUGZuN3NoSEFSSko1aU5aQUEKHcuI2+9q7DsDwRn7mfwcSyC7AixzCC0e\nhqnGaW0HxmtLeOFuSPLdFMhhockCYGEV/907i/X6EImepWC4cf3bqA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-01-03T15:31:40Z",
+                "mac": "ENC[AES256_GCM,data:soDFDk35A1ULzOosZNrbhvtG3NPJDpAtLP3xrDtCBxgSGQ0lWrQ0o3MaKaJoDXQv7g/vYghmSwjH+0In0Ib3OWg0WLAlhwTEsiAn1o4JNRu/wF5aqvazOiDzFu7cyWil4Lsphy5eZgtc4IUp75SlCQc71xlNLoxudPpdcSxNLWg=,iv:jBYUZbiWM5gxFA+ZdpxpZIkz3WfgFi59tXFp242/qr8=,tag:H7ihAryZ8be+BbaqXFhRRg==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.2"
+        }
+}
\ No newline at end of file
diff --git a/hosts/surtr/tls/tsig_keys/kimai.yggdrasil.li b/hosts/surtr/tls/tsig_keys/kimai.yggdrasil.li
new file mode 100644
index 00000000..b9199975
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/kimai.yggdrasil.li
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:ATcU3Ix7o5d/49rD5H8je1ozTjoghrloMh5DIZ5WE3oYauUAknpGfr9xq92V,iv:vy9YK5Ot7CCjMtgAGVeAUQuaSw4F5kmmZ0GJYV9kCdQ=,tag:F/MXTUM2AI1fGXa9Ewn8yQ==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDMEF0cUdydERYVzJCa3pW\nTlo0NUFON0d5RGJFVnVTNVg3cjNEUERQMEdFClEvQW5odlNEd2F1VTFmMWQrL2RB\ncllFZVpIVVJrNTJsSGF4UEdZMnVmQzAKLS0tIFUrQkkzRVZiOFNiTnFCT1pEYVRM\nQm8wV1JkQ3RrR1dkL0FsNkhsY2kxa1kKGnAo/6oibgXexUU31THdLu6X+pRtrkjD\nZnXGPZ2xaESDVUVEYQPVpNrjt9brZGJBI1BasrkEwHAXMbJC236yYQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3MGs1Z2ZqK2pqWHdVYTJH\naTlncHdPa3Zld0JhQW5Ccmc1SStWSnlDR0JrCmpML2d4TGdldUdoZCtaWVpPZVl0\nVm4waWVBS1orRS90ZS96N0Y2M29LY0UKLS0tIEI1Z2VVbVVxRUpOZEN4NnBRRklC\nQXloelZCb04xbmduTlVuL005TlRGMHMKfLB6zA3sj3HgDBC7VGfGVB6I1zJpt0PV\nkCV2yADgvAA2pT9HPg9IWAEpTPysOBiuE2jPNtFvylZYwTDHoumFnQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-24T09:42:23Z",
+                "mac": "ENC[AES256_GCM,data:0pk1LpWPmX9td/TwJFxwWp5pTDyW78UtHXMDah+V9Tmgi8hH7ONdysgjwpDwS/c4zGnMA3qtobEL286U3//CTXt2qVsiUGLsnngzs2E6yBg8oGMYlGrch4M355Fl5ZxYsc8QLA6qWcuZ4H3QW8PnoqdJixcHoYLoxG01dzh4Bc0=,iv:zchk4enI1D80BkJLji5RLm7OTk3GeF8nYHuwqBxCXIM=,tag:bgkknPMqkSidi6bDFfv6UQ==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/surtr/tls/tsig_keys/paperless.yggdrasil.li b/hosts/surtr/tls/tsig_keys/paperless.yggdrasil.li
new file mode 100644
index 00000000..b1029931
--- /dev/null
+++ b/hosts/surtr/tls/tsig_keys/paperless.yggdrasil.li
@@ -0,0 +1,24 @@
+{
+        "data": "ENC[AES256_GCM,data:D9l0pklD2KDZ4/TXHtXg00MmCnjCVVBG0AK9j5OxxBCyYseCTckp2P/iPOng,iv:DjvuKWPr/jldfk0eZ5+jWHN0RurdruR4Md7AMAPzRQg=,tag:h0c4m3hpATzzb6a7DVmi9w==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3S05aS0ZEcVU2T3BIOG13\nSDJLTUp4OG9ZYVluK2gxbUJDSFRaQ0xnS0YwClFkKzByanJGOWFwbTlISndyU0Rx\nN1FJb3FVaUZOVDBsWEdHTVNGaGNtMVkKLS0tIDI1RmxaMlhVd1FPL1dNdlRGK0Nq\nMFpJZTNnWncrbkV5YS82ZnhGRld0UG8KIuf7bC7GVxaGeR7gwC7kGu/wtBppjq4H\nyDT05CYJf9/EE3K5aJpIOlxyqowRs2SINvIVkyd5ggYkkxCctmGXjQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUV3ZqTVJkNWdHeTlKK3Vl\nVTdrdzE2Z3YzVmZxelNFMDNMTUJneHNtNzFRCmQxTU84ekV4bFVLajU0ajB6ZzZK\neEpuQTcyS1o4MW9xTU5nMXVUR0gxTmcKLS0tIGVzZC8xYTc1VkU2RzA2NFQ1K2xz\nLzhPVjBUcytWNGRsdnFob3A4aWljelkKFMlmigcEVzelcEiv6WGya1dsIOJYr7YT\naBHgMttV7zzYHLqvIVJSCz+uw2FqDyqN46twmzFC0HSHeiKbvRrHVw==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-02-13T19:23:42Z",
+                "mac": "ENC[AES256_GCM,data:0Fcgq0pOZtBBSiK8pUr/jadXMdtbZYFhUbSe+7DQpB8Fo2r8cEoT+Cpcy7tu+l9eXUiDk/tXTBJyMXaW4XWwS/Fe6Zcb95UYaYR1Y6OM9JVPYmwd6QSeC13MwzhYaCDlBiWWq69Zn8grEg7npWo/LS9LK7IEbN7EI8o7QYDI6cw=,iv:C+8ZmVTNWySQ+/6j+YirSwZzoMqXRlgstk47Efxmqps=,tag:Be/6Ve6M/Dcm/6QrbF+JTw==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.4"
+        }
+}
\ No newline at end of file
diff --git a/hosts/surtr/vpn/default.nix b/hosts/surtr/vpn/default.nix
index 1bdcf74e..92223144 100644
--- a/hosts/surtr/vpn/default.nix
+++ b/hosts/surtr/vpn/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, config, lib, ... }:
+{ flake, pkgs, config, lib, ... }:
 
 with lib;
 
@@ -22,7 +22,11 @@ in {
         "--load-credential=surtr.priv:/run/credentials/container@vpn.service/surtr.priv"
         "--network-ipvlan=ens3:upstream"
       ];
-      config = {
+      config = let hostConfig = config; in { config, pkgs, ... }: {
+        system.stateVersion = lib.mkIf hostConfig.containers."vpn".ephemeral config.system.nixos.release;
+        system.configurationRevision = mkIf (flake ? rev) flake.rev;
+        nixpkgs.pkgs = hostConfig.nixpkgs.pkgs;
+
         boot.kernel.sysctl = {
           "net.core.rmem_max" = 4194304;
           "net.core.wmem_max" = 4194304;
diff --git a/hosts/surtr/vpn/geri.pub b/hosts/surtr/vpn/geri.pub
index ed5de2b2..2cd9b24e 100644
--- a/hosts/surtr/vpn/geri.pub
+++ b/hosts/surtr/vpn/geri.pub
@@ -1 +1 @@
-sYuQSNZHzfegv8HRz71jnZm2nFLGeRnaGwVonhKUj2k=
+hhER05bvstOTGfiAG3IJsFkBNWCUZHokBXwaiC5d534=
diff --git a/hosts/surtr/zfs.nix b/hosts/surtr/zfs.nix
index 17c5cd32..3795956d 100644
--- a/hosts/surtr/zfs.nix
+++ b/hosts/surtr/zfs.nix
@@ -49,7 +49,7 @@
 
     boot.postBootCommands = ''
       echo "=== STARTING ZPOOL IMPORT ==="
-      ${pkgs.zfs}/bin/zpool import -a -N -d /dev
+      ${pkgs.zfs}/bin/zpool import -a -f -N -d /dev
       ${pkgs.zfs}/bin/zpool status
       ${pkgs.zfs}/bin/zfs mount -a
       echo "=== ZPOOL IMPORT COMPLETE ==="
diff --git a/hosts/vidhar/audiobookshelf/abs-podcast-autoplaylist-gkleen.toml b/hosts/vidhar/audiobookshelf/abs-podcast-autoplaylist-gkleen.toml
new file mode 100644
index 00000000..42920069
--- /dev/null
+++ b/hosts/vidhar/audiobookshelf/abs-podcast-autoplaylist-gkleen.toml
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:7STcG1J3zLHzlHi2LZgSa+pmKlYU6X1eLvjXcx7gvCuHFkXwa/ldrHdzaBXAMrQ+C+DWM4+cyhdal3ypxXueBuBEvH3P7/KofPP2A519sdZo1vDkXCzYRD3Ow74M+hX5ej6hL1mv21HayrRMPnYfH8HUWk1kd/y69EjpjvDHyCpQuw1WG5M4FDUaTd4Vh51QRCSG/Is29dEkvQowhIvNqnAR4KW9PpfjlbUPHauZ6PQLnlJmI9QCcAGJ8hHtp5T+xctTym82GAlXugTJpHnkqcxnGteu9H7UuiDMQ3aKKGYzZCpWkNHrbD1IRhzPzSjVlN2nIX3Ydp8ENNf61EGOrp5hzmV0MhwRHKfz5rE1FRVuyHcwhwBdJzfhzrL9zXZYzn9Zuf9KWwsF+1+58i9u9hPym63r4c1+RbMjNKzHc1/yhhsRDCrTwvMd/Hc6KfUi3H1wW/r02Va2bOCkYrOkWIQpBdx4ThMgkTaHr94DBMqT8n3Fzhc7+uaUsl6I9gMwTn8QCV3g4U7Mp3+/gnQLOdsCTgKr69x1iPfp7jzzbC29MWhIk+2aig+iWRMVT0n4AWIxooc3cYnfOJNtCdJwKuPUl4xNlZ22NK3XQfxBURSw0pi5KyDO1wgTVRoRJMnXZyin3bZ10OU8QKBqLp22FXpG/+mHrm3Y6yLkqfIP5ry+b86Rb7nWJlxDTwTGSoGi8sJzwNb+H9ioG7LjaSmvr7V+2aSq0+72WopAkIFSBq/yIWX3J/rNZuia6jKMY/8bSLDJz3V/YuzeUJ5feUkOS4KW1J1UkaYd6XxZ9Y8szCS/B7Ocz0YiV8fHmOzZKRn8BTmmXUIoyxO07MmwQ1shYfiVCwXjdjq2f3/CZbXNVOPvhGBYOcutUztftu3H9DRDTKrVae1TnztCVSkBSk1o52uSj0r8t6f4l1r7UG1TviOnVLVh1/6iiJVQey0m8G6ugw22zxfhI0Uea/rB70i+2UuoxrmsOfg+TgnvKBuakEBifp4rx0S5wyz05RYXkBLJTIwi2fVGmulqjZuCQNQnI3cfPI+oGcykob9IQqdo/Dwd118hNPVAwdDHyaiGXGh8eu8N2OCLQxlGZDtkVUveaEasJaZ0WWWaK97FUeoNJfUnB7Y3lNjv5u2rzviZyk4=,iv:jT21FNnHod6btDlBa3UflK3au5VmcsABs5OTMXF6oFA=,tag:Oh8cOL+edT5Wp0I1L5+vwg==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0aE1XNUNCM1Q5V0d3R2JG\nbjJZTmdvQ21JbmtyR0ZmODFMdVBGejRoam1vCjMzMGdTb3BReDVCa2JJU0JrSHFP\ndTdicU5TRjIrTWpteDMzeGtDT0xaelkKLS0tIFhaSlFrbzFDUjRZV0lGR0cydVdZ\nY2xma0VSVXlTM1JucFJUSys4dlRvdEUK9gQNQEdKDDf1ikWzd6uTlE50WsfO/EB0\nGH2Ono6oNWbKWTyl/wRO8NzXx0nudwqq66s0oBLIdTMQOpIBBNI0XQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiRWFqSHNlY1IvMkkwaEto\ncHZHa2p1Y25SakFkS2JYMlRFcFhnZGY1dVRFCkxSWmxvcHZMampQKzdKRHI0ZVMx\nUTFtR0pHbzFaQ0xQUFA2ZERDSWpwS0UKLS0tIFBaSGczY3VWdy9TKzRDZWZ2SElY\nbVQ4dDNhQllmVmViWGs5c3V4TmNscjQKeugevQJFAN/8JrzeAm4hm2JsQGb26BCb\n3dKYnN1kJU7oVHr1aVfXwMpELNYt9poX6WTY2h9lsdHuRlqoFXAA5Q==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-08-11T07:08:36Z",
+                "mac": "ENC[AES256_GCM,data:ZL/dOz+NC8sr8vPBsux+gFOWxUhQqMSmG1az7udhB0ckmOXtnrPBzMM1gs+5pwXLvfLux0m4xzT87+o87axIECnCq35FSuMjtEBK24OUJXsLG/q/tDv5dfRBy/976dM5W7YkBVX/uc03p8CLKf5w4XYNeRKnSwjLvWGd9runDOU=,iv:9ZIeJ5aDVVPHi3/oHqWkWtEfeivV/nFFyQ1lJWJwMu8=,tag:TfkHaopMa+Z0zk38A6/NTA==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/vidhar/audiobookshelf/default.nix b/hosts/vidhar/audiobookshelf/default.nix
new file mode 100644
index 00000000..136bcaff
--- /dev/null
+++ b/hosts/vidhar/audiobookshelf/default.nix
@@ -0,0 +1,21 @@
+{ config, pkgs, lib, ... }:
+
+{
+  config = {
+    services.audiobookshelf = {
+      enable = true;
+      host = "2a03:4000:52:ada:4:1::";
+      port = 28982;
+    };
+
+    users.groups.audiobookshelf.members = [ "gkleen" ];
+
+    services.abs-podcast-autoplaylist = {
+      gkleen = {};
+    };
+    sops.secrets.${config.services.abs-podcast-autoplaylist.gkleen.configSecret} = {
+      format = "binary";
+      sopsFile = ./abs-podcast-autoplaylist-gkleen.toml;
+    };
+  };
+}
diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix
index 42a9e80d..547572c6 100644
--- a/hosts/vidhar/default.nix
+++ b/hosts/vidhar/default.nix
@@ -4,7 +4,7 @@ with lib;
 
 {
   imports = with flake.nixosModules.systemProfiles; [
-    ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest
+    ./zfs.nix ./network ./samba.nix ./dns ./prometheus ./borg ./pgbackrest ./postgresql.nix ./immich.nix ./paperless ./hledger ./audiobookshelf ./kimai
     tmpfs-root zfs
     initrd-all-crypto-modules default-locale openssh rebuild-machines
     build-server
@@ -136,7 +136,7 @@ with lib;
       wantedBy = ["basic.target"];
       serviceConfig = {
         ExecStart = pkgs.writeShellScript "limit-pstate-start" ''
-          echo 60 > /sys/devices/system/cpu/intel_pstate/max_perf_pct
+          echo 40 > /sys/devices/system/cpu/intel_pstate/max_perf_pct
         '';
         RemainAfterExit = true;
         ExecStop = pkgs.writeShellScript "limit-pstate-stop" ''
diff --git a/hosts/vidhar/hledger/default.nix b/hosts/vidhar/hledger/default.nix
new file mode 100644
index 00000000..ae080f66
--- /dev/null
+++ b/hosts/vidhar/hledger/default.nix
@@ -0,0 +1,83 @@
+{ config, lib, pkgs, ... }:
+{
+  config = {
+    services.hledger-web = {
+      enable = true;
+      allow = "view";
+      stateDir = "/var/lib/hledger";
+      journalFiles = lib.mkForce ["web.journal"];
+      baseUrl = "https://hledger.yggdrasil.li";
+      extraOptions = [
+        "--socket=/run/hledger-web/http.sock"
+      ];
+    };
+    users = {
+      users.hledger.uid = 982;
+      groups.hledger.gid = 979;
+    };
+    systemd.services.hledger-web = {
+      serviceConfig = {
+        UMask = "0002";
+        ReadOnlyPaths = [ config.services.hledger-web.stateDir ];
+        RuntimeDirectory = [ "hledger-web" ];
+        PrivateDevices = true;
+        StateDirectory = "hledger";
+        CapabilityBoundingSet = "";
+        AmbientCapabilities = "";
+        ProtectSystem = "strict";
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectHome = "tmpfs";
+        ProtectKernelLogs = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        PrivateNetwork = false;
+        RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service @resources"
+          "~@obsolete @privileged"
+        ];
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        NoNewPrivileges = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        PrivateUsers = true;
+        TemporaryFileSystem = [ "/var/lib/hledger/.cache:mode=0750,uid=${toString (config.users.users.hledger.uid)},gid=${toString (config.users.groups.hledger.gid)}" ];
+      };
+    };
+    services.nginx = {
+      upstreams.hledger = {
+        servers = { "unix:/run/hledger-web/http.sock" = {}; };
+      };
+      virtualHosts."hledger.yggdrasil.li" = {
+        listen = [
+          { addr = "[2a03:4000:52:ada:4:1::]"; port = 5000; }
+        ];
+        extraConfig = ''
+          set_real_ip_from 2a03:4000:52:ada:4::;
+          auth_basic "hledger";
+          auth_basic_user_file "/run/credentials/nginx.service/hledger_users";
+        '';
+        locations."/" = {
+          proxyPass = "http://hledger/";
+          proxyWebsockets = true;
+        };
+      };
+    };
+    systemd.services.nginx.serviceConfig = {
+      SupplementaryGroups = [ "hledger" ];
+      LoadCredential = [ "hledger_users:${config.sops.secrets."hledger_users".path}" ];
+    };
+    sops.secrets."hledger_users" = {
+      format = "binary";
+      sopsFile = ./htpasswd;
+      reloadUnits = [ "nginx.service" ];
+    };
+  };
+}
diff --git a/hosts/vidhar/hledger/htpasswd b/hosts/vidhar/hledger/htpasswd
new file mode 100644
index 00000000..016cb525
--- /dev/null
+++ b/hosts/vidhar/hledger/htpasswd
@@ -0,0 +1,24 @@
+{
+        "data": "ENC[AES256_GCM,data:9MNDIAc7ePYk3xQDorX2pU8ybJkJb33RKiJxc2DYauXFNQYxtGwCYhZwod7p7fPh3KqZxBNMRoZXr+/RnV+trsqjAcOOjnXTWLbX6nubq/xm+q0BxEjOPn7FvJF9XOblBeupldo+byGh2CMH9qQv5Fov,iv:3Tym+Mfr48OJet3qDFZPg0XjYr4sNQdNdiu0vUxmzbY=,tag:E0sxRY/jeMVlqH6uAYvD/Q==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eFBsOEM2ZUNVT2V3LytC\nTUJvUDdKc0VzMyt2cDFKYU03djBjZVFpeVY4CjByMXhPVXRJVjhKQWZvQ2xuOTE3\ncXdJV1lZaHR3cVl0Z0hQaG00M2dGbjQKLS0tIEIzenVxb3cwM3pXTUl1YUZlSlk2\nbDc3VmE5NkEyZ2tRd01OUGZibmhtUlEKxdesIdvzm8s0SmXU5R+tSbmS5Dj24jrb\nEiMERYy1g8GyHR3d2/mU5iOIdsBegSZReUVzomaMT9L7/TmubgOP3g==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPa2RDZzR6cEFYTFA1QkND\nbndVeHVrMVJ0MWZvRmw5VXRhOHlRYllIRWxRCjU4dks4R25LS1RZMHFnbmpQRVZz\nNXhubkJvZFc2amRwMDVtQlE0NnBKNzQKLS0tIHRyeDUxTEFPMEMzWUVkZURzODdm\nSHdqbUpvNmFTS1QveFRpRHdnWHpHb28KnvdUkMkKGiBVHQD7Yv7n6WZjihCGJAR2\nMKl2WAn4g4jzgcXPwwIAIjUrMGSIdGpwCTUDcDnlKWAbRYO2B6P17A==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-02-19T17:11:17Z",
+                "mac": "ENC[AES256_GCM,data:yBIEqHhr4igoMlRcgg2SigKfejqeuNmuleYolsLJo+QOaW4BHITJTvLxRV1JHPpcMVQkF//zx4ZfUUrb8tTN0znGu3Jnpd0JVagbfCVyEuT6d1SB/GzyUVvoQ2GlcA9us+5gjI4oEJTQCfVqnLDBWsw+jXdr3nEIWo6Mvbqo3lI=,iv:I6Swk4wyd+96+tJKRY/FHlS7ZShMDROcbl+l+ZLRxhM=,tag:P1uQvB4NLdkPEKRMI6lLxw==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.4"
+        }
+}
\ No newline at end of file
diff --git a/hosts/vidhar/immich.nix b/hosts/vidhar/immich.nix
new file mode 100644
index 00000000..a1f145a8
--- /dev/null
+++ b/hosts/vidhar/immich.nix
@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  config = {
+    services.immich = {
+      enable = true;
+      host = "2a03:4000:52:ada:4:1::";
+    };
+  };
+}
diff --git a/hosts/vidhar/kimai/default.nix b/hosts/vidhar/kimai/default.nix
new file mode 100644
index 00000000..0258697b
--- /dev/null
+++ b/hosts/vidhar/kimai/default.nix
@@ -0,0 +1,89 @@
+{ flake, config, ... }:
+
+{
+  config = {
+    boot.enableContainers = true;
+    boot.kernel.sysctl = {
+      "net.netfilter.nf_log_all_netns" = true;
+    };
+
+    containers."kimai" = {
+      autoStart = true;
+      ephemeral = true;
+      bindMounts = {
+        "/var/lib/kimai" = {
+          hostPath = "/var/lib/kimai/state";
+          isReadOnly = false;
+        };
+        "/var/lib/mysql" = {
+          hostPath = "/var/lib/kimai/mysql";
+          isReadOnly = false;
+        };
+      };
+      privateNetwork = true;
+      # forwardPorts = [
+      #   { containerPort = 80;
+      #     hostPort = 28983;
+      #   }
+      # ];
+      hostAddress = "192.168.52.113";
+      localAddress = "192.168.52.114";
+      hostAddress6 = "2a03:4000:52:ada:6::1";
+      localAddress6 = "2a03:4000:52:ada:6::2";
+      config = let hostConfig = config; in { config, pkgs, lib, ... }: {
+        system.stateVersion = lib.mkIf hostConfig.containers."kimai".ephemeral config.system.nixos.release;
+        system.configurationRevision = lib.mkIf (flake ? rev) flake.rev;
+        nixpkgs.pkgs = hostConfig.nixpkgs.pkgs;
+
+        services.kimai.sites."kimai.yggdrasil.li" = {
+          database.socket = "/run/mysqld/mysqld.sock";
+        };
+
+        networking = {
+          useDHCP = false;
+          useNetworkd = true;
+          useHostResolvConf = false;
+          firewall.enable = false;
+          nftables = {
+            enable = true;
+            rulesetFile = ./ruleset.nft;
+          };
+        };
+
+        services.resolved.fallbackDns = [
+          "9.9.9.10#dns10.quad9.net"
+          "149.112.112.10#dns10.quad9.net"
+          "2620:fe::10#dns10.quad9.net"
+          "2620:fe::fe:10#dns10.quad9.net"
+        ];
+
+        systemd.network = {
+          networks.upstream = {
+            name = "eth0";
+            matchConfig = {
+              Name = "eth0";
+            };
+            linkConfig = {
+              RequiredForOnline = true;
+            };
+            networkConfig = {
+              Address = [ "192.168.52.114/32" "2a03:4000:52:ada:6::2/128" ];
+              LLMNR = false;
+              MulticastDNS = false;
+            };
+            routes = [
+              { Destination = "192.168.52.113/32"; }
+              { Destination = "2a03:4000:52:ada:6::1/128"; }
+              { Destination = "0.0.0.0/0";
+                Gateway = "192.168.52.113";
+              }
+              { Destination = "::/0";
+                Gateway = "2a03:4000:52:ada:6::1";
+              }
+            ];
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/vidhar/kimai/ruleset.nft b/hosts/vidhar/kimai/ruleset.nft
new file mode 100644
index 00000000..ad4db6d5
--- /dev/null
+++ b/hosts/vidhar/kimai/ruleset.nft
@@ -0,0 +1,149 @@
+define icmp_protos = {ipv6-icmp, icmp, igmp}
+
+table arp filter {
+  limit lim_arp {
+    rate over 50 mbytes/second burst 50 mbytes
+  }
+
+  counter arp-rx {}
+  counter arp-tx {}
+
+  counter arp-ratelimit-rx {}
+  counter arp-ratelimit-tx {}
+
+  chain input {
+    type filter hook input priority filter
+    policy accept
+
+    limit name lim_arp counter name arp-ratelimit-rx drop
+
+    counter name arp-rx
+  }
+
+  chain output {
+    type filter hook output priority filter
+    policy accept
+
+    limit name lim_arp counter name arp-ratelimit-tx drop
+
+    counter name arp-tx
+  }
+}
+
+table inet filter {
+  limit lim_reject {
+    rate over 1000/second burst 1000 packets
+  }
+
+  limit lim_icmp {
+    rate over 50 mbytes/second burst 50 mbytes
+  }
+
+  counter invalid-fw {}
+  counter fw-lo {}
+
+  counter reject-ratelimit-fw {}
+  counter reject-fw {}
+  counter reject-tcp-fw {}
+  counter reject-icmp-fw {}
+
+  counter drop-fw {}
+
+  counter invalid-rx {}
+
+  counter rx-lo {}
+  counter invalid-local4-rx {}
+  counter invalid-local6-rx {}
+
+  counter icmp-ratelimit-rx {}
+  counter icmp-rx {}
+
+  counter kimai-rx {}
+
+  counter established-rx {}
+
+  counter reject-ratelimit-rx {}
+  counter reject-rx {}
+  counter reject-tcp-rx {}
+  counter reject-icmp-rx {}
+
+  counter drop-rx {}
+
+  counter tx-lo {}
+
+  counter icmp-ratelimit-tx {}
+  counter icmp-tx {}
+
+  counter kimai-tx {}
+
+  counter tx {}
+
+  chain forward {
+    type filter hook forward priority filter
+    policy drop
+
+
+    ct state invalid log level debug prefix "kimai: drop invalid forward: " counter name invalid-fw drop
+
+
+    iifname lo counter name fw-lo accept
+
+
+    limit name lim_reject log level debug prefix "kimai: drop forward: " counter name reject-ratelimit-fw drop
+    log level debug prefix "kimai: reject forward: " counter name reject-fw
+    meta l4proto tcp ct state new counter name reject-tcp-fw reject with tcp reset
+    ct state new counter name reject-icmp-fw reject
+
+
+    counter name drop-fw
+  }
+
+  chain input {
+    type filter hook input priority filter
+    policy drop
+
+
+    ct state invalid log level debug prefix "kimai: drop invalid input: " counter name invalid-rx drop
+
+
+    iifname lo counter name rx-lo accept
+    iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
+    iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
+
+
+    meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-rx drop
+    meta l4proto $icmp_protos counter name icmp-rx accept
+
+
+    tcp dport 80 counter name kimai-rx accept
+
+
+    ct state { established, related } counter name established-rx accept
+
+
+    limit name lim_reject log level debug prefix "kimai: drop input: " counter name reject-ratelimit-rx drop
+    log level debug prefix "kimai: reject input: " counter name reject-rx
+    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
+    ct state new counter name reject-icmp-rx reject
+
+
+    counter name drop-rx
+  }
+
+  chain output {
+    type filter hook output priority filter
+    policy accept
+
+
+    oifname lo counter name tx-lo accept
+
+    meta l4proto $icmp_protos limit name lim_icmp counter name icmp-ratelimit-tx drop
+    meta l4proto $icmp_protos counter name icmp-tx accept
+
+
+    tcp sport 80 counter name kimai-tx
+
+
+    counter name tx
+  }
+}
diff --git a/hosts/vidhar/network/default.nix b/hosts/vidhar/network/default.nix
index 0643f0bb..92d755f3 100644
--- a/hosts/vidhar/network/default.nix
+++ b/hosts/vidhar/network/default.nix
@@ -103,7 +103,14 @@ with lib;
           /srv/nfs/nix-store 10.141.0.0/24(ro,async,root_squash) 2a03:4000:52:ada:1::/80(ro,async,root_squash)
         '';
       };
-      settings.nfsd.vers3 = false;
+      settings.nfsd = {
+        rdma = true;
+        vers3 = false;
+        vers4 = true;
+        "vers4.0" = false;
+        "vers4.1" = false;
+        "vers4.2" = true;
+      };
     };
 
     fileSystems = {
diff --git a/hosts/vidhar/network/dhcp/default.nix b/hosts/vidhar/network/dhcp/default.nix
index 07a83351..11460393 100644
--- a/hosts/vidhar/network/dhcp/default.nix
+++ b/hosts/vidhar/network/dhcp/default.nix
@@ -1,8 +1,33 @@
-{ flake, config, pkgs, lib, ... }:
+{ flake, config, pkgs, lib, sources, ... }:
 
 with lib;
 
-{
+let
+  nfsrootBaseUrl = "http://nfsroot.vidhar.yggdrasil";
+  tftpIp = "10.141.0.1";
+  nfsIp = tftpIp;
+  ipxe = pkgs.ipxe.override {
+    additionalTargets = {
+      "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
+    };
+    additionalOptions = [
+      "NSLOOKUP_CMD"
+      "PING_CMD"
+      "CONSOLE_CMD"
+    ];
+    embedScript = pkgs.writeText "yggdrasil.ipxe" ''
+      #!ipxe
+
+      cpair --background 9 1
+      cpair --background 9 3
+      cpair --background 9 6
+
+      set user-class iPXE-yggdrasil
+
+      autoboot
+    '';
+  };
+in {
   config = {
     services.kea = {
       dhcp4 = {
@@ -23,41 +48,67 @@ with lib;
           };
 
           client-classes = [
-            { name = "eostre-ipxe";
-              test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE'";
-              next-server = "10.141.0.1";
-              boot-file-name = "http://nfsroot.vidhar.yggdrasil/eostre/netboot.ipxe";
+            { name = "ipxe-eostre";
+              test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE-yggdrasil'";
+              next-server = tftpIp;
+              boot-file-name = "${nfsrootBaseUrl}/eostre.menu.ipxe";
+              only-if-required = true;
+            }
+            { name = "ipxe-yggdrasil";
+              test = "option[77].hex == 'iPXE-yggdrasil'";
+              next-server = tftpIp;
+              boot-file-name = "${nfsrootBaseUrl}/installer-x86_64-linux.menu.ipxe";
+              only-if-required = true;
+            }
+
+            { name = "uefi-http";
+              test = "option[client-system].hex == 0x0010";
+              option-data = [
+                { name = "vendor-class-identifier"; data = "HTTPClient"; }
+              ];
+              boot-file-name = "${nfsrootBaseUrl}/ipxe.efi";
+              only-if-required = true;
+            }
+
+            { name = "ipxe-uefi-64";
+              test = "option[77].hex == 'iPXE' and (substring(option[60].hex,0,20) == 'PXEClient:Arch:00007' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00008' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00009')";
+              boot-file-name = "${nfsrootBaseUrl}/ipxe.efi";
+              only-if-required = true;
+            }
+            { name = "ipxe-uefi-32";
+              test = "option[77].hex == 'iPXE' and (substring(option[60].hex,0,20) == 'PXEClient:Arch:00002' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00006')";
+              boot-file-name = "${nfsrootBaseUrl}/i386-ipxe.efi";
               only-if-required = true;
             }
-            { name = "ipxe";
-              test = "option[77].hex == 'iPXE'";
-              next-server = "10.141.0.1";
-              boot-file-name = "http://nfsroot.vidhar.yggdrasil/installer-x86_64-linux/netboot.ipxe";
+            { name = "ipxe-legacy";
+              test = "option[77].hex == 'iPXE' and substring(option[60].hex,0,20) == 'PXEClient:Arch:00000'";
+              boot-file-name = "${nfsrootBaseUrl}/ipxe.lkrn";
               only-if-required = true;
             }
+
             { name = "uefi-64";
               test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:00007' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00008' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00009'";
-              only-if-required = true;
               option-data = [
-                { name = "tftp-server-name"; data = "10.141.0.1"; }
+                { name = "tftp-server-name"; data = tftpIp; }
               ];
               boot-file-name = "ipxe.efi";
+              only-if-required = true;
             }
             { name = "uefi-32";
               test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:00002' or substring(option[60].hex,0,20) == 'PXEClient:Arch:00006'";
-              only-if-required = true;
               option-data = [
-                { name = "tftp-server-name"; data = "10.141.0.1"; }
+                { name = "tftp-server-name"; data = tftpIp; }
               ];
               boot-file-name = "i386-ipxe.efi";
+              only-if-required = true;
             }
             { name = "legacy";
               test = "substring(option[60].hex,0,20) == 'PXEClient:Arch:00000'";
-              only-if-required = true;
               option-data = [
-                { name = "tftp-server-name"; data = "10.141.0.1"; }
+                { name = "tftp-server-name"; data = tftpIp; }
               ];
-              boot-file-name = "undionly.kpxe";
+              boot-file-name = "ipxe.lkrn";
+              only-if-required = true;
             }
           ];
 
@@ -252,34 +303,78 @@ with lib;
           name = "nfsroot.vidhar.yggdrasil";
           paths =
             (map (system:
-               let
-                 installerBuild = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
-                   modules = [
-                     ({ ... }: {
-                       config.nfsroot.storeDevice = "10.141.0.1:nix-store";
-                       config.nfsroot.registrationUrl = "http://nfsroot.vidhar.yggdrasil/installer-${system}/registration";
-                     })
-                   ];
-                 }).config.system.build;
-               in builtins.toPath (pkgs.runCommandLocal "install-${system}" {} ''
-                 mkdir -p $out/installer-${system}
-                 install -m 0444 -t $out/installer-${system} \
-                   ${installerBuild.initialRamdisk}/initrd \
-                   ${installerBuild.kernel}/bzImage \
-                   ${installerBuild.netbootIpxeScript}/netboot.ipxe \
-                   ${pkgs.closureInfo { rootPaths = installerBuild.storeContents; }}/registration
-               '')
-              ) ["x86_64-linux"]
+              pkgs.symlinkJoin {
+                name = "installer-${system}";
+                paths = [
+                  (builtins.addErrorContext "while evaluating installer-${system}-nfsroot" (let
+                    installerBuild' = (flake.nixosConfigurations.${"installer-${system}-nfsroot"}.extendModules {
+                      modules = [
+                        ({ ... }: {
+                          config.nfsroot.storeDevice = "${nfsIp}:nix-store";
+                          config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/installer-${system}/registration";
+                          config.system.nixos.label = "installer-${system}";
+                        })
+                      ];
+                    });
+                    installerBuild = installerBuild'.config.system.build;
+                  in builtins.toPath (pkgs.runCommandLocal "installer-${system}" {} ''
+                    mkdir -p $out/installer-${system}
+                    install -m 0444 -t $out/installer-${system} \
+                      ${installerBuild.initialRamdisk}/initrd \
+                      ${installerBuild.kernel}/bzImage \
+                      ${installerBuild.netbootIpxeScript}/netboot.ipxe \
+                      ${pkgs.closureInfo { rootPaths = installerBuild.storeContents; }}/registration
+                    install -m 0444 ${pkgs.writeText "installer-${system}.menu.ipxe" ''
+                      #!ipxe
+
+                      :start
+                      menu iPXE boot menu for installer-${system}
+                      item installer ${with installerBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
+                      item memtest memtest86plus
+                      item netboot netboot.xyz
+                      item shell iPXE shell
+                      choose --timeout 0 --default installer selected || goto shell
+                      goto ''${selected}
+
+                      :shell
+                      shell
+                      goto start
+
+                      :installer
+                      chain installer-${system}/netboot.ipxe
+                      goto start
+
+                      :netboot
+                      iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
+                      goto start
+
+                      :memtest
+                      iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin
+                      goto start
+                    ''} $out/installer-${system}.menu.ipxe
+                  '')))
+                ];
+              }) ["x86_64-linux"]
             ) ++ [
-              (let
-                 eostreBuild = (flake.nixosConfigurations.eostre.extendModules {
+              (pkgs.runCommandLocal "utils" {} ''
+                mkdir $out
+                install -m 0444 -t $out \
+                  ${ipxe}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn} \
+                  ${pkgs.memtest86plus}/{memtest.efi,memtest.bin}
+                install -m 0444 ${sources.netbootxyz-efi.src} $out/netboot.xyz.efi
+                install -m 0444 ${sources.netbootxyz-lkrn.src} $out/netboot.xyz.lkrn
+              '')
+              (builtins.addErrorContext "while evaluating eostre" (let
+                 eostreBuild' = (flake.nixosConfigurations.eostre.extendModules {
                    modules = [
                      ({ ... }: {
-                       config.nfsroot.storeDevice = "10.141.0.1:nix-store";
-                       config.nfsroot.registrationUrl = "http://nfsroot.vidhar.yggdrasil/eostre/registration";
+                       config.nfsroot.storeDevice = "${nfsIp}:nix-store";
+                       config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/eostre/registration";
+                       config.system.nixos.label = "eostre";
                      })
                    ];
-                 }).config.system.build;
+                 });
+                 eostreBuild = eostreBuild'.config.system.build;
                in builtins.toPath (pkgs.runCommandLocal "eostre" {} ''
                     mkdir -p $out/eostre
                     install -m 0444 -t $out/eostre \
@@ -287,7 +382,39 @@ with lib;
                       ${eostreBuild.kernel}/bzImage \
                       ${eostreBuild.netbootIpxeScript}/netboot.ipxe \
                       ${pkgs.closureInfo { rootPaths = eostreBuild.storeContents; }}/registration
-                  ''))
+                    install -m 0444 ${pkgs.writeText "eostre.menu.ipxe" ''
+                      #!ipxe
+
+                      set menu-timeout 5000
+
+                      :start
+                      menu iPXE boot menu for eostre
+                      item eostre ${with eostreBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
+                      item memtest memtest86plus
+                      item netboot netboot.xyz
+                      item shell iPXE shell
+                      choose --timeout ''${menu-timeout} --default eostre selected || goto shell
+                      set menu-timeout 0
+                      goto ''${selected}
+
+                      :shell
+                      set menu-timeout 0
+                      shell
+                      goto start
+
+                      :eostre
+                      chain eostre/netboot.ipxe
+                      goto start
+
+                      :netboot
+                      iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
+                      goto start
+
+                      :memtest
+                      iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin
+                      goto start
+                    ''} $out/eostre.menu.ipxe
+                  '')))
             ];
         };
       };
@@ -298,20 +425,12 @@ with lib;
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig.ExecStart = let
-        ipxe = pkgs.ipxe.override {
-          additionalTargets = {
-            "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
-          };
-          additionalOptions = [
-            "NSLOOKUP_CMD"
-          ];
-        };
         tftpRoot = pkgs.runCommandLocal "netboot" {} ''
           mkdir -p $out
           install -m 0444 -t $out \
-            ${ipxe}/ipxe.efi ${ipxe}/i386-ipxe.efi ${ipxe}/undionly.kpxe
+            ${ipxe}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn}
         '';
-      in "${pkgs.atftp}/sbin/atftpd --daemon --no-fork --bind-address=10.141.0.1 ${tftpRoot}";
+      in "${pkgs.atftp}/sbin/atftpd --daemon --no-fork --bind-address=${tftpIp} ${tftpRoot}";
     };
   };
 }
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 9f519302..7897fb3d 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -1,4 +1,5 @@
 define icmp_protos = { ipv6-icmp, icmp, igmp }
+define bifrost_surtr = 2a03:4000:52:ada:4::/128
 
 table arp filter {
   limit lim_arp_local {
@@ -59,6 +60,7 @@ table inet filter {
   counter fw-lo {}
   counter fw-lan {}
   counter fw-gpon {}
+  counter fw-kimai {}
 
   counter fw-cups {}
 
@@ -90,6 +92,11 @@ table inet filter {
   counter http-rx {}
   counter tftp-rx {}
   counter pgbackrest-rx {}
+  counter immich-rx {}
+  counter paperless-rx {}
+  counter hledger-rx {}
+  counter audiobookshelf-rx {}
+  counter kimai-rx {}
 
   counter established-rx {}
 
@@ -118,6 +125,11 @@ table inet filter {
   counter http-tx {}
   counter tftp-tx {}
   counter pgbackrest-tx {}
+  counter immich-tx {}
+  counter paperless-tx {}
+  counter hledger-tx {}
+  counter audiobookshelf-tx {}
+  counter kimai-tx {}
 
   counter tx {}
 
@@ -141,8 +153,13 @@ table inet filter {
 
     oifname { lan, gpon, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
     iifname lan oifname { gpon, bifrost } counter name fw-lan accept
+    iifname ve-kimai oifname gpon counter name fw-kimai accept
 
     iifname gpon oifname lan ct state { established, related } counter name fw-gpon accept
+    iifname gpon oifname ve-kimai ct state { established, related } counter name fw-kimai accept
+
+    iifname bifrost oifname ve-kimai tcp dport 80 ip6 saddr $bifrost_surtr ip6 daddr 2a03:4000:52:ada:6::2 counter name kimai-rx accept
+    iifname ve-kimai oifname bifrost tcp sport 80 ip6 saddr 2a03:4000:52:ada:6::2 ip6 daddr $bifrost_surtr counter name kimai-tx accept
 
 
     limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop
@@ -193,6 +210,11 @@ table inet filter {
 
     tcp dport 8432 counter name pgbackrest-rx accept
 
+    iifname bifrost tcp dport 2283 ip6 saddr $bifrost_surtr counter name immich-rx accept
+    iifname bifrost tcp dport 28981 ip6 saddr $bifrost_surtr counter name paperless-rx accept
+    iifname bifrost tcp dport 5000 ip6 saddr $bifrost_surtr counter name hledger-rx accept
+    iifname bifrost tcp dport 28982 ip6 saddr $bifrost_surtr counter name audiobookshelf-rx accept
+
     ct state { established, related } counter name established-rx accept
 
 
@@ -240,6 +262,11 @@ table inet filter {
 
     tcp sport 8432 counter name pgbackrest-tx accept
 
+    iifname bifrost tcp sport 2283 ip6 daddr $bifrost_surtr counter name immich-tx accept
+    iifname bifrost tcp sport 28981 ip6 daddr $bifrost_surtr counter name paperless-tx accept
+    iifname bifrost tcp sport 5000 ip6 daddr $bifrost_surtr counter name hledger-tx accept
+    iifname bifrost tcp sport 28982 ip6 daddr $bifrost_surtr counter name audiobookshelf-tx accept
+
 
     counter name tx
   }
@@ -247,7 +274,7 @@ table inet filter {
 
 table inet nat {
   counter gpon-nat {}
-  # counter container-nat {}
+  counter kimai-nat {}
 
   chain postrouting {
     type nat hook postrouting priority srcnat
@@ -255,7 +282,7 @@ table inet nat {
 
 
     meta nfproto ipv4 oifname gpon counter name gpon-nat masquerade
-    # iifname ve-* oifname gpon counter name container-nat masquerade
+    iifname ve-kimai oifname gpon counter name kimai-nat masquerade
   }
 }
 
diff --git a/hosts/vidhar/paperless/default.nix b/hosts/vidhar/paperless/default.nix
new file mode 100644
index 00000000..dd02da38
--- /dev/null
+++ b/hosts/vidhar/paperless/default.nix
@@ -0,0 +1,25 @@
+{ config, ... }:
+
+{
+  config = {
+    services.paperless = {
+      enable = true;
+      address = "2a03:4000:52:ada:4:1::";
+      passwordFile = config.sops.secrets."paperless-rootpw".path;
+      settings = {
+        PAPERLESS_OCR_LANGUAGE = "deu+eng";
+        PAPERLESS_URL = "https://paperless.yggdrasil.li";
+        PAPERLESS_FILENAME_FORMAT = "{{ created_year }}/{{ document_type }}/{{ correspondent }}/{{ created }}_{{ doc_pk }}_{{ title }}";
+        PAPERLESS_FILENAME_FORMAT_REMOVE_NONE = "true";
+        PAPERLESS_TASK_WORKERS = "3";
+        PAPERLESS_THREADS_PER_WORKER = "4";
+      };
+      database.createLocally = true;
+    };
+
+    sops.secrets."paperless-rootpw" = {
+      format = "binary";
+      sopsFile = ./rootpw;
+    };
+  };
+}
diff --git a/hosts/vidhar/paperless/rootpw b/hosts/vidhar/paperless/rootpw
new file mode 100644
index 00000000..11f48fcb
--- /dev/null
+++ b/hosts/vidhar/paperless/rootpw
@@ -0,0 +1,24 @@
+{
+        "data": "ENC[AES256_GCM,data:Bsns3bLs7aA++eTf2Vh4g2iAXhmrMRTF,iv:zQ6hgXEvgHAloN6UMW54f2nYCvEhHPXQSBVSihHFiC0=,tag:uiGTEs07dpx12PcAjmbr9Q==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlVUJjdEdIZGd6UDJBRXlL\nODFyWDhHOU9oTEVCVlFiUXVXNm9XZmVuampVCkJ0YkFXTlZXVnRldmtlVkJaR3R2\nMFhpaHB5M3pLeDFkUkkzMUFydGNnOFEKLS0tIEJtNWc0V2JaaWYvQlp6TGxVdVZO\neVpzQzB5Um82TUZOeHBHeE50MGlqNWsKj1P54Fc+c5n35+Og9DwBWkvW947hgFsp\ni/G2QcaLHHJMTexTCZYsr1naSVa/cMBAbrZmtjz0HV4Q1kCJtvlrIg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1UG1QSWtXcFZoQVRBOC9D\nT2VnTW9pcTRCMForcHdZVld0c1NmNFZpWUNBCkRkMERKUVliYXRqb25saWxyb2JN\nbC9YL2ZQbytRM0ZjNmlQOTlTZTQrV2sKLS0tIFZyUWtRcXNqZUZxMGN5d0tHUng2\nVXNSdFEwMmtIVEdVRVlWeVU1YmJVSkUKRJa42k551QtiC6S0tmMv7eVN7GRqpXWz\nvzNh+BM9TOJNaTMmVesr4vXNDLOSFS3PxYv95xuOBzVg3zOHuai72g==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-02-13T19:20:33Z",
+                "mac": "ENC[AES256_GCM,data:mG6AC3L8MMeZ0Ajr7zV1mzPcHviQw2adtGjSbrbPRw1xqN7siu6svoybv8xkahP2Grq/xKAiyfXFOFo7Uyc3ub5fSovAEolNazqybZYsyam5vHpeC23dXcEkZUJSPJ9/CSB5uI9nX3NPC64QUjCxHZ7qfH5gcXT9D12H8LSqKlQ=,iv:4Skdj8l9jlTX9Unc2xE2hCKVawHBnHR8L4kZA6H8xNw=,tag:zJsJ3S//faAn7AGwLefNoA==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.4"
+        }
+}
\ No newline at end of file
diff --git a/hosts/vidhar/pgbackrest/default.nix b/hosts/vidhar/pgbackrest/default.nix
index ffb149f5..1e0828ce 100644
--- a/hosts/vidhar/pgbackrest/default.nix
+++ b/hosts/vidhar/pgbackrest/default.nix
@@ -130,8 +130,9 @@ in {
     };
 
     systemd.tmpfiles.rules = [
-      "d /var/lib/pgbackrest 0750 pgbackrest pgbackrest - -"
-      "d /var/spool/pgbackrest 0750 pgbackrest pgbackrest - -"
+      "d /var/lib/pgbackrest 0770 pgbackrest pgbackrest - -"
+      "d /var/spool/pgbackrest 0770 pgbackrest pgbackrest - -"
+      "d /tmp/pgbackrest 0770 pgbackrest pgbackrest - -"
     ];
 
     users = {
@@ -141,7 +142,9 @@ in {
         isSystemUser = true;
         home = "/var/lib/pgbackrest";
       };
-      groups.pgbackrest = {};
+      groups.pgbackrest = {
+        members = [ "postgres" ];
+      };
     };
 
     systemd.services."pgbackrest-tls-server".serviceConfig = {
diff --git a/hosts/vidhar/postgresql.nix b/hosts/vidhar/postgresql.nix
new file mode 100644
index 00000000..7e44e69f
--- /dev/null
+++ b/hosts/vidhar/postgresql.nix
@@ -0,0 +1,36 @@
+{ pkgs, config, flake, flakeInputs, ... }:
+
+let
+  nixpkgs-pgbackrest = import (flakeInputs.nixpkgs-pgbackrest.outPath + "/pkgs/top-level") {
+    overlays = [ flake.overlays.libdscp ];
+    localSystem = config.nixpkgs.system;
+  };
+in {
+  config = {
+    services.postgresql = {
+      enable = true;
+      package = pkgs.postgresql_15;
+    };
+
+    services.pgbackrest = {
+      settings."vidhar" = {
+        pg1-path = config.services.postgresql.dataDir;
+
+        repo1-path = "/var/lib/pgbackrest";
+        repo1-retention-full-type = "time";
+        repo1-retention-full = 14;
+        repo1-retention-archive = 7;
+      };
+
+      backups."vidhar-daily" = {
+        stanza = "vidhar";
+        repo = "1";
+        timerConfig.OnCalendar = "daily";
+      };
+    };
+
+    systemd.services.postgresql.serviceConfig = {
+      ReadWritePaths = [ "/var/spool/pgbackrest" "/var/lib/pgbackrest/archive/vidhar" ];
+    };
+  };
+}
diff --git a/hosts/vidhar/prometheus/default.nix b/hosts/vidhar/prometheus/default.nix
index d368ad52..094f9f7a 100644
--- a/hosts/vidhar/prometheus/default.nix
+++ b/hosts/vidhar/prometheus/default.nix
@@ -26,7 +26,8 @@ in {
       enable = true;
 
       extraFlags = [
-        "--enable-feature=remote-write-receiver"
+        "--web.enable-remote-write-receiver"
+        "--storage.tsdb.retention.size=35GB"
       ];
 
       exporters = {
diff --git a/hosts/vidhar/zfs.nix b/hosts/vidhar/zfs.nix
index 518c3287..9d667fd6 100644
--- a/hosts/vidhar/zfs.nix
+++ b/hosts/vidhar/zfs.nix
@@ -34,7 +34,7 @@ with lib;
         };
 
       "/etc/zfs/zfs-list.cache" =
-        { device = "ssd-raid1/local/zfs-zfs--list.cache";
+        { device = "ssd-raid1/local/etc-zfs-zfs--list.cache";
           fsType = "zfs";
           neededForBoot = true;
         };
diff --git a/installer-profiles/cd-dvd.nix b/installer-profiles/cd-dvd.nix
index 45291bad..ac12d885 100644
--- a/installer-profiles/cd-dvd.nix
+++ b/installer-profiles/cd-dvd.nix
@@ -1,7 +1,13 @@
-{ flakeInputs, ... }:
+{ flakeInputs, lib, ... }:
 
 {
   imports = [
     "${flakeInputs.nixpkgs.outPath}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
   ];
+
+  config = {
+    isoImage.squashfsCompression = "zstd -Xcompression-level 9";
+    system.installer.channel.enable = false;
+    boot.loader.grub.memtest86.enable = lib.mkForce false;
+  };
 }
diff --git a/installer-profiles/netboot.nix b/installer-profiles/netboot.nix
index 28e8084d..6e39ebfb 100644
--- a/installer-profiles/netboot.nix
+++ b/installer-profiles/netboot.nix
@@ -4,4 +4,9 @@
   imports = [
     "${flakeInputs.nixpkgs.outPath}/nixos/modules/installer/netboot/netboot-minimal.nix"
   ];
+
+  config = {
+    netboot.squashfsCompression = "zstd -Xcompression-level 9";
+    system.installer.channel.enable = false;
+  };
 }
diff --git a/installer-profiles/nfsroot.nix b/installer-profiles/nfsroot.nix
index 6bd875b4..a8f6def6 100644
--- a/installer-profiles/nfsroot.nix
+++ b/installer-profiles/nfsroot.nix
@@ -8,4 +8,6 @@
     "${flakeInputs.nixpkgs.outPath}/nixos/modules/profiles/base.nix"
     "${flakeInputs.nixpkgs.outPath}/nixos/modules/profiles/installation-device.nix"
   ];
+
+  config.system.installer.channel.enable = false;
 }
diff --git a/installer/default.nix b/installer/default.nix
index cd1ee064..26f38572 100644
--- a/installer/default.nix
+++ b/installer/default.nix
@@ -8,7 +8,7 @@ with lib;
   ];
 
   config = {
-    boot.initrd.availableKernelModules = [ "e1000e" ];
+    boot.initrd.kernelModules = [ "e1000e" "virtio_net" ];
 
     hardware.cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware;
 
@@ -47,7 +47,7 @@ with lib;
     services.xserver.videoDrivers = [ "nvidia" ];
     systemd.services.nvidia-control-devices = {
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.linuxPackages.nvidia_x11.bin}/bin/nvidia-smi";
+      serviceConfig.ExecStart = lib.getExe' pkgs.linuxPackages.nvidia_x11.bin "nvidia-smi";
     };
     nixpkgs.externalConfig.allowUnfree = true;
 
@@ -57,6 +57,10 @@ with lib;
 
     system.disableInstallerTools = false;
 
+    xdg.autostart.enable = lib.mkForce false;
+    xdg.icons.enable = lib.mkForce false;
+    xdg.mime.enable = lib.mkForce false;
+
     systemd.sysusers.enable = false;
     system.machine-id.generate.enable = false;
     system.stateVersion = config.system.nixos.release; # No state in installer
diff --git a/lib/pythonSet.nix b/lib/pythonSet.nix
new file mode 100644
index 00000000..c69216cc
--- /dev/null
+++ b/lib/pythonSet.nix
@@ -0,0 +1,42 @@
+{ uv2nix, pyproject-nix, pyproject-build-systems, ... }:
+{ pkgs, python, overlay, lib ? pkgs.lib }:
+(pkgs.callPackage pyproject-nix.build.packages {
+  inherit python;
+}).overrideScope
+  (
+    lib.composeManyExtensions [
+      pyproject-build-systems.overlays.default
+      overlay
+      (final: prev: {
+        sdnotify = (prev.sdnotify.override {
+          sourcePreference = "sdist";
+        }).overrideAttrs (oldAttrs: {
+          nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [
+            (final.resolveBuildSystem { setuptools = []; })
+          ];
+        });
+        systemd-python = (prev.systemd-python.override {
+          sourcePreference = "sdist";
+        }).overrideAttrs (oldAttrs: {
+          nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [
+            pkgs.pkg-config pkgs.systemd.dev
+            (final.resolveBuildSystem { setuptools = []; })
+          ];
+        });
+        halo = (prev.halo.override {
+          sourcePreference = "sdist";
+        }).overrideAttrs (oldAttrs: {
+          nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [
+            (final.resolveBuildSystem { setuptools = []; })
+          ];
+        });
+        unshare = (prev.unshare.override {
+          sourcePreference = "sdist";
+        }).overrideAttrs (oldAttrs: {
+          nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [
+            (final.resolveBuildSystem { setuptools = []; })
+          ];
+        });
+      })
+    ]
+  )
diff --git a/modules/abs-podcast-autoplaylist.nix b/modules/abs-podcast-autoplaylist.nix
new file mode 100644
index 00000000..f526a434
--- /dev/null
+++ b/modules/abs-podcast-autoplaylist.nix
@@ -0,0 +1,55 @@
+{ config, pkgs, lib, utils, ... }:
+
+let
+  cfg = config.services.abs-podcast-autoplaylist;
+
+  enabledAttrs = lib.filterAttrs (_name: { enable, ... }: enable) cfg;
+in {
+  options = {
+    services.abs-podcast-autoplaylist = lib.mkOption {
+      default = {};
+      type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
+        options = {
+          enable = lib.mkEnableOption "this instance of abs-podcast-autoplaylist" // {
+            default = true;
+          };
+          cron = lib.mkOption {
+            type = lib.types.str;
+            default = "*-*-* *:00/30:00";
+          };
+          configSecret = lib.mkOption {
+            type = lib.types.str;
+            default = "abs-podcast-autoplaylist-${name}.toml";
+          };
+        };
+      }));
+    };
+  };
+
+  config = lib.mkIf (enabledAttrs != {}) {
+    systemd.services = {
+      "abs-podcast-autoplaylist@" = {
+        serviceConfig = {
+          WorkingDirectory = "%d";
+          DynamicUser = true;
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          Type = "oneshot";
+          ExecStart = "${lib.getExe pkgs.abs-podcast-autoplaylist} %I.toml";
+          TimeoutSec = "5min";
+        };
+      };
+    } // lib.mapAttrs' (name: { configSecret, ... }: lib.nameValuePair "abs-podcast-autoplaylist@${utils.escapeSystemdPath name}" {
+      overrideStrategy = "asDropin";
+      serviceConfig = {
+        LoadCredential = "${name}.toml:${config.sops.secrets.${configSecret}.path}";
+      };
+    }) enabledAttrs;
+
+    systemd.timers = lib.mapAttrs' (name: { cron, ... }: lib.nameValuePair "abs-podcast-autoplaylist@${utils.escapeSystemdPath name}" {
+      wantedBy = [ "timers.target" ];
+      timerConfig.OnCalendar = cron;
+    }) enabledAttrs;
+  };
+}
diff --git a/modules/backup-utils.nix b/modules/backup-utils.nix
index 82a42ecd..698140da 100644
--- a/modules/backup-utils.nix
+++ b/modules/backup-utils.nix
@@ -9,5 +9,8 @@ with lib;
 
   config = {
     services.borgsnap.archive-prefix = mkDefault "yggdrasil.${hostName}.";
+
+    systemd.services."zfssnap-prune".restartIfChanged = false;
+    systemd.services."zfssnap".restartIfChanged = false;
   };
 }
diff --git a/modules/borgcopy/.envrc b/modules/borgcopy/.envrc
new file mode 100644
index 00000000..01e755c1
--- /dev/null
+++ b/modules/borgcopy/.envrc
@@ -0,0 +1,4 @@
+use flake
+
+uv venv && uv sync
+. .venv/bin/activate
diff --git a/modules/borgcopy/.gitignore b/modules/borgcopy/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/modules/borgcopy/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/modules/borgcopy/default.nix b/modules/borgcopy/default.nix
index 475edbd9..af021777 100644
--- a/modules/borgcopy/default.nix
+++ b/modules/borgcopy/default.nix
@@ -1,27 +1,35 @@
-{ config, pkgs, lib, utils, flakeInputs, ... }:
+{ config, pkgs, lib, utils, flake, flakeInputs, ... }:
 
 with lib;
 
 let
-  copyBorg =
-    with pkgs.poetry2nix;
-    mkPoetryApplication {
-      projectDir = cleanPythonSources { src = ./.; };
+  copyBorg = let
+    workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
+    pythonSet = flake.lib.pythonSet {
+      inherit pkgs;
+      python = pkgs.python312;
+      overlay = workspace.mkPyprojectOverlay {
+        sourcePreference = "wheel";
+      };
+    };
+    virtualEnv = pythonSet.mkVirtualEnv "copy_borg" workspace.deps.default;
+  in virtualEnv.overrideAttrs (oldAttrs: {
+    meta = (oldAttrs.meta or {}) // {
+      mainProgram = "copy_borg";
+    };
 
-      overrides = overrides.withDefaults (self: super: {
-        pyprctl = super.pyprctl.overridePythonAttrs (oldAttrs: {
-          buildInputs = (oldAttrs.buildInputs or []) ++ [super.setuptools];
-        });
-        inherit (pkgs.python3Packages) python-unshare;
-      });
+    nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [ pkgs.makeWrapper ];
 
-      postInstall = ''
-        wrapProgram $out/bin/copy_borg \
-          --prefix PATH : ${makeBinPath (with pkgs; [util-linux borgbackup])}:${config.security.wrapperDir}
-      '';
-    };
+    postInstall = ''
+      ${oldAttrs.postInstall or ""}
+
+      wrapProgram $out/bin/copy_borg \
+        --prefix PATH : ${makeBinPath (with pkgs; [util-linux borgbackup])}:${config.security.wrapperDir}
+    '';
+  });
 
   copyService = name: opts: nameValuePair "copy-borg@${utils.escapeSystemdPath name}" {
+    restartIfChanged = false;
     serviceConfig = {
       Type = "oneshot";
       ExecStart = "${copyBorg}/bin/copy_borg --verbosity ${toString opts.verbosity} ${utils.escapeSystemdExecArgs [opts.from opts.to]}";
diff --git a/modules/borgcopy/poetry.lock b/modules/borgcopy/poetry.lock
deleted file mode 100644
index 759ecfe9..00000000
--- a/modules/borgcopy/poetry.lock
+++ /dev/null
@@ -1,180 +0,0 @@
-# This file is automatically @generated by Poetry 1.4.2 and should not be changed by hand.
-
-[[package]]
-name = "colorama"
-version = "0.4.6"
-description = "Cross-platform colored terminal text."
-category = "main"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*,!=3.6.*,>=2.7"
-files = [
-    {file = "colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6"},
-    {file = "colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44"},
-]
-
-[[package]]
-name = "halo"
-version = "0.0.31"
-description = "Beautiful terminal spinners in Python"
-category = "main"
-optional = false
-python-versions = ">=3.4"
-files = [
-    {file = "halo-0.0.31-py2-none-any.whl", hash = "sha256:5350488fb7d2aa7c31a1344120cee67a872901ce8858f60da7946cef96c208ab"},
-    {file = "halo-0.0.31.tar.gz", hash = "sha256:7b67a3521ee91d53b7152d4ee3452811e1d2a6321975137762eb3d70063cc9d6"},
-]
-
-[package.dependencies]
-colorama = ">=0.3.9"
-log-symbols = ">=0.0.14"
-six = ">=1.12.0"
-spinners = ">=0.0.24"
-termcolor = ">=1.1.0"
-
-[package.extras]
-ipython = ["IPython (==5.7.0)", "ipywidgets (==7.1.0)"]
-
-[[package]]
-name = "humanize"
-version = "4.6.0"
-description = "Python humanize utilities"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "humanize-4.6.0-py3-none-any.whl", hash = "sha256:401201aca462749773f02920139f302450cb548b70489b9b4b92be39fe3c3c50"},
-    {file = "humanize-4.6.0.tar.gz", hash = "sha256:5f1f22bc65911eb1a6ffe7659bd6598e33dcfeeb904eb16ee1e705a09bf75916"},
-]
-
-[package.extras]
-tests = ["freezegun", "pytest", "pytest-cov"]
-
-[[package]]
-name = "log-symbols"
-version = "0.0.14"
-description = "Colored symbols for various log levels for Python"
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "log_symbols-0.0.14-py3-none-any.whl", hash = "sha256:4952106ff8b605ab7d5081dd2c7e6ca7374584eff7086f499c06edd1ce56dcca"},
-    {file = "log_symbols-0.0.14.tar.gz", hash = "sha256:cf0bbc6fe1a8e53f0d174a716bc625c4f87043cc21eb55dd8a740cfe22680556"},
-]
-
-[package.dependencies]
-colorama = ">=0.3.9"
-
-[[package]]
-name = "pyprctl"
-version = "0.1.3"
-description = "An interface to Linux's prctl() syscall written in pure Python using ctypes."
-category = "main"
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "pyprctl-0.1.3-py3-none-any.whl", hash = "sha256:6302e5114f078fb33e5799835d0a69e2fc180bb6b28ad073515fa40c5272f1dd"},
-    {file = "pyprctl-0.1.3.tar.gz", hash = "sha256:1fb54d3ab030ec02e4afc38fb9662d6634c12834e91ae7959de56a9c09f69c26"},
-]
-
-[[package]]
-name = "python-dateutil"
-version = "2.8.2"
-description = "Extensions to the standard Python datetime module"
-category = "main"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-files = [
-    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
-    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
-]
-
-[package.dependencies]
-six = ">=1.5"
-
-[[package]]
-name = "python-unshare"
-version = "0.2"
-description = "Python bindings for the Linux unshare() syscall"
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "python-unshare-0.2.tar.gz", hash = "sha256:f79b7de441b6c27930b775085a6a4fd2f378b628737aaaebc2a6c519023fd47a"},
-]
-
-[[package]]
-name = "six"
-version = "1.16.0"
-description = "Python 2 and 3 compatibility utilities"
-category = "main"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
-    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
-]
-
-[[package]]
-name = "spinners"
-version = "0.0.24"
-description = "Spinners for terminals"
-category = "main"
-optional = false
-python-versions = "*"
-files = [
-    {file = "spinners-0.0.24-py3-none-any.whl", hash = "sha256:2fa30d0b72c9650ad12bbe031c9943b8d441e41b4f5602b0ec977a19f3290e98"},
-    {file = "spinners-0.0.24.tar.gz", hash = "sha256:1eb6aeb4781d72ab42ed8a01dcf20f3002bf50740d7154d12fb8c9769bf9e27f"},
-]
-
-[[package]]
-name = "termcolor"
-version = "2.2.0"
-description = "ANSI color formatting for output in terminal"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "termcolor-2.2.0-py3-none-any.whl", hash = "sha256:91ddd848e7251200eac969846cbae2dacd7d71c2871e92733289e7e3666f48e7"},
-    {file = "termcolor-2.2.0.tar.gz", hash = "sha256:dfc8ac3f350788f23b2947b3e6cfa5a53b630b612e6cd8965a015a776020b99a"},
-]
-
-[package.extras]
-tests = ["pytest", "pytest-cov"]
-
-[[package]]
-name = "tqdm"
-version = "4.65.0"
-description = "Fast, Extensible Progress Meter"
-category = "main"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "tqdm-4.65.0-py3-none-any.whl", hash = "sha256:c4f53a17fe37e132815abceec022631be8ffe1b9381c2e6e30aa70edc99e9671"},
-    {file = "tqdm-4.65.0.tar.gz", hash = "sha256:1871fb68a86b8fb3b59ca4cdd3dcccbc7e6d613eeed31f4c332531977b89beb5"},
-]
-
-[package.dependencies]
-colorama = {version = "*", markers = "platform_system == \"Windows\""}
-
-[package.extras]
-dev = ["py-make (>=0.1.0)", "twine", "wheel"]
-notebook = ["ipywidgets (>=6)"]
-slack = ["slack-sdk"]
-telegram = ["requests"]
-
-[[package]]
-name = "xdg"
-version = "6.0.0"
-description = "Variables defined by the XDG Base Directory Specification"
-category = "main"
-optional = false
-python-versions = ">=3.7,<4.0"
-files = [
-    {file = "xdg-6.0.0-py3-none-any.whl", hash = "sha256:df3510755b4395157fc04fc3b02467c777f3b3ca383257397f09ab0d4c16f936"},
-    {file = "xdg-6.0.0.tar.gz", hash = "sha256:24278094f2d45e846d1eb28a2ebb92d7b67fc0cab5249ee3ce88c95f649a1c92"},
-]
-
-[metadata]
-lock-version = "2.0"
-python-versions = ">=3.10.0,<3.12"
-content-hash = "3c6b538852447a8f3ae34e1be122716d47e669a2b44f7c5d3d850e5d877353c7"
diff --git a/modules/borgcopy/pyproject.toml b/modules/borgcopy/pyproject.toml
index f3401ed2..d76d73c6 100644
--- a/modules/borgcopy/pyproject.toml
+++ b/modules/borgcopy/pyproject.toml
@@ -1,22 +1,25 @@
-[tool.poetry]
+[project]
 name = "copy_borg"
 version = "0.0.0"
-authors = ["Gregor Kleen <gkleen@yggdrasil.li>"]
 description = ""
+authors = [{ name = "Gregor Kleen", email = "gkleen@yggdrasil.li" }]
+requires-python = "~=3.12"
+dependencies = [
+    "humanize>=4.6.0,<5",
+    "tqdm>=4.65.0,<5",
+    "python-dateutil>=2.8.2,<3",
+    "xdg>=6.0.0,<7",
+    "pyprctl>=0.1.3,<0.2",
+    "halo>=0.0.31,<0.0.32",
+    "unshare>=0.22",
+]
 
-[tool.poetry.scripts]
+[project.scripts]
 copy_borg = "copy_borg.__main__:main"
 
-[tool.poetry.dependencies]
-python = ">=3.10.0,<3.12"
-humanize = "^4.6.0"
-tqdm = "^4.65.0"
-python-dateutil = "^2.8.2"
-xdg = "^6.0.0"
-python-unshare = "^0.2"
-pyprctl = "^0.1.3"
-halo = "^0.0.31"
-
 [build-system]
-requires = ["poetry-core>=1.0.0"]
-build-backend = "poetry.core.masonry.api"
\ No newline at end of file
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["copy_borg"]
diff --git a/modules/borgcopy/uv.lock b/modules/borgcopy/uv.lock
new file mode 100644
index 00000000..1a282598
--- /dev/null
+++ b/modules/borgcopy/uv.lock
@@ -0,0 +1,146 @@
+version = 1
+revision = 2
+requires-python = ">=3.12, <4"
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "copy-borg"
+version = "0.0.0"
+source = { editable = "." }
+dependencies = [
+    { name = "halo" },
+    { name = "humanize" },
+    { name = "pyprctl" },
+    { name = "python-dateutil" },
+    { name = "tqdm" },
+    { name = "unshare" },
+    { name = "xdg" },
+]
+
+[package.metadata]
+requires-dist = [
+    { name = "halo", specifier = ">=0.0.31,<0.0.32" },
+    { name = "humanize", specifier = ">=4.6.0,<5" },
+    { name = "pyprctl", specifier = ">=0.1.3,<0.2" },
+    { name = "python-dateutil", specifier = ">=2.8.2,<3" },
+    { name = "tqdm", specifier = ">=4.65.0,<5" },
+    { name = "unshare", specifier = ">=0.22" },
+    { name = "xdg", specifier = ">=6.0.0,<7" },
+]
+
+[[package]]
+name = "halo"
+version = "0.0.31"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama" },
+    { name = "log-symbols" },
+    { name = "six" },
+    { name = "spinners" },
+    { name = "termcolor" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ee/48/d53580d30b1fabf25d0d1fcc3f5b26d08d2ac75a1890ff6d262f9f027436/halo-0.0.31.tar.gz", hash = "sha256:7b67a3521ee91d53b7152d4ee3452811e1d2a6321975137762eb3d70063cc9d6", size = 11666, upload-time = "2020-11-10T02:36:48.335Z" }
+
+[[package]]
+name = "humanize"
+version = "4.12.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/22/d1/bbc4d251187a43f69844f7fd8941426549bbe4723e8ff0a7441796b0789f/humanize-4.12.3.tar.gz", hash = "sha256:8430be3a615106fdfceb0b2c1b41c4c98c6b0fc5cc59663a5539b111dd325fb0", size = 80514, upload-time = "2025-04-30T11:51:07.98Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a0/1e/62a2ec3104394a2975a2629eec89276ede9dbe717092f6966fcf963e1bf0/humanize-4.12.3-py3-none-any.whl", hash = "sha256:2cbf6370af06568fa6d2da77c86edb7886f3160ecd19ee1ffef07979efc597f6", size = 128487, upload-time = "2025-04-30T11:51:06.468Z" },
+]
+
+[[package]]
+name = "log-symbols"
+version = "0.0.14"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/45/87/e86645d758a4401c8c81914b6a88470634d1785c9ad09823fa4a1bd89250/log_symbols-0.0.14.tar.gz", hash = "sha256:cf0bbc6fe1a8e53f0d174a716bc625c4f87043cc21eb55dd8a740cfe22680556", size = 3211, upload-time = "2019-08-08T06:32:22.538Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/28/5d/d710c38be68b0fb54e645048fe359c3904cc3cb64b2de9d40e1712bf110c/log_symbols-0.0.14-py3-none-any.whl", hash = "sha256:4952106ff8b605ab7d5081dd2c7e6ca7374584eff7086f499c06edd1ce56dcca", size = 3081, upload-time = "2019-08-08T06:32:20.604Z" },
+]
+
+[[package]]
+name = "pyprctl"
+version = "0.1.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c9/16/6ed71ebcad76c1cd5f22185bcc6b31c0ee62fc5e693b626febea8fedeba3/pyprctl-0.1.3.tar.gz", hash = "sha256:1fb54d3ab030ec02e4afc38fb9662d6634c12834e91ae7959de56a9c09f69c26", size = 18739, upload-time = "2021-10-26T23:52:03.87Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/bf/5e/62765de39bbce8111fb1f4453a4a804913bf49179fa265fb713ed66c9d15/pyprctl-0.1.3-py3-none-any.whl", hash = "sha256:6302e5114f078fb33e5799835d0a69e2fc180bb6b28ad073515fa40c5272f1dd", size = 20016, upload-time = "2021-10-26T23:52:02.986Z" },
+]
+
+[[package]]
+name = "python-dateutil"
+version = "2.9.0.post0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/66/c0/0c8b6ad9f17a802ee498c46e004a0eb49bc148f2fd230864601a86dcf6db/python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 342432, upload-time = "2024-03-01T18:36:20.211Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
+]
+
+[[package]]
+name = "six"
+version = "1.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/94/e7/b2c673351809dca68a0e064b6af791aa332cf192da575fd474ed7d6f16a2/six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81", size = 34031, upload-time = "2024-12-04T17:35:28.174Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" },
+]
+
+[[package]]
+name = "spinners"
+version = "0.0.24"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d3/91/bb331f0a43e04d950a710f402a0986a54147a35818df0e1658551c8d12e1/spinners-0.0.24.tar.gz", hash = "sha256:1eb6aeb4781d72ab42ed8a01dcf20f3002bf50740d7154d12fb8c9769bf9e27f", size = 5308, upload-time = "2020-02-19T21:42:32.326Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9f/8e/3310207a68118000ca27ac878b8386123628b335ecb3d4bec4743357f0d1/spinners-0.0.24-py3-none-any.whl", hash = "sha256:2fa30d0b72c9650ad12bbe031c9943b8d441e41b4f5602b0ec977a19f3290e98", size = 5499, upload-time = "2020-02-19T21:42:30.876Z" },
+]
+
+[[package]]
+name = "termcolor"
+version = "3.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ca/6c/3d75c196ac07ac8749600b60b03f4f6094d54e132c4d94ebac6ee0e0add0/termcolor-3.1.0.tar.gz", hash = "sha256:6a6dd7fbee581909eeec6a756cff1d7f7c376063b14e4a298dc4980309e55970", size = 14324, upload-time = "2025-04-30T11:37:53.791Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4f/bd/de8d508070629b6d84a30d01d57e4a65c69aa7f5abe7560b8fad3b50ea59/termcolor-3.1.0-py3-none-any.whl", hash = "sha256:591dd26b5c2ce03b9e43f391264626557873ce1d379019786f99b0c2bee140aa", size = 7684, upload-time = "2025-04-30T11:37:52.382Z" },
+]
+
+[[package]]
+name = "tqdm"
+version = "4.67.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a8/4b/29b4ef32e036bb34e4ab51796dd745cdba7ed47ad142a9f4a1eb8e0c744d/tqdm-4.67.1.tar.gz", hash = "sha256:f8aef9c52c08c13a65f30ea34f4e5aac3fd1a34959879d7e59e63027286627f2", size = 169737, upload-time = "2024-11-24T20:12:22.481Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d0/30/dc54f88dd4a2b5dc8a0279bdd7270e735851848b762aeb1c1184ed1f6b14/tqdm-4.67.1-py3-none-any.whl", hash = "sha256:26445eca388f82e72884e0d580d5464cd801a3ea01e63e5601bdff9ba6a48de2", size = 78540, upload-time = "2024-11-24T20:12:19.698Z" },
+]
+
+[[package]]
+name = "unshare"
+version = "0.22"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/15/85/2ba218129c95b894efe87506489b525f859c40f6e21cb0521ff3cec754f4/unshare-0.22.tar.gz", hash = "sha256:d521d72cca6e876f22cbd5ff5eb51f1beef75e8f9c53b599b55fa05fba1dd3a6", size = 2041, upload-time = "2019-10-17T12:58:31.498Z" }
+
+[[package]]
+name = "xdg"
+version = "6.0.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/2a/b9/0e6e6f19fb75cf5e1758f4f33c1256738f718966700cffc0fde2f966218b/xdg-6.0.0.tar.gz", hash = "sha256:24278094f2d45e846d1eb28a2ebb92d7b67fc0cab5249ee3ce88c95f649a1c92", size = 3453, upload-time = "2023-02-27T19:27:44.309Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dd/54/3516c1cf349060fc3578686d271eba242f10ec00b4530c2985af9faac49b/xdg-6.0.0-py3-none-any.whl", hash = "sha256:df3510755b4395157fc04fc3b02467c777f3b3ca383257397f09ab0d4c16f936", size = 3855, upload-time = "2023-02-27T19:27:42.151Z" },
+]
diff --git a/modules/envfs.nix b/modules/envfs.nix
deleted file mode 100644
index b5b453a5..00000000
--- a/modules/envfs.nix
+++ /dev/null
@@ -1,77 +0,0 @@
-{ pkgs, config, lib, ... }:
-
-let
-  cfg = config.services.envfs;
-  mounts = {
-    "/usr/bin" = {
-      device = "none";
-      fsType = "envfs";
-      options = [
-        "bind-mount=/bin"
-        "fallback-path=${pkgs.symlinkJoin {
-          name = "fallback-path";
-          inherit (cfg) paths;
-        }}"
-        "nofail"
-      ];
-    };
-    "/bin" = {
-      device = "/usr/bin";
-      fsType = "none";
-      options = [ "bind" "nofail" ];
-    };
-  };
-in {
-  disabledModules = [ "tasks/filesystems/envfs.nix" ];
-
-  options = {
-    services.envfs = {
-      enable = lib.mkEnableOption "Envfs filesystem" // {
-        default = true;
-        description = ''
-          Fuse filesystem that returns symlinks to executables based on the PATH
-          of the requesting process. This is useful to execute shebangs on NixOS
-          that assume hard coded locations in locations like /bin or /usr/bin
-          etc.
-        '';
-      };
-
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.envfs;
-        defaultText = lib.literalExpression "pkgs.envfs";
-        description = "Which package to use for the envfs.";
-      };
-
-      paths = lib.mkOption {
-        type = lib.types.listOf lib.types.package;
-        default = [
-          (pkgs.runCommand "fallback-path-environment" {} ''
-            mkdir -p $out
-            ln -s ${config.environment.usrbinenv} $out/env
-            ln -s ${config.environment.binsh} $out/sh
-          '')
-        ];
-        defaultText = lib.literalExpression ''
-          [ (pkgs.runCommand "fallback-path-environment" {} '''
-              mkdir -p $out
-              ln -s ''${config.environment.usrbinenv} $out/env
-              ln -s ''${config.environment.binsh} $out/sh
-            ''')
-          ]
-        '';
-        description = "Extra packages to join into collection of fallback executables in case not other executable is found";
-      };
-    };
-  };
-
-  config = lib.mkIf (cfg.enable) {
-    environment.systemPackages = [ cfg.package ];
-    # we also want these mounts in virtual machines.
-    fileSystems = if config.virtualisation ? qemu then lib.mkVMOverride mounts else mounts;
-
-    # We no longer need those when using envfs
-    system.activationScripts.usrbinenv = lib.mkForce "";
-    system.activationScripts.binsh = lib.mkForce "";
-  };
-}
diff --git a/modules/i18n.nix b/modules/i18n.nix
new file mode 100644
index 00000000..f84e8b64
--- /dev/null
+++ b/modules/i18n.nix
@@ -0,0 +1,156 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  aggregatedLocales =
+    (builtins.map
+      (l: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8")
+      (
+        [ config.i18n.defaultLocale ]
+        ++ (lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales)
+        ++ (lib.attrValues (lib.filterAttrs (n: _v: lib.hasPrefix "LC_" n) config.i18n.extraLocaleSettings))
+      )
+    )
+    ++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
+in
+{
+  disabledModules = [ "config/i18n.nix" ];
+
+  ###### interface
+
+  options = {
+
+    i18n = {
+      glibcLocales = lib.mkOption {
+        type = lib.types.path;
+        default = pkgs.glibcLocales.override {
+          allLocales = lib.any (x: x == "all") config.i18n.supportedLocales;
+          locales = config.i18n.supportedLocales;
+        };
+        defaultText = lib.literalExpression ''
+          pkgs.glibcLocales.override {
+            allLocales = lib.any (x: x == "all") config.i18n.supportedLocales;
+            locales = config.i18n.supportedLocales;
+          }
+        '';
+        example = lib.literalExpression "pkgs.glibcLocales";
+        description = ''
+          Customized pkg.glibcLocales package.
+
+          Changing this option can disable handling of i18n.defaultLocale
+          and supportedLocale.
+        '';
+      };
+
+      defaultLocale = lib.mkOption {
+        type = lib.types.str;
+        default = "en_US.UTF-8";
+        example = "nl_NL.UTF-8";
+        description = ''
+          The default locale.  It determines the language for program
+          messages, the format for dates and times, sort order, and so on.
+          It also determines the character set, such as UTF-8.
+        '';
+      };
+
+      extraLocales = lib.mkOption {
+        type = lib.types.either (lib.types.listOf lib.types.str) (lib.types.enum [ "all" ]);
+        default = [ ];
+        example = [ "nl_NL.UTF-8" ];
+        description = ''
+          Additional locales that the system should support, besides the ones
+          configured with {option}`i18n.defaultLocale` and
+          {option}`i18n.extraLocaleSettings`.
+          Set this to `"all"` to install all available locales.
+        '';
+      };
+
+      extraLocaleSettings = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        example = {
+          LC_MESSAGES = "en_US.UTF-8";
+          LC_TIME = "de_DE.UTF-8";
+        };
+        description = ''
+          A set of additional system-wide locale settings other than
+          `LANG` which can be configured with
+          {option}`i18n.defaultLocale`.
+        '';
+      };
+
+      supportedLocales = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        visible = false;
+        default = lib.unique (
+          [
+            "C.UTF-8/UTF-8"
+            "en_US.UTF-8/UTF-8"
+          ]
+          ++ aggregatedLocales
+        );
+        example = [
+          "en_US.UTF-8/UTF-8"
+          "nl_NL.UTF-8/UTF-8"
+          "nl_NL/ISO-8859-1"
+        ];
+        description = ''
+          List of locales that the system should support.  The value
+          `"all"` means that all locales supported by
+          Glibc will be installed.  A full list of supported locales
+          can be found at <https://sourceware.org/git/?p=glibc.git;a=blob;f=localedata/SUPPORTED>.
+        '';
+      };
+
+    };
+
+  };
+
+  ###### implementation
+
+  config = {
+    warnings =
+      lib.optional
+        (
+          !(
+            (lib.subtractLists config.i18n.supportedLocales aggregatedLocales) == [ ]
+            || lib.any (x: x == "all") config.i18n.supportedLocales
+          )
+        )
+        ''
+          `i18n.supportedLocales` is deprecated in favor of `i18n.extraLocales`,
+          and it seems you are using `i18n.supportedLocales` and forgot to
+          include some locales specified in `i18n.defaultLocale`,
+          `i18n.extraLocales` or `i18n.extraLocaleSettings`.
+
+          If you're trying to install additional locales not specified in
+          `i18n.defaultLocale` or `i18n.extraLocaleSettings`, consider adding
+          only those locales to `i18n.extraLocales`.
+        '';
+
+    environment.systemPackages =
+      # We increase the priority a little, so that plain glibc in systemPackages can't win.
+      lib.optional (config.i18n.supportedLocales != [ ]) (lib.setPrio (-1) config.i18n.glibcLocales);
+
+    environment.sessionVariables = {
+      LANG = config.i18n.defaultLocale;
+      LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
+    } // config.i18n.extraLocaleSettings;
+
+    systemd.globalEnvironment = lib.mkIf (config.i18n.supportedLocales != [ ]) {
+      LOCALE_ARCHIVE = "${config.i18n.glibcLocales}/lib/locale/locale-archive";
+    };
+
+    # ‘/etc/locale.conf’ is used by systemd.
+    environment.etc."locale.conf".source = pkgs.writeText "locale.conf" ''
+      LANG=${config.i18n.defaultLocale}
+      ${lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (n: v: "${n}=${v}") config.i18n.extraLocaleSettings
+      )}
+    '';
+
+  };
+}
diff --git a/modules/impermanence-timezone.nix b/modules/impermanence-timezone.nix
new file mode 100644
index 00000000..a1edbfa5
--- /dev/null
+++ b/modules/impermanence-timezone.nix
@@ -0,0 +1,41 @@
+{ config, lib, utils, pkgs, ... }:
+
+{
+  options = {
+    environment.persistence = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule {
+        options = {
+          timezone = lib.mkEnableOption "storing system timezone";
+        };
+      });
+    };
+  };
+
+  config = {
+    systemd = lib.mkMerge (lib.mapAttrsToList (name: cfg: lib.mkIf cfg.timezone {
+      services = {
+        "timezone@${utils.escapeSystemdPath name}" = {
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${pkgs.coreutils}/bin/cp -vP ${utils.escapeSystemdExecArg "${name}/etc/localtime"} /etc/localtime";
+            ExecStop = "${pkgs.coreutils}/bin/cp -vP /etc/localtime ${utils.escapeSystemdExecArg "${name}/etc/localtime"}";
+          };
+        };
+        "etc-localtime@${utils.escapeSystemdPath name}" = {
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${pkgs.coreutils}/bin/cp -vP /etc/localtime ${utils.escapeSystemdExecArg "${name}/etc/localtime"}";
+          };
+        };
+      };
+      paths."etc-localtime@${utils.escapeSystemdPath name}" = {
+        wantedBy = [ "timezone@${utils.escapeSystemdPath name}.service" ];
+        after = [ "timezone@${utils.escapeSystemdPath name}.service" ];
+
+        pathConfig.PathChanged = "/etc/localtime";
+      };
+    }) config.environment.persistence);
+  };
+}
diff --git a/modules/impermanence.nix b/modules/impermanence.nix
new file mode 100644
index 00000000..621576a3
--- /dev/null
+++ b/modules/impermanence.nix
@@ -0,0 +1,6 @@
+{ flakeInputs, ... }:
+{
+  imports = [
+    flakeInputs.impermanence.nixosModules.impermanence
+  ];
+}
diff --git a/modules/installer.nix b/modules/installer.nix
new file mode 100644
index 00000000..3e5c6d5b
--- /dev/null
+++ b/modules/installer.nix
@@ -0,0 +1,56 @@
+{ flake, config, lib, pkgs, ... }:
+
+let
+  cfg = config.installer.links;
+
+  installerOutPath = {
+    "cd-dvd" = _: installerBuild: "${installerBuild.config.system.build.isoImage}/iso";
+    "netboot" = {system, variant}: installerBuild: pkgs.runCommandLocal "${system}-${variant}" {} ''
+      mkdir $out
+      install -m 0444 -t $out \
+        ${installerBuild.config.system.build.netbootRamdisk}/initrd \
+        ${installerBuild.config.system.build.kernel}/${config.system.boot.loader.kernelFile} \
+        ${installerBuild.config.system.build.netbootIpxeScript}/netboot.ipxe \
+        ${pkgs.ipxe.override {
+          additionalTargets = {
+            "bin-i386-efi/ipxe.efi" = "i386-ipxe.efi";
+          };
+          additionalOptions = [
+            "NSLOOKUP_CMD"
+            "PING_CMD"
+            "CONSOLE_CMD"
+          ];
+          embedScript = pkgs.writeText "netboot.ipxe" ''
+            #!ipxe
+
+            chain netboot.ipxe
+          '';
+        }}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn}
+    '';
+  };
+in {
+  options = {
+    installer.links = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule {
+        options = {
+          system = lib.mkOption {
+            type = lib.types.str;
+          };
+          variant = lib.mkOption {
+            type = lib.types.str;
+          };
+        };
+      });
+      default = [];
+    };
+  };
+
+  config = lib.mkIf (cfg != []) {
+    systemd.tmpfiles.rules = map (installer'@{system, variant}:
+      let
+        installer = "${system}-${variant}";
+        installerBuild = builtins.addErrorContext "while evaluating installer-${installer}" flake.nixosConfigurations.${"installer-${installer}"};
+      in "L+ /run/installer-${installer} - - - - ${installerOutPath.${variant} installer' installerBuild}"
+    ) cfg;
+  };
+}
diff --git a/modules/niri.nix b/modules/niri.nix
new file mode 100644
index 00000000..4e2ddf8b
--- /dev/null
+++ b/modules/niri.nix
@@ -0,0 +1,6 @@
+{ flakeInputs, ... }:
+{
+  imports = [
+    flakeInputs.niri-flake.nixosModules.niri
+  ];
+}
diff --git a/modules/nix-access-tokens/default.nix b/modules/nix-access-tokens/default.nix
new file mode 100644
index 00000000..a3b7abfa
--- /dev/null
+++ b/modules/nix-access-tokens/default.nix
@@ -0,0 +1,24 @@
+{ lib, config, hostName ,... }:
+
+let
+  cfg = config.nix.includeAccessTokens;
+in {
+  options = {
+    nix.includeAccessTokens.enable = lib.mkEnableOption "including access tokens in nix.conf" // { default = lib.elem hostName ["sif" "surtr" "vidhar"]; };
+  };
+
+  config = lib.mkIf cfg.enable {
+    nix = {
+      extraOptions = ''
+        !include ${config.sops.secrets.nixAccessTokens.path}
+      '';
+    };
+
+    sops.secrets.nixAccessTokens = {
+      format = "binary";
+      sopsFile = ./nix.conf;
+      mode = "0440";
+      group = "wheel";
+    };
+  };
+}
diff --git a/modules/nix-access-tokens/nix.conf b/modules/nix-access-tokens/nix.conf
new file mode 100644
index 00000000..f0b394ef
--- /dev/null
+++ b/modules/nix-access-tokens/nix.conf
@@ -0,0 +1,32 @@
+{
+        "data": "ENC[AES256_GCM,data:/cdBpvCAFpgm0YWhy1WYlA09KlU6PzVfBYVLBD0boqGqvP+8wuyDzj5KWbcKsdGhoiklODiKR0ODXNU+fA35y862PFXvSb4xVyfbdKRndYdIA4W6vyobtoC9h7B1yR9pkq9L+1tqlU30Dgy2Gndg9rWHlIo+1lO/1A==,iv:B1Px2+cxCaopHZThkEG5saOib+PNvurPIS6aeAv2uPo=,tag:K3JqRaX3/iIqD3c//YdqSQ==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5NkZUUGI3M2pQYWVXeFV6\na2h2czRTeUJFekJCS012YlBkL1FDdTd3ekZ3ClJsTVh0R2JQM0Jua1JjL285RVA1\nRHhlbjlLdmNBUXVLelFGY2NGYWpLejQKLS0tIDBUWUhJNm8zWGoyQ0pBYnV1ZjBh\ndktNRkNPS1lpWXFITC81aEZJbXlONk0Km2c1xVKwSankaVs7O/utGJwRRX395upz\ndPbsOElTnbGmkb0esGtvGSPboTvK+gjn9w/GhaPyTnNDoos7GaIfyg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1fj65apkhfkrwyv5tx6zcs9nkjg8267fy733qph30sc7zfn7vapjqkd5kne",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bS9iY2lua3U4U3lJa1pK\nSlZNMmFZMEU5M1V2bWRjaXIwajZJVDJPMlM4Cmd3TTNFWjVuSGdtbC9iODltTS91\nOE5XOEVEQkh0SFpVVW5jc3IzbzNpTmMKLS0tIEtrSU54QUVPa2tBZDhLYlRFWitR\nc2x6MFlxL0tobDJTek42dEcyZXpoWDgKXzQfU+o6FkbJBwmm6oaHu4sDPi822uUR\n5VY6gY/h3g2kM4cuS03Q4NJmeRxuh7cx0UqGU3j5Mf8muE1LHpYEPw==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaOVpNZ2lVT0VwbHVZNzFl\nenJsMGpnbkRvU0xOSU5obk5yT2p5ZVNzdXhNCnVlQzZtRjZNVmJLSUpKc3UwVXZs\nWi9EZ3kxZkJNeFJDSjl1L1IweTFNMXcKLS0tIDJUOTBwTldCUmlnU0tWVkZkNzJL\nejM4ajJVbVhvSm1YM2Vxa2JldllYN0UKAzxy2wkzRvCSiTy417AulpCu41z668HG\nto92eGF2ZRFfEG5LGlCKWeDcP3gM8QwKiVlm6wndbOkhMMfc4Sp3wA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ejRHcGttNUxYZnFzTU5J\nMTFvY3daQ1VMM2xxYTgvLzZwT1owazVNenhzCktaWFF6K2s5UjI2b20rSHFNSS9E\nMVlJSmZhQm15eUs3U0hGTGpSRndmSDgKLS0tIDVrcjl4eDhwak1pRithbnRWWEZy\nVE9EOEpKdEJoRTFrTXpQVDc1cmsrU1kK/goTdUmpZPeMRbY1QzLXAa6Qpg4YYYYo\n3v3GK1bzdey8szfgIr1dHTtQEzqE2WX1swzZizDXj/RiUWx01Ky3GA==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-01-25T19:58:58Z",
+                "mac": "ENC[AES256_GCM,data:Oza4XgnTX3vly89nGluLbEytk1dUYAiOhIYewQyDLLLSSlUIpXmWhV+X0HUQ9AX5kUrEhNbVzRdvUG/9YwoWjTJfvd7tw41IYeTqgykMNXJUfGssoutXfeij9YR+t5aJaRhlTkIWcBhUjXSUNyJCl6Z3XmzWstTPZXEU9VmAvuE=,iv:LqVwIiit+WqI5NWSboexWsmPzg7e63nWJYsNFEK1Uog=,tag:ClR6oI62WXEfIYYAY6vL0A==,type:str]",
+                "pgp": null,
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.9.3"
+        }
+}
\ No newline at end of file
diff --git a/modules/pgbackrest.nix b/modules/pgbackrest.nix
index 886840b9..550e970b 100644
--- a/modules/pgbackrest.nix
+++ b/modules/pgbackrest.nix
@@ -43,6 +43,8 @@ let
   loglevelType = types.enum ["off" "error" "warn" "info" "detail" "debug" "trace"];
   inherit (utils.systemdUtils.unitOptions) unitOption;
 in {
+  disabledModules = ["services/backup/pgbackrest.nix"];
+
   options = {
     services.pgbackrest = {
       enable = mkEnableOption "pgBackRest";
@@ -216,6 +218,7 @@ in {
         };
       };
     } // mapAttrs' (name: backupCfg: nameValuePair "pgbackrest-backup@${escapeSystemdPath name}" {
+      restartIfChanged = false;
       description = "Perform pgBackRest Backup (${name}${optionalString (!(isNull backupCfg.repo)) " repo${backupCfg.repo}"})";
       serviceConfig = {
         Type = "oneshot";
diff --git a/modules/postsrsd.nix b/modules/postsrsd.nix
new file mode 100644
index 00000000..bc941e3e
--- /dev/null
+++ b/modules/postsrsd.nix
@@ -0,0 +1,163 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+
+  cfg = config.services.postsrsd;
+  runtimeDirectoryName = "postsrsd";
+  runtimeDirectory = "/run/${runtimeDirectoryName}";
+  # TODO: follow RFC 42, but we need a libconfuse format first:
+  #       https://github.com/NixOS/nixpkgs/issues/401565
+  # Arrays in `libconfuse` look like this: {"Life", "Universe", "Everything"}
+  # See https://www.nongnu.org/confuse/tutorial-html/ar01s03.html.
+  #
+  # Note: We're using `builtins.toJSON` to escape strings, but JSON strings
+  # don't have exactly the same semantics as libconfuse strings. For example,
+  # "${F}" gets treated as an env var reference, see above issue for details.
+  libconfuseDomains = "{ " + lib.concatMapStringsSep ", " builtins.toJSON cfg.domains + " }";
+  configFile = pkgs.writeText "postsrsd.conf" ''
+    secrets-file = "''${CREDENTIALS_DIRECTORY}/secrets-file"
+    domains = ${libconfuseDomains}
+    separator = "${cfg.separator}"
+
+    # Disable postsrsd's jailing in favor of confinement with systemd.
+    unprivileged-user = ""
+    chroot-dir = ""
+
+    ${cfg.extraConfig}
+  '';
+
+in
+{
+  imports =
+    map
+      (
+        name:
+        lib.mkRemovedOptionModule [ "services" "postsrsd" name ] ''
+          `postsrsd` was upgraded to `>= 2.0.0`, with some different behaviors and configuration settings:
+            - NixOS Release Notes: https://nixos.org/manual/nixos/unstable/release-notes#sec-nixpkgs-release-25.05-incompatibilities
+            - NixOS Options Reference: https://nixos.org/manual/nixos/unstable/options#opt-services.postsrsd.enable
+            - Migration instructions: https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#migrating-from-version-1x
+            - Postfix Setup: https://github.com/roehling/postsrsd/blob/2.0.10/README.rst#postfix-setup
+        ''
+      )
+      [
+        "domain"
+        "forwardPort"
+        "reversePort"
+        "timeout"
+        "excludeDomains"
+      ];
+
+  disabledModules = [ "services/mail/postsrsd.nix" ];
+
+  options = {
+    services.postsrsd = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Whether to enable the postsrsd SRS server for Postfix.";
+      };
+
+      secretsFile = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/postsrsd/postsrsd.secret";
+        description = "Secret keys used for signing and verification";
+      };
+
+      domains = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        description = "Domain names for rewrite";
+        default = [ config.networking.hostName ];
+        defaultText = lib.literalExpression "[ config.networking.hostName ]";
+      };
+
+      separator = lib.mkOption {
+        type = lib.types.enum [
+          "-"
+          "="
+          "+"
+        ];
+        default = "=";
+        description = "First separator character in generated addresses";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "postsrsd";
+        description = "User for the daemon";
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "postsrsd";
+        description = "Group for the daemon";
+      };
+
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+      };
+
+      configurePostfix = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "noop";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users = lib.optionalAttrs (cfg.user == "postsrsd") {
+      postsrsd = {
+        group = cfg.group;
+        uid = config.ids.uids.postsrsd;
+      };
+    };
+
+    users.groups = lib.optionalAttrs (cfg.group == "postsrsd") {
+      postsrsd.gid = config.ids.gids.postsrsd;
+    };
+
+    systemd.services.postsrsd-generate-secrets = {
+      path = [ pkgs.coreutils ];
+      script = ''
+        if [ -e "${cfg.secretsFile}" ]; then
+          echo "Secrets file exists. Nothing to do!"
+        else
+          echo "WARNING: secrets file not found, autogenerating!"
+          DIR="$(dirname "${cfg.secretsFile}")"
+          install -m 750 -o ${cfg.user} -g ${cfg.group} -d "$DIR"
+          install -m 600 -o ${cfg.user} -g ${cfg.group} <(dd if=/dev/random bs=18 count=1 | base64) "${cfg.secretsFile}"
+        fi
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+      };
+    };
+
+    systemd.services.postsrsd = {
+      description = "PostSRSd SRS rewriting server";
+      after = [
+        "network.target"
+        "postsrsd-generate-secrets.service"
+      ];
+      before = [ "postfix.service" ];
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "postsrsd-generate-secrets.service" ];
+      confinement.enable = true;
+
+      serviceConfig = {
+        ExecStart = "${lib.getExe pkgs.postsrsd} -C ${configFile}";
+        User = cfg.user;
+        Group = cfg.group;
+        PermissionsStartOnly = true;
+        RuntimeDirectory = runtimeDirectoryName;
+        LoadCredential = "secrets-file:${cfg.secretsFile}";
+      };
+    };
+  };
+}
diff --git a/modules/systemd-run0.nix b/modules/systemd-run0.nix
new file mode 100644
index 00000000..8575ec7c
--- /dev/null
+++ b/modules/systemd-run0.nix
@@ -0,0 +1,4 @@
+{ config, lib, ... }:
+{
+  config.security.pam.services.systemd-run0 = lib.mkIf (lib.versionAtLeast config.systemd.package.version "256") {};
+}
diff --git a/modules/tzupdate.nix b/modules/tzupdate.nix
new file mode 100644
index 00000000..6465d33f
--- /dev/null
+++ b/modules/tzupdate.nix
@@ -0,0 +1,81 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.tzupdate;
+in
+{
+  disabledModules = [ "services/misc/tzupdate.nix" ];
+
+  options.services.tzupdate = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enable the tzupdate timezone updating service. This provides
+        a one-shot service which can be activated with systemctl to
+        update the timezone.
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "tzupdate" { };
+
+    timer.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Enable the tzupdate timer to update the timezone automatically.
+      '';
+    };
+
+    timer.interval = lib.mkOption {
+      type = lib.types.str;
+      default = "hourly";
+      description = ''
+        The interval at which the tzupdate timer should run. See
+        {manpage}`systemd.time(7)` to understand the format.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # We need to have imperative time zone management for this to work.
+    # This will give users an error if they have set an explicit time
+    # zone, which is better than silently overriding it.
+    time.timeZone = null;
+
+    # We provide a one-shot service that runs at startup once network
+    # interfaces are up, but we can’t ensure we actually have Internet access
+    # at that point. It can also be run manually with `systemctl start tzupdate`.
+    systemd.services.tzupdate = {
+      description = "tzupdate timezone update service";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      script = ''
+        timezone="$(${lib.getExe cfg.package} --print-only)"
+        if [[ -n "$timezone" ]]; then
+          echo "Setting timezone to '$timezone'"
+          ${lib.getExe' config.systemd.package "timedatectl"} set-timezone "$timezone"
+        fi
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+      };
+    };
+
+    systemd.timers.tzupdate = {
+      enable = cfg.timer.enable;
+      timerConfig = {
+        OnStartupSec = "30s";
+        OnCalendar = cfg.timer.interval;
+        Persistent = true;
+      };
+      wantedBy = [ "timers.target" ];
+    };
+  };
+}
diff --git a/modules/uucp.nix b/modules/uucp.nix
deleted file mode 100644
index abca2acb..00000000
--- a/modules/uucp.nix
+++ /dev/null
@@ -1,398 +0,0 @@
-{ flake, config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  portSpec = name: node: concatStringsSep "\n" (map (port: ''
-    port ${name}.${port}
-    type pipe
-    protocol ${node.protocols}
-    reliable true
-    command ${pkgs.openssh}/bin/ssh -x -o batchmode=yes ${name}.${port}
-  '') node.hostnames);
-  sysSpec = name: node: ''
-    system ${name}
-    time any
-    chat-seven-bit false
-    chat . ""
-    protocol ${node.protocols}
-    command-path ${concatStringsSep " " cfg.commandPath}
-    commands ${concatStringsSep " " node.commands}
-    ${concatStringsSep "\nalternate\n" (map (port: ''
-      port ${name}.${port}
-    '') node.hostnames)}
-  '';
-  sshConfig = name: node: concatStringsSep "\n" (map (port: ''
-    Host ${name}.${port}
-      Hostname ${port}
-      IdentitiesOnly Yes
-      IdentityFile ${cfg.sshKeyDir}/${name}
-  '') node.hostnames);
-  sshKeyGen = name: node: ''
-    if [[ ! -e ${cfg.sshKeyDir}/${name} ]]; then
-      ${pkgs.openssh}/bin/ssh-keygen ${escapeShellArgs node.generateKey} -f ${cfg.sshKeyDir}/${name}
-    fi
-  '';
-  restrictKey = key: ''
-    restrict,command="${chat}" ${key}
-  '';
-  chat = pkgs.writeScript "chat" ''
-    #!${pkgs.stdenv.shell}
-
-    echo .
-    exec ${config.security.wrapperDir}/uucico
-  '';
-
-  nodeCfg = {
-    options = {
-      commands = mkOption {
-        type = types.listOf types.str;
-        default = cfg.defaultCommands;
-        defaultText = literalExpression "config.services.uucp.defaultCommands";
-        description = "Commands to allow for this remote";
-      };
-
-      protocols = mkOption {
-        type = types.separatedString "";
-              default = cfg.defaultProtocols;
-        defaultText = literalExpression "config.services.uucp.defaultProtocols";
-              description = "UUCP protocols to use for this remote";
-      };
-
-      publicKeys = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = "SSH client public keys for this node";
-      };
-
-      generateKey = mkOption {
-        type = types.listOf types.str;
-        default = [ "-t" "ed25519" "-N" "" ];
-        description = "Arguments to pass to `ssh-keygen` to generate a keypair for communication with this host";
-      };
-
-      hostnames = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        description = "Hostnames to try in order when connecting";
-      };
-    };
-  };
-
-  cfg = config.services.uucp;
-in {
-  options = {
-    services.uucp = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          If enabled we set up an account accesible via uucp over ssh
-        '';
-      };
-
-      nodeName = mkOption {
-        type = types.str;
-        default = "nixos";
-        description = "uucp node name";
-      };
-
-      sshUser = mkOption { 
-        type = types.attrs;
-        default = {};
-        description = "Overrides for the local uucp linux-user";
-      };
-
-      extraSSHConfig = mkOption {
-        type = types.str;
-        default = "";
-        description = "Extra SSH config";
-      };
-
-      remoteNodes = mkOption {
-        type = types.attrsOf (types.submodule nodeCfg);
-        default = {};
-        description = ''
-          Ports to set up
-          Names will probably need to be configured in sshConfig
-        '';
-      };
-
-      commandPath = mkOption {
-        type = types.listOf types.path;
-        default = [ "${pkgs.rmail}/bin" ];
-        defaultText = literalExpression ''[ "''${pkgs.rmail}/bin" ]'';
-        description = ''
-          Command search path for all systems
-        '';
-      };
-
-      defaultCommands = mkOption {
-        type = types.listOf types.str;
-        default = ["rmail"];
-        description = "Commands allowed for remotes without explicit override";
-      };
-
-      defaultProtocols = mkOption {
-        type = types.separatedString "";
-              default = "te";
-              description = "UUCP protocol to use within ssh unless overriden";
-      };
-
-      incomingProtocols = mkOption {
-        type = types.separatedString "";
-        default = "te";
-        description = "UUCP protocols to use when called";
-      };
-
-      homeDir = mkOption {
-        type = types.path;
-        default = "/var/uucp";
-        description = "Home of the uucp user";
-      };
-
-      sshKeyDir = mkOption {
-        type = types.path;
-        default = "${cfg.homeDir}/.ssh/";
-        defaultText = literalExpression ''''${config.services.uucp.homeDir}/.ssh/'';
-        description = "Directory to store ssh keypairs";
-      };
-
-      spoolDir = mkOption {
-        type = types.path;
-        default = "/var/spool/uucp";
-        description = "Spool directory";
-      };
-
-      lockDir = mkOption {
-        type = types.path;
-        default = "/var/spool/uucp";
-        description = "Lock directory";
-      };
-
-      pubDir = mkOption {
-        type = types.path;
-        default = "/var/spool/uucppublic";
-        description = "Public directory";
-      };
-
-      logFile = mkOption {
-        type = types.path;
-        default = "/var/log/uucp";
-        description = "Log file";
-      };
-
-      statFile = mkOption {
-        type = types.path;
-        default = "/var/log/uucp.stat";
-        description = "Statistics file";
-      };
-
-      debugFile = mkOption {
-        type = types.path;
-        default = "/var/log/uucp.debug";
-        description = "Debug file";
-      };
-
-      interval = mkOption {
-        type = types.nullOr types.str;
-        default = "1h";
-        description = ''
-          Specification of when to run `uucico' in format used by systemd timers
-          The default is to do so every hour
-        '';
-      };
-
-      nmDispatch = mkOption {
-        type = types.bool;
-        default = config.networking.networkmanager.enable;
-        defaultText = literalExpression "config.networking.networkmanager.enable";
-        description = ''
-          Install a network-manager dispatcher script to automatically
-          call all remotes when networking is available
-        '';
-      };
-
-      extraConfig = mkOption {
-        type = types.lines;
-        default = ''
-          run-uuxqt 1
-        '';
-        description = "Extra configuration to append verbatim to `/etc/uucp/config'";
-      };
-
-      extraSys = mkOption {
-        type = types.lines;
-        default = ''
-          protocol-parameter g packet-size 4096
-        '';
-              description = "Extra configuration to prepend verbatim to `/etc/uucp/sys`";
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    environment.etc."uucp/config" = {
-      text = ''
-        hostname ${cfg.nodeName}
-      
-        spool ${cfg.spoolDir}
-        lockdir ${cfg.lockDir}
-        pubdir ${cfg.pubDir}
-        logfile ${cfg.logFile}
-        statfile ${cfg.statFile}
-        debugfile ${cfg.debugFile}
-        
-        ${cfg.extraConfig}
-      '';
-    };
-
-    users.groups."uucp" = {};
-    users.users."uucp" = {
-      name = "uucp";
-      group = "uucp";
-      isSystemUser = true;
-      isNormalUser = false;
-      createHome = true;
-      home = cfg.homeDir;
-      description = "User for uucp over ssh";
-      useDefaultShell = true;
-      openssh.authorizedKeys.keys = map restrictKey (concatLists (mapAttrsToList (name: node: node.publicKeys) cfg.remoteNodes));
-    } // cfg.sshUser;
-
-    system.activationScripts."uucp-sshconfig" = ''
-      mkdir -p ${config.users.users."uucp".home}/.ssh
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${config.users.users."uucp".home}/.ssh
-      chmod 700 ${config.users.users."uucp".home}/.ssh
-      ln -fs ${builtins.toFile "ssh-config" ''
-        ${concatStringsSep "\n" (mapAttrsToList sshConfig cfg.remoteNodes)}
-      
-        ${cfg.extraSSHConfig}
-      ''} ${config.users.users."uucp".home}/.ssh/config
-
-      mkdir -p ${cfg.sshKeyDir}
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${cfg.sshKeyDir}
-      chmod 700 ${cfg.sshKeyDir}
-
-      ${concatStringsSep "\n" (mapAttrsToList sshKeyGen cfg.remoteNodes)}
-    '';
-
-    system.activationScripts."uucp-logs" = ''
-      touch ${cfg.logFile}
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${cfg.logFile}
-      chmod 644 ${cfg.logFile}
-      touch ${cfg.statFile}
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${cfg.statFile}
-      chmod 644 ${cfg.statFile}
-      touch ${cfg.debugFile}
-      chown ${config.users.users."uucp".name}:${config.users.users."uucp".group} ${cfg.debugFile}
-      chmod 644 ${cfg.debugFile}
-    '';
-
-    environment.etc."uucp/port" = {
-      text = ''
-        port ssh
-        type stdin
-        protocol ${cfg.incomingProtocols}
-      '' + concatStringsSep "\n" (mapAttrsToList portSpec cfg.remoteNodes);
-    };
-    environment.etc."uucp/sys" = {
-      text = cfg.extraSys + "\n" + concatStringsSep "\n" (mapAttrsToList sysSpec cfg.remoteNodes);
-    };
-
-    security.wrappers = let
-      wrapper = p: {
-        name = p;
-        value = {
-          source = "${pkgs.uucp}/bin/${p}";
-          owner = "root";
-          group = "root";
-          setuid = true;
-          setgid = false;
-        };
-      };
-    in listToAttrs (map wrapper ["uucico" "cu" "uucp" "uuname" "uustat" "uux" "uuxqt"]);
-
-    nixpkgs.overlays = [(self: super: {
-      uucp = super.lib.overrideDerivation super.uucp (oldAttrs: {
-        configureFlags = "--with-newconfigdir=/etc/uucp";
-        patches = [
-          (super.writeText "mailprogram" ''
-             policy.h | 2 +-
-             1 file changed, 1 insertion(+), 1 deletion(-)
-
-            diff --git a/policy.h b/policy.h
-            index 5afe34b..8e92c8b 100644
-            --- a/policy.h
-            +++ b/policy.h
-            @@ -240,7 +240,7 @@
-                the sendmail choice below.  Otherwise, select one of the other
-                choices as appropriate.  */
-             #if 1
-            -#define MAIL_PROGRAM "/usr/lib/sendmail -t"
-            +#define MAIL_PROGRAM "${config.security.wrapperDir}/sendmail -t"
-             /* #define MAIL_PROGRAM "/usr/sbin/sendmail -t" */
-             #define MAIL_PROGRAM_TO_BODY 1
-             #define MAIL_PROGRAM_SUBJECT_BODY 1
-          '')
-        ];
-      });
-      rmail = super.writeScriptBin "rmail" ''
-          #!${super.stdenv.shell}
-
-          # Dummy UUCP rmail command for postfix/qmail systems
-
-          IFS=" " read junk from junk junk junk junk junk junk junk relay
-
-          case "$from" in
-            *[@!]*) ;;
-            *) from="$from@$relay";;
-          esac
-
-          exec ${config.security.wrapperDir}/sendmail -G -i -f "$from" -- "$@"
-        '';
-    })];
-
-    environment.systemPackages = with pkgs; [
-      uucp
-    ];
-
-    systemd.services."uucico@" = {
-      serviceConfig = {
-        User = "uucp";
-        Type = "oneshot";
-        ExecStart = "${config.security.wrapperDir}/uucico -D -S %i";
-      };
-    };
-
-    systemd.timers."uucico@" = {
-      timerConfig.OnActiveSec = cfg.interval;
-      timerConfig.OnUnitActiveSec = cfg.interval;
-    };
-
-    systemd.targets."multi-user" = {
-      wants = mapAttrsToList (name: node: "uucico@${name}.timer") cfg.remoteNodes;
-    };
-
-    systemd.kill-user.enable = true;
-    systemd.targets."sleep" = {
-      after = [ "kill-user@uucp.service" ];
-      wants = [ "kill-user@uucp.service" ];
-    };
-    
-    networking.networkmanager.dispatcherScripts = optional cfg.nmDispatch {
-      type = "basic";
-      source = pkgs.writeScript "callRemotes.sh" ''
-        #!${pkgs.stdenv.shell}
-
-        shopt -s extglob
-
-        case "''${2}" in
-          (?(vpn-)up)
-            ${concatStringsSep "\n    " (mapAttrsToList (name: node: "${pkgs.systemd}/bin/systemctl start uucico@${name}.service") cfg.remoteNodes)}
-            ;;
-        esac
-      '';
-    };
-  };
-}
diff --git a/nvfetcher.toml b/nvfetcher.toml
index c0566373..72c0d99d 100644
--- a/nvfetcher.toml
+++ b/nvfetcher.toml
@@ -78,12 +78,12 @@ git.fetchSubmodules = true
 src.git = "https://github.com/jgreco/mpv-youtube-quality"
 fetch.git = "https://github.com/jgreco/mpv-youtube-quality"
 
-[batman-adv]
-src.webpage = "https://www.open-mesh.org/projects/open-mesh/wiki/Download"
-src.regex = "The latest version of <a[^\\>]*>batman-adv</a> is <a[^\\>]*>batman-adv-([0-9\\.]+).tar.gz</a>"
-src.from_pattern = "^.*batman-adv-([0-9\\.]+).tar.gz.*$"
-src.to_pattern = "\\1"
-fetch.tarball = "https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-$ver.tar.gz"
+# [batman-adv]
+# src.webpage = "https://www.open-mesh.org/projects/open-mesh/wiki/Download"
+# src.regex = "The latest version of <a[^\\>]*>batman-adv</a> is <a[^\\>]*>batman-adv-([0-9\\.]+).tar.gz</a>"
+# src.from_pattern = "^.*batman-adv-([0-9\\.]+).tar.gz.*$"
+# src.to_pattern = "\\1"
+# fetch.tarball = "https://downloads.open-mesh.org/batman/stable/sources/batman-adv/batman-adv-$ver.tar.gz"
 
 [scutiger]
 src.github_tag = "bk2204/scutiger"
@@ -107,3 +107,19 @@ fetch.tarball = "https://github.com/JonathonReinhart/spice-record/archive/refs/t
 [yt-dlp]
 src.pypi = "yt_dlp"
 fetch.pypi = "yt_dlp"
+
+[mako]
+src.git = "https://github.com/emersion/mako"
+fetch.git = "https://github.com/emersion/mako"
+
+[swayosd]
+src.git = "https://github.com/ErikReider/SwayOSD"
+fetch.git = "https://github.com/ErikReider/SwayOSD"
+
+[netbootxyz-efi]
+src.github = "netbootxyz/netboot.xyz"
+fetch.url = "https://github.com/netbootxyz/netboot.xyz/releases/download/$ver/netboot.xyz.efi"
+
+[netbootxyz-lkrn]
+src.github = "netbootxyz/netboot.xyz"
+fetch.url = "https://github.com/netbootxyz/netboot.xyz/releases/download/$ver/netboot.xyz.lkrn"
diff --git a/overlays/abs-podcast-autoplaylist/.envrc b/overlays/abs-podcast-autoplaylist/.envrc
new file mode 100644
index 00000000..2c909235
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/.envrc
@@ -0,0 +1,4 @@
+use flake
+
+[[ -d ".venv" ]] || ( uv venv && uv sync )
+. .venv/bin/activate
diff --git a/overlays/abs-podcast-autoplaylist/.gitignore b/overlays/abs-podcast-autoplaylist/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__init__.py b/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__init__.py
diff --git a/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__main__.py b/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__main__.py
new file mode 100644
index 00000000..fd739805
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/abs_podcast_autoplaylist/__main__.py
@@ -0,0 +1,107 @@
+import click
+from pathlib import Path
+import tomllib
+import requests
+from urllib.parse import urljoin
+from operator import itemgetter
+import re
+from frozendict import frozendict
+
+class BearerAuth(requests.auth.AuthBase):
+    def __init__(self, token):
+        self.token = token
+    def __call__(self, r):
+        r.headers["authorization"] = "Bearer " + self.token
+        return r
+
+class ABSSession(requests.Session):
+    def __init__(self, config):
+        super().__init__()
+        self.base_url = config['instance']
+        self.auth = BearerAuth(config['api_token'])
+
+    def request(self, method, url, *args, **kwargs):
+        joined_url = urljoin(self.base_url, url)
+        return super().request(method, joined_url, *args, **kwargs)
+
+@click.command()
+@click.argument('config_file', type=click.Path(dir_okay=False, path_type=Path))
+def main(config_file: Path):
+    with config_file.open('rb') as fh:
+        config = tomllib.load(fh)
+
+    with ABSSession(config) as s:
+        libraries = s.get('/api/libraries').json()['libraries']
+        playlists = s.get('/api/playlists').json()['playlists']
+
+        for library_config in config['libraries']:
+            [library] = filter(lambda l: l['name'] == library_config['name'], libraries)
+            filtered_playlists = list(filter(lambda p: p['name'] == library_config['playlist'] and p['libraryId'] == library['id'], playlists))
+            def get_playlist():
+                playlist = None
+                if filtered_playlists:
+                    [playlist] = filtered_playlists
+                if not playlist:
+                    playlist = s.post('/api/playlists', json={
+                        'libraryId': library['id'],
+                        'name': library_config['playlist'],
+                    }).json()
+                return playlist
+
+            podcasts = dict()
+            items = s.get('/api/libraries/{}/items'.format(library['id'])).json()['results']
+            for item in items:
+                item = s.get('/api/items/{}'.format(item['id']), json={'expanded': True}).json()
+                episodes = list()
+                for episode in sorted(item['media']['episodes'], key = itemgetter('publishedAt')):
+                    progress = s.get('/api/me/progress/{}/{}'.format(episode['libraryItemId'], episode['id']))
+                    if progress.ok and progress.json()["isFinished"]:
+                        continue
+                    episodes.append(episode)
+                podcasts[item['media']['metadata']['title']] = list(map(lambda x: frozendict({ 'libraryItemId': x['libraryItemId'], 'episodeId': x['id']}), episodes))
+            def lookup_podcast(expr):
+                expr = re.compile(expr, flags=re.I)
+                matches = filter(lambda t: expr.search(t), podcasts.keys())
+                match list(matches):
+                    case [x]:
+                        return (x,)
+                    case _:
+                        raise RuntimeError("No unique match for ‘{}’".format(expr))
+
+            priorities = [
+                [
+                    k
+                    for item in (section if type(section) is list else [section])
+                    for k in lookup_podcast(item)
+                ]
+                for section in library_config['priorities']
+            ]
+
+            playlist_items = list()
+            for section in priorities:
+                while any(map(lambda item: item in podcasts, section)):
+                    for item in section:
+                        if not item in podcasts:
+                            continue
+
+                        if not podcasts[item]:
+                            del podcasts[item]
+                            continue
+
+                        playlist_items.append(podcasts[item].pop(0))
+
+            playlist = get_playlist()
+            current_playlist_items = map(lambda item: frozendict({ k: v for k, v in item.items() if k in {'libraryItemId', 'episodeId'}}), playlist['items'])
+
+            if current_playlist_items == playlist_items:
+                continue
+
+            to_remove = set(current_playlist_items) - set(playlist_items)
+            if to_remove:
+                s.post('/api/playlists/{}/batch/remove'.format(playlist['id']), json={'items': list(to_remove)}).raise_for_status()
+                playlist = get_playlist()
+            to_add = set(playlist_items) - set(current_playlist_items)
+            if to_add:
+                s.post('/api/playlists/{}/batch/add'.format(playlist['id']), json={'items': list(to_add)}).raise_for_status()
+
+            r = s.patch('/api/playlists/{}'.format(playlist['id']), json={'items': playlist_items}).raise_for_status()
diff --git a/overlays/abs-podcast-autoplaylist/default.nix b/overlays/abs-podcast-autoplaylist/default.nix
new file mode 100644
index 00000000..843f1b65
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/default.nix
@@ -0,0 +1,19 @@
+{ prev, final, flake, flakeInputs, ... }:
+
+let
+  workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
+  pythonSet = flake.lib.pythonSet {
+    pkgs = final;
+    python = final.python312;
+    overlay = workspace.mkPyprojectOverlay {
+      sourcePreference = "wheel";
+    };
+  };
+  virtualEnv = pythonSet.mkVirtualEnv "abs-podcast-autoplaylist-env" workspace.deps.default;
+in {
+  abs-podcast-autoplaylist = virtualEnv.overrideAttrs (oldAttrs: {
+    meta = (oldAttrs.meta or {}) // {
+      mainProgram = "abs-podcast-autoplaylist";
+    };
+  });
+}
diff --git a/overlays/abs-podcast-autoplaylist/pyproject.toml b/overlays/abs-podcast-autoplaylist/pyproject.toml
new file mode 100644
index 00000000..f52a84bc
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/pyproject.toml
@@ -0,0 +1,16 @@
+[project]
+name = "abs-podcast-autoplaylist"
+version = "0.1.0"
+requires-python = ">=3.12"
+dependencies = [
+    "click>=8.1.8",
+    "frozendict>=2.4.6",
+    "requests>=2.32.3",
+]
+
+[project.scripts]
+abs-podcast-autoplaylist = "abs_podcast_autoplaylist.__main__:main"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
diff --git a/overlays/abs-podcast-autoplaylist/uv.lock b/overlays/abs-podcast-autoplaylist/uv.lock
new file mode 100644
index 00000000..17de5f0e
--- /dev/null
+++ b/overlays/abs-podcast-autoplaylist/uv.lock
@@ -0,0 +1,129 @@
+version = 1
+revision = 2
+requires-python = ">=3.12"
+
+[[package]]
+name = "abs-podcast-autoplaylist"
+version = "0.1.0"
+source = { editable = "." }
+dependencies = [
+    { name = "click" },
+    { name = "frozendict" },
+    { name = "requests" },
+]
+
+[package.metadata]
+requires-dist = [
+    { name = "click", specifier = ">=8.1.8" },
+    { name = "frozendict", specifier = ">=2.4.6" },
+    { name = "requests", specifier = ">=2.32.3" },
+]
+
+[[package]]
+name = "certifi"
+version = "2025.4.26"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e8/9e/c05b3920a3b7d20d3d3310465f50348e5b3694f4f88c6daf736eef3024c4/certifi-2025.4.26.tar.gz", hash = "sha256:0a816057ea3cdefcef70270d2c515e4506bbc954f417fa5ade2021213bb8f0c6", size = 160705, upload_time = "2025-04-26T02:12:29.51Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4a/7e/3db2bd1b1f9e95f7cddca6d6e75e2f2bd9f51b1246e546d88addca0106bd/certifi-2025.4.26-py3-none-any.whl", hash = "sha256:30350364dfe371162649852c63336a15c70c6510c2ad5015b21c2345311805f3", size = 159618, upload_time = "2025-04-26T02:12:27.662Z" },
+]
+
+[[package]]
+name = "charset-normalizer"
+version = "3.4.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e4/33/89c2ced2b67d1c2a61c19c6751aa8902d46ce3dacb23600a283619f5a12d/charset_normalizer-3.4.2.tar.gz", hash = "sha256:5baececa9ecba31eff645232d59845c07aa030f0c81ee70184a90d35099a0e63", size = 126367, upload_time = "2025-05-02T08:34:42.01Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d7/a4/37f4d6035c89cac7930395a35cc0f1b872e652eaafb76a6075943754f095/charset_normalizer-3.4.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:0c29de6a1a95f24b9a1aa7aefd27d2487263f00dfd55a77719b530788f75cff7", size = 199936, upload_time = "2025-05-02T08:32:33.712Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/8a/1a5e33b73e0d9287274f899d967907cd0bf9c343e651755d9307e0dbf2b3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cddf7bd982eaa998934a91f69d182aec997c6c468898efe6679af88283b498d3", size = 143790, upload_time = "2025-05-02T08:32:35.768Z" },
+    { url = "https://files.pythonhosted.org/packages/66/52/59521f1d8e6ab1482164fa21409c5ef44da3e9f653c13ba71becdd98dec3/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:fcbe676a55d7445b22c10967bceaaf0ee69407fbe0ece4d032b6eb8d4565982a", size = 153924, upload_time = "2025-05-02T08:32:37.284Z" },
+    { url = "https://files.pythonhosted.org/packages/86/2d/fb55fdf41964ec782febbf33cb64be480a6b8f16ded2dbe8db27a405c09f/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d41c4d287cfc69060fa91cae9683eacffad989f1a10811995fa309df656ec214", size = 146626, upload_time = "2025-05-02T08:32:38.803Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/73/6ede2ec59bce19b3edf4209d70004253ec5f4e319f9a2e3f2f15601ed5f7/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4e594135de17ab3866138f496755f302b72157d115086d100c3f19370839dd3a", size = 148567, upload_time = "2025-05-02T08:32:40.251Z" },
+    { url = "https://files.pythonhosted.org/packages/09/14/957d03c6dc343c04904530b6bef4e5efae5ec7d7990a7cbb868e4595ee30/charset_normalizer-3.4.2-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:cf713fe9a71ef6fd5adf7a79670135081cd4431c2943864757f0fa3a65b1fafd", size = 150957, upload_time = "2025-05-02T08:32:41.705Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/c8/8174d0e5c10ccebdcb1b53cc959591c4c722a3ad92461a273e86b9f5a302/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a370b3e078e418187da8c3674eddb9d983ec09445c99a3a263c2011993522981", size = 145408, upload_time = "2025-05-02T08:32:43.709Z" },
+    { url = "https://files.pythonhosted.org/packages/58/aa/8904b84bc8084ac19dc52feb4f5952c6df03ffb460a887b42615ee1382e8/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:a955b438e62efdf7e0b7b52a64dc5c3396e2634baa62471768a64bc2adb73d5c", size = 153399, upload_time = "2025-05-02T08:32:46.197Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/26/89ee1f0e264d201cb65cf054aca6038c03b1a0c6b4ae998070392a3ce605/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:7222ffd5e4de8e57e03ce2cef95a4c43c98fcb72ad86909abdfc2c17d227fc1b", size = 156815, upload_time = "2025-05-02T08:32:48.105Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/07/68e95b4b345bad3dbbd3a8681737b4338ff2c9df29856a6d6d23ac4c73cb/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:bee093bf902e1d8fc0ac143c88902c3dfc8941f7ea1d6a8dd2bcb786d33db03d", size = 154537, upload_time = "2025-05-02T08:32:49.719Z" },
+    { url = "https://files.pythonhosted.org/packages/77/1a/5eefc0ce04affb98af07bc05f3bac9094513c0e23b0562d64af46a06aae4/charset_normalizer-3.4.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:dedb8adb91d11846ee08bec4c8236c8549ac721c245678282dcb06b221aab59f", size = 149565, upload_time = "2025-05-02T08:32:51.404Z" },
+    { url = "https://files.pythonhosted.org/packages/37/a0/2410e5e6032a174c95e0806b1a6585eb21e12f445ebe239fac441995226a/charset_normalizer-3.4.2-cp312-cp312-win32.whl", hash = "sha256:db4c7bf0e07fc3b7d89ac2a5880a6a8062056801b83ff56d8464b70f65482b6c", size = 98357, upload_time = "2025-05-02T08:32:53.079Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/4f/c02d5c493967af3eda9c771ad4d2bbc8df6f99ddbeb37ceea6e8716a32bc/charset_normalizer-3.4.2-cp312-cp312-win_amd64.whl", hash = "sha256:5a9979887252a82fefd3d3ed2a8e3b937a7a809f65dcb1e068b090e165bbe99e", size = 105776, upload_time = "2025-05-02T08:32:54.573Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/12/a93df3366ed32db1d907d7593a94f1fe6293903e3e92967bebd6950ed12c/charset_normalizer-3.4.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:926ca93accd5d36ccdabd803392ddc3e03e6d4cd1cf17deff3b989ab8e9dbcf0", size = 199622, upload_time = "2025-05-02T08:32:56.363Z" },
+    { url = "https://files.pythonhosted.org/packages/04/93/bf204e6f344c39d9937d3c13c8cd5bbfc266472e51fc8c07cb7f64fcd2de/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:eba9904b0f38a143592d9fc0e19e2df0fa2e41c3c3745554761c5f6447eedabf", size = 143435, upload_time = "2025-05-02T08:32:58.551Z" },
+    { url = "https://files.pythonhosted.org/packages/22/2a/ea8a2095b0bafa6c5b5a55ffdc2f924455233ee7b91c69b7edfcc9e02284/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3fddb7e2c84ac87ac3a947cb4e66d143ca5863ef48e4a5ecb83bd48619e4634e", size = 153653, upload_time = "2025-05-02T08:33:00.342Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/57/1b090ff183d13cef485dfbe272e2fe57622a76694061353c59da52c9a659/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98f862da73774290f251b9df8d11161b6cf25b599a66baf087c1ffe340e9bfd1", size = 146231, upload_time = "2025-05-02T08:33:02.081Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/28/ffc026b26f441fc67bd21ab7f03b313ab3fe46714a14b516f931abe1a2d8/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6c9379d65defcab82d07b2a9dfbfc2e95bc8fe0ebb1b176a3190230a3ef0e07c", size = 148243, upload_time = "2025-05-02T08:33:04.063Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/0f/9abe9bd191629c33e69e47c6ef45ef99773320e9ad8e9cb08b8ab4a8d4cb/charset_normalizer-3.4.2-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e635b87f01ebc977342e2697d05b56632f5f879a4f15955dfe8cef2448b51691", size = 150442, upload_time = "2025-05-02T08:33:06.418Z" },
+    { url = "https://files.pythonhosted.org/packages/67/7c/a123bbcedca91d5916c056407f89a7f5e8fdfce12ba825d7d6b9954a1a3c/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1c95a1e2902a8b722868587c0e1184ad5c55631de5afc0eb96bc4b0d738092c0", size = 145147, upload_time = "2025-05-02T08:33:08.183Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/fe/1ac556fa4899d967b83e9893788e86b6af4d83e4726511eaaad035e36595/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ef8de666d6179b009dce7bcb2ad4c4a779f113f12caf8dc77f0162c29d20490b", size = 153057, upload_time = "2025-05-02T08:33:09.986Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/ff/acfc0b0a70b19e3e54febdd5301a98b72fa07635e56f24f60502e954c461/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:32fc0341d72e0f73f80acb0a2c94216bd704f4f0bce10aedea38f30502b271ff", size = 156454, upload_time = "2025-05-02T08:33:11.814Z" },
+    { url = "https://files.pythonhosted.org/packages/92/08/95b458ce9c740d0645feb0e96cea1f5ec946ea9c580a94adfe0b617f3573/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:289200a18fa698949d2b39c671c2cc7a24d44096784e76614899a7ccf2574b7b", size = 154174, upload_time = "2025-05-02T08:33:13.707Z" },
+    { url = "https://files.pythonhosted.org/packages/78/be/8392efc43487ac051eee6c36d5fbd63032d78f7728cb37aebcc98191f1ff/charset_normalizer-3.4.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4a476b06fbcf359ad25d34a057b7219281286ae2477cc5ff5e3f70a246971148", size = 149166, upload_time = "2025-05-02T08:33:15.458Z" },
+    { url = "https://files.pythonhosted.org/packages/44/96/392abd49b094d30b91d9fbda6a69519e95802250b777841cf3bda8fe136c/charset_normalizer-3.4.2-cp313-cp313-win32.whl", hash = "sha256:aaeeb6a479c7667fbe1099af9617c83aaca22182d6cf8c53966491a0f1b7ffb7", size = 98064, upload_time = "2025-05-02T08:33:17.06Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/b0/0200da600134e001d91851ddc797809e2fe0ea72de90e09bec5a2fbdaccb/charset_normalizer-3.4.2-cp313-cp313-win_amd64.whl", hash = "sha256:aa6af9e7d59f9c12b33ae4e9450619cf2488e2bbe9b44030905877f0b2324980", size = 105641, upload_time = "2025-05-02T08:33:18.753Z" },
+    { url = "https://files.pythonhosted.org/packages/20/94/c5790835a017658cbfabd07f3bfb549140c3ac458cfc196323996b10095a/charset_normalizer-3.4.2-py3-none-any.whl", hash = "sha256:7f56930ab0abd1c45cd15be65cc741c28b1c9a34876ce8c17a2fa107810c0af0", size = 52626, upload_time = "2025-05-02T08:34:40.053Z" },
+]
+
+[[package]]
+name = "click"
+version = "8.1.8"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b9/2e/0090cbf739cee7d23781ad4b89a9894a41538e4fcf4c31dcdd705b78eb8b/click-8.1.8.tar.gz", hash = "sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a", size = 226593, upload_time = "2024-12-21T18:38:44.339Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7e/d4/7ebdbd03970677812aac39c869717059dbb71a4cfc033ca6e5221787892c/click-8.1.8-py3-none-any.whl", hash = "sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2", size = 98188, upload_time = "2024-12-21T18:38:41.666Z" },
+]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload_time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload_time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "frozendict"
+version = "2.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bb/59/19eb300ba28e7547538bdf603f1c6c34793240a90e1a7b61b65d8517e35e/frozendict-2.4.6.tar.gz", hash = "sha256:df7cd16470fbd26fc4969a208efadc46319334eb97def1ddf48919b351192b8e", size = 316416, upload_time = "2024-10-13T12:15:32.449Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/13/d9839089b900fa7b479cce495d62110cddc4bd5630a04d8469916c0e79c5/frozendict-2.4.6-py311-none-any.whl", hash = "sha256:d065db6a44db2e2375c23eac816f1a022feb2fa98cbb50df44a9e83700accbea", size = 16148, upload_time = "2024-10-13T12:15:26.839Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/d0/d482c39cee2ab2978a892558cf130681d4574ea208e162da8958b31e9250/frozendict-2.4.6-py312-none-any.whl", hash = "sha256:49344abe90fb75f0f9fdefe6d4ef6d4894e640fadab71f11009d52ad97f370b9", size = 16146, upload_time = "2024-10-13T12:15:28.16Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/8e/b6bf6a0de482d7d7d7a2aaac8fdc4a4d0bb24a809f5ddd422aa7060eb3d2/frozendict-2.4.6-py313-none-any.whl", hash = "sha256:7134a2bb95d4a16556bb5f2b9736dceb6ea848fa5b6f3f6c2d6dba93b44b4757", size = 16146, upload_time = "2024-10-13T12:15:29.495Z" },
+]
+
+[[package]]
+name = "idna"
+version = "3.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload_time = "2024-09-15T18:07:39.745Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload_time = "2024-09-15T18:07:37.964Z" },
+]
+
+[[package]]
+name = "requests"
+version = "2.32.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "charset-normalizer" },
+    { name = "idna" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/63/70/2bf7780ad2d390a8d301ad0b550f1581eadbd9a20f896afe06353c2a2913/requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760", size = 131218, upload_time = "2024-05-29T15:37:49.536Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f9/9b/335f9764261e915ed497fcdeb11df5dfd6f7bf257d4a6a2a686d80da4d54/requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6", size = 64928, upload_time = "2024-05-29T15:37:47.027Z" },
+]
+
+[[package]]
+name = "urllib3"
+version = "2.4.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/8a/78/16493d9c386d8e60e442a35feac5e00f0913c0f4b7c217c11e8ec2ff53e0/urllib3-2.4.0.tar.gz", hash = "sha256:414bc6535b787febd7567804cc015fee39daab8ad86268f1310a9250697de466", size = 390672, upload_time = "2025-04-10T15:23:39.232Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/6b/11/cc635220681e93a0183390e26485430ca2c7b5f9d33b15c74c2861cb8091/urllib3-2.4.0-py3-none-any.whl", hash = "sha256:4e16665048960a0900c702d4a66415956a584919c03361cac9f1df5c5dd7e813", size = 128680, upload_time = "2025-04-10T15:23:37.377Z" },
+]
diff --git a/overlays/batman-adv.nix b/overlays/batman-adv.nix
deleted file mode 100644
index cce7dc4f..00000000
--- a/overlays/batman-adv.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ final, prev, sources, ... }: {
-  linuxPackages_latest = prev.linuxPackages_latest.extend (self: super: {
-    batman_adv = super.batman_adv.overrideAttrs (oldAttrs: {
-      version = "${sources.batman-adv.version}-${self.kernel.version}";
-      inherit (sources.batman-adv) src;
-    });
-  });
-
-  linuxPackages_6_2 = prev.linuxPackages_6_2.extend (self: super: {
-    batman_adv = super.batman_adv.overrideAttrs (oldAttrs: {
-      version = "${sources.batman-adv.version}-${self.kernel.version}";
-      inherit (sources.batman-adv) src;
-    });
-  });
-}
diff --git a/overlays/cake-prometheus-exporter/default.nix b/overlays/cake-prometheus-exporter/default.nix
index 3d0acc2d..69a5008c 100644
--- a/overlays/cake-prometheus-exporter/default.nix
+++ b/overlays/cake-prometheus-exporter/default.nix
@@ -1,19 +1,18 @@
 { final, prev, ... }:
 let
   inpPython = final.python310.override {};
+  python = inpPython.withPackages (ps: with ps; []);
 in {
   cake-prometheus-exporter = prev.stdenv.mkDerivation rec {
     pname = "cake-prometheus-exporter";
     version = "0.0.0";
 
-    src = ./cake-prometheus-exporter.py;
+    src = prev.replaceVars ./cake-prometheus-exporter.py { inherit python; };
 
-    phases = [ "buildPhase" "checkPhase" "installPhase" ];
+    phases = [ "unpackPhase" "checkPhase" "installPhase" ];
 
-    python = inpPython.withPackages (ps: with ps; []);
-
-    buildPhase = ''
-      substituteAll $src cake-prometheus-exporter
+    unpackPhase = ''
+      cp $src cake-prometheus-exporter
     '';
 
     doCheck = true;
diff --git a/overlays/deploy-rs.nix b/overlays/deploy-rs.nix
new file mode 100644
index 00000000..678c6f5f
--- /dev/null
+++ b/overlays/deploy-rs.nix
@@ -0,0 +1,16 @@
+{ final, prev, flakeInputs, ... }: prev.lib.composeExtensions
+  flakeInputs.deploy-rs.overlays.default
+  (final: prev: {
+    deploy-rs = prev.deploy-rs // {
+      deploy-rs = prev.symlinkJoin {
+        name = "${prev.deploy-rs.deploy-rs.name}-wrapped";
+        paths = [ prev.deploy-rs.deploy-rs ];
+        buildInputs = [ prev.makeWrapper ];
+        postBuild = ''
+          wrapProgram $out/bin/deploy \
+            --prefix PATH : ${prev.lib.makeBinPath (with final; [ nix-monitored ])}
+        '';
+      };
+    };
+  })
+  final prev
diff --git a/overlays/etesync-dav.nix b/overlays/etesync-dav.nix
index cec216e2..e0ced1e3 100644
--- a/overlays/etesync-dav.nix
+++ b/overlays/etesync-dav.nix
@@ -1,55 +1,58 @@
 { final, prev, ... }: {
-  etesync-dav = prev.python3Packages.buildPythonApplication rec {
+  etesync-dav = final.python3Packages.buildPythonApplication rec {
     pname = "etesync-dav";
-    version = "0.33.4";
+    version = "0.35.1";
+    pyproject = true;
 
     src = prev.fetchFromGitHub {
       owner = "etesync";
       repo = "etesync-dav";
-      rev = "v${version}";
-      hash = "sha256-g+rK762tSWPDaBsaTwpTzfK/lqVs+Z/Qrpq2HCpipQE=";
+      tag = "v${version}";
+      hash = "sha256-y4BhU2kSn+RWqc5+pJQFhbwfat9cMWD0ED0EXJp25cY=";
     };
 
-    dependencies = with prev.python3Packages; [
+    build-system = with final.python3Packages; [ setuptools ];
+
+    dependencies = with final.python3Packages; [
       appdirs
       etebase
       etesync
       flask
       flask-wtf
       msgpack
-      setuptools
-      (toPythonModule (buildPythonApplication rec {
+      requests
+      requests.optional-dependencies.socks
+      (buildPythonApplication rec {
         pname = "radicale";
-        version = "3.2.3";
+        version = "3.2.0";
         pyproject = true;
 
         src = prev.fetchFromGitHub {
           owner = "Kozea";
           repo = "Radicale";
           rev = "refs/tags/v${version}";
-          hash = "sha256-1IlnXVetQQuKBt6+QVKNeMM6qBQAiUhqc+4x3xOnSdE=";
+          hash = "sha256-RxC8VOfdTXJZiAroDHTKjJqGWu65Z5uyb4WK1LOqubQ=";
         };
 
+        postPatch = ''
+          sed -i '/addopts/d' setup.cfg
+        '';
+
         build-system = [
           setuptools
         ];
 
-        dependencies =
-          [
-            defusedxml
-            passlib
-            vobject
-            pika
-            python-dateutil
-            pytz # https://github.com/Kozea/Radicale/issues/816
-          ]
-          ++ passlib.optional-dependencies.bcrypt;
+        dependencies = [
+          defusedxml
+          passlib
+          vobject
+          pika
+          python-dateutil
+          pytz # https://github.com/Kozea/Radicale/issues/816
+        ] ++ passlib.optional-dependencies.bcrypt;
 
         doCheck = false;
-      }))
-      requests
-      types-setuptools
-      requests.optional-dependencies.socks
+      })
     ];
 
     doCheck = false;
diff --git a/overlays/inwx-cdnskey/default.nix b/overlays/inwx-cdnskey/default.nix
index cd564f24..e1bee0f2 100644
--- a/overlays/inwx-cdnskey/default.nix
+++ b/overlays/inwx-cdnskey/default.nix
@@ -2,17 +2,16 @@
 let
   packageOverrides = final.callPackage ./python-packages.nix {};
   inpPython = final.python39.override { inherit packageOverrides; };
+  python = inpPython.withPackages (ps: with ps; [pyxdg inwx-domrobot configparser dnspython]);
 in {
   inwx-cdnskey = prev.stdenv.mkDerivation rec {
     name = "inwx-cdnskey";
-    src = ./inwx-cdnskey.py;
+    src = prev.replaceVars ./inwx-cdnskey.py { inherit python; };
 
-    phases = [ "buildPhase" "checkPhase" "installPhase" ];
+    phases = [ "unpackPhase" "checkPhase" "installPhase" ];
 
-    python = inpPython.withPackages (ps: with ps; [pyxdg inwx-domrobot configparser dnspython]);
-
-    buildPhase = ''
-      substituteAll $src inwx-cdnskey
+    unpackPhase = ''
+      cp $src inwx-cdnskey
     '';
 
     doCheck = true;
diff --git a/overlays/keepassxc/database-open-dialog.patch b/overlays/keepassxc/database-open-dialog.patch
new file mode 100644
index 00000000..dff84846
--- /dev/null
+++ b/overlays/keepassxc/database-open-dialog.patch
@@ -0,0 +1,129 @@
+diff --git a/src/browser/BrowserService.cpp b/src/browser/BrowserService.cpp
+index 60412b5a..c0497d91 100644
+--- a/src/browser/BrowserService.cpp
++++ b/src/browser/BrowserService.cpp
+@@ -249,7 +249,7 @@ QJsonObject BrowserService::createNewGroup(const QString& groupName)
+         return result;
+     }
+ 
+-    auto dialogResult = MessageBox::warning(m_currentDatabaseWidget,
++    auto dialogResult = MessageBox::warning(nullptr,
+                                             tr("KeePassXC - Create a new group"),
+                                             tr("A request for creating a new group \"%1\" has been received.\n"
+                                                "Do you want to create this group?\n")
+@@ -422,7 +422,7 @@ QList<Entry*> BrowserService::confirmEntries(QList<Entry*>& entriesToConfirm,
+ 
+     m_dialogActive = true;
+     updateWindowState();
+-    BrowserAccessControlDialog accessControlDialog(m_currentDatabaseWidget);
++    BrowserAccessControlDialog accessControlDialog{};
+ 
+     connect(m_currentDatabaseWidget, SIGNAL(databaseLockRequested()), &accessControlDialog, SLOT(reject()));
+ 
+@@ -512,7 +512,7 @@ QString BrowserService::storeKey(const QString& key)
+     QString id;
+ 
+     do {
+-        QInputDialog keyDialog(m_currentDatabaseWidget);
++        QInputDialog keyDialog{};
+         connect(m_currentDatabaseWidget, SIGNAL(databaseLockRequested()), &keyDialog, SLOT(reject()));
+         keyDialog.setWindowTitle(tr("KeePassXC - New key association request"));
+         keyDialog.setLabelText(tr("You have received an association request for the following database:\n%1\n\n"
+@@ -535,7 +535,7 @@ QString BrowserService::storeKey(const QString& key)
+ 
+         contains = db->metadata()->customData()->contains(CustomData::BrowserKeyPrefix + id);
+         if (contains) {
+-            dialogResult = MessageBox::warning(m_currentDatabaseWidget,
++            dialogResult = MessageBox::warning(nullptr,
+                                                tr("KeePassXC - Overwrite existing key?"),
+                                                tr("A shared encryption key with the name \"%1\" "
+                                                   "already exists.\nDo you want to overwrite it?")
+@@ -595,7 +595,7 @@ QJsonObject BrowserService::showPasskeysRegisterPrompt(const QJsonObject& public
+     const auto existingEntries = getPasskeyEntriesWithUserHandle(rpId, userId, keyList);
+ 
+     raiseWindow();
+-    BrowserPasskeysConfirmationDialog confirmDialog(m_currentDatabaseWidget);
++    BrowserPasskeysConfirmationDialog confirmDialog{};
+     confirmDialog.registerCredential(username, rpId, existingEntries, timeout);
+ 
+     auto dialogResult = confirmDialog.exec();
+@@ -612,7 +612,7 @@ QJsonObject BrowserService::showPasskeysRegisterPrompt(const QJsonObject& public
+             // If no entry is selected, show the import dialog for manual entry selection
+             auto selectedEntry = confirmDialog.getSelectedEntry();
+             if (!selectedEntry) {
+-                PasskeyImporter passkeyImporter(m_currentDatabaseWidget);
++               PasskeyImporter passkeyImporter{};
+                 const auto result = passkeyImporter.showImportDialog(db,
+                                                                      nullptr,
+                                                                      origin,
+@@ -683,7 +683,7 @@ QJsonObject BrowserService::showPasskeysAuthenticationPrompt(const QJsonObject&
+     const auto timeout = publicKeyOptions["timeout"].toInt();
+ 
+     raiseWindow();
+-    BrowserPasskeysConfirmationDialog confirmDialog(m_currentDatabaseWidget);
++    BrowserPasskeysConfirmationDialog confirmDialog{};
+     confirmDialog.authenticateCredential(entries, rpId, timeout);
+     auto dialogResult = confirmDialog.exec();
+     if (dialogResult == QDialog::Accepted) {
+@@ -760,7 +760,7 @@ void BrowserService::addPasskeyToEntry(Entry* entry,
+ 
+     // Ask confirmation if entry already contains a Passkey
+     if (entry->hasPasskey()) {
+-        if (MessageBox::question(m_currentDatabaseWidget,
++        if (MessageBox::question(nullptr,
+                                  tr("KeePassXC - Update passkey"),
+                                  tr("Entry already has a passkey.\nDo you want to overwrite the passkey in %1 - %2?")
+                                      .arg(entry->title(), passkeyUtils()->getUsernameFromEntry(entry)),
+@@ -873,7 +873,7 @@ bool BrowserService::updateEntry(const EntryParameters& entryParameters, const Q
+         MessageBox::Button dialogResult = MessageBox::No;
+         if (!browserSettings()->alwaysAllowUpdate()) {
+             raiseWindow();
+-            dialogResult = MessageBox::question(m_currentDatabaseWidget,
++            dialogResult = MessageBox::question(nullptr,
+                                                 tr("KeePassXC - Update Entry"),
+                                                 tr("Do you want to update the information in %1 - %2?")
+                                                     .arg(QUrl(entryParameters.siteUrl).host(), username),
+@@ -909,7 +909,7 @@ bool BrowserService::deleteEntry(const QString& uuid)
+         return false;
+     }
+ 
+-    auto dialogResult = MessageBox::warning(m_currentDatabaseWidget,
++    auto dialogResult = MessageBox::warning(nullptr,
+                                             tr("KeePassXC - Delete entry"),
+                                             tr("A request for deleting entry \"%1\" has been received.\n"
+                                                "Do you want to delete the entry?\n")
+@@ -1536,7 +1536,7 @@ QSharedPointer<Database> BrowserService::selectedDatabase()
+         }
+     }
+ 
+-    BrowserEntrySaveDialog browserEntrySaveDialog(m_currentDatabaseWidget);
++    BrowserEntrySaveDialog browserEntrySaveDialog{};
+     int openDatabaseCount = browserEntrySaveDialog.setItems(databaseWidgets, m_currentDatabaseWidget);
+     if (openDatabaseCount > 1) {
+         int res = browserEntrySaveDialog.exec();
+diff --git a/src/fdosecrets/objects/Prompt.cpp b/src/fdosecrets/objects/Prompt.cpp
+index e89cd499..347c98b8 100644
+--- a/src/fdosecrets/objects/Prompt.cpp
++++ b/src/fdosecrets/objects/Prompt.cpp
+@@ -313,7 +313,7 @@ namespace FdoSecrets
+         if (!entries.isEmpty()) {
+             QString app = tr("%1 (PID: %2)").arg(client->name()).arg(client->pid());
+             auto ac = new AccessControlDialog(
+-                findWindow(m_windowId), entries, app, client->processInfo(), AuthOption::Remember);
++                nullptr, entries, app, client->processInfo(), AuthOption::Remember);
+             connect(ac, &AccessControlDialog::finished, this, &UnlockPrompt::itemUnlockFinished);
+             connect(ac, &AccessControlDialog::finished, ac, &AccessControlDialog::deleteLater);
+             ac->open();
+diff --git a/src/gui/DatabaseTabWidget.cpp b/src/gui/DatabaseTabWidget.cpp
+index 805d4eab..4836199e 100644
+--- a/src/gui/DatabaseTabWidget.cpp
++++ b/src/gui/DatabaseTabWidget.cpp
+@@ -41,7 +41,7 @@ DatabaseTabWidget::DatabaseTabWidget(QWidget* parent)
+     : QTabWidget(parent)
+     , m_dbWidgetStateSync(new DatabaseWidgetStateSync(this))
+     , m_dbWidgetPendingLock(nullptr)
+-    , m_databaseOpenDialog(new DatabaseOpenDialog(this))
++    , m_databaseOpenDialog(new DatabaseOpenDialog())
+     , m_databaseOpenInProgress(false)
+ {
+     auto* tabBar = new QTabBar(this);
diff --git a/overlays/keepassxc/default.nix b/overlays/keepassxc/default.nix
new file mode 100644
index 00000000..46b3a459
--- /dev/null
+++ b/overlays/keepassxc/default.nix
@@ -0,0 +1,8 @@
+{ final, prev, ... }:
+{
+  keepassxc = prev.keepassxc.overrideAttrs (oldAttrs: {
+    patches = (oldAttrs.patches or []) ++ prev.lib.optional (prev.lib.versionAtLeast oldAttrs.version "2.7.9") [
+      ./database-open-dialog.patch
+    ];
+  });
+}
diff --git a/overlays/lesspipe.nix b/overlays/lesspipe.nix
index 3258eb70..b791f6e5 100644
--- a/overlays/lesspipe.nix
+++ b/overlays/lesspipe.nix
@@ -17,7 +17,7 @@
 
     preFixup = ''
       wrapProgram $out/bin/lesspipe.sh \
-        --prefix PATH : ${final.python3.pkgs.pygments}/bin:${final.file}/bin:${final.ncurses}/bin
+        --prefix PATH : ${prev.lib.makeBinPath (with final; [ file ncurses binutils ])}
     '';
   };
 }
diff --git a/overlays/mako.nix b/overlays/mako.nix
new file mode 100644
index 00000000..1c1464fb
--- /dev/null
+++ b/overlays/mako.nix
@@ -0,0 +1,5 @@
+{ final, prev, sources, ... }: {
+  mako = prev.mako.overrideAttrs (oldAttrs: {
+    inherit (sources.mako) version src;
+  });
+}
diff --git a/overlays/nftables-prometheus-exporter/default.nix b/overlays/nftables-prometheus-exporter/default.nix
index aab0c8e9..48f668c4 100644
--- a/overlays/nftables-prometheus-exporter/default.nix
+++ b/overlays/nftables-prometheus-exporter/default.nix
@@ -1,17 +1,16 @@
 { final, prev, ... }:
 let
   inpPython = final.python310;
+  python = inpPython.withPackages (ps: with ps; []);
 in {
   nftables-prometheus-exporter = prev.stdenv.mkDerivation rec {
     name = "nftables-prometheus-exporter";
-    src = ./nftables-prometheus-exporter.py;
+    src = prev.replaceVars ./nftables-prometheus-exporter.py { inherit python; };
 
-    phases = [ "buildPhase" "checkPhase" "installPhase" ];
+    phases = [ "unpackPhase" "checkPhase" "installPhase" ];
 
-    python = inpPython.withPackages (ps: with ps; []);
-
-    buildPhase = ''
-      substituteAll $src nftables-prometheus-exporter
+    unpackPhase = ''
+      cp $src nftables-prometheus-exporter
     '';
 
     doCheck = true;
diff --git a/overlays/niri.nix b/overlays/niri.nix
new file mode 100644
index 00000000..9188ed7d
--- /dev/null
+++ b/overlays/niri.nix
@@ -0,0 +1,8 @@
+{ final, prev, flakeInputs, ... }: prev.lib.composeExtensions
+  flakeInputs.niri-flake.overlays.niri
+  (final: prev: {
+    niri-unstable = prev.niri-unstable.overrideAttrs (oldAttrs: {
+      buildInputs = (oldAttrs.buildInputs or []) ++ [ final.libgbm ];
+    });
+  })
+  final prev
diff --git a/overlays/nix-direnv/default.nix b/overlays/nix-direnv/default.nix
new file mode 100644
index 00000000..7c488e4e
--- /dev/null
+++ b/overlays/nix-direnv/default.nix
@@ -0,0 +1,53 @@
+{ final, prev, ... }: {
+  nix-direnv = prev.resholve.mkDerivation rec {
+    pname = "nix-direnv";
+    version = "3.0.6";
+
+    patches = [
+      ./static-nix.patch
+    ];
+
+    src = prev.fetchFromGitHub {
+      owner = "nix-community";
+      repo = "nix-direnv";
+      rev = version;
+      hash = "sha256-oNqhPqgQT92yxbKmcgX4F3e2yTUPyXYG7b2xQm3TvQw=";
+    };
+
+    installPhase = ''
+      runHook preInstall
+      install -m400 -D direnvrc $out/share/nix-direnv/direnvrc
+      runHook postInstall
+    '';
+
+    solutions = {
+      default = {
+        scripts = [ "share/nix-direnv/direnvrc" ];
+        interpreter = "none";
+        inputs = with final; [ coreutils nix-monitored ];
+        fake = {
+          builtin = [
+            "PATH_add"
+            "direnv_layout_dir"
+            "has"
+            "log_error"
+            "log_status"
+            "watch_file"
+          ];
+          function = [
+            # not really a function - this is in an else branch for macOS/homebrew that
+            # cannot be reached when built with nix
+            "shasum"
+          ];
+        };
+        keep = {
+          "$cmd" = true;
+          "$direnv" = true;
+        };
+        execer = [
+          "cannot:${prev.lib.getExe' final.nix-monitored "nix"}"
+        ];
+      };
+    };
+  };
+}
diff --git a/overlays/nix-direnv/static-nix.patch b/overlays/nix-direnv/static-nix.patch
new file mode 100644
index 00000000..5de8193f
--- /dev/null
+++ b/overlays/nix-direnv/static-nix.patch
@@ -0,0 +1,62 @@
+diff --git i/direnvrc w/direnvrc
+index ddac0f5..fbcade6 100644
+--- i/direnvrc
++++ w/direnvrc
+@@ -29,10 +29,8 @@ _nix_direnv_warning() {
+ 
+ _nix_direnv_error() { log_error "${_NIX_DIRENV_LOG_PREFIX}$*"; }
+ 
+-_nix_direnv_nix=""
+-
+ _nix() {
+-  ${_nix_direnv_nix} --extra-experimental-features "nix-command flakes" "$@"
++  nix --extra-experimental-features "nix-command flakes" "$@"
+ }
+ 
+ _require_version() {
+@@ -55,34 +53,6 @@ _require_cmd_version() {
+   _require_version "$cmd" "${BASH_REMATCH[1]}" "$required"
+ }
+ 
+-_nix_direnv_resolve_nix() {
+-  local ambient_nix
+-
+-  if ambient_nix=$(command -v nix); then
+-    if _require_cmd_version "${ambient_nix}" "${NIX_MIN_VERSION}"; then
+-      echo "${ambient_nix}"
+-      return 0
+-    else
+-      _nix_direnv_warning "Nix version in PATH is too old, wanted ${NIX_MIN_VERSION}+, got $(${ambient_nix} --version), will attempt fallback"
+-    fi
+-  else
+-    _nix_direnv_warning "Could not find Nix in PATH, will attempt fallback"
+-  fi
+-
+-  if [ -n "${NIX_DIRENV_FALLBACK_NIX}" ]; then
+-    if _require_cmd_version "${NIX_DIRENV_FALLBACK_NIX}" "${NIX_MIN_VERSION}"; then
+-      echo "${NIX_DIRENV_FALLBACK_NIX}"
+-      return 0
+-    else
+-      _nix_direnv_error "Fallback Nix version is too old, wanted ${NIX_MIN_VERSION}+, got $(${NIX_DIRENV_FALLBACK_NIX} --version)"
+-      return 1
+-    fi
+-  else
+-    _nix_direnv_error "Could not find fallback Nix binary, please add Nix to PATH or set NIX_DIRENV_FALLBACK_NIX"
+-    return 1
+-  fi
+-}
+-
+ _nix_direnv_preflight() {
+   if [[ -z $direnv ]]; then
+     # shellcheck disable=2016
+@@ -102,10 +72,6 @@ _nix_direnv_preflight() {
+     fi
+   fi
+ 
+-  if ! _nix_direnv_nix=$(_nix_direnv_resolve_nix); then
+-    return 1
+-  fi
+-
+   local layout_dir
+   layout_dir=$(direnv_layout_dir)
+ 
diff --git a/overlays/nix-monitored.nix b/overlays/nix-monitored.nix
new file mode 100644
index 00000000..9f6caff1
--- /dev/null
+++ b/overlays/nix-monitored.nix
@@ -0,0 +1,8 @@
+{ final, prev, flakeInputs, ... }: prev.lib.composeExtensions
+  flakeInputs.nix-monitored.overlays.default
+  (final: prev: {
+    nix-monitored = prev.nix-monitored.override {
+      withNotify = false;
+    };
+  })
+  final prev
diff --git a/overlays/persistent-nix-shell/default.nix b/overlays/persistent-nix-shell/default.nix
index c36b9e86..6067cade 100644
--- a/overlays/persistent-nix-shell/default.nix
+++ b/overlays/persistent-nix-shell/default.nix
@@ -5,10 +5,9 @@
 
     phases = [ "buildPhase" "installPhase" ];
 
-    inherit (final) zsh;
-
     buildPhase = ''
-      substituteAll $src persistent-nix-shell
+      substitute $src persistent-nix-shell \
+        --subst-var-by zsh ${final.zsh}
     '';
 
     installPhase = ''
diff --git a/overlays/postsrsd.nix b/overlays/postsrsd.nix
new file mode 100644
index 00000000..cb1ccf30
--- /dev/null
+++ b/overlays/postsrsd.nix
@@ -0,0 +1,11 @@
+{ final, prev, ... }:
+{
+  postsrsd = prev.postsrsd.overrideAttrs (oldAttrs: {
+    cmakeFlags = (oldAttrs.cmakeFlags or []) ++ [
+      "-DWITH_MILTER=ON"
+    ];
+    buildInputs = (oldAttrs.buildInputs or []) ++ [
+      final.libmilter
+    ];
+  });
+}
diff --git a/overlays/preserve-dscp/default.nix b/overlays/preserve-dscp/default.nix
index 105eccb9..208d69db 100644
--- a/overlays/preserve-dscp/default.nix
+++ b/overlays/preserve-dscp/default.nix
@@ -15,7 +15,7 @@
 
     outputs = [ "out" "lib" ];
 
-    buildInputs = with final; [ elfutils libpcap zlib ];
+    buildInputs = with final; [ elfutils libpcap libcap zlib ];
     nativeBuildInputs = with final; [ llvmPackages.clang llvmPackages.llvm pkg-config bpftools libmnl gnum4 glibc_multi makeWrapper ];
 
     installPhase = ''
diff --git a/overlays/prometheus-lvm-exporter.nix b/overlays/prometheus-lvm-exporter.nix
index 6b671cab..cae45003 100644
--- a/overlays/prometheus-lvm-exporter.nix
+++ b/overlays/prometheus-lvm-exporter.nix
@@ -3,7 +3,7 @@
     pname = "prometheus-lvm-exporter";
     inherit (sources.prometheus-lvm-exporter) version src;
 
-    vendorHash = "sha256-vqxsg70ShMo4OVdzhqYDj/HT3RTpCUBGHze/EkbBJig=";
+    vendorHash = "sha256-QpJM11Rg+TUV0GWYlvIkwuQqiTsfSdQNtPpD6zT08ew=";
 
     doCheck = false;
 
diff --git a/overlays/scutiger.nix b/overlays/scutiger.nix
index 7a56adaf..fea15c5f 100644
--- a/overlays/scutiger.nix
+++ b/overlays/scutiger.nix
@@ -2,7 +2,7 @@
   scutiger = final.rustPlatform.buildRustPackage {
     inherit (sources.scutiger) pname version src;
 
-    cargoHash = "sha256-d+wJ3trrldCVATsudsbglElU6q4LaS6feRocRyHal2k=";
+    cargoHash = if prev.lib.versionOlder prev.lib.version "24.05" then "sha256-d+wJ3trrldCVATsudsbglElU6q4LaS6feRocRyHal2k=" else "sha256-FTAEmRuO95ii84uwaALVuImiymnSAQkB2UwZ5yX0WPs=";
 
     nativeBuildInputs = with final; [ pkg-config pcre2.dev zlib.dev git ];
   };
diff --git a/overlays/spice-record.nix b/overlays/spice-record.nix
index 06a114da..2d37079b 100644
--- a/overlays/spice-record.nix
+++ b/overlays/spice-record.nix
@@ -8,5 +8,7 @@
       wrapProgram $out/bin/spice-record \
         --prefix PATH : ${prev.lib.makeBinPath (with prev; [ ffmpeg-full ])}
     '';
+    pyproject = true;
+    build-system = [ prev.python3Packages.setuptools ];
   };
 }
diff --git a/overlays/swayosd/default.nix b/overlays/swayosd/default.nix
new file mode 100644
index 00000000..5e715dae
--- /dev/null
+++ b/overlays/swayosd/default.nix
@@ -0,0 +1,13 @@
+{ final, prev, sources, ... }: {
+  swayosd = prev.swayosd.overrideAttrs (oldAttrs: rec {
+    inherit (sources.swayosd) version src;
+    cargoDeps = prev.rustPlatform.fetchCargoVendor {
+      inherit (oldAttrs) pname;
+      inherit version src;
+      hash = "sha256-J2sl6/4+bRWlkvaTJtFsMqvvOxYtWLRjJcYWcu0loRE=";
+    };
+    patches = (oldAttrs.patches or []) ++ [
+      ./exponential.patch
+    ];
+  });
+}
diff --git a/overlays/swayosd/exponential.patch b/overlays/swayosd/exponential.patch
new file mode 100644
index 00000000..eb90d739
--- /dev/null
+++ b/overlays/swayosd/exponential.patch
@@ -0,0 +1,57 @@
+diff --git a/src/brightness_backend/brightnessctl.rs b/src/brightness_backend/brightnessctl.rs
+index ccb0e11..740fdb6 100644
+--- a/src/brightness_backend/brightnessctl.rs
++++ b/src/brightness_backend/brightnessctl.rs
+@@ -107,10 +107,21 @@ impl VirtualDevice {
+                }
+        }
+ 
+-       fn set_percent(&mut self, mut val: u32) -> anyhow::Result<()> {
+-               val = val.clamp(0, 100);
+-               self.current = self.max.map(|max| val * max / 100);
+-               let _: String = self.run(("set", &*format!("{val}%")))?;
++        fn val_to_percent(&mut self, val: u32) -> u32 {
++                return ((val as f64 / self.get_max() as f64).powf(0.25) * 100_f64).round() as u32;
++        }
++        fn percent_to_val(&mut self, perc: u32) -> u32 {
++                return ((perc as f64 / 100_f64).powf(4_f64) * self.get_max() as f64).round() as u32;
++        }
++
++       fn set_percent(&mut self, val: u32) -> anyhow::Result<()> {
++                let new = self.percent_to_val(val);
++                self.set_val(new)
++       }
++       fn set_val(&mut self, val: u32) -> anyhow::Result<()> {
++                let curr = val.clamp(0, self.get_max());
++                self.current = Some(curr);
++               let _: String = self.run(("set", &*format!("{curr}")))?;
+                Ok(())
+        }
+ }
+@@ -134,20 +145,18 @@ impl BrightnessBackend for BrightnessCtl {
+ 
+        fn lower(&mut self, by: u32) -> anyhow::Result<()> {
+                let curr = self.get_current();
+-               let max = self.get_max();
+-
+-               let curr = curr * 100 / max;
++                let mut new = self.device.val_to_percent(curr).saturating_sub(by);
++                new = self.device.percent_to_val(new).min(curr.saturating_sub(1));
+ 
+-               self.device.set_percent(curr.saturating_sub(by))
++               self.device.set_val(new)
+        }
+ 
+        fn raise(&mut self, by: u32) -> anyhow::Result<()> {
+                let curr = self.get_current();
+-               let max = self.get_max();
+-
+-               let curr = curr * 100 / max;
++                let mut new = self.device.val_to_percent(curr) + by;
++                new = self.device.percent_to_val(new).max(curr + 1);
+ 
+-               self.device.set_percent(curr + by)
++               self.device.set_val(new)
+        }
+ 
+        fn set(&mut self, val: u32) -> anyhow::Result<()> {
diff --git a/overlays/waybar-systemd-inhibit/.envrc b/overlays/waybar-systemd-inhibit/.envrc
new file mode 100644
index 00000000..2c909235
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/.envrc
@@ -0,0 +1,4 @@
+use flake
+
+[[ -d ".venv" ]] || ( uv venv && uv sync )
+. .venv/bin/activate
diff --git a/overlays/waybar-systemd-inhibit/.gitignore b/overlays/waybar-systemd-inhibit/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/overlays/waybar-systemd-inhibit/default.nix b/overlays/waybar-systemd-inhibit/default.nix
new file mode 100644
index 00000000..ae6b8c75
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/default.nix
@@ -0,0 +1,20 @@
+{ prev, final, flake, flakeInputs, ... }:
+
+let
+  workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
+  pythonSet = flake.lib.pythonSet {
+    pkgs = final;
+    python = final.python312;
+    overlay = workspace.mkPyprojectOverlay {
+      sourcePreference = "wheel";
+    };
+  };
+  virtualEnv = pythonSet.mkVirtualEnv "waybar-systemd-inhibit-env" workspace.deps.default;
+in {
+  waybar-systemd-inhibit = virtualEnv.overrideAttrs (oldAttrs: {
+    meta = (oldAttrs.meta or {}) // {
+      mainProgram = "waybar-systemd-inhibit";
+    };
+    nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ [ final.gobject-introspection final.wrapGAppsHook ];
+  });
+}
diff --git a/overlays/waybar-systemd-inhibit/pyproject.toml b/overlays/waybar-systemd-inhibit/pyproject.toml
new file mode 100644
index 00000000..6c6240b8
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/pyproject.toml
@@ -0,0 +1,17 @@
+[project]
+name = "waybar-systemd-inhibit"
+version = "0.1.0"
+requires-python = ">=3.12"
+dependencies = [
+    "asyncclick>=8.1.8",
+    "asyncio>=3.4.3",
+    "dbus-next>=0.2.3",
+]
+
+[project.scripts]
+waybar-systemd-inhibit = "waybar_systemd_inhibit.__main__:main"
+waybar-systemd-inhibit-toggle = "waybar_systemd_inhibit.__main__:toggle"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
diff --git a/overlays/waybar-systemd-inhibit/uv.lock b/overlays/waybar-systemd-inhibit/uv.lock
new file mode 100644
index 00000000..4e10d145
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/uv.lock
@@ -0,0 +1,102 @@
+version = 1
+revision = 2
+requires-python = ">=3.12"
+
+[[package]]
+name = "anyio"
+version = "4.9.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "idna" },
+    { name = "sniffio" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/95/7d/4c1bd541d4dffa1b52bd83fb8527089e097a106fc90b467a7313b105f840/anyio-4.9.0.tar.gz", hash = "sha256:673c0c244e15788651a4ff38710fea9675823028a6f08a5eda409e0c9840a028", size = 190949, upload-time = "2025-03-17T00:02:54.77Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a1/ee/48ca1a7c89ffec8b6a0c5d02b89c305671d5ffd8d3c94acf8b8c408575bb/anyio-4.9.0-py3-none-any.whl", hash = "sha256:9f76d541cad6e36af7beb62e978876f3b41e3e04f2c1fbf0884604c0a9c4d93c", size = 100916, upload-time = "2025-03-17T00:02:52.713Z" },
+]
+
+[[package]]
+name = "asyncclick"
+version = "8.1.8"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/cb/b5/e1e5fdf1c1bb7e6e614987c120a98d9324bf8edfaa5f5cd16a6235c9d91b/asyncclick-8.1.8.tar.gz", hash = "sha256:0f0eb0f280e04919d67cf71b9fcdfb4db2d9ff7203669c40284485c149578e4c", size = 232900, upload-time = "2025-01-06T09:46:52.694Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/14/cc/a436f0fc2d04e57a0697e0f87a03b9eaed03ad043d2d5f887f8eebcec95f/asyncclick-8.1.8-py3-none-any.whl", hash = "sha256:eb1ccb44bc767f8f0695d592c7806fdf5bd575605b4ee246ffd5fadbcfdbd7c6", size = 99093, upload-time = "2025-01-06T09:46:51.046Z" },
+    { url = "https://files.pythonhosted.org/packages/92/c4/ae9e9d25522c6dc96ff167903880a0fe94d7bd31ed999198ee5017d977ed/asyncclick-8.1.8.0-py3-none-any.whl", hash = "sha256:be146a2d8075d4fe372ff4e877f23c8b5af269d16705c1948123b9415f6fd678", size = 99115, upload-time = "2025-01-06T09:50:52.72Z" },
+]
+
+[[package]]
+name = "asyncio"
+version = "3.4.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/da/54/054bafaf2c0fb8473d423743e191fcdf49b2c1fd5e9af3524efbe097bafd/asyncio-3.4.3.tar.gz", hash = "sha256:83360ff8bc97980e4ff25c964c7bd3923d333d177aa4f7fb736b019f26c7cb41", size = 204411, upload-time = "2015-03-10T14:11:26.494Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/22/74/07679c5b9f98a7cb0fc147b1ef1cc1853bc07a4eb9cb5731e24732c5f773/asyncio-3.4.3-py3-none-any.whl", hash = "sha256:c4d18b22701821de07bd6aea8b53d21449ec0ec5680645e5317062ea21817d2d", size = 101767, upload-time = "2015-03-10T14:05:10.959Z" },
+]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "dbus-next"
+version = "0.2.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/45/6a40fbe886d60a8c26f480e7d12535502b5ba123814b3b9a0b002ebca198/dbus_next-0.2.3.tar.gz", hash = "sha256:f4eae26909332ada528c0a3549dda8d4f088f9b365153952a408e28023a626a5", size = 71112, upload-time = "2021-07-25T22:11:28.398Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d2/fc/c0a3f4c4eaa5a22fbef91713474666e13d0ea2a69c84532579490a9f2cc8/dbus_next-0.2.3-py3-none-any.whl", hash = "sha256:58948f9aff9db08316734c0be2a120f6dc502124d9642f55e90ac82ffb16a18b", size = 57885, upload-time = "2021-07-25T22:11:25.466Z" },
+]
+
+[[package]]
+name = "idna"
+version = "3.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
+]
+
+[[package]]
+name = "sniffio"
+version = "1.3.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a2/87/a6771e1546d97e7e041b6ae58d80074f81b7d5121207425c964ddf5cfdbd/sniffio-1.3.1.tar.gz", hash = "sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc", size = 20372, upload-time = "2024-02-25T23:20:04.057Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e9/44/75a9c9421471a6c4805dbf2356f7c181a29c1879239abab1ea2cc8f38b40/sniffio-1.3.1-py3-none-any.whl", hash = "sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2", size = 10235, upload-time = "2024-02-25T23:20:01.196Z" },
+]
+
+[[package]]
+name = "typing-extensions"
+version = "4.13.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f6/37/23083fcd6e35492953e8d2aaaa68b860eb422b34627b13f2ce3eb6106061/typing_extensions-4.13.2.tar.gz", hash = "sha256:e6c81219bd689f51865d9e372991c540bda33a0379d5573cddb9a3a23f7caaef", size = 106967, upload-time = "2025-04-10T14:19:05.416Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/8b/54/b1ae86c0973cc6f0210b53d508ca3641fb6d0c56823f288d108bc7ab3cc8/typing_extensions-4.13.2-py3-none-any.whl", hash = "sha256:a439e7c04b49fec3e5d3e2beaa21755cadbbdc391694e28ccdd36ca4a1408f8c", size = 45806, upload-time = "2025-04-10T14:19:03.967Z" },
+]
+
+[[package]]
+name = "waybar-systemd-inhibit"
+version = "0.1.0"
+source = { editable = "." }
+dependencies = [
+    { name = "asyncclick" },
+    { name = "asyncio" },
+    { name = "dbus-next" },
+]
+
+[package.metadata]
+requires-dist = [
+    { name = "asyncclick", specifier = ">=8.1.8" },
+    { name = "asyncio", specifier = ">=3.4.3" },
+    { name = "dbus-next", specifier = ">=0.2.3" },
+]
diff --git a/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__init__.py b/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__init__.py
diff --git a/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__main__.py b/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__main__.py
new file mode 100644
index 00000000..35cc7fd1
--- /dev/null
+++ b/overlays/waybar-systemd-inhibit/waybar_systemd_inhibit/__main__.py
@@ -0,0 +1,117 @@
+import asyncclick as click
+from dbus_next.aio import MessageBus
+from dbus_next import BusType, Message, PropertyAccess
+import asyncio
+from functools import update_wrapper
+from dbus_next.service import ServiceInterface, method, dbus_property
+from dbus_next import Variant, DBusError
+import os
+import json
+
+class BlockInterface(ServiceInterface):
+    def __init__(self, system_bus, logind):
+        super().__init__('li.yggdrasil.WaybarSystemdInhibit')
+        self.system_bus = system_bus
+        self.logind = logind
+        self.fd = None
+
+    def Release(self):
+        if not self.fd:
+            return
+
+        os.close(self.fd)
+        self.fd = None
+        self.emit_properties_changed({'IsAcquired': False})
+
+    async def Acquire(self):
+        if self.fd:
+            return
+
+        res = await self.system_bus.call(Message(
+            destination='org.freedesktop.login1',
+            path='/org/freedesktop/login1',
+            interface='org.freedesktop.login1.Manager',
+            member='Inhibit',
+            signature='ssss',
+            body=[
+                "handle-lid-switch",
+                "waybar-systemd-inhibit",
+                "User request",
+                "block",
+            ],
+        ))
+        self.fd = res.unix_fds[res.body[0]]
+        self.emit_properties_changed({'IsAcquired': True})
+
+    @method()
+    async def ToggleBlock(self):
+        if self.fd:
+            self.Release()
+        else:
+            await self.Acquire()
+
+    @dbus_property(access=PropertyAccess.READ)
+    def IsAcquired(self) -> 'b':
+        return self.fd is not None
+
+
+@click.command()
+async def main():
+    system_bus = await MessageBus(bus_type=BusType.SYSTEM, negotiate_unix_fd=True).connect()
+    session_bus = await MessageBus(bus_type=BusType.SESSION).connect()
+
+    introspection = await system_bus.introspect('org.freedesktop.login1', '/org/freedesktop/login1')
+    obj = system_bus.get_proxy_object('org.freedesktop.login1', '/org/freedesktop/login1', introspection)
+    logind = obj.get_interface('org.freedesktop.login1.Manager')
+    properties = obj.get_interface('org.freedesktop.DBus.Properties')
+
+    def is_blocked_logind(what: str):
+        return "handle-lid-switch" in what.split(':')
+
+    def print_state(is_blocked: bool, is_acquired: bool = False):
+        icon = "&#xf0322;" if is_blocked else "&#xf06e7;"
+        text = f"<span font=\"Symbols Nerd Font Mono\">{icon}</span>"
+        if is_acquired:
+            text = f"<span color=\"#f28a21\">{text}</span>"
+        elif is_blocked:
+            text = f"<span color=\"#ffffff\">{text}</span>"
+        print(json.dumps({'text': text, 'tooltip': ("Manually inhibited" if is_acquired else None)}, separators=(',', ':')), flush=True)
+
+    print_state(is_blocked_logind(await logind.get_block_inhibited()))
+
+    async def get_inhibit():
+        introspection = await session_bus.introspect('li.yggdrasil.WaybarSystemdInhibit', '/li/yggdrasil/WaybarSystemdInhibit')
+        return session_bus.get_proxy_object('li.yggdrasil.WaybarSystemdInhibit', '/li/yggdrasil/WaybarSystemdInhibit', introspection)
+
+    async def on_logind_properties_changed(interface_name, changed_properties, invalidated_properties):
+        if 'BlockInhibited' not in changed_properties:
+            return
+
+        properties = (await get_inhibit()).get_interface('li.yggdrasil.WaybarSystemdInhibit')
+
+        print_state(is_blocked_logind(changed_properties['BlockInhibited'].value), await properties.get_is_acquired())
+
+    properties.on_properties_changed(on_logind_properties_changed)
+
+    session_bus.export('/li/yggdrasil/WaybarSystemdInhibit', BlockInterface(system_bus, logind))
+    await session_bus.request_name('li.yggdrasil.WaybarSystemdInhibit')
+
+    properties = (await get_inhibit()).get_interface('org.freedesktop.DBus.Properties')
+
+    async def on_inhibit_properties_changed(interface_name, changed_properties, invalidated_properties):
+        if 'IsAcquired' not in changed_properties:
+            return
+
+        print_state(is_blocked_logind(await logind.get_block_inhibited()), changed_properties['IsAcquired'].value)
+
+    properties.on_properties_changed(on_inhibit_properties_changed)
+
+    await session_bus.wait_for_disconnect()
+
+@click.command()
+async def toggle():
+    session_bus = await MessageBus(bus_type=BusType.SESSION).connect()
+    introspection = await session_bus.introspect('li.yggdrasil.WaybarSystemdInhibit', '/li/yggdrasil/WaybarSystemdInhibit')
+    obj = session_bus.get_proxy_object('li.yggdrasil.WaybarSystemdInhibit', '/li/yggdrasil/WaybarSystemdInhibit', introspection)
+    interface = obj.get_interface('li.yggdrasil.WaybarSystemdInhibit')
+    await interface.call_toggle_block()
diff --git a/overlays/waybar.nix b/overlays/waybar.nix
index 20f37255..e7e3b807 100644
--- a/overlays/waybar.nix
+++ b/overlays/waybar.nix
@@ -1,3 +1,8 @@
-{ final, prev, flakeInputs, ... }:
-
-flakeInputs.waybar.overlays.default final prev
+{ final, prev, flakeInputs, ... }: prev.lib.composeExtensions
+  flakeInputs.waybar.overlays.default
+  (final: prev: {
+    waybar = prev.waybar.overrideAttrs (oldAttrs: {
+      dontVersionCheck = true;
+    });
+  })
+  final prev
diff --git a/overlays/worktime/.envrc b/overlays/worktime/.envrc
new file mode 100644
index 00000000..2c909235
--- /dev/null
+++ b/overlays/worktime/.envrc
@@ -0,0 +1,4 @@
+use flake
+
+[[ -d ".venv" ]] || ( uv venv && uv sync )
+. .venv/bin/activate
diff --git a/overlays/worktime/.gitignore b/overlays/worktime/.gitignore
new file mode 100644
index 00000000..4ccfae70
--- /dev/null
+++ b/overlays/worktime/.gitignore
@@ -0,0 +1,2 @@
+.venv
+**/__pycache__
diff --git a/overlays/worktime/default.nix b/overlays/worktime/default.nix
index 5ecdf149..579cf7ad 100644
--- a/overlays/worktime/default.nix
+++ b/overlays/worktime/default.nix
@@ -1,13 +1,19 @@
-{ prev, ... }:
+{ prev, final, flake, flakeInputs, ... }:
 
-with prev.poetry2nix;
-
-{
-  worktime = mkPoetryApplication {
-    python = prev.python310;
-
-    projectDir = cleanPythonSources { src = ./.; };
-
-    meta.mainProgram = "worktime";
+let
+  workspace = flakeInputs.uv2nix.lib.workspace.loadWorkspace { workspaceRoot = ./.; };
+  pythonSet = flake.lib.pythonSet {
+    pkgs = final;
+    python = final.python312;
+    overlay = workspace.mkPyprojectOverlay {
+      sourcePreference = "wheel";
+    };
   };
+  virtualEnv = pythonSet.mkVirtualEnv "worktime" workspace.deps.default;
+in {
+  worktime = virtualEnv.overrideAttrs (oldAttrs: {
+    meta = (oldAttrs.meta or {}) // {
+      mainProgram = "worktime";
+    };
+  });
 }
diff --git a/overlays/worktime/poetry.lock b/overlays/worktime/poetry.lock
deleted file mode 100644
index 54182b09..00000000
--- a/overlays/worktime/poetry.lock
+++ /dev/null
@@ -1,248 +0,0 @@
-# This file is automatically @generated by Poetry 1.6.1 and should not be changed by hand.
-
-[[package]]
-name = "backoff"
-version = "2.2.1"
-description = "Function decoration for backoff and retry"
-optional = false
-python-versions = ">=3.7,<4.0"
-files = [
-    {file = "backoff-2.2.1-py3-none-any.whl", hash = "sha256:63579f9a0628e06278f7e47b7d7d5b6ce20dc65c5e96a6f3ca99a6adca0396e8"},
-    {file = "backoff-2.2.1.tar.gz", hash = "sha256:03f829f5bb1923180821643f8753b0502c3b682293992485b0eef2807afa5cba"},
-]
-
-[[package]]
-name = "certifi"
-version = "2022.12.7"
-description = "Python package for providing Mozilla's CA Bundle."
-optional = false
-python-versions = ">=3.6"
-files = [
-    {file = "certifi-2022.12.7-py3-none-any.whl", hash = "sha256:4ad3232f5e926d6718ec31cfc1fcadfde020920e278684144551c91769c7bc18"},
-    {file = "certifi-2022.12.7.tar.gz", hash = "sha256:35824b4c3a97115964b408844d64aa14db1cc518f6562e8d7261699d1350a9e3"},
-]
-
-[[package]]
-name = "charset-normalizer"
-version = "3.1.0"
-description = "The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet."
-optional = false
-python-versions = ">=3.7.0"
-files = [
-    {file = "charset-normalizer-3.1.0.tar.gz", hash = "sha256:34e0a2f9c370eb95597aae63bf85eb5e96826d81e3dcf88b8886012906f509b5"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:e0ac8959c929593fee38da1c2b64ee9778733cdf03c482c9ff1d508b6b593b2b"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:d7fc3fca01da18fbabe4625d64bb612b533533ed10045a2ac3dd194bfa656b60"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:04eefcee095f58eaabe6dc3cc2262f3bcd776d2c67005880894f447b3f2cb9c1"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:20064ead0717cf9a73a6d1e779b23d149b53daf971169289ed2ed43a71e8d3b0"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1435ae15108b1cb6fffbcea2af3d468683b7afed0169ad718451f8db5d1aff6f"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c84132a54c750fda57729d1e2599bb598f5fa0344085dbde5003ba429a4798c0"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:75f2568b4189dda1c567339b48cba4ac7384accb9c2a7ed655cd86b04055c795"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:11d3bcb7be35e7b1bba2c23beedac81ee893ac9871d0ba79effc7fc01167db6c"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:891cf9b48776b5c61c700b55a598621fdb7b1e301a550365571e9624f270c203"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:5f008525e02908b20e04707a4f704cd286d94718f48bb33edddc7d7b584dddc1"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_ppc64le.whl", hash = "sha256:b06f0d3bf045158d2fb8837c5785fe9ff9b8c93358be64461a1089f5da983137"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_s390x.whl", hash = "sha256:49919f8400b5e49e961f320c735388ee686a62327e773fa5b3ce6721f7e785ce"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:22908891a380d50738e1f978667536f6c6b526a2064156203d418f4856d6e86a"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-win32.whl", hash = "sha256:12d1a39aa6b8c6f6248bb54550efcc1c38ce0d8096a146638fd4738e42284448"},
-    {file = "charset_normalizer-3.1.0-cp310-cp310-win_amd64.whl", hash = "sha256:65ed923f84a6844de5fd29726b888e58c62820e0769b76565480e1fdc3d062f8"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:9a3267620866c9d17b959a84dd0bd2d45719b817245e49371ead79ed4f710d19"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:6734e606355834f13445b6adc38b53c0fd45f1a56a9ba06c2058f86893ae8017"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f8303414c7b03f794347ad062c0516cee0e15f7a612abd0ce1e25caf6ceb47df"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:aaf53a6cebad0eae578f062c7d462155eada9c172bd8c4d250b8c1d8eb7f916a"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3dc5b6a8ecfdc5748a7e429782598e4f17ef378e3e272eeb1340ea57c9109f41"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e1b25e3ad6c909f398df8921780d6a3d120d8c09466720226fc621605b6f92b1"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0ca564606d2caafb0abe6d1b5311c2649e8071eb241b2d64e75a0d0065107e62"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b82fab78e0b1329e183a65260581de4375f619167478dddab510c6c6fb04d9b6"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:bd7163182133c0c7701b25e604cf1611c0d87712e56e88e7ee5d72deab3e76b5"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:11d117e6c63e8f495412d37e7dc2e2fff09c34b2d09dbe2bee3c6229577818be"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_ppc64le.whl", hash = "sha256:cf6511efa4801b9b38dc5546d7547d5b5c6ef4b081c60b23e4d941d0eba9cbeb"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_s390x.whl", hash = "sha256:abc1185d79f47c0a7aaf7e2412a0eb2c03b724581139193d2d82b3ad8cbb00ac"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:cb7b2ab0188829593b9de646545175547a70d9a6e2b63bf2cd87a0a391599324"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-win32.whl", hash = "sha256:c36bcbc0d5174a80d6cccf43a0ecaca44e81d25be4b7f90f0ed7bcfbb5a00909"},
-    {file = "charset_normalizer-3.1.0-cp311-cp311-win_amd64.whl", hash = "sha256:cca4def576f47a09a943666b8f829606bcb17e2bc2d5911a46c8f8da45f56755"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:0c95f12b74681e9ae127728f7e5409cbbef9cd914d5896ef238cc779b8152373"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:fca62a8301b605b954ad2e9c3666f9d97f63872aa4efcae5492baca2056b74ab"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ac0aa6cd53ab9a31d397f8303f92c42f534693528fafbdb997c82bae6e477ad9"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c3af8e0f07399d3176b179f2e2634c3ce9c1301379a6b8c9c9aeecd481da494f"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3a5fc78f9e3f501a1614a98f7c54d3969f3ad9bba8ba3d9b438c3bc5d047dd28"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:628c985afb2c7d27a4800bfb609e03985aaecb42f955049957814e0491d4006d"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:74db0052d985cf37fa111828d0dd230776ac99c740e1a758ad99094be4f1803d"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_i686.whl", hash = "sha256:1e8fcdd8f672a1c4fc8d0bd3a2b576b152d2a349782d1eb0f6b8e52e9954731d"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_ppc64le.whl", hash = "sha256:04afa6387e2b282cf78ff3dbce20f0cc071c12dc8f685bd40960cc68644cfea6"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_s390x.whl", hash = "sha256:dd5653e67b149503c68c4018bf07e42eeed6b4e956b24c00ccdf93ac79cdff84"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:d2686f91611f9e17f4548dbf050e75b079bbc2a82be565832bc8ea9047b61c8c"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-win32.whl", hash = "sha256:4155b51ae05ed47199dc5b2a4e62abccb274cee6b01da5b895099b61b1982974"},
-    {file = "charset_normalizer-3.1.0-cp37-cp37m-win_amd64.whl", hash = "sha256:322102cdf1ab682ecc7d9b1c5eed4ec59657a65e1c146a0da342b78f4112db23"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-macosx_10_9_universal2.whl", hash = "sha256:e633940f28c1e913615fd624fcdd72fdba807bf53ea6925d6a588e84e1151531"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:3a06f32c9634a8705f4ca9946d667609f52cf130d5548881401f1eb2c39b1e2c"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-macosx_11_0_arm64.whl", hash = "sha256:7381c66e0561c5757ffe616af869b916c8b4e42b367ab29fedc98481d1e74e14"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3573d376454d956553c356df45bb824262c397c6e26ce43e8203c4c540ee0acb"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e89df2958e5159b811af9ff0f92614dabf4ff617c03a4c1c6ff53bf1c399e0e1"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:78cacd03e79d009d95635e7d6ff12c21eb89b894c354bd2b2ed0b4763373693b"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:de5695a6f1d8340b12a5d6d4484290ee74d61e467c39ff03b39e30df62cf83a0"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1c60b9c202d00052183c9be85e5eaf18a4ada0a47d188a83c8f5c5b23252f649"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_aarch64.whl", hash = "sha256:f645caaf0008bacf349875a974220f1f1da349c5dbe7c4ec93048cdc785a3326"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_i686.whl", hash = "sha256:ea9f9c6034ea2d93d9147818f17c2a0860d41b71c38b9ce4d55f21b6f9165a11"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_ppc64le.whl", hash = "sha256:80d1543d58bd3d6c271b66abf454d437a438dff01c3e62fdbcd68f2a11310d4b"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_s390x.whl", hash = "sha256:73dc03a6a7e30b7edc5b01b601e53e7fc924b04e1835e8e407c12c037e81adbd"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-musllinux_1_1_x86_64.whl", hash = "sha256:6f5c2e7bc8a4bf7c426599765b1bd33217ec84023033672c1e9a8b35eaeaaaf8"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-win32.whl", hash = "sha256:12a2b561af122e3d94cdb97fe6fb2bb2b82cef0cdca131646fdb940a1eda04f0"},
-    {file = "charset_normalizer-3.1.0-cp38-cp38-win_amd64.whl", hash = "sha256:3160a0fd9754aab7d47f95a6b63ab355388d890163eb03b2d2b87ab0a30cfa59"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:38e812a197bf8e71a59fe55b757a84c1f946d0ac114acafaafaf21667a7e169e"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:6baf0baf0d5d265fa7944feb9f7451cc316bfe30e8df1a61b1bb08577c554f31"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:8f25e17ab3039b05f762b0a55ae0b3632b2e073d9c8fc88e89aca31a6198e88f"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3747443b6a904001473370d7810aa19c3a180ccd52a7157aacc264a5ac79265e"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b116502087ce8a6b7a5f1814568ccbd0e9f6cfd99948aa59b0e241dc57cf739f"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d16fd5252f883eb074ca55cb622bc0bee49b979ae4e8639fff6ca3ff44f9f854"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:21fa558996782fc226b529fdd2ed7866c2c6ec91cee82735c98a197fae39f706"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:6f6c7a8a57e9405cad7485f4c9d3172ae486cfef1344b5ddd8e5239582d7355e"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:ac3775e3311661d4adace3697a52ac0bab17edd166087d493b52d4f4f553f9f0"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:10c93628d7497c81686e8e5e557aafa78f230cd9e77dd0c40032ef90c18f2230"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_ppc64le.whl", hash = "sha256:6f4f4668e1831850ebcc2fd0b1cd11721947b6dc7c00bf1c6bd3c929ae14f2c7"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_s390x.whl", hash = "sha256:0be65ccf618c1e7ac9b849c315cc2e8a8751d9cfdaa43027d4f6624bd587ab7e"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:53d0a3fa5f8af98a1e261de6a3943ca631c526635eb5817a87a59d9a57ebf48f"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-win32.whl", hash = "sha256:a04f86f41a8916fe45ac5024ec477f41f886b3c435da2d4e3d2709b22ab02af1"},
-    {file = "charset_normalizer-3.1.0-cp39-cp39-win_amd64.whl", hash = "sha256:830d2948a5ec37c386d3170c483063798d7879037492540f10a475e3fd6f244b"},
-    {file = "charset_normalizer-3.1.0-py3-none-any.whl", hash = "sha256:3d9098b479e78c85080c98e1e35ff40b4a31d8953102bb0fd7d1b6f8a2111a3d"},
-]
-
-[[package]]
-name = "idna"
-version = "3.4"
-description = "Internationalized Domain Names in Applications (IDNA)"
-optional = false
-python-versions = ">=3.5"
-files = [
-    {file = "idna-3.4-py3-none-any.whl", hash = "sha256:90b77e79eaa3eba6de819a0c442c0b4ceefc341a7a2ab77d7562bf49f425c5c2"},
-    {file = "idna-3.4.tar.gz", hash = "sha256:814f528e8dead7d329833b91c5faa87d60bf71824cd12a7530b5526063d02cb4"},
-]
-
-[[package]]
-name = "jsonpickle"
-version = "3.0.2"
-description = "Python library for serializing any arbitrary object graph into JSON"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "jsonpickle-3.0.2-py3-none-any.whl", hash = "sha256:4a8442d97ca3f77978afa58068768dba7bff2dbabe79a9647bc3cdafd4ef019f"},
-    {file = "jsonpickle-3.0.2.tar.gz", hash = "sha256:e37abba4bfb3ca4a4647d28bb9f4706436f7b46c8a8333b4a718abafa8e46b37"},
-]
-
-[package.extras]
-docs = ["jaraco.packaging (>=3.2)", "rst.linker (>=1.9)", "sphinx"]
-testing = ["ecdsa", "feedparser", "gmpy2", "numpy", "pandas", "pymongo", "pytest (>=3.5,!=3.7.3)", "pytest-black-multipy", "pytest-checkdocs (>=1.2.3)", "pytest-cov", "pytest-flake8 (>=1.1.1)", "scikit-learn", "sqlalchemy"]
-testing-libs = ["simplejson", "ujson"]
-
-[[package]]
-name = "python-dateutil"
-version = "2.8.2"
-description = "Extensions to the standard Python datetime module"
-optional = false
-python-versions = "!=3.0.*,!=3.1.*,!=3.2.*,>=2.7"
-files = [
-    {file = "python-dateutil-2.8.2.tar.gz", hash = "sha256:0123cacc1627ae19ddf3c27a5de5bd67ee4586fbdd6440d9748f8abb483d3e86"},
-    {file = "python_dateutil-2.8.2-py2.py3-none-any.whl", hash = "sha256:961d03dc3453ebbc59dbdea9e4e11c5651520a876d0f4db161e8674aae935da9"},
-]
-
-[package.dependencies]
-six = ">=1.5"
-
-[[package]]
-name = "pyxdg"
-version = "0.28"
-description = "PyXDG contains implementations of freedesktop.org standards in python."
-optional = false
-python-versions = "*"
-files = [
-    {file = "pyxdg-0.28-py2.py3-none-any.whl", hash = "sha256:bdaf595999a0178ecea4052b7f4195569c1ff4d344567bccdc12dfdf02d545ab"},
-    {file = "pyxdg-0.28.tar.gz", hash = "sha256:3267bb3074e934df202af2ee0868575484108581e6f3cb006af1da35395e88b4"},
-]
-
-[[package]]
-name = "requests"
-version = "2.28.2"
-description = "Python HTTP for Humans."
-optional = false
-python-versions = ">=3.7, <4"
-files = [
-    {file = "requests-2.28.2-py3-none-any.whl", hash = "sha256:64299f4909223da747622c030b781c0d7811e359c37124b4bd368fb8c6518baa"},
-    {file = "requests-2.28.2.tar.gz", hash = "sha256:98b1b2782e3c6c4904938b84c0eb932721069dfdb9134313beff7c83c2df24bf"},
-]
-
-[package.dependencies]
-certifi = ">=2017.4.17"
-charset-normalizer = ">=2,<4"
-idna = ">=2.5,<4"
-urllib3 = ">=1.21.1,<1.27"
-
-[package.extras]
-socks = ["PySocks (>=1.5.6,!=1.5.7)"]
-use-chardet-on-py3 = ["chardet (>=3.0.2,<6)"]
-
-[[package]]
-name = "six"
-version = "1.16.0"
-description = "Python 2 and 3 compatibility utilities"
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "six-1.16.0-py2.py3-none-any.whl", hash = "sha256:8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254"},
-    {file = "six-1.16.0.tar.gz", hash = "sha256:1e61c37477a1626458e36f7b1d82aa5c9b094fa4802892072e49de9c60c4c926"},
-]
-
-[[package]]
-name = "tabulate"
-version = "0.9.0"
-description = "Pretty-print tabular data"
-optional = false
-python-versions = ">=3.7"
-files = [
-    {file = "tabulate-0.9.0-py3-none-any.whl", hash = "sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f"},
-    {file = "tabulate-0.9.0.tar.gz", hash = "sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c"},
-]
-
-[package.extras]
-widechars = ["wcwidth"]
-
-[[package]]
-name = "toml"
-version = "0.10.2"
-description = "Python Library for Tom's Obvious, Minimal Language"
-optional = false
-python-versions = ">=2.6, !=3.0.*, !=3.1.*, !=3.2.*"
-files = [
-    {file = "toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b"},
-    {file = "toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f"},
-]
-
-[[package]]
-name = "uritools"
-version = "4.0.1"
-description = "URI parsing, classification and composition"
-optional = false
-python-versions = "~=3.7"
-files = [
-    {file = "uritools-4.0.1-py3-none-any.whl", hash = "sha256:d122d394ed6e6e15ac0fddba6a5b19e9fa204e7797507815cbfb0e1455ac0475"},
-    {file = "uritools-4.0.1.tar.gz", hash = "sha256:efc5c3a6de05404850685a8d3f34da8476b56aa3516fbf8eff5c8704c7a2826f"},
-]
-
-[[package]]
-name = "urllib3"
-version = "1.26.15"
-description = "HTTP library with thread-safe connection pooling, file post, and more."
-optional = false
-python-versions = ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.*, !=3.5.*"
-files = [
-    {file = "urllib3-1.26.15-py2.py3-none-any.whl", hash = "sha256:aa751d169e23c7479ce47a0cb0da579e3ede798f994f5816a74e4f4500dcea42"},
-    {file = "urllib3-1.26.15.tar.gz", hash = "sha256:8a388717b9476f934a21484e8c8e61875ab60644d29b9b39e11e4b9dc1c6b305"},
-]
-
-[package.extras]
-brotli = ["brotli (>=1.0.9)", "brotlicffi (>=0.8.0)", "brotlipy (>=0.6.0)"]
-secure = ["certifi", "cryptography (>=1.3.4)", "idna (>=2.0.0)", "ipaddress", "pyOpenSSL (>=0.14)", "urllib3-secure-extra"]
-socks = ["PySocks (>=1.5.6,!=1.5.7,<2.0)"]
-
-[metadata]
-lock-version = "2.0"
-python-versions = "^3.10"
-content-hash = "d9137b4f8e37bba934abf732e4a2aeeb9924c4b6576830d8ae08bdb43b4e147f"
diff --git a/overlays/worktime/pyproject.toml b/overlays/worktime/pyproject.toml
index 08002d4d..42da51f5 100644
--- a/overlays/worktime/pyproject.toml
+++ b/overlays/worktime/pyproject.toml
@@ -1,23 +1,28 @@
-[tool.poetry]
+[project]
 name = "worktime"
-version = "0.1.0"
-description = ""
-authors = ["Gregor Kleen <gkleen@yggdrasil.li>"]
+version = "1.0.0"
+requires-python = "~=3.12"
+dependencies = [
+    "pyxdg>=0.28,<0.29",
+    "python-dateutil>=2.9.0.post0,<3",
+    "uritools>=4.0.3,<5",
+    "requests>=2.32.3,<3",
+    "tabulate>=0.9.0,<0.10",
+    "toml>=0.10.2,<0.11",
+    "jsonpickle>=4.0.5,<5",
+    "frozendict>=2.4.6",
+    "atomicwriter>=0.2.5",
+    "desktop-notify>=1.3.3",
+]
 
-[tool.poetry.dependencies]
-python = "^3.10"
-pyxdg = "^0.28"
-python-dateutil = "^2.8.2"
-uritools = "^4.0.1"
-requests = "^2.28.2"
-tabulate = "^0.9.0"
-backoff = "^2.2.1"
-toml = "^0.10.2"
-jsonpickle = "^3.0.2"
-
-[tool.poetry.scripts]
+[project.scripts]
 worktime = "worktime.__main__:main"
+worktime-ui = "worktime.__main__:ui"
+worktime-stop = "worktime.__main__:stop"
 
 [build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
\ No newline at end of file
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[dependency-groups]
+dev = []
diff --git a/overlays/worktime/uv.lock b/overlays/worktime/uv.lock
new file mode 100644
index 00000000..39de4ccf
--- /dev/null
+++ b/overlays/worktime/uv.lock
@@ -0,0 +1,248 @@
+version = 1
+revision = 2
+requires-python = ">=3.12, <4"
+
+[[package]]
+name = "atomicwriter"
+version = "0.2.5"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/50/b4/dd04e186eb244d1ed84b1d0ebfba19ddc7f8886b98e345aaca4208b031d2/atomicwriter-0.2.5.tar.gz", hash = "sha256:5ced6afb0579377a13e191b17a16115e14c30ec00e6c38b60403f58235a867af", size = 64990, upload-time = "2025-05-24T20:35:42.538Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/99/7c/672a0de09b0b355a2ffa521ef25cf106f1984823379dee37f7305fdc1774/atomicwriter-0.2.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:5c1fab874e62ebe96f1af0e965dc1e92c4c1ef2e2e9612a444371b8fc751ec43", size = 234141, upload-time = "2025-05-24T20:34:32.74Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/0c/e1c5bad033284c212c0a77121b48dd4147f80e9a7cd82a9d2ce0a2160901/atomicwriter-0.2.5-cp312-cp312-macosx_11_0_x86_64.whl", hash = "sha256:8dbb67cc730be7d6bdfd5e991271bc17052be8fb2e4fa27854b47d8a76d36349", size = 245788, upload-time = "2025-05-24T20:34:33.897Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/d3/7036e203cc5fc4c49bf916b4ba158e0d2779de127afad5963edd7e3b9400/atomicwriter-0.2.5-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:a4e7f81932839c738425dc96ad98e4a7511b740cd3d75f480bfabbcf8e6f7eae", size = 260428, upload-time = "2025-05-24T20:34:35.533Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/b9/9a4d235a8d67fb442302dc0f3ea2394b7bd994bfc99b1dc0f744c7852418/atomicwriter-0.2.5-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:de37a3a5d1b57b719cfb0b81a11cab2114acfdc2c36051bf0af72d05eb644411", size = 263648, upload-time = "2025-05-24T20:34:36.72Z" },
+    { url = "https://files.pythonhosted.org/packages/71/7c/32d4ddad53375de42f3e972bb0633ec76f2c31772f2e508479d4788651d9/atomicwriter-0.2.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:0b925e55750092fd482565b6068b8c8366fd79de526681af9e58eb209f0deeca", size = 323775, upload-time = "2025-05-24T20:34:37.968Z" },
+    { url = "https://files.pythonhosted.org/packages/06/fe/6a226368a3f7ea30001fbd165f6a97f28c8f1a884896357b3d694983f5d2/atomicwriter-0.2.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:538f78f25e01584535782397211c66b8b3c9de90c2d1fc01a668ddce73dd0cb2", size = 340819, upload-time = "2025-05-24T20:34:39.63Z" },
+    { url = "https://files.pythonhosted.org/packages/92/95/b035b2296c483fde5392c629e0b6e3844eba6e54ea965c4b8827379b0893/atomicwriter-0.2.5-cp312-cp312-win_amd64.whl", hash = "sha256:1d2d49a1b94ea7b289be9f7134d756bfb0bbf53eb0e58411334ed1b9958abe5e", size = 152789, upload-time = "2025-05-24T20:34:40.905Z" },
+    { url = "https://files.pythonhosted.org/packages/da/25/caa0959ae8ce24763e24e1f45be6cb897414545d224a155f929d496d6812/atomicwriter-0.2.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3f5490fd5bec378509521f7c2a19a64031a0de07d368d76733c3f76a0b9f026b", size = 233830, upload-time = "2025-05-24T20:34:42.532Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/76/3c41bfd4fd74bc63bec29f05a806a767258eea7cf151496b4ab015cb5323/atomicwriter-0.2.5-cp313-cp313-macosx_11_0_x86_64.whl", hash = "sha256:a4dada83ff1255c7e640363cc2a4399ab9a822d4dbc9c18f55bbf0c8b12ce056", size = 245461, upload-time = "2025-05-24T20:34:44.454Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/1e/5512dbdfdc3f4ab12f5923c50ae4765cc2fc65a9f112bb9dccbcbe60b395/atomicwriter-0.2.5-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:ef2cf15e67513f05ad37d4cec48e403982c6b3c07f491472effd76d2157de7e2", size = 259892, upload-time = "2025-05-24T20:34:45.688Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/1d/2382b6cacb119115828eb519697a555900bcfdb062efeb0f82603295402d/atomicwriter-0.2.5-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:73618f74c3c5f5401d3da0a3cd3043f23de5b6bb4a3d85bc580940a441355d25", size = 263125, upload-time = "2025-05-24T20:34:47.205Z" },
+    { url = "https://files.pythonhosted.org/packages/07/d7/c4d68386161870db4a8d0452f0655a19902fa435b749c12e6ef800e89b19/atomicwriter-0.2.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:bbd5eda80710ddac7aefb421c79cef6b905852a827e764f0f12fcbaa88919f7a", size = 323503, upload-time = "2025-05-24T20:34:48.417Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/08/0fc03c0736ab8466e1b47a3ee17a528da18019cff93b7c4c2b33df82c19e/atomicwriter-0.2.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:b4776aaca40bc3040c3716c2adad74625c42285083ff31e8bf24a95315225c7b", size = 340156, upload-time = "2025-05-24T20:34:50.389Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/09/7ba888cf4d90bcabd9e82db3bdb9de50e4ef072e0ea0d375cd1931b79349/atomicwriter-0.2.5-cp313-cp313-win_amd64.whl", hash = "sha256:225ed1fbfa1996d9b0b2252f8a5d81263e51cbc797086d830f488c35b1d2ab42", size = 152274, upload-time = "2025-05-24T20:34:51.785Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/70/07d2ba2e0a126cfecfbfed46baf599c9e2155f4c8338fed4d3ae0041b133/atomicwriter-0.2.5-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:63b55982cfa47232f179689933bf003eefb2bd33464235883ed3ce7322cf38f3", size = 232879, upload-time = "2025-05-24T20:34:53.195Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/4d/397eb5435917135df93b339d849884bb1125896b1e15163c5244aa590336/atomicwriter-0.2.5-cp313-cp313t-macosx_11_0_x86_64.whl", hash = "sha256:e33f40b2a27f8831beeabb485923acb6dd067cc70bba1a63096749b3dc4747ff", size = 244386, upload-time = "2025-05-24T20:34:54.852Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/01/73f0b683fa55e61dd29d30e48e9a75ddb049e6dad0ac4ae1a29dbc05f21e/atomicwriter-0.2.5-cp313-cp313t-manylinux_2_28_aarch64.whl", hash = "sha256:c646e115e88147d71f845a005fc53910f22c4dc65bd634768cb90b7f34259359", size = 258255, upload-time = "2025-05-24T20:34:56.046Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/19/692387c1fb1b8714a9b2fab99a58850fd4136bed988814c8ff74d0c8de02/atomicwriter-0.2.5-cp313-cp313t-manylinux_2_28_x86_64.whl", hash = "sha256:47f974e986ff6514351c3ea75041009a514be0c34c225c062b0ad8a28ec9c0a3", size = 261768, upload-time = "2025-05-24T20:34:57.795Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/f2/4d466f52ee635cc54011713272f302584c6d1ce612c331d9989fa6fa672f/atomicwriter-0.2.5-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:e1db8b9004cd3f628166e83b25eb814b82345f9d6bc15e99b6d201c355455b45", size = 321975, upload-time = "2025-05-24T20:34:59.45Z" },
+    { url = "https://files.pythonhosted.org/packages/84/ad/0189ad9783ca6609df47e06cc0cd22866a8073d46478f59c6ab3ec13e0fb/atomicwriter-0.2.5-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:a7da4a114121ab865663578b801a0520b2b518d4591af0bd294f6aac0dad243b", size = 338946, upload-time = "2025-05-24T20:35:01.501Z" },
+    { url = "https://files.pythonhosted.org/packages/94/79/2c4d8f75eeb09192cf572957f031271998f3c985fabd79d513fff66ac715/atomicwriter-0.2.5-cp313-cp313t-win_amd64.whl", hash = "sha256:7aab4b3956cc17219e7e4da76e8a1bceb3d3aeaf03234f89b90e234a2adcf27b", size = 151571, upload-time = "2025-05-24T20:35:02.747Z" },
+    { url = "https://files.pythonhosted.org/packages/32/19/d6a686d189c3577e7f08b33df398b959c24bf74b3cec34359104db1a24ff/atomicwriter-0.2.5-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:8d0fccac2dfe5d884d97edbda28be9c16d55faee9bdf66f53a99384ac387cc43", size = 239320, upload-time = "2025-05-24T20:35:04.028Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/35/35571a4eed57816c3b5fdbefcb15f38563fbe4f3a4a7d1588c8ef899afaf/atomicwriter-0.2.5-cp39-abi3-macosx_11_0_x86_64.whl", hash = "sha256:6583c24333508839db2156d895cbbb5cd3ff20d4f9c698e341435e5b35990eaa", size = 250818, upload-time = "2025-05-24T20:35:05.21Z" },
+    { url = "https://files.pythonhosted.org/packages/81/d9/145093630bc25f115a49d32d9ef66745f5cdef787492d77fd27e74d20389/atomicwriter-0.2.5-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:136a9902ae3f1c0cb262a07dd3ac85069d71f8b11347cd740030567e67d611aa", size = 265796, upload-time = "2025-05-24T20:35:06.388Z" },
+    { url = "https://files.pythonhosted.org/packages/58/32/d1881adade2ebc70aa9dbb61cadabc2c00cfa99a7a5d6ba48f44e279056f/atomicwriter-0.2.5-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:0b6830434b6a49c19473c3f3975dfa0a87dec95bee81297f7393e378f9a0b82f", size = 269378, upload-time = "2025-05-24T20:35:07.578Z" },
+    { url = "https://files.pythonhosted.org/packages/93/f5/2661ea763784a4991c4c7be5c932a468937bd1d4618b833a63ec638a3b76/atomicwriter-0.2.5-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:53095a01891a2901aa04c10c8de52c0ba41e0d8a4a1893318cf34ccbdbde00b7", size = 328167, upload-time = "2025-05-24T20:35:08.764Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/bc/e3aa521671a589bee9662d3e2108e4835a5d80e6da76e4d05d98d1c78005/atomicwriter-0.2.5-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:ecf4dc3983bb1f28b21cb09c2d96b6936d8864c559dcf151b57813cb1eae998b", size = 347153, upload-time = "2025-05-24T20:35:10.507Z" },
+    { url = "https://files.pythonhosted.org/packages/59/b7/e190383e7240b1f247c6df9bc6667db8df10190cd0bb2dba8ea6bd704ea4/atomicwriter-0.2.5-cp39-abi3-win_amd64.whl", hash = "sha256:92cff264a20364301ab341b332fd0112866870b8cb35caf99a3f3fee0e6c19e8", size = 156374, upload-time = "2025-05-24T20:35:11.716Z" },
+]
+
+[[package]]
+name = "certifi"
+version = "2025.1.31"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1c/ab/c9f1e32b7b1bf505bf26f0ef697775960db7932abeb7b516de930ba2705f/certifi-2025.1.31.tar.gz", hash = "sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651", size = 167577, upload-time = "2025-01-31T02:16:47.166Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/38/fc/bce832fd4fd99766c04d1ee0eead6b0ec6486fb100ae5e74c1d91292b982/certifi-2025.1.31-py3-none-any.whl", hash = "sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe", size = 166393, upload-time = "2025-01-31T02:16:45.015Z" },
+]
+
+[[package]]
+name = "charset-normalizer"
+version = "3.4.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/16/b0/572805e227f01586461c80e0fd25d65a2115599cc9dad142fee4b747c357/charset_normalizer-3.4.1.tar.gz", hash = "sha256:44251f18cd68a75b56585dd00dae26183e102cd5e0f9f1466e6df5da2ed64ea3", size = 123188, upload-time = "2024-12-24T18:12:35.43Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0a/9a/dd1e1cdceb841925b7798369a09279bd1cf183cef0f9ddf15a3a6502ee45/charset_normalizer-3.4.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:73d94b58ec7fecbc7366247d3b0b10a21681004153238750bb67bd9012414545", size = 196105, upload-time = "2024-12-24T18:10:38.83Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/8c/90bfabf8c4809ecb648f39794cf2a84ff2e7d2a6cf159fe68d9a26160467/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dad3e487649f498dd991eeb901125411559b22e8d7ab25d3aeb1af367df5efd7", size = 140404, upload-time = "2024-12-24T18:10:44.272Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/8f/e410d57c721945ea3b4f1a04b74f70ce8fa800d393d72899f0a40526401f/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:c30197aa96e8eed02200a83fba2657b4c3acd0f0aa4bdc9f6c1af8e8962e0757", size = 150423, upload-time = "2024-12-24T18:10:45.492Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/b8/e6825e25deb691ff98cf5c9072ee0605dc2acfca98af70c2d1b1bc75190d/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2369eea1ee4a7610a860d88f268eb39b95cb588acd7235e02fd5a5601773d4fa", size = 143184, upload-time = "2024-12-24T18:10:47.898Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/a2/513f6cbe752421f16d969e32f3583762bfd583848b763913ddab8d9bfd4f/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bc2722592d8998c870fa4e290c2eec2c1569b87fe58618e67d38b4665dfa680d", size = 145268, upload-time = "2024-12-24T18:10:50.589Z" },
+    { url = "https://files.pythonhosted.org/packages/74/94/8a5277664f27c3c438546f3eb53b33f5b19568eb7424736bdc440a88a31f/charset_normalizer-3.4.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ffc9202a29ab3920fa812879e95a9e78b2465fd10be7fcbd042899695d75e616", size = 147601, upload-time = "2024-12-24T18:10:52.541Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/5f/6d352c51ee763623a98e31194823518e09bfa48be2a7e8383cf691bbb3d0/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:804a4d582ba6e5b747c625bf1255e6b1507465494a40a2130978bda7b932c90b", size = 141098, upload-time = "2024-12-24T18:10:53.789Z" },
+    { url = "https://files.pythonhosted.org/packages/78/d4/f5704cb629ba5ab16d1d3d741396aec6dc3ca2b67757c45b0599bb010478/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:0f55e69f030f7163dffe9fd0752b32f070566451afe180f99dbeeb81f511ad8d", size = 149520, upload-time = "2024-12-24T18:10:55.048Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/96/64120b1d02b81785f222b976c0fb79a35875457fa9bb40827678e54d1bc8/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c4c3e6da02df6fa1410a7680bd3f63d4f710232d3139089536310d027950696a", size = 152852, upload-time = "2024-12-24T18:10:57.647Z" },
+    { url = "https://files.pythonhosted.org/packages/84/c9/98e3732278a99f47d487fd3468bc60b882920cef29d1fa6ca460a1fdf4e6/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:5df196eb874dae23dcfb968c83d4f8fdccb333330fe1fc278ac5ceeb101003a9", size = 150488, upload-time = "2024-12-24T18:10:59.43Z" },
+    { url = "https://files.pythonhosted.org/packages/13/0e/9c8d4cb99c98c1007cc11eda969ebfe837bbbd0acdb4736d228ccaabcd22/charset_normalizer-3.4.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:e358e64305fe12299a08e08978f51fc21fac060dcfcddd95453eabe5b93ed0e1", size = 146192, upload-time = "2024-12-24T18:11:00.676Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/21/2b6b5b860781a0b49427309cb8670785aa543fb2178de875b87b9cc97746/charset_normalizer-3.4.1-cp312-cp312-win32.whl", hash = "sha256:9b23ca7ef998bc739bf6ffc077c2116917eabcc901f88da1b9856b210ef63f35", size = 95550, upload-time = "2024-12-24T18:11:01.952Z" },
+    { url = "https://files.pythonhosted.org/packages/21/5b/1b390b03b1d16c7e382b561c5329f83cc06623916aab983e8ab9239c7d5c/charset_normalizer-3.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:6ff8a4a60c227ad87030d76e99cd1698345d4491638dfa6673027c48b3cd395f", size = 102785, upload-time = "2024-12-24T18:11:03.142Z" },
+    { url = "https://files.pythonhosted.org/packages/38/94/ce8e6f63d18049672c76d07d119304e1e2d7c6098f0841b51c666e9f44a0/charset_normalizer-3.4.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:aabfa34badd18f1da5ec1bc2715cadc8dca465868a4e73a0173466b688f29dda", size = 195698, upload-time = "2024-12-24T18:11:05.834Z" },
+    { url = "https://files.pythonhosted.org/packages/24/2e/dfdd9770664aae179a96561cc6952ff08f9a8cd09a908f259a9dfa063568/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:22e14b5d70560b8dd51ec22863f370d1e595ac3d024cb8ad7d308b4cd95f8313", size = 140162, upload-time = "2024-12-24T18:11:07.064Z" },
+    { url = "https://files.pythonhosted.org/packages/24/4e/f646b9093cff8fc86f2d60af2de4dc17c759de9d554f130b140ea4738ca6/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8436c508b408b82d87dc5f62496973a1805cd46727c34440b0d29d8a2f50a6c9", size = 150263, upload-time = "2024-12-24T18:11:08.374Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/67/2937f8d548c3ef6e2f9aab0f6e21001056f692d43282b165e7c56023e6dd/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:2d074908e1aecee37a7635990b2c6d504cd4766c7bc9fc86d63f9c09af3fa11b", size = 142966, upload-time = "2024-12-24T18:11:09.831Z" },
+    { url = "https://files.pythonhosted.org/packages/52/ed/b7f4f07de100bdb95c1756d3a4d17b90c1a3c53715c1a476f8738058e0fa/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:955f8851919303c92343d2f66165294848d57e9bba6cf6e3625485a70a038d11", size = 144992, upload-time = "2024-12-24T18:11:12.03Z" },
+    { url = "https://files.pythonhosted.org/packages/96/2c/d49710a6dbcd3776265f4c923bb73ebe83933dfbaa841c5da850fe0fd20b/charset_normalizer-3.4.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:44ecbf16649486d4aebafeaa7ec4c9fed8b88101f4dd612dcaf65d5e815f837f", size = 147162, upload-time = "2024-12-24T18:11:13.372Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/41/35ff1f9a6bd380303dea55e44c4933b4cc3c4850988927d4082ada230273/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:0924e81d3d5e70f8126529951dac65c1010cdf117bb75eb02dd12339b57749dd", size = 140972, upload-time = "2024-12-24T18:11:14.628Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/43/c6a0b685fe6910d08ba971f62cd9c3e862a85770395ba5d9cad4fede33ab/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:2967f74ad52c3b98de4c3b32e1a44e32975e008a9cd2a8cc8966d6a5218c5cb2", size = 149095, upload-time = "2024-12-24T18:11:17.672Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/ff/a9a504662452e2d2878512115638966e75633519ec11f25fca3d2049a94a/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:c75cb2a3e389853835e84a2d8fb2b81a10645b503eca9bcb98df6b5a43eb8886", size = 152668, upload-time = "2024-12-24T18:11:18.989Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/71/189996b6d9a4b932564701628af5cee6716733e9165af1d5e1b285c530ed/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:09b26ae6b1abf0d27570633b2b078a2a20419c99d66fb2823173d73f188ce601", size = 150073, upload-time = "2024-12-24T18:11:21.507Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/93/946a86ce20790e11312c87c75ba68d5f6ad2208cfb52b2d6a2c32840d922/charset_normalizer-3.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:fa88b843d6e211393a37219e6a1c1df99d35e8fd90446f1118f4216e307e48cd", size = 145732, upload-time = "2024-12-24T18:11:22.774Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/e5/131d2fb1b0dddafc37be4f3a2fa79aa4c037368be9423061dccadfd90091/charset_normalizer-3.4.1-cp313-cp313-win32.whl", hash = "sha256:eb8178fe3dba6450a3e024e95ac49ed3400e506fd4e9e5c32d30adda88cbd407", size = 95391, upload-time = "2024-12-24T18:11:24.139Z" },
+    { url = "https://files.pythonhosted.org/packages/27/f2/4f9a69cc7712b9b5ad8fdb87039fd89abba997ad5cbe690d1835d40405b0/charset_normalizer-3.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:b1ac5992a838106edb89654e0aebfc24f5848ae2547d22c2c3f66454daa11971", size = 102702, upload-time = "2024-12-24T18:11:26.535Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/f6/65ecc6878a89bb1c23a086ea335ad4bf21a588990c3f535a227b9eea9108/charset_normalizer-3.4.1-py3-none-any.whl", hash = "sha256:d98b1668f06378c6dbefec3b92299716b931cd4e6061f3c875a71ced1780ab85", size = 49767, upload-time = "2024-12-24T18:12:32.852Z" },
+]
+
+[[package]]
+name = "dbus-next"
+version = "0.2.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/45/6a40fbe886d60a8c26f480e7d12535502b5ba123814b3b9a0b002ebca198/dbus_next-0.2.3.tar.gz", hash = "sha256:f4eae26909332ada528c0a3549dda8d4f088f9b365153952a408e28023a626a5", size = 71112, upload-time = "2021-07-25T22:11:28.398Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d2/fc/c0a3f4c4eaa5a22fbef91713474666e13d0ea2a69c84532579490a9f2cc8/dbus_next-0.2.3-py3-none-any.whl", hash = "sha256:58948f9aff9db08316734c0be2a120f6dc502124d9642f55e90ac82ffb16a18b", size = 57885, upload-time = "2021-07-25T22:11:25.466Z" },
+]
+
+[[package]]
+name = "desktop-notify"
+version = "1.3.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "dbus-next" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/7a/d8/7ae5779257f5f1aa0a2d50c02d70b29522bd414692f3d3bd18ef119fe82d/desktop-notify-1.3.3.tar.gz", hash = "sha256:62934ad1f72f292f9a3af5ffe45af32814af18c396c00369385540c72bf08077", size = 7828, upload-time = "2021-01-03T16:46:36.483Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0a/cd/a7e3bd0262f3e8a9272fd24d0193e24dad7cb4e4edd27da48e74b5523e59/desktop_notify-1.3.3-py3-none-any.whl", hash = "sha256:8ad7ecc3a9a603dd5fa3cdc11cc6265cfbc7f6df9d8ed240f4663f43ef0de37a", size = 9937, upload-time = "2021-01-03T16:46:35.157Z" },
+]
+
+[[package]]
+name = "frozendict"
+version = "2.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bb/59/19eb300ba28e7547538bdf603f1c6c34793240a90e1a7b61b65d8517e35e/frozendict-2.4.6.tar.gz", hash = "sha256:df7cd16470fbd26fc4969a208efadc46319334eb97def1ddf48919b351192b8e", size = 316416, upload-time = "2024-10-13T12:15:32.449Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/04/13/d9839089b900fa7b479cce495d62110cddc4bd5630a04d8469916c0e79c5/frozendict-2.4.6-py311-none-any.whl", hash = "sha256:d065db6a44db2e2375c23eac816f1a022feb2fa98cbb50df44a9e83700accbea", size = 16148, upload-time = "2024-10-13T12:15:26.839Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/d0/d482c39cee2ab2978a892558cf130681d4574ea208e162da8958b31e9250/frozendict-2.4.6-py312-none-any.whl", hash = "sha256:49344abe90fb75f0f9fdefe6d4ef6d4894e640fadab71f11009d52ad97f370b9", size = 16146, upload-time = "2024-10-13T12:15:28.16Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/8e/b6bf6a0de482d7d7d7a2aaac8fdc4a4d0bb24a809f5ddd422aa7060eb3d2/frozendict-2.4.6-py313-none-any.whl", hash = "sha256:7134a2bb95d4a16556bb5f2b9736dceb6ea848fa5b6f3f6c2d6dba93b44b4757", size = 16146, upload-time = "2024-10-13T12:15:29.495Z" },
+]
+
+[[package]]
+name = "idna"
+version = "3.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
+]
+
+[[package]]
+name = "jsonpickle"
+version = "4.0.5"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d6/33/4bda317ab294722fcdfff8f63aab74af9fda3675a4652d984a101aa7587e/jsonpickle-4.0.5.tar.gz", hash = "sha256:f299818b39367c361b3f26bdba827d4249ab5d383cd93144d0f94b5417aacb35", size = 315661, upload-time = "2025-03-29T19:22:56.92Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/dc/1b/0e79cf115e0f54f1e8f56effb6ffd2ef8f92e9c324d692ede660067f1bfe/jsonpickle-4.0.5-py3-none-any.whl", hash = "sha256:b4ac7d0a75ddcdfd93445737f1d36ff28768690d43e54bf5d0ddb1d915e580df", size = 46382, upload-time = "2025-03-29T19:22:54.252Z" },
+]
+
+[[package]]
+name = "python-dateutil"
+version = "2.9.0.post0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/66/c0/0c8b6ad9f17a802ee498c46e004a0eb49bc148f2fd230864601a86dcf6db/python-dateutil-2.9.0.post0.tar.gz", hash = "sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3", size = 342432, upload-time = "2024-03-01T18:36:20.211Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
+]
+
+[[package]]
+name = "pyxdg"
+version = "0.28"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b0/25/7998cd2dec731acbd438fbf91bc619603fc5188de0a9a17699a781840452/pyxdg-0.28.tar.gz", hash = "sha256:3267bb3074e934df202af2ee0868575484108581e6f3cb006af1da35395e88b4", size = 77776, upload-time = "2022-06-05T11:35:01Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e5/8d/cf41b66a8110670e3ad03dab9b759704eeed07fa96e90fdc0357b2ba70e2/pyxdg-0.28-py2.py3-none-any.whl", hash = "sha256:bdaf595999a0178ecea4052b7f4195569c1ff4d344567bccdc12dfdf02d545ab", size = 49520, upload-time = "2022-06-05T11:34:58.832Z" },
+]
+
+[[package]]
+name = "requests"
+version = "2.32.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "charset-normalizer" },
+    { name = "idna" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/63/70/2bf7780ad2d390a8d301ad0b550f1581eadbd9a20f896afe06353c2a2913/requests-2.32.3.tar.gz", hash = "sha256:55365417734eb18255590a9ff9eb97e9e1da868d4ccd6402399eaf68af20a760", size = 131218, upload-time = "2024-05-29T15:37:49.536Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f9/9b/335f9764261e915ed497fcdeb11df5dfd6f7bf257d4a6a2a686d80da4d54/requests-2.32.3-py3-none-any.whl", hash = "sha256:70761cfe03c773ceb22aa2f671b4757976145175cdfca038c02654d061d6dcc6", size = 64928, upload-time = "2024-05-29T15:37:47.027Z" },
+]
+
+[[package]]
+name = "six"
+version = "1.17.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/94/e7/b2c673351809dca68a0e064b6af791aa332cf192da575fd474ed7d6f16a2/six-1.17.0.tar.gz", hash = "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81", size = 34031, upload-time = "2024-12-04T17:35:28.174Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" },
+]
+
+[[package]]
+name = "tabulate"
+version = "0.9.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ec/fe/802052aecb21e3797b8f7902564ab6ea0d60ff8ca23952079064155d1ae1/tabulate-0.9.0.tar.gz", hash = "sha256:0095b12bf5966de529c0feb1fa08671671b3368eec77d7ef7ab114be2c068b3c", size = 81090, upload-time = "2022-10-06T17:21:48.54Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/40/44/4a5f08c96eb108af5cb50b41f76142f0afa346dfa99d5296fe7202a11854/tabulate-0.9.0-py3-none-any.whl", hash = "sha256:024ca478df22e9340661486f85298cff5f6dcdba14f3813e8830015b9ed1948f", size = 35252, upload-time = "2022-10-06T17:21:44.262Z" },
+]
+
+[[package]]
+name = "toml"
+version = "0.10.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/be/ba/1f744cdc819428fc6b5084ec34d9b30660f6f9daaf70eead706e3203ec3c/toml-0.10.2.tar.gz", hash = "sha256:b3bda1d108d5dd99f4a20d24d9c348e91c4db7ab1b749200bded2f839ccbe68f", size = 22253, upload-time = "2020-11-01T01:40:22.204Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/44/6f/7120676b6d73228c96e17f1f794d8ab046fc910d781c8d151120c3f1569e/toml-0.10.2-py2.py3-none-any.whl", hash = "sha256:806143ae5bfb6a3c6e736a764057db0e6a0e05e338b5630894a5f779cabb4f9b", size = 16588, upload-time = "2020-11-01T01:40:20.672Z" },
+]
+
+[[package]]
+name = "uritools"
+version = "4.0.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d3/43/4182fb2a03145e6d38698e38b49114ce59bc8c79063452eb585a58f8ce78/uritools-4.0.3.tar.gz", hash = "sha256:ee06a182a9c849464ce9d5fa917539aacc8edd2a4924d1b7aabeeecabcae3bc2", size = 24184, upload-time = "2024-05-28T18:07:45.194Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e6/17/5a4510d9ca9cc8be217ce359eb54e693dca81cf4d442308b282d5131b17d/uritools-4.0.3-py3-none-any.whl", hash = "sha256:bae297d090e69a0451130ffba6f2f1c9477244aa0a5543d66aed2d9f77d0dd9c", size = 10304, upload-time = "2024-05-28T18:07:42.731Z" },
+]
+
+[[package]]
+name = "urllib3"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/aa/63/e53da845320b757bf29ef6a9062f5c669fe997973f966045cb019c3f4b66/urllib3-2.3.0.tar.gz", hash = "sha256:f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d", size = 307268, upload-time = "2024-12-22T07:47:30.032Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c8/19/4ec628951a74043532ca2cf5d97b7b14863931476d117c471e8e2b1eb39f/urllib3-2.3.0-py3-none-any.whl", hash = "sha256:1cee9ad369867bfdbbb48b7dd50374c0967a0bb7710050facf0dd6911440e3df", size = 128369, upload-time = "2024-12-22T07:47:28.074Z" },
+]
+
+[[package]]
+name = "worktime"
+version = "1.0.0"
+source = { editable = "." }
+dependencies = [
+    { name = "atomicwriter" },
+    { name = "desktop-notify" },
+    { name = "frozendict" },
+    { name = "jsonpickle" },
+    { name = "python-dateutil" },
+    { name = "pyxdg" },
+    { name = "requests" },
+    { name = "tabulate" },
+    { name = "toml" },
+    { name = "uritools" },
+]
+
+[package.metadata]
+requires-dist = [
+    { name = "atomicwriter", specifier = ">=0.2.5" },
+    { name = "desktop-notify", specifier = ">=1.3.3" },
+    { name = "frozendict", specifier = ">=2.4.6" },
+    { name = "jsonpickle", specifier = ">=4.0.5,<5" },
+    { name = "python-dateutil", specifier = ">=2.9.0.post0,<3" },
+    { name = "pyxdg", specifier = ">=0.28,<0.29" },
+    { name = "requests", specifier = ">=2.32.3,<3" },
+    { name = "tabulate", specifier = ">=0.9.0,<0.10" },
+    { name = "toml", specifier = ">=0.10.2,<0.11" },
+    { name = "uritools", specifier = ">=4.0.3,<5" },
+]
+
+[package.metadata.requires-dev]
+dev = []
diff --git a/overlays/worktime/worktime/__main__.py b/overlays/worktime/worktime/__main__.py
index 362c8da4..016690f0 100755
--- a/overlays/worktime/worktime/__main__.py
+++ b/overlays/worktime/worktime/__main__.py
@@ -1,10 +1,12 @@
 import requests
 from requests.exceptions import HTTPError
 from requests.auth import HTTPBasicAuth
+from requests.adapters import HTTPAdapter, Retry
 from datetime import *
 from xdg import BaseDirectory
 import toml
-from uritools import (uricompose)
+from uritools import uricompose
+from urllib.parse import urljoin
 
 from inspect import signature
 
@@ -23,80 +25,80 @@ import argparse
 from copy import deepcopy
 
 import sys
-from sys import stderr
+from sys import stderr, stdout
 
 from tabulate import tabulate
 
-from itertools import groupby, count
+from itertools import groupby, count, islice
 from functools import cache, partial
 
-import backoff
-
 from pathlib import Path
 
 from collections import defaultdict
+from collections.abc import Iterable, Generator
+from typing import Any
 
 import jsonpickle
 from hashlib import blake2s
+import json
+
+import asyncio
+
+from frozendict import frozendict
+from contextlib import closing
+import os
+from time import clock_gettime_ns, CLOCK_MONOTONIC
+from atomicwriter import AtomicWriter
+import desktop_notify.aio as notify
+
+class BearerAuth(requests.auth.AuthBase):
+    def __init__(self, token):
+        self.token = token
+    def __call__(self, r):
+        r.headers["authorization"] = "Bearer " + self.token
+        return r
+
+class KimaiSession(requests.Session):
+    def __init__(self, base_url: str, api_token: str):
+        super().__init__()
+        self.base_url = base_url
+        self.auth = BearerAuth(api_token)
+        retries = Retry(total=5, backoff_factor=0.1, status_forcelist=[500, 502, 503, 504])
+        super().mount(base_url, HTTPAdapter(max_retries=retries))
+
+    def request(self, method, url, *args, **kwargs):
+        joined_url = urljoin(self.base_url, url)
+        return super().request(method, joined_url, *args, headers = {'Accept': 'application/json'} | (kwargs['headers'] if 'headers' in kwargs else {}), **{k: v for k, v in kwargs.items() if k not in ['headers']})
+
+class KimaiAPI(object):
+    def __init__(self, base_url: str, api_token: str, clients: Iterable[str]):
+        self._session = KimaiSession(base_url, api_token)
+        self._kimai_clients = self._session.get('/api/customers').json()
+        self._client_ids = self.resolve_clients(clients)
+        kimai_user = self._session.get('/api/users/me').json()
+        self._tz = gettz(kimai_user['timezone'])
+
+    def resolve_clients(self, clients: Iterable[str]) -> frozenset[int]:
+        return frozenset({ client['id'] for client in self._kimai_clients if client['name'] in clients })
+
+    def render_datetime(self, datetime: datetime) -> str:
+        return datetime.astimezone(self._tz).strftime('%Y-%m-%dT%H:%M:%S')
+
+    def get_timesheets(self, params: dict[str, Any] = {}) -> Generator[Any]:
+        for page in count(start=1):
+            resp = self._session.get('/api/timesheets', params=params | {'size': 100, 'page': page})
+            if resp.status_code == 404:
+                break
+            yield from resp.json()
 
-class TogglAPISection(Enum):
-    TOGGL = '/api/v9'
-    REPORTS = '/reports/api/v2'
-
-class TogglAPIError(Exception):
-    def __init__(self, response, *, http_error=None):
-        self.http_error = http_error
-        self.response = response
-
-    def __str__(self):
-        if not self.http_error is None:
-            return str(self.http_error)
-        else:
-            return self.response.text
-
-class TogglAPI(object):
-    def __init__(self, api_token, workspace_id, client_ids):
-        self._api_token = api_token
-        self._workspace_id = workspace_id
-        self._client_ids = set(map(int, client_ids.split(','))) if client_ids else None
-
-    def _make_url(self, api=TogglAPISection.TOGGL, section=['me', 'time_entries', 'current'], params={}):
-        if api is TogglAPISection.REPORTS:
-          params.update({'user_agent': 'worktime', 'workspace_id': self._workspace_id})
-
-        api_path = api.value
-        section_path = '/'.join(section)
-        uri = uricompose(scheme='https', host='api.track.toggl.com', path=f"{api_path}/{section_path}", query=params)
-
-        return uri
-
-    def _query(self, url, method):
-        response = self._raw_query(url, method)
-        response.raise_for_status()
-        return response
-
-    @backoff.on_predicate(
-        backoff.expo,
-        factor=0.1, max_value=2,
-        predicate=lambda r: r.status_code == 429,
-        max_time=10,
-    )
-    def _raw_query(self, url, method):
-        headers = {'content-type': 'application/json', 'accept': 'application/json'}
-        response = None
-
-        if method == 'GET':
-            response = requests.get(url, headers=headers, auth=HTTPBasicAuth(self._api_token, 'api_token'))
-        elif method == 'POST':
-            response = requests.post(url, headers=headers, auth=HTTPBasicAuth(self._api_token, 'api_token'))
-        else:
-            raise ValueError(f"Undefined HTTP method “{method}”")
-
-        return response
-
-    def entry_durations(self, start_date, *, end_date, rounding=False, client_ids):
-        if client_ids is not None and not client_ids:
+    def entry_durations(self, start_date: datetime, *, end_date: datetime, clients: Iterable[str] | None = None) -> Generator[timedelta]:
+        client_ids = None
+        if clients is not None and not clients:
             return
+        elif clients is None:
+            client_ids = self._client_ids
+        else:
+            client_ids = self.resolve_clients(clients)
 
         cache_dir = Path(BaseDirectory.save_cache_path('worktime')) / 'entry_durations'
         step = timedelta(days = 120)
@@ -115,11 +117,8 @@ class TogglAPI(object):
                 cache_key = blake2s(jsonpickle.encode({
                     'start': req_start,
                     'end': req_end,
-                    'rounding': rounding,
-                    'clients': client_ids,
-                    'workspace': self._workspace_id,
-                    'workspace_clients': self._client_ids
-                }).encode('utf-8'), key = self._api_token.encode('utf-8')).hexdigest()
+                    'client_ids': client_ids,
+                }).encode('utf-8'), key = self._session.auth.token.encode('utf-8')).hexdigest()
                 cache_path = cache_dir / cache_key[:2] / cache_key[2:4] / f'{cache_key[4:]}.json'
                 try:
                     with cache_path.open('r', encoding='utf-8') as ch:
@@ -129,85 +128,83 @@ class TogglAPI(object):
                     pass
 
             entries = list()
-            params = { 'since': (req_start - timedelta(days=1)).date().isoformat(),
-                       'until': (req_end + timedelta(days=1)).date().isoformat(),
-                       'rounding': 'yes' if rounding else 'no',
-                       'billable': 'yes'
-                      }
-            if client_ids is not None:
-                params |= { 'client_ids': ','.join(map(str, client_ids)) }
-            for page in count(start = 1):
-                url = self._make_url(api = TogglAPISection.REPORTS, section = ['details'], params = params | { 'page': page })
-                r = self._query(url = url, method='GET')
-                if not r or not r.json():
-                    raise TogglAPIError(r)
-                report = r.json()
-                for entry in report['data']:
-                    start = isoparse(entry['start'])
-                    end = isoparse(entry['end'])
-
-                    if start > req_end or end < req_start:
-                        continue
+            params = {
+                'begin': self.render_datetime(req_start),
+                'end': self.render_datetime(req_end),
+                'customers[]': list(client_ids),
+                'billable': 1,
+            }
+
+            for entry in self.get_timesheets(params):
+                if entry['end'] is None:
+                    continue
+
+                start = isoparse(entry['begin'])
+                end = isoparse(entry['end'])
 
-                    x = min(end, req_end) - max(start, req_start)
-                    if cache_key:
-                        entries.append(x)
-                    yield x
-                if not report['data']:
-                    break
+                if start > req_end or end < req_start:
+                    continue
+
+                x = min(end, req_end) - max(start, req_start)
+                if cache_key:
+                    entries.append(x)
+                yield x
 
             if cache_path:
                 cache_path.parent.mkdir(parents=True, exist_ok=True)
                 with cache_path.open('w', encoding='utf-8') as ch:
                     ch.write(jsonpickle.encode(entries))
-            # res = timedelta(milliseconds=report['total_billable']) if report['total_billable'] else timedelta(milliseconds=0)
-            # return res
-
-    def get_billable_hours(self, start_date, end_date=datetime.now(timezone.utc), rounding=False):
-        billable_acc = timedelta(milliseconds = 0)
-        if 0 in self._client_ids:
-            url = self._make_url(api = TogglAPISection.TOGGL, section = ['workspaces', self._workspace_id, 'clients'])
-            r = self._query(url = url, method = 'GET')
-            if not r or not r.json():
-                raise TogglAPIError(r)
-
-            billable_acc += sum(self.entry_durations(start_date, end_date=end_date, rounding=rounding, client_ids=None), start=timedelta(milliseconds=0)) - sum(self.entry_durations(start_date, end_date=end_date, rounding=rounding, client_ids=frozenset(map(lambda c: c['id'], r.json()))), start=timedelta(milliseconds=0))
 
-        billable_acc += sum(self.entry_durations(start_date, end_date=end_date, rounding=rounding, client_ids=frozenset(*(self._client_ids - {0}))), start=timedelta(milliseconds=0))
+    def get_billable_hours(self, start_date: datetime, end_date: datetime = datetime.now(timezone.utc)) -> timedelta:
+        return sum(self.entry_durations(start_date, end_date=end_date), start=timedelta(milliseconds=0))
 
-        return billable_acc
+    def get_running_entry(self) -> Any | None:
+        kimai_entries = self._session.get('/api/timesheets/active').json()
+        if not kimai_entries:
+            return None
+        entry = kimai_entries[0]
 
-    def get_running_clock(self, now=datetime.now(timezone.utc)):
-        url = self._make_url(api = TogglAPISection.TOGGL, section = ['me', 'time_entries', 'current'])
-        r = self._query(url = url, method='GET')
+        if entry['project']['customer']['id'] not in self._client_ids:
+            return None
 
-        if not r or (not r.json() and r.json() is not None):
-            raise TogglAPIError(r)
+        return entry
 
-        if not r.json() or not r.json()['billable']:
+    def get_running_clock(self, now: datetime = datetime.now(timezone.utc)) -> timedelta | None:
+        entry = self.get_running_entry()
+        if not entry:
             return None
+        start = isoparse(entry['begin'])
+        return now - start if start <= now else None
 
-        if self._client_ids is not None:
-            if 'pid' in r.json() and r.json()['pid']:
-                url = self._make_url(api = TogglAPISection.TOGGL, section = ['projects', str(r.json()['pid'])])
-                pr = self._query(url = url, method = 'GET')
-                if not pr or not pr.json():
-                    raise TogglAPIError(pr)
-
-                if not pr.json():
-                    return None
+    def get_recent_entries(self) -> Generator[Any]:
+        step = timedelta(days = 7)
+        now = datetime.now().astimezone(timezone.utc)
+        ids = set()
+        for req_end in (now - step * i for i in count()):
+            params = {
+                'begin': self.render_datetime(req_end - step),
+                'end': self.render_datetime(req_end),
+                'full': 'true',
+            }
+            for entry in self.get_timesheets(params):
+                if entry['id'] in ids:
+                    continue
+                ids.add(entry['id'])
+                yield entry
 
-                if 'cid' in pr.json() and pr.json()['cid']:
-                    if pr.json()['cid'] not in self._client_ids:
-                        return None
-                elif 0 not in self._client_ids:
-                    return None
-            elif 0 not in self._client_ids:
-                return None
+    def start_clock(self, project_id: int, activity_id: int, description: str | None = None, tags: Iterable[str] | None = None, billable: bool = True):
+        self._session.post('/api/timesheets', json={
+            'begin': self.render_datetime(datetime.now()),
+            'project': project_id,
+            'activity': activity_id,
+            'description': description if description else '',
+            'tags': (','.join(tags)) if tags else '',
+            'billable': billable,
+        }).raise_for_status()
 
-        start = isoparse(r.json()['start'])
+    def stop_clock(self, running_id: int):
+        self._session.patch(f'/api/timesheets/{running_id}/stop').raise_for_status()
 
-        return now - start if start <= now else None
 
 class Worktime(object):
     time_worked = timedelta()
@@ -223,6 +220,7 @@ class Worktime(object):
     leave_budget = dict()
     time_per_day = None
     workdays = None
+    pull_forward = dict()
 
     @staticmethod
     @cache
@@ -279,10 +277,10 @@ class Worktime(object):
 
       config = Worktime.config()
       config_dir = BaseDirectory.load_first_config('worktime')
-      api = TogglAPI(
-          api_token=config.get("TOGGL", {}).get("ApiToken", None),
-          workspace_id=config.get("TOGGL", {}).get("Workspace", None),
-          client_ids=config.get("TOGGL", {}).get("ClientIds", None)
+      api = KimaiAPI(
+          base_url=config.get("KIMAI", {}).get("BaseUrl", None),
+          api_token=config.get("KIMAI", {}).get("ApiToken", None),
+          clients=config.get("KIMAI", {}).get("Clients", None)
       )
       date_format = config.get("WORKTIME", {}).get("DateFormat", '%Y-%m-%d')
 
@@ -377,10 +375,7 @@ class Worktime(object):
                               parse_datestr(stripped_line)
 
                           for day in [fromDay + timedelta(days = x) for x in range(0, (toDay - fromDay).days + 1)]:
-                              if self.end_date.date() < day or day < self.start_date.date():
-                                  continue
-
-                              if self.would_be_workday(day):
+                              if self.would_be_workday(day) and self.start_date.date() <= day and day <= self.end_date.date():
                                   if excused_kind == 'leave':
                                       self.leave_days.add(day)
                                   elif time is not None and time >= self.time_per_day(day):
@@ -390,14 +385,34 @@ class Worktime(object):
               if e.errno != 2:
                   raise e
 
-      pull_forward = dict()
+      self.time_per_day = lambda day: timedelta(hours = hours_per_week(day)) / len(self.workdays) - (holidays[day] if day in holidays else timedelta())
 
       start_day = self.start_date.date()
       end_day = self.end_date.date()
 
+      self.extra_days_to_work = dict()
+
       try:
-          with open(Path(config_dir) / "pull-forward", 'r') as excused:
-              for line in excused:
+          with open(Path(config_dir) / "days-to-work", 'r') as extra_days_to_work_file:
+              for line in extra_days_to_work_file:
+                  stripped_line = line.strip()
+                  if stripped_line:
+                      splitLine = stripped_line.split(' ')
+                      if len(splitLine) == 2:
+                          [hours, datestr] = splitLine
+                          day = datetime.strptime(datestr, date_format).replace(tzinfo=tzlocal()).date()
+                          self.extra_days_to_work[day] = timedelta(hours = float(hours))
+                      else:
+                          day = datetime.strptime(stripped_line, date_format).replace(tzinfo=tzlocal()).date()
+                          self.extra_days_to_work[day] = self.time_per_day(day)
+      except IOError as e:
+          if e.errno != 2:
+              raise e
+
+
+      try:
+          with open(Path(config_dir) / "pull-forward", 'r') as pull_forward:
+              for line in pull_forward:
                   stripped_line = line.strip()
                   if stripped_line:
                       [hours, datestr] = stripped_line.split(' ')
@@ -418,44 +433,29 @@ class Worktime(object):
                                   if not d == datetime.strptime(c, date_format).replace(tzinfo=tzlocal()).date(): break
                           else:
                               if d >= self.end_date.date():
-                                  pull_forward[d] = min(timedelta(hours = float(hours)), self.time_per_day(d) - (holidays[d] if d in holidays else timedelta()))
+                                  time_for_day = self.time_per_day(d) if d.isoweekday() in self.workdays else timedelta()
+                                  if d in self.extra_days_to_work:
+                                      time_for_day += self.extra_days_to_work[d]
+                                  self.pull_forward[d] = min(timedelta(hours = float(hours)), time_for_day)
       except IOError as e:
           if e.errno != 2:
               raise e
 
+      if self.pull_forward:
+          for year in range(self.end_date.year + 1, max(self.pull_forward.keys()).year + 1):
+              holidays |= {k: v * timedelta(hours = hours_per_week(k)) / len(self.workdays) for k, v in Worktime.holidays(year).items()}
+
       self.days_to_work = dict()
 
-      if pull_forward:
-          end_day = max(end_day, max(list(pull_forward)))
+      # if self.pull_forward:
+      #     end_day = max(end_day, max(self.pull_forward.keys()))
 
       for day in [start_day + timedelta(days = x) for x in range(0, (end_day - start_day).days + 1)]:
           if day.isoweekday() in self.workdays:
               time_to_work = self.time_per_day(day)
-              if day in holidays.keys():
-                time_to_work -= holidays[day]
               if time_to_work > timedelta():
                 self.days_to_work[day] = time_to_work
 
-      self.extra_days_to_work = dict()
-
-      try:
-          with open(Path(config_dir) / "days-to-work", 'r') as extra_days_to_work_file:
-              for line in extra_days_to_work_file:
-                  stripped_line = line.strip()
-                  if stripped_line:
-                      splitLine = stripped_line.split(' ')
-                      if len(splitLine) == 2:
-                          [hours, datestr] = splitLine
-                          day = datetime.strptime(datestr, date_format).replace(tzinfo=tzlocal()).date()
-                          self.extra_days_to_work[day] = timedelta(hours = float(hours))
-                      else:
-                          day = datetime.strptime(stripped_line, date_format).replace(tzinfo=tzlocal()).date()
-                          self.extra_days_to_work[day] = self.time_per_day(day)
-      except IOError as e:
-          if e.errno != 2:
-              raise e
-
-
       self.now_is_workday = self.is_workday(self.now.date())
 
       self.time_worked = timedelta()
@@ -470,33 +470,46 @@ class Worktime(object):
           self.extra_days_to_work[self.now.date()] = timedelta()
 
       self.time_to_work = sum([self.days_to_work[day] for day in self.days_to_work.keys() if day <= self.end_date.date()], timedelta())
-      for day in [d for d in list(pull_forward) if d > self.end_date.date()]:
-          days_forward = set([d for d in self.days_to_work.keys() if d >= self.end_date.date() and d < day and (not d in pull_forward or d == self.end_date.date())])
-          extra_days_forward = set([d for d in self.extra_days_to_work.keys() if d >= self.end_date.date() and d < day and (not d in pull_forward or d == self.end_date.date())])
-          days_forward = days_forward.union(extra_days_forward)
+      for day in [d for d in list(self.pull_forward) if d > self.end_date.date()]:
+          days_forward = set([d for d in [start_day + timedelta(days = x) for x in range(0, (day - start_day).days + 1)] if d >= self.end_date.date() and d < day and (d not in self.pull_forward or d == self.end_date.date())])
+          extra_days_forward = set([d for d in self.extra_days_to_work.keys() if d >= self.end_date.date() and d < day and (d not in self.pull_forward or d == self.end_date.date())])
+          days_forward |= extra_days_forward
 
           extra_day_time_left = timedelta()
           for extra_day in extra_days_forward:
               day_time = max(timedelta(), self.time_per_day(extra_day) - self.extra_days_to_work[extra_day])
               extra_day_time_left += day_time
-          extra_day_time = min(extra_day_time_left, pull_forward[day])
-          time_forward = pull_forward[day] - extra_day_time
+          extra_day_time = min(extra_day_time_left, self.pull_forward[day])
+          time_forward = self.pull_forward[day] - extra_day_time
           if extra_day_time_left > timedelta():
             for extra_day in extra_days_forward:
                 day_time = max(timedelta(), self.time_per_day(extra_day) - self.extra_days_to_work[extra_day])
                 self.extra_days_to_work[extra_day] += extra_day_time * (day_time / extra_day_time_left)
 
-          hours_per_day_forward = time_forward / len(days_forward) if len(days_forward) > 0 else timedelta()
+          def days_count(days_forward):
+              r = 0
+              for day in sorted(days_forward):
+                  day_time = timedelta()
+                  if day in self.extra_days_to_work:
+                      day_time += self.extra_days_to_work
+                  if day in holidays and not day in self.extra_days_to_work:
+                      day_time -= holidays[day]
+                  if day.isoweekday() in self.workdays:
+                      day_time += timedelta(hours = hours_per_week(day)) / len(self.workdays)
+                  r += max(timedelta(), day_time) / (timedelta(hours = hours_per_week(day)) / len(self.workdays))
+              return r
+
+          hours_per_day_forward = time_forward / days_count(days_forward) if days_count(days_forward) > 0 else timedelta()
           days_forward.discard(self.end_date.date())
 
-          self.time_pulled_forward += time_forward - hours_per_day_forward * len(days_forward)
+          self.time_pulled_forward += time_forward - hours_per_day_forward * days_count(days_forward)
 
       if self.end_date.date() in self.extra_days_to_work:
           self.time_pulled_forward += self.extra_days_to_work[self.end_date.date()]
 
-      self.time_to_work += self.time_pulled_forward
+      # self.time_to_work += self.time_pulled_forward
 
-      self.time_worked += api.get_billable_hours(self.start_date, self.now, rounding = config.get("WORKTIME", {}).get("rounding", True))
+      self.time_worked += api.get_billable_hours(self.start_date, self.now)
 
 def format_days(worktime, days, date_format=None):
     if not date_format:
@@ -518,7 +531,14 @@ def format_days(worktime, days, date_format=None):
     return ', '.join(map(lambda group: ','.join(map(format_group, group)), groups))
 
 
-def worktime(**args):
+def tooltip_timedelta(td):
+    if td < timedelta(seconds = 0):
+        return "-" + tooltip_timedelta(-td)
+    mm, ss = divmod(td.total_seconds(), 60)
+    hh, mm = divmod(mm, 60)
+    return "%d:%02d:%02d" % (hh, mm, ss)
+
+def worktime(pull_forward_cutoff, waybar, **args):
     worktime = Worktime(**args)
 
     def format_worktime(worktime):
@@ -557,24 +577,41 @@ def worktime(**args):
               return f"{indicator}{difference_string}"
           else:
               difference_string = difference_string(total_minutes_difference * timedelta(minutes = 1))
-              if worktime.now_is_workday:
-                  return difference_string
-              else:
-                  return f"({difference_string})"
-
-    if worktime.time_pulled_forward >= timedelta(minutes = 15):
+              return difference_string
+
+    out_class = "running" if worktime.running_entry else "stopped"
+    difference = worktime.time_to_work - worktime.time_worked
+    if worktime.running_entry and -min(timedelta(milliseconds=0), difference) > sum(worktime.pull_forward.values(), start=timedelta(milliseconds=0)) or not worktime.running_entry and max(timedelta(milliseconds=0), difference) > worktime.time_per_day(worktime.now.date()) and worktime.now_is_workday:
+        out_class = "over"
+    pull_forward_sum = sum(worktime.pull_forward.values(), start=timedelta(milliseconds=0))
+    if pull_forward_sum >= min(pull_forward_cutoff, timedelta(seconds = 1)):
         worktime_no_pulled_forward = deepcopy(worktime)
-        worktime_no_pulled_forward.time_to_work -= worktime_no_pulled_forward.time_pulled_forward
+        # worktime_no_pulled_forward.time_to_work -= worktime_no_pulled_forward.time_pulled_forward
         worktime_no_pulled_forward.time_pulled_forward = timedelta()
+        worktime_no_pulled_forward.pull_forward = dict()
+        worktime.time_to_work += pull_forward_sum
 
-        difference_string = format_worktime(worktime)
         difference_string_no_pulled_forward = format_worktime(worktime_no_pulled_forward)
 
-        print(f"{difference_string_no_pulled_forward}…{difference_string}")
+        tooltip = tooltip_timedelta(worktime_no_pulled_forward.time_to_work - worktime_no_pulled_forward.time_worked) + "…" + tooltip_timedelta(difference + pull_forward_sum)
+        if pull_forward_sum >= pull_forward_cutoff:
+            out_text = f"{difference_string_no_pulled_forward}…{format_worktime(worktime)}"
+        else:
+            out_text = format_worktime(worktime)
+    else:
+        tooltip = tooltip_timedelta(difference)
+        out_text = format_worktime(worktime)
+
+    if waybar:
+        json.dump({"text": out_text, "class": out_class, "tooltip": tooltip}, stdout)
     else:
-        print(format_worktime(worktime))
+        print(out_text)
 
-def time_worked(now, **args):
+def pull_forward(**args):
+    worktime = Worktime(**args)
+    print(tooltip_timedelta(sum(worktime.pull_forward.values(), start=timedelta(milliseconds=0))))
+
+def time_worked(now, waybar, **args):
     then = now.replace(hour = 0, minute = 0, second = 0, microsecond = 0)
     if now.time() == time():
         now = now + timedelta(days = 1)
@@ -584,33 +621,62 @@ def time_worked(now, **args):
 
     worked = now.time_worked - then.time_worked
 
+    out_text = None
+    out_class = "running" if now.running_entry else "stopped"
+    tooltip = tooltip_timedelta(worked)
+    target_time = max(then.time_per_day(then.now.date()), now.time_per_day(now.now.date())) if then.time_per_day(then.now.date()) and now.time_per_day(now.now.date()) else (then.time_per_day(then.now.date()) if then.time_per_day(then.now.date()) else now.time_per_day(now.now.date()))
+    difference = target_time - worked
+    difference_pull_forward = difference + now.time_pulled_forward
+    if now.running_entry and difference_pull_forward < timedelta(seconds=0):
+        out_class = "over"
     if args['do_round']:
-      total_minutes_difference = 5 * ceil(worked / timedelta(minutes = 5))
-      (hours_difference, minutes_difference) = divmod(abs(total_minutes_difference), 60)
-      sign = '' if total_minutes_difference >= 0 else '-'
-
-      difference_string = f"{sign}"
-      if hours_difference != 0:
-        difference_string += f"{hours_difference}h"
-      if hours_difference == 0 or minutes_difference != 0:
-        difference_string += f"{minutes_difference}m"
-
-      clockout_time = None
-      clockout_difference = None
-      if then.now_is_workday or now.now_is_workday:
-          target_time = max(then.time_per_day(then.now.date()), now.time_per_day(now.now.date())) if then.time_per_day(then.now.date()) and now.time_per_day(now.now.date()) else (then.time_per_day(then.now.date()) if then.time_per_day(then.now.date()) else now.time_per_day(now.now.date()));
-          difference = target_time - worked
-          clockout_difference = 5 * ceil(difference / timedelta(minutes = 5))
-          clockout_time = now.now + difference
-          clockout_time += (5 - clockout_time.minute % 5) * timedelta(minutes = 1)
-          clockout_time = clockout_time.replace(second = 0, microsecond = 0)
+        total_minutes_difference = 5 * ceil(worked / timedelta(minutes = 5))
+        (hours_difference, minutes_difference) = divmod(abs(total_minutes_difference), 60)
+        sign = '' if total_minutes_difference >= 0 else '-'
 
-      if now.running_entry and clockout_time and clockout_difference >= 0:
-          print(f"{difference_string}/{clockout_time:%H:%M}")
-      else:
-          print(difference_string)
+        difference_string = f"{sign}"
+        if hours_difference != 0:
+          difference_string += f"{hours_difference}h"
+        if hours_difference == 0 or minutes_difference != 0:
+          difference_string += f"{minutes_difference}m"
+
+        def round_clockout_time(difference):
+            clockout_time = None
+            clockout_difference = None
+            exact_clockout_time = None
+            if then.now_is_workday or now.now_is_workday:
+                clockout_difference = 5 * ceil(difference / timedelta(minutes = 5))
+                clockout_time = now.now + difference
+                exact_clockout_time = clockout_time
+                clockout_time += (5 - clockout_time.minute % 5) * timedelta(minutes = 1)
+                clockout_time = clockout_time.replace(second = 0, microsecond = 0)
+
+            return clockout_time, exact_clockout_time, clockout_difference
+
+        clockout_time, exact_clockout_time, clockout_difference = round_clockout_time(difference)
+        clockout_time_pull_forward, exact_clockout_time_pull_forward, clockout_difference_pull_forward = round_clockout_time(difference_pull_forward)
+        clockout_pull_forward_sum, exact_clockout_pull_forward_sum, _ = round_clockout_time(now.time_to_work - now.time_worked + sum(now.pull_forward.values(), start=timedelta(milliseconds=0)))
+
+        if now.running_entry and clockout_time and (clockout_difference >= 0 or clockout_difference_pull_forward >= 0):
+            out_text = f"{difference_string}/{clockout_time:%H:%M}"
+            tooltip = f"{tooltip_timedelta(worked)}/{exact_clockout_time:%H:%M:%S}"
+
+            if clockout_pull_forward_sum >= clockout_time_pull_forward and clockout_time_pull_forward != clockout_time:
+                out_text += f"…{clockout_time_pull_forward:%H:%M}"
+            if exact_clockout_pull_forward_sum >= exact_clockout_time_pull_forward and exact_clockout_time_pull_forward != exact_clockout_time:
+                tooltip += f"…{exact_clockout_time_pull_forward:%H:%M:%S}"
+        else:
+            out_text = difference_string
     else:
-      print(worked)
+        out_text = str(worked)
+
+    if not now.now_is_workday:
+        out_text = f'({out_text})'
+
+    if waybar:
+        json.dump({"text": out_text, "class": out_class, "tooltip": tooltip}, stdout)
+    else:
+        print(out_text)
 
 def diff(now, **args):
     now = now.replace(hour = 0, minute = 0, second = 0, microsecond = 0)
@@ -798,18 +864,54 @@ def classification(classification_name, table, table_format, **args):
 def main():
     def isotime(s):
         return datetime.fromisoformat(s).replace(tzinfo=tzlocal())
+    def duration_minutes(s):
+        return timedelta(minutes = float(s))
+
+    def set_default_subparser(self, name, args=None, positional_args=0):
+        """default subparser selection. Call after setup, just before parse_args()
+        name: is the name of the subparser to call by default
+        args: if set is the argument list handed to parse_args()
+
+        , tested with 2.7, 3.2, 3.3, 3.4
+        it works with 2.6 assuming argparse is installed
+        """
+        subparser_found = False
+        for arg in sys.argv[1:]:
+            if arg in ['-h', '--help']:  # global help if no subparser
+                break
+        else:
+            for x in self._subparsers._actions:
+                if not isinstance(x, argparse._SubParsersAction):
+                    continue
+                for sp_name in x._name_parser_map.keys():
+                    if sp_name in sys.argv[1:]:
+                        subparser_found = True
+            if not subparser_found:
+                # insert default in last position before global positional
+                # arguments, this implies no global options are specified after
+                # first positional argument
+                if args is None:
+                    sys.argv.insert(len(sys.argv) - positional_args, name)
+                else:
+                    args.insert(len(args) - positional_args, name)
+
+    argparse.ArgumentParser.set_default_subparser = set_default_subparser
 
     config = Worktime.config()
 
-    parser = argparse.ArgumentParser(prog = "worktime", description = 'Track worktime using toggl API')
+    parser = argparse.ArgumentParser(prog = "worktime", description = 'Track worktime using Kimai API')
     parser.add_argument('--time', dest = 'now', metavar = 'TIME', type = isotime, help = 'Time to calculate status for (default: current time)', default = datetime.now(tzlocal()))
     parser.add_argument('--start', dest = 'start_datetime', metavar = 'TIME', type = isotime, help = 'Time to calculate status from (default: None)', default = None)
     parser.add_argument('--no-running', dest = 'include_running', action = 'store_false')
     parser.add_argument('--no-force-day-to-work', dest = 'force_day_to_work', action = 'store_false')
     subparsers = parser.add_subparsers(help = 'Subcommands')
-    parser.set_defaults(cmd = worktime)
-    time_worked_parser = subparsers.add_parser('time_worked', aliases = ['time', 'worked', 'today'])
+    worktime_parser = subparsers.add_parser('time_worked', aliases = ['time', 'worked'])
+    worktime_parser.add_argument('--pull-forward-cutoff', dest = 'pull_forward_cutoff', metavar = 'MINUTES', type = duration_minutes, default = timedelta(minutes = 15))
+    worktime_parser.add_argument('--waybar', action='store_true')
+    worktime_parser.set_defaults(cmd = worktime)
+    time_worked_parser = subparsers.add_parser('today')
     time_worked_parser.add_argument('--no-round', dest = 'do_round', action = 'store_false')
+    time_worked_parser.add_argument('--waybar', action='store_true')
     time_worked_parser.set_defaults(cmd = time_worked)
     diff_parser = subparsers.add_parser('diff')
     diff_parser.set_defaults(cmd = diff)
@@ -827,9 +929,146 @@ def main():
         classification_parser.add_argument('--table', action = 'store_true')
         classification_parser.add_argument('--table-format', dest='table_format', type=str, default='fancy_grid')
         classification_parser.set_defaults(cmd = partial(classification, classification_name=classification_name))
+    pull_forward_parser = subparsers.add_parser('pull-forward')
+    pull_forward_parser.set_defaults(cmd = pull_forward)
+    parser.set_default_subparser('time_worked')
     args = parser.parse_args()
 
     args.cmd(**vars(args))
 
+async def ui_update_options(api, cache_path):
+    options = set()
+    sort_order = dict()
+    entry_iter = enumerate(api.get_recent_entries())
+    loop = asyncio.get_event_loop()
+    start = clock_gettime_ns(CLOCK_MONOTONIC)
+    while item := await loop.run_in_executor(None, next, entry_iter):
+        ix, entry = item
+        if len(options) >= 20 or ix >= 1000:
+            break
+        elif len(options) >= 3:
+            now = clock_gettime_ns(CLOCK_MONOTONIC)
+            if now - start >= 4000000000:
+                break
+
+        option = frozendict({
+            'tags': frozenset(entry['tags']),
+            'activity': frozendict({'id': entry['activity']['id'], 'name': entry['activity']['name']}),
+            'project': frozendict({'id': entry['project']['id'], 'customer': entry['project']['customer']['name'], 'name': entry['project']['name']}),
+            'description': entry['description'] if entry['description'] else None,
+            'billable': entry['billable'],
+        })
+        sort_value = isoparse(entry['begin'])
+        if option in sort_order:
+            sort_value = max(sort_value, sort_order[option])
+        sort_order[option] = sort_value
+        options.add(option)
+
+    options = list(sorted(options, key = lambda o: sort_order[o], reverse = True))
+
+    with AtomicWriter(cache_path, overwrite=True) as ch:
+        ch.write_text(jsonpickle.encode(options))
+
+    return options
+
+def ui_render_option(option):
+    res = ''
+    if option['description']:
+        res += '„{}“, '.format(option['description'])
+    res += option['activity']['name'] + ', '
+    res += option['project']['name']
+    if option['project']['customer'] not in option['project']['name']:
+        res += ' ({})'.format(option['project']['customer'])
+    if option['tags']:
+        res += ', {}'.format(' '.join(map(lambda t: '#{}'.format(t), option['tags'])))
+    if not option['billable']:
+        res += ', not billable'
+    return res
+
+async def ui_main():
+    cache_path = Path(BaseDirectory.save_cache_path('worktime-ui')) / 'options.json'
+    options = None
+    try:
+        with cache_path.open('r', encoding='utf-8') as ch:
+            options = jsonpickle.decode(ch.read())
+    except FileNotFoundError:
+        pass
+
+    config = Worktime.config()
+    api = KimaiAPI(
+        base_url=config.get("KIMAI", {}).get("BaseUrl", None),
+        api_token=config.get("KIMAI", {}).get("ApiToken", None),
+        clients=config.get("KIMAI", {}).get("Clients", None)
+    )
+    running_entry = api.get_running_entry()
+
+    async with asyncio.TaskGroup() as tg:
+        update_options = tg.create_task(ui_update_options(api, cache_path))
+        if not options:
+            options = await update_options
+
+        read_fd, write_fd = os.pipe()
+        w_pipe = open(write_fd, 'wb', 0)
+        loop = asyncio.get_event_loop()
+        w_transport, _ = await loop.connect_write_pipe(
+            asyncio.Protocol,
+            w_pipe,
+        )
+        r_pipe = open(read_fd, 'rb', 0)
+
+        proc = await asyncio.create_subprocess_exec(
+            "fuzzel", "--dmenu", "--index", "--width=60",
+            stdout = asyncio.subprocess.PIPE,
+            stdin = r_pipe,
+        )
+
+        with closing(w_transport) as t:
+            if running_entry:
+                t.write(b'Stop running timesheet\n')
+            for option in options:
+                t.write(ui_render_option(option).encode('utf-8') + b'\n')
+
+        stdout, _ = await proc.communicate()
+        if proc.returncode != 0:
+            return
+        fuzzel_out = int(stdout.decode('utf-8'))
+        if fuzzel_out < 0 or fuzzel_out >= len(options):
+            return
+        elif running_entry and fuzzel_out == 0:
+            api.stop_clock(running_entry['id'])
+            await notify.Server('worktime').Notify("Stopped running timesheet").set_timeout(65000).show()
+        else:
+            if running_entry:
+                fuzzel_out -= 1
+            option = options[fuzzel_out]
+            api.start_clock(
+                project_id = option['project']['id'],
+                activity_id = option['activity']['id'],
+                description = option['description'],
+                tags = option['tags'],
+                billable = option['billable'],
+            )
+            await notify.Server('worktime').Notify("Timesheet started…").set_timeout(65000).show()
+
+
+def ui():
+    asyncio.run(ui_main())
+
+async def stop_main():
+    config = Worktime.config()
+    api = KimaiAPI(
+        base_url=config.get("KIMAI", {}).get("BaseUrl", None),
+        api_token=config.get("KIMAI", {}).get("ApiToken", None),
+        clients=config.get("KIMAI", {}).get("Clients", None)
+    )
+    if running_entry := api.get_running_entry():
+        api.stop_clock(running_entry['id'])
+        await notify.Server('worktime').Notify("Stopped running timesheet").set_timeout(65000).show()
+    else:
+        await notify.Server('worktime').Notify("No timesheet currently running").set_timeout(65000).show()
+
+def stop():
+    asyncio.run(stop_main())
+
 if __name__ == "__main__":
     sys.exit(main())
diff --git a/overlays/wttrbar/default.nix b/overlays/wttrbar/default.nix
deleted file mode 100644
index 876fa699..00000000
--- a/overlays/wttrbar/default.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{ prev, ... }: {
-  wttrbar = prev.wttrbar.overrideAttrs (oldAttrs: {
-    patches = (oldAttrs.patches or []) ++ [
-      ./icons.patch
-    ];
-  });
-}
diff --git a/overlays/wttrbar/icons.patch b/overlays/wttrbar/icons.patch
deleted file mode 100644
index e7e721c8..00000000
--- a/overlays/wttrbar/icons.patch
+++ /dev/null
@@ -1,154 +0,0 @@
-diff --git a/src/constants.rs b/src/constants.rs
-index 81b1926..3619d8f 100644
---- a/src/constants.rs
-+++ b/src/constants.rs
-@@ -1,64 +1,52 @@
- pub const WEATHER_CODES: &[(i32, &str)] = &[
--    (113, "☀️"),
--    (116, "🌤️"),
--    (119, "☁️"),
--    (122, "🌥️"),
--    (143, "🌫️"),
--    (176, "🌦️"),
--    (179, "🌧️"),
--    (182, "🌨️"),
--    (185, "🌨️"),
--    (200, "🌩️"),
--    (227, "❄️"),
--    (230, "❄️"),
--    (248, "🌫️"),
--    (260, "🌫️"),
--    (263, "🌧️"),
--    (266, "🌧️"),
--    (281, "🌦️"),
--    (284, "🌦️"),
--    (293, "🌧️"),
--    (296, "🌧️"),
--    (299, "🌧️"),
--    (302, "🌧️"),
--    (305, "🌧️"),
--    (308, "🌧️"),
--    (311, "🌧️"),
--    (314, "🌧️"),
--    (317, "🌧️"),
--    (320, "🌨️"),
--    (323, "🌨️"),
--    (326, "🌨️"),
--    (329, "🌨️"),
--    (332, "🌨️"),
--    (335, "🌨️"),
--    (338, "🌨️"),
--    (350, "🌨️"),
--    (353, "🌧️"),
--    (356, "🌧️"),
--    (359, "🌧️"),
--    (362, "🌨️"),
--    (365, "🌨️"),
--    (368, "🌨️"),
--    (371, "🌨️"),
--    (374, "🌨️"),
--    (377, "🌨️"),
--    (386, "🌩️"),
--    (389, "🌨️"),
--    (392, "🌨️"),
--    (395, "🌨️"),
--    (398, "🌨️"),
--    (401, "🌨️"),
--    (404, "🌨️"),
--    (407, "🌨️"),
--    (410, "🌨️"),
--    (413, "🌨️"),
--    (416, "🌨️"),
--    (419, "🌨️"),
--    (422, "🌨️"),
--    (425, "🌨️"),
--    (428, "🌨️"),
--    (431, "🌨️"),
-+    (113, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (116, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (119, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (122, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (143, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (176, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (179, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (182, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (185, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (200, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (227, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (230, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (248, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (260, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (263, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (266, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (281, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (284, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (293, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (296, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (299, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (302, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (305, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (308, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (311, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (314, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (317, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (320, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (323, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (326, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (329, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (332, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (335, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (338, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (350, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (353, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (356, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (359, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (362, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (365, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (368, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (371, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (374, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (377, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (386, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (389, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (392, "<span font=\"Symbols Nerd Font Mono\"></span>"),
-+    (395, "<span font=\"Symbols Nerd Font Mono\"></span>"),
- ];
- 
- pub const ICON_PLACEHOLDER: &str = "{ICON}";
-diff --git a/src/main.rs b/src/main.rs
-index 6ac4654..1b84207 100644
---- a/src/main.rs
-+++ b/src/main.rs
-@@ -175,20 +175,20 @@ fn main() {
- 
-         if args.fahrenheit {
-             tooltip += &format!(
--                "⬆️ {}° ⬇️ {}° ",
-+                "<span font=\"Symbols Nerd Font Mono\">󰸃</span> {}° <span font=\"Symbols Nerd Font Mono\">󰸂</span> {}° ",
-                 day["maxtempF"].as_str().unwrap(),
-                 day["mintempF"].as_str().unwrap(),
-             );
-         } else {
-             tooltip += &format!(
--                "⬆️ {}° ⬇️ {}° ",
-+                "<span font=\"Symbols Nerd Font Mono\">󰸃</span> {}° <span font=\"Symbols Nerd Font Mono\">󰸂</span> {}° ",
-                 day["maxtempC"].as_str().unwrap(),
-                 day["mintempC"].as_str().unwrap(),
-             );
-         };
- 
-         tooltip += &format!(
--            "🌅 {} 🌇 {}\n",
-+            "<span font=\"Symbols Nerd Font Mono\"></span> {} <span font=\"Symbols Nerd Font Mono\"></span> {}\n",
-             format_ampm_time(day, "sunrise", args.ampm),
-             format_ampm_time(day, "sunset", args.ampm),
-         );
-@@ -207,7 +207,7 @@ fn main() {
-             }
- 
-             let mut tooltip_line = format!(
--                "{} {} {} {}",
-+                "{} {}{} {}",
-                 format_time(hour["time"].as_str().unwrap(), args.ampm),
-                 WEATHER_CODES
-                     .iter()
diff --git a/overlays/yt-dlp.nix b/overlays/yt-dlp.nix
index 94ab1fdd..9a54a32b 100644
--- a/overlays/yt-dlp.nix
+++ b/overlays/yt-dlp.nix
@@ -1,5 +1,7 @@
 { prev, sources, ... }: {
   yt-dlp = prev.yt-dlp.overrideAttrs (oldAttrs: {
     inherit (sources.yt-dlp) pname version src;
+
+    postPatch = "";
   });
 }
diff --git a/overlays/zte-prometheus-exporter/default.nix b/overlays/zte-prometheus-exporter/default.nix
index 2188e7b3..cd4207cd 100644
--- a/overlays/zte-prometheus-exporter/default.nix
+++ b/overlays/zte-prometheus-exporter/default.nix
@@ -2,17 +2,16 @@
 let
   packageOverrides = final.callPackage ./python-packages.nix {};
   inpPython = final.python310.override { inherit packageOverrides; };
+  python = inpPython.withPackages (ps: with ps; [pytimeparse requests]);
 in {
   zte-prometheus-exporter = prev.stdenv.mkDerivation rec {
     name = "zte-prometheus-exporter";
-    src = ./zte-prometheus-exporter.py;
+    src = prev.replaceVars ./zte-prometheus-exporter.py { inherit python; };
 
-    phases = [ "buildPhase" "checkPhase" "installPhase" ];
+    phases = [ "unpackPhase" "checkPhase" "installPhase" ];
 
-    python = inpPython.withPackages (ps: with ps; [pytimeparse requests]);
-
-    buildPhase = ''
-      substituteAll $src zte-prometheus-exporter
+    unpackPhase = ''
+      cp $src zte-prometheus-exporter
     '';
 
     doCheck = true;
diff --git a/shell.nix b/shell.nix
index 5bcb8180..1b334187 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,19 +1,29 @@
-inputs@{ system, self, deploy-rs, nvfetcher, nixpkgs, ca-util, ... }:
+inputs@{ system, self, nvfetcher, nixpkgs, ca-util, ... }:
 let
   pkgs = self.legacyPackages.${system};
   utils = import ./utils { inherit (nixpkgs) lib; };
   inherit (utils) nixImport;
+  uv-links = pkgs.symlinkJoin {
+    name = "uv-links";
+    paths = [
+      pkgs.python312.pkgs.pygobject3
+    ];
+  };
 in pkgs.mkShell {
   nativeBuildInputs = builtins.attrValues self.packages.${system} ++ (with pkgs; [
     sops
     wireguard-tools
     gup
     nftables
-    deploy-rs.packages.${system}.deploy-rs
+    deploy-rs.deploy-rs
     knot-dns
     yq
     nvfetcher.packages.${system}.default
     ca-util.packages.${system}.ca
-    poetry
+    poetry uv
+    ninja pkg-config cairo.dev systemd.dev
   ]);
+  shellHook = ''
+    export UV_FIND_LINKS=${uv-links}/lib/python3.12/site-packages
+  '';
 }
diff --git a/system-profiles/bcachefs.nix b/system-profiles/bcachefs.nix
index f9f048b9..be12bf20 100644
--- a/system-profiles/bcachefs.nix
+++ b/system-profiles/bcachefs.nix
@@ -1,6 +1,16 @@
-{ pkgs, ... } : {
+{ pkgs, lib, ... } : {
   config = {
     boot.supportedFilesystems.bcachefs = true;
     environment.systemPackages = with pkgs; [ bcachefs-tools ];
+
+    boot.kernelPatches = [
+      {
+        name = "bcachefs-casefold-fix";
+        patch = null;
+        structuredExtraConfig = with lib.kernel; {
+          UNICODE = lib.mkOverride 90 no;
+        };
+      }
+    ];
   };
 }
diff --git a/system-profiles/core/default.nix b/system-profiles/core/default.nix
index 71d0619a..e5f9dc16 100644
--- a/system-profiles/core/default.nix
+++ b/system-profiles/core/default.nix
@@ -127,36 +127,16 @@ in {
 
           flake-registry = "${flakeInputs.flake-registry}/flake-registry.json";
         };
-        nixPath = [
-          "nixpkgs=${pkgs.runCommand "nixpkgs" {} ''
-            mkdir $out
-            ln -s ${./nixpkgs.nix} $out/default.nix
-            ln -s /run/nixpkgs/lib $out/lib
-          ''}"
-        ];
+        nixPath = map (flake: "${flake}=flake:${flake}") (attrNames config.nix.registry);
         registry =
           let override = { self = "nixos"; };
           in mapAttrs' (inpName: inpFlake: nameValuePair
             (override.${inpName} or inpName)
-            { flake = inpFlake; } ) flakeInputs;
+            { to = { type = "path"; path = inpFlake; }; } ) flakeInputs;
       };
 
       systemd.tmpfiles.rules = [
         "L+ /run/nixpkgs - - - - ${flakeInputs.${config.nixpkgs.flakeInput}.outPath}"
-        "L+ /run/nixpkgs-overlays.nix - - - - ${pkgs.writeText "overlays.nix" ''
-          with builtins;
-
-          attrValues (import
-            (
-              let lock = fromJSON (readFile ${flake + "/flake.lock"}); in
-              fetchTarball {
-                url = "https://github.com/edolstra/flake-compat/archive/''${lock.nodes.flake-compat.locked.rev}.tar.gz";
-                sha256 = lock.nodes.flake-compat.locked.narHash;
-              }
-            )
-            { src = ${flake}; }
-          ).defaultNix.overlays
-        ''}"
         "L+ /etc/nixos - - - - ${flake}"
       ] ++ map (input: "L+ /run/flake-inputs/${input} - - - - ${flakeInputs.${input}.outPath}") (attrNames flakeInputs);
 
@@ -177,11 +157,9 @@ in {
           {
             manual.manpages.enable = true;
             systemd.user.startServices = "sd-switch";
-
-            programs.ssh.internallyManaged = mkForce true;
           }
         ];
-        extraSpecialArgs = { inherit flake flakeInputs path; };
+        extraSpecialArgs = { inherit flake flakeInputs path; hostConfig = config; };
       };
 
       sops = mkIf hasSops {
@@ -202,17 +180,22 @@ in {
       };
       environment.systemPackages = with pkgs; [ git-annex scutiger ];
     }
-  ] ++ (optional (options ? system.switch.enableNg) {
-    system.switch = lib.mkDefault {
-      enable = false;
-      enableNg = true;
+  ] ++ (optional (options ? system.rebuild.enableNg) {
+    system.rebuild.enableNg = lib.mkDefault true;
+  })
+  ++ (optional (options ? services.userborn) {
+    services.userborn = {
+      enable = lib.mkDefault true;
+      passwordFilesLocation = lib.mkDefault "/var/lib/nixos";
     };
   })
+  ++ (optional (!(options ? services.userborn) && (options ? system.etc)) {
+    systemd.sysusers.enable = lib.mkDefault true;
+  })
   ++ (optional (options ? system.etc) {
     boot.initrd.systemd.enable = lib.mkDefault true;
     system.etc.overlay.enable = lib.mkDefault true;
     system.etc.overlay.mutable = lib.mkDefault (!config.systemd.sysusers.enable);
-    systemd.sysusers.enable = lib.mkDefault true;
 
     # Random perl remnants
     system.disableInstallerTools = lib.mkDefault true;
diff --git a/system-profiles/default-locale.nix b/system-profiles/default-locale.nix
index 2d483f04..60d338cb 100644
--- a/system-profiles/default-locale.nix
+++ b/system-profiles/default-locale.nix
@@ -1,16 +1,23 @@
-{ lib, ... }:
+{ lib, options, ... }:
 
 with lib;
 
 {
-  i18n = {
-    defaultLocale = "en_DK.UTF-8";
-    extraLocaleSettings = {
-      "TIME_STYLE" = "long-iso";
-    };
-    supportedLocales = [ "C.UTF-8/UTF-8" "en_US.UTF-8/UTF-8" "en_DK.UTF-8/UTF-8" ];
-  };
-  console.keyMap = mkDefault "dvorak-programmer";
+  config = foldr recursiveUpdate {} ([
+    {
+      i18n = {
+        defaultLocale = "en_DK.UTF-8";
+        extraLocaleSettings = {
+          "TIME_STYLE" = "long-iso";
+        };
+      };
+      console.keyMap = mkDefault "dvorak-programmer";
 
-  time.timeZone = mkDefault "Europe/Berlin";
+      time.timeZone = mkDefault "Europe/Berlin";
+    }
+  ] ++ (optional (options ? i18n.extraLocales) {
+    i18n.extraLocales = [ "C.UTF-8" "en_US.UTF-8" "en_DK.UTF-8" ];
+  }) ++ (optional (!(options ? i18n.extraLocales)) {
+    i18n.supportedLocales = [ "C.UTF-8/UTF-8" "en_US.UTF-8/UTF-8" "en_DK.UTF-8/UTF-8" ];
+  }));
 }
diff --git a/system-profiles/initrd-all-crypto-modules.nix b/system-profiles/initrd-all-crypto-modules.nix
index 45cd4b74..da6c781e 100644
--- a/system-profiles/initrd-all-crypto-modules.nix
+++ b/system-profiles/initrd-all-crypto-modules.nix
@@ -18,7 +18,7 @@ in {
     {
       name = "encrypted_key";
       patch = null;
-      extraStructuredConfig.ENCRYPTED_KEYS = lib.kernel.yes;
+      structuredExtraConfig.ENCRYPTED_KEYS = lib.kernel.yes;
     }
   ];
 }
diff --git a/system-profiles/lanzaboote.nix b/system-profiles/lanzaboote.nix
new file mode 100644
index 00000000..f1e179cf
--- /dev/null
+++ b/system-profiles/lanzaboote.nix
@@ -0,0 +1,14 @@
+{ flakeInputs, pkgs, ... }:
+{
+  imports = [
+    flakeInputs.lanzaboote.nixosModules.lanzaboote
+  ];
+
+  config = {
+    environment.systemPackages = [ pkgs.sbctl ];
+    boot.lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+    };
+  };
+}
diff --git a/system-profiles/nfsroot.nix b/system-profiles/nfsroot.nix
index 1cd930d9..e3dc2d2e 100644
--- a/system-profiles/nfsroot.nix
+++ b/system-profiles/nfsroot.nix
@@ -1,4 +1,4 @@
-{ config, options, pkgs, lib, flake, flakeInputs, ... }:
+{ config, options, pkgs, lib, flake, ... }:
 
 with lib;
 
@@ -48,7 +48,7 @@ in {
       fileSystems."/nix/.ro-store" = mkImageMediaOverride
         { fsType = "nfs4";
           device = cfg.storeDevice;
-          options = [ "ro" ];
+          options = [ "ro" "nfsvers=4.2" ];
           neededForBoot = true;
         };
 
@@ -86,7 +86,7 @@ in {
         mkdir -p /mnt-root/etc/
         cp /etc/resolv.conf /mnt-root/etc/resolv.conf
       '';
-      networking.useDHCP = true;
+      networking.useDHCP = mkImageMediaOverride true;
       networking.resolvconf.enable = false;
       networking.dhcpcd.persistent = true;
 
diff --git a/system-profiles/niri-flake.nix b/system-profiles/niri-flake.nix
new file mode 100644
index 00000000..b28d51ff
--- /dev/null
+++ b/system-profiles/niri-flake.nix
@@ -0,0 +1,4 @@
+{ ... }:
+{
+  config.niri-flake.cache.enable = false;
+}
diff --git a/system-profiles/niri-unstable.nix b/system-profiles/niri-unstable.nix
new file mode 100644
index 00000000..3a8b393d
--- /dev/null
+++ b/system-profiles/niri-unstable.nix
@@ -0,0 +1,11 @@
+{ config, pkgs, lib, ... }:
+{
+  config = {
+    programs.niri.package = lib.mkDefault pkgs.niri-unstable;
+    home-manager.sharedModules = [
+      {
+        programs.niri.package = lib.mkDefault config.programs.niri.package;
+      }
+    ];
+  };
+}
diff --git a/system-profiles/rebuild-machines/default.nix b/system-profiles/rebuild-machines/default.nix
index 544f47e1..de86cd74 100644
--- a/system-profiles/rebuild-machines/default.nix
+++ b/system-profiles/rebuild-machines/default.nix
@@ -25,16 +25,18 @@ let
 
     phases = [ "buildPhase" "installPhase" ];
 
-    inherit (pkgs) zsh coreutils openssh;
-    inherit (cfg) scriptName;
-    inherit (cfg.flake) flakeOutput;
-    flake = cfg.flake.name;
-    nixosRebuild = config.system.build.nixos-rebuild;
-    inherit (config.security) wrapperDir;
-    inherit sshConfig;
-
     buildPhase = ''
-      substituteAll $src rebuild-machine.zsh
+      substitute $src rebuild-machine.zsh \
+        --subst-var-by zsh ${pkgs.zsh} \
+        --subst-var-by coreutils ${pkgs.coreutils} \
+        --subst-var-by openssh ${pkgs.openssh} \
+        --subst-var-by wrapperDir ${config.security.wrapperDir} \
+        --subst-var-by sshConfig ${sshConfig} \
+        --subst-var-by out "$out" \
+        --subst-var-by nixosRebuild ${config.system.build.nixos-rebuild} \
+        --subst-var-by flake ${cfg.flake.name} \
+        --subst-var-by scriptName ${cfg.scriptName} \
+        --subst-var-by flakeOutput ${cfg.flake.flakeOutput}
     '';
 
     installPhase = ''
diff --git a/system-profiles/zfs.nix b/system-profiles/zfs.nix
index 149decee..af9f1c17 100644
--- a/system-profiles/zfs.nix
+++ b/system-profiles/zfs.nix
@@ -1,8 +1,8 @@
-{ pkgs, lib, ... } : {
+{ config, pkgs, lib, ... } : {
   config = {
     boot = {
-      kernelPackages = pkgs.linuxPackages_6_11;
-      zfs.package = pkgs.zfs_unstable;
+      kernelPackages = pkgs.linuxPackages_6_12;
+      zfs.package = pkgs.zfs_2_3;
 
       supportedFilesystems.zfs = true;
     };
diff --git a/user-profiles/core.nix b/user-profiles/core.nix
index a8af48b3..57fb7628 100644
--- a/user-profiles/core.nix
+++ b/user-profiles/core.nix
@@ -5,7 +5,11 @@ with lib;
 {
   config = {
     users.users.${userName} = {}; # Just make sure the user is created
-    home-manager.users.${userName} = {};
+    home-manager.users.${userName} = let sysConfig = config; in { config, ... }: {
+      config.nix.settings = {
+        inherit (sysConfig.nix.settings) use-xdg-base-directories;
+      };
+    };
 
     systemd.services."home-manager-${utils.escapeSystemdPath userName}" = lib.mkIf (!config.home-manager.enableSystemd) {
       restartIfChanged = false; # only run once on startup, deploy to running system with deploy-rs
diff --git a/user-profiles/feeds/alot.config b/user-profiles/feeds/alot.config
deleted file mode 100644
index a14d4539..00000000
--- a/user-profiles/feeds/alot.config
+++ /dev/null
@@ -1,50 +0,0 @@
-attachment_prefix="~/Downloads"
-bug_on_exit=true
-editor_cmd="false"
-tabwidth=2
-timestamp_format="%a %d %b %H:%M:%S %Y UTC%z"
-auto_remove_unread=True
-#initial_command="search ( tag:inbox ) AND NOT ( tag:killed )"
-initial_command="search ( tag:inbox ) AND NOT ( is:link OR is:media OR is:killed )"
-
-[accounts]
-  [[private]]
-    realname = @realname@
-    address = @address@
-
-[bindings]
-j = 
-k =
-'g g' =
-G =
-I = search ( tag:inbox ) AND NOT ( is:killed )
-U = search ( tag:inbox ) AND NOT ( is:link OR is:media OR is:killed )
-V = search ( tag:inbox AND is:media OR ( is:live AND date:12h.. AND NOT is:unread ) ) AND NOT ( is:killed )
-W = search ( is:media ) AND NOT ( tag:inbox OR is:killed OR is:highlight )
-L = search ( tag:inbox AND is:link ) AND NOT ( is:killed )
-
-h = move first
-t = move up
-n = move down
-s = move last
-        [[search]]
-                a =
-                s = 
- 
-                u = toggletags unread
-                i = toggletags inbox
-                j = untag unread,inbox
-                r = toggletags later
-        [[thread]]
-    s =
-                S =
-                n =
-                'g j' =
-    'g k' =
-    'g l' =
-                w = save
-                W = save --all
-    'g h' = move parent
-                'g t' = move next sibling
-    'g n' = move previous sibling
-    'g s' = move first reply
\ No newline at end of file
diff --git a/user-profiles/feeds/default.nix b/user-profiles/feeds/default.nix
deleted file mode 100644
index 82be90c7..00000000
--- a/user-profiles/feeds/default.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{ config, flakeInputs, pkgs, lib, userName, customUtils, ... }:
-{
-  home-manager.users.${userName} = {...}: {
-    imports = [
-      (customUtils.overrideModuleArgs
-        (import ./module.nix)
-        (inputs: inputs // { inherit flakeInputs; inherit (config.nixpkgs) system; })
-      )
-    ];
-  };
-}
diff --git a/user-profiles/feeds/imm-notmuch-insert.py b/user-profiles/feeds/imm-notmuch-insert.py
deleted file mode 100644
index b7eed292..00000000
--- a/user-profiles/feeds/imm-notmuch-insert.py
+++ /dev/null
@@ -1,52 +0,0 @@
-#!@python@/bin/python
-
-import json
-import sys
-import subprocess
-from io import BytesIO
-from email.message import EmailMessage
-import configparser
-from os import environ
-from datetime import *
-from dateutil.tz import *
-from dateutil.parser import isoparse
-from html2text import html2text
-
-def main():
-    notmuchConfig = configparser.ConfigParser()
-    notmuchConfig.read(environ.get('NOTMUCH_CONFIG'))
-
-    callbackMessage = json.load(sys.stdin)
-
-    msg = EmailMessage()
-    authors = ', '.join(map(lambda author: author['name'], callbackMessage['feed_item']['authors']))
-    if authors:
-        msg['From'] = f"{callbackMessage['feed_definition']['title']} ({authors}) <imm@imm.invalid>"
-    else:
-        msg['From'] = f"{callbackMessage['feed_definition']['title']} <imm@imm.invalid>"
-    msg['To'] = f"{notmuchConfig['user']['name']} <{notmuchConfig['user']['primary_email']}>"
-    if 'title' in callbackMessage['feed_item'] and callbackMessage['feed_item']['title']:
-        msg['Subject'] = callbackMessage['feed_item']['title']
-    msg['Item-Identifier'] = f"{callbackMessage['feed_item']['identifier']}"
-    for link in callbackMessage['feed_item']['links']:
-        msg.add_header('Link', link['uri'])
-    date = None
-    if 'date' in callbackMessage['feed_item']:
-        date = isoparse(callbackMessage['feed_item']['date'])
-    else:
-        date = datetime.now(tzlocal())
-    msg['Date'] = date.strftime('%a, %e %b %Y %T %z')
-
-    if 'content' in callbackMessage['feed_item'] and callbackMessage['feed_item']['content']:
-        msg.set_content(html2text(callbackMessage['feed_item']['content']))
-        msg.add_alternative(callbackMessage['feed_item']['content'], subtype='html')
-
-
-    subprocess.run(
-        args=['notmuch', 'insert'],
-        check=True,
-        input=bytes(msg)
-    )
-
-if __name__ == '__main__':
-    sys.exit(main())
diff --git a/user-profiles/feeds/module.nix b/user-profiles/feeds/module.nix
deleted file mode 100644
index 63e827eb..00000000
--- a/user-profiles/feeds/module.nix
+++ /dev/null
@@ -1,236 +0,0 @@
-{ config, flakeInputs, pkgs, lib, system, ... }:
-
-with lib;
-
-let
-  inherit (flakeInputs.home-manager.lib) hm;
-
-  databasePath = "${config.xdg.dataHome}/feeds";
-
-  imm =
-    let
-      hlib = pkgs.haskell.lib;
-      haskellPackages = pkgs.haskellPackages.override {
-        overrides = finalHaskell: prevHaskell: {
-          uri-bytestring = finalHaskell.callCabal2nix "uri-bytestring" (pkgs.fetchFromGitHub {
-            owner = "gkleen";
-            repo = "uri-bytestring";
-            rev = "5f7f32c8274bc4d1b81d99582f5148fe3e8b637e";
-            sha256 = "XLanwyCDIlMuOkpE5LbTNOBfL+1kZX+URfj9Bhs1Nsc=";
-            fetchSubmodules = true;
-          }) {};
-          atom-conduit = finalHaskell.callCabal2nix "atom-conduit" (pkgs.fetchFromGitHub {
-            owner = "gkleen";
-            repo = "atom-conduit";
-            rev = "022f0182a02373f87c06a0a09817c8c41efe2425";
-            sha256 = "8yEyh3ymqkoM/YP+eBqPq1I5ofzj0Qn7ojL7IWx1DPo=";
-            fetchSubmodules = true;
-          }) {};
-          rss-conduit = finalHaskell.callCabal2nix "rss-condit" (pkgs.fetchFromGitHub {
-            owner = "gkleen";
-            repo = "rss-conduit";
-            rev = "dbb0960a8d3dc519f1607aa0223b3a25a49282ef";
-            sha256 = "Md1XApZWkdv4JvNoaVnjz0S85LbEC6w9U3PUcwXfu94=";
-            fetchSubmodules = true;
-          }) {};
-          beam-core = hlib.doJailbreak (finalHaskell.callCabal2nix "beam-core" "${beamSrc}/beam-core" {});
-          beam-migrate = hlib.doJailbreak (finalHaskell.callCabal2nix "beam-migrate" "${beamSrc}/beam-migrate" {});
-          beam-sqlite = hlib.doJailbreak (finalHaskell.callCabal2nix "beam-sqlite" "${beamSrc}/beam-sqlite" {});
-
-          imm = finalHaskell.callCabal2nix "imm" (pkgs.fetchFromGitHub {
-            owner = "k0ral";
-            repo = "imm";
-            rev = "5033879667264cb44cee65671a66f6aa43f249e7";
-            sha256 = "PG22caLQmAGhLZP49HsazuNd8IFKKaTuhXIQBD8v4Fs=";
-            fetchSubmodules = true;
-          }) {};
-        };
-      };
-      beamSrc = pkgs.fetchFromGitHub {
-        owner = "haskell-beam";
-        repo = "beam";
-        rev = "efd464b079755a781c2bb7a2fc030d6c141bbb8a";
-        sha256 = "8nTuBP/vD0L/qMo4h3XNrGZvpIwXuMVdj40j5gvHU6w=";
-        fetchSubmodules = true;
-      };
-    in haskellPackages.imm;
-   immWrapped = pkgs.runCommand "${imm.name}-wrapped-${config.home.username}"
-    { nativeBuildInputs = with pkgs; [ makeWrapper ];
-    } ''
-      mkdir -p $out/bin
-      makeWrapper ${imm}/bin/imm $out/bin/imm \
-        --add-flags --callbacks=${notmuchCallbacks}
-    '';
-
-  notmuchCallbacks = pkgs.writeText "imm-callbacks-${config.home.username}.dhall" ''
-    [ { _executable = "${immNotmuchInsert}/bin/imm-notmuch-insert"
-      , _arguments = [] : List Text
-      }
-    ]
-  '';
-
-  immNotmuchInsert = pkgs.stdenv.mkDerivation rec {
-    name = "imm-notmuch-insert-${config.home.username}";
-    src = ./imm-notmuch-insert.py;
-
-    phases = [ "buildPhase" "checkPhase" "installPhase" "fixupPhase" ];
-
-    python = pkgs.python39.withPackages (ps: with ps; [ configparser python-dateutil html2text ]);
-
-    nativeBuildInputs = with pkgs; [ makeWrapper ];
-
-    buildPhase = ''
-      substituteAll $src imm-notmuch-insert
-    '';
-
-    doCheck = true;
-    checkPhase = ''
-      ${python}/bin/python -m py_compile imm-notmuch-insert
-    '';
-
-    installPhase = ''
-      install -m 0755 -D -t $out/bin \
-        imm-notmuch-insert
-    '';
-
-    fixupPhase = ''
-      wrapProgram $out/bin/imm-notmuch-insert \
-        --prefix PATH : ${pkgs.notmuch}/bin \
-        --set NOTMUCH_CONFIG ${configPath}
-    '';
-  };
-
-  mkIniKeyValue = key: value:
-    let
-      tweakVal = v:
-        if isString v then
-          v
-        else if isList v then
-          concatMapStringsSep ";" tweakVal v
-        else if isBool v then
-          (if v then "true" else "false")
-        else
-          toString v;
-    in "${key}=${tweakVal value}";
-
-  notmuchIni = {
-    database = { path = databasePath; };
-
-    maildir = { synchronize_flags = false; };
-
-    new = {
-      ignore = [];
-      tags = ["new"];
-    };
-
-    user = {
-      name = config.home.username;
-      primary_email = "${config.home.username}@imm.invalid";
-    };
-
-    search = { exclude_tags = ["deleted"]; };
-  };
-  configPath = pkgs.writeText "notmuchrc" (generators.toINI { mkKeyValue = mkIniKeyValue; } notmuchIni);
-
-  afewConfigDir = pkgs.symlinkJoin {
-    name = "afew-config";
-    paths = [
-      (pkgs.writeTextDir "config" ''
-         [InboxFilter]
-      '')
-    ];
-  };
-
-  notmuchHooksDir =
-    let
-      afewHook = pkgs.writeShellScript "afew" ''
-        exec -- ${pkgs.afew}/bin/afew -c ${afewConfigDir} -C ${configPath} --tag --new -vv
-      '';
-    in pkgs.linkFarm "notmuch-hooks" [
-      { name = "post-new";
-        path = afewHook;
-      }
-      { name = "post-insert";
-        path = afewHook;
-      }
-    ];
-
-  notmuchWrapped = pkgs.runCommand "${pkgs.notmuch.name}-wrapped-${config.home.username}"
-    { nativeBuildInputs = with pkgs; [ makeWrapper ];
-    } ''
-      mkdir -p $out/bin
-      makeWrapper ${pkgs.notmuch}/bin/notmuch $out/bin/notmuch-feeds \
-        --set NOTMUCH_CONFIG ${configPath}
-    '';
-  alotWrapped = pkgs.runCommand "${pkgs.alot.name}-wrapped-${config.home.username}"
-    { nativeBuildInputs = with pkgs; [ makeWrapper gnused ];
-    } ''
-      mkdir -p $out/bin
-      makeWrapper ${pkgs.alot}/bin/alot $out/bin/alot-feeds \
-        --prefix MAILCAPS : ${alotMailcaps} \
-        --add-flags --config=${alotConfig} \
-        --add-flags --notmuch-config=${configPath}
-
-      mkdir $out/share
-      ln -s ${pkgs.alot}/share/alot $out/share
-      mkdir -p $out/share/applications
-      sed -r 's/alot/alot-feeds/g' ${pkgs.alot}/share/applications/alot.desktop > $out/share/applications/alot-feeds.desktop
-      mkdir -p $out/share/zsh/site-functions
-      sed -r 's/alot/alot-feeds/g' ${pkgs.alot}/share/zsh/site-functions/_alot > $out/share/zsh/site-functions/_alot-feeds
-    '';
-
-  alotConfig = pkgs.runCommand "alot" {
-    realname = notmuchIni.user.name;
-    address = notmuchIni.user.primary_email;
-  } "substituteAll ${./alot.config} $out";
-  alotMailcaps = pkgs.writeText "mailcaps" ''
-    text/html; ${pkgs.lynx}/bin/lynx -dump -dont_wrap_pre -assume_charset=utf-8 -display_charset=utf-8 "%s"; nametemplate=%s.html; copiousoutput
-  '';
-in {
-  config = {
-    home.packages = [ immWrapped notmuchWrapped pkgs.notmuch.man alotWrapped ];
-
-    home.activation.createImm = hm.dag.entryAfter ["writeBoundary"] ''
-      $DRY_RUN_CMD mkdir -p $VERBOSE_ARG ${config.xdg.configHome}/imm
-    '';
-    
-    home.activation.createFeedsDatabase = hm.dag.entryAfter ["linkGeneration" "writeBoundary"] ''
-      $DRY_RUN_CMD mkdir -p -m 0750 $VERBOSE_ARG ${databasePath}
-      $DRY_RUN_CMD mkdir -p $VERBOSE_ARG ${databasePath}/new ${databasePath}/cur ${databasePath}/tmp
-      if ! [[ -d ${databasePath}/.notmuch ]]; then
-          NOTMUCH_VERBOSE_ARG="--quiet"
-          if [[ -v VERBOSE ]]; then
-            NOTMUCH_VERBOSE_ARG="--verbose"
-          fi
-          NOTMUCH_CONFIG=${configPath} $DRY_RUN_CMD ${pkgs.notmuch}/bin/notmuch new $NOTMUCH_VERBOSE_ARG
-      fi
-      $DRY_RUN_CMD ln -Tsf $VERBOSE_ARG ${notmuchHooksDir} ${databasePath}/.notmuch/hooks
-    '';
-
-    systemd.user.services."logrotate-imm" = {
-      Unit = {
-        Description = "Rotate imm logfile";
-      };
-      Service = {
-        Type = "oneshot";
-        ExecStart = ''
-          ${pkgs.logrotate}/bin/logrotate --state ${config.xdg.configHome}/imm/imm.logrotate ${pkgs.writeText "logrotate.conf" ''
-            ${config.xdg.configHome}/imm/imm.log {
-                rotate 5
-                size 1024k
-            }
-          ''}
-        '';
-      };
-    };
-    systemd.user.timers."logrotate-imm" = {
-      Timer = {
-        OnActiveSec = "6h";
-        OnUnitActiveSec = "6h";
-      };
-      Install = {
-        WantedBy = ["default.target"];
-      };
-    };
-  };
-}
diff --git a/user-profiles/mpv/default.nix b/user-profiles/mpv/default.nix
index 2df87994..94f241c8 100644
--- a/user-profiles/mpv/default.nix
+++ b/user-profiles/mpv/default.nix
@@ -1,6 +1,6 @@
-{ config, lib, userName, pkgs, sources, ... }:
+{ lib, userName, pkgs, sources, ... }:
 {
-  home-manager.users.${userName} = {
+  home-manager.users.${userName} = { config, ... }: {
     programs.mpv = {
       enable = true;
       package = pkgs.symlinkJoin {
@@ -10,7 +10,7 @@
             (pkgs.stdenv.mkDerivation (sources.mpv-reload // rec {
               installPhase = ''
                 install -d $out/share/mpv/scripts
-                install -m 0644 reload.lua $out/share/mpv/scripts/${passthru.scriptName}
+                install -m 0644 main.lua $out/share/mpv/scripts/${passthru.scriptName}
               '';
 
               passthru.scriptName = "reload.lua";
@@ -105,6 +105,7 @@
       };
       config = {
         ytdl = true;
+        ytdl-raw-options = "sub-langs=\"${config.programs.yt-dlp.settings.sub-langs}\"";
         subs-with-matching-audio = false;
         audio-display = false;
         osd-font = "Fira Sans";
diff --git a/user-profiles/tmux/default.nix b/user-profiles/tmux/default.nix
index 11c53788..7ea0c0d5 100644
--- a/user-profiles/tmux/default.nix
+++ b/user-profiles/tmux/default.nix
@@ -1,10 +1,11 @@
 { userName, pkgs, lib, ... }:
 {
-  home-manager.users.${userName} = {
+  home-manager.users.${userName} = { config, ... }: {
     programs.tmux = {
       enable = true;
       clock24 = true;
       historyLimit = 50000;
+      mouse = true;
       extraConfig = lib.readFile (pkgs.stdenv.mkDerivation {
         name = "tmux.conf";
         src = ./tmux.conf;
@@ -13,11 +14,10 @@
 
         phases = [ "installPhase" ];
 
-        inherit (pkgs) zsh;
-        mandb = pkgs.man-db;
-        
         installPhase = ''
-          substituteAll $src $out
+          substitute $src $out \
+            --subst-var-by zsh ${lib.getExe config.programs.zsh.package} \
+            --subst-var-by man ${lib.getExe config.programs.man.package}
         '';
       });
     };
diff --git a/user-profiles/tmux/tmux.conf b/user-profiles/tmux/tmux.conf
index 415d13e7..9e658800 100644
--- a/user-profiles/tmux/tmux.conf
+++ b/user-profiles/tmux/tmux.conf
@@ -1,23 +1,20 @@
-set-option -g history-limit 50000
 set-option -g status-bg black
 set-option -g status-fg white
 set-option -g clock-mode-colour white
-set-option -g clock-mode-style 24
 set-option -g bell-action any
-set-option -g default-shell @zsh@/bin/zsh
+set-option -g default-shell @zsh@
 set-option -g update-environment 'DISPLAY SSH_ASKPASS SSH_AUTH_SOCK SSH_AGENT_PID SSH_CONNECTION WINDOWID XAUTHORITY PROMPT_INFO PATH PGHOST PGLOG'
-set-option -g mouse on
 set-option -g set-clipboard on
 set-option -g terminal-overrides 'rxvt-uni*:XT:Ms=\E]52;%p1%s;%p2%s\007'
 
 set-environment -g LESS " -R "
 
 ## determine if we should enable 256-colour support
-if "[[ ''${TERM} =~ 256color || ''${TERM} == fbterm || ''${TERM} =~ alacritty ]]" 'set -g default-terminal tmux-256color'
+if "[[ ''${TERM} =~ 256color || ''${TERM} == fbterm || ''${TERM} =~ alacritty || ''${TERM} =~ kitty ]]" 'set -g default-terminal tmux-256color'
 
 set-option -g status-right ""
 
-bind / command-prompt "split-window -h 'exec @mandb@/bin/man %%'"
+bind / command-prompt "split-window -h 'exec @man@ %%'"
 bind C clock-mode
 bind r switch-client -r
 
diff --git a/user-profiles/utils.nix b/user-profiles/utils.nix
index 13eb6033..edf6da11 100644
--- a/user-profiles/utils.nix
+++ b/user-profiles/utils.nix
@@ -1,19 +1,6 @@
 { userName, lib, pkgs, config, ... }:
 let
   cfg = config.home-manager.users.${userName};
-
-  wrappedLess = pkgs.less.overrideAttrs (oldAttrs: {
-    pname = "${oldAttrs.pname or "less"}-wrapper";
-
-    nativeBuildInputs = (oldAttrs.nativeBuildInputs or []) ++ (with pkgs; [makeWrapper]);
-
-    postInstall = ''
-      ${oldAttrs.postInstall or ""}
-
-      wrapProgram $out/bin/less \
-        --prefix PATH : ${lib.makeBinPath (with pkgs; [binutils])}
-    '';
-  });
 in {
   home-manager.users.${userName} = {
     programs = {
@@ -55,19 +42,25 @@ in {
       };
 
       jq.enable = true;
+
+      lesspipe.enable = true;
+
+      man.enable = true;
+
+      vim.enable = true;
     };
 
     home.sessionVariables = {
-      LESSCOLORIZER = "pygmentize -O style=rrt";
+      LESSCOLORIZER = "${lib.getExe' pkgs.python3Packages.pygments "pygmentize"} -O style=rrt";
     };
 
     home.packages = with pkgs; [
       autossh usbutils pciutils eza silver-searcher pwgen xkcdpass
-      unzip magic-wormhole qrencode tty-clock dnsutils openssl sshfs
+      unzip magic-wormhole dnsutils openssl sshfs
       psmisc mosh tree vnstat file pv bc zip nmap aspell
       aspellDicts.de aspellDicts.en borgbackup man-pages rsync socat
       inetutils yq cached-nix-shell persistent-nix-shell rage
-      smartmontools hdparm nix-output-monitor wrappedLess dscp
+      smartmontools hdparm nix-output-monitor less dscp
       iputils
     ];
   };
diff --git a/user-profiles/yt-dlp.nix b/user-profiles/yt-dlp.nix
index 0f0b2204..5c9858a6 100644
--- a/user-profiles/yt-dlp.nix
+++ b/user-profiles/yt-dlp.nix
@@ -13,11 +13,12 @@
           "best"
         ];
         embed-subs = true;
+        embed-thumbnail = true;
+        embed-metadata = true;
         # write-subs = true;
-        # write-auto-subs = true;
+        write-auto-subs = true;
         sub-langs = "en(-(gb|us|orig))?,de(-(de|orig))?,-live_chat,-rechat";
         prefer-free-formats = true;
-        embed-metadata = true;
         # downloader = "${pkgs.axel}/bin/axel";
         concurrent-fragments = 12;
         buffer-size = "16K";
@@ -28,7 +29,8 @@
         #   "youtube:formats=dashy"
         # ];
         remux-video = "mp4>mkv";
-        output = "\"%(title)s [%(uploader)s %(webpage_url)s].%(ext)s\"";
+        output = lib.mkDefault "\"%(modified_date>%Y%m%d,release_date>%Y%m%d,upload_date>%Y%m%d)s %(title)s [%(uploader)s %(webpage_url)s].%(ext)s\"";
+        audio-multistreams = true;
       };
     };
   };
diff --git a/user-profiles/zsh/default.nix b/user-profiles/zsh/default.nix
index daeb7e82..ab523a52 100644
--- a/user-profiles/zsh/default.nix
+++ b/user-profiles/zsh/default.nix
@@ -1,38 +1,72 @@
 { userName, pkgs, customUtils, lib, config, ... }:
-let
-  dotDir = ".config/zsh";
-  p10kZsh = "${dotDir}/.p10k.zsh";
-  cfg = config.home-manager.users.${userName};
-in {
-  home-manager.users.${userName} = {
-    programs.zsh = {
-      inherit dotDir;
-      enable = true;
-      autocd = true;
-      enableCompletion = true;
-      
-      plugins = [
-        { name = "powerlevel10k";
-          file = "share/zsh-powerlevel10k/powerlevel10k.zsh-theme";
-          src = pkgs.zsh-powerlevel10k;
-        }
-      ];
-      initExtraFirst = ''
-        if [[ $TERM == "dumb" ]]; then
-          unsetopt zle
-          PS1='$ '
-          return
-        fi
-      '';
-      initExtraBeforeCompInit = ''
-        source "${cfg.home.homeDirectory}/${p10kZsh}"
-      '';
-      initExtra = lib.mkAfter ''
-        source ${./zshrc}
-        source "${pkgs.zsh-syntax-highlighting}/share/zsh-syntax-highlighting/zsh-syntax-highlighting.zsh"
-      '';
+{
+  config = {
+    home-manager.users.${userName} = let sysConfig = config; in { config, ... }: {
+      config = {
+        programs.zsh = {
+          dotDir = ".config/zsh";
+          enable = true;
+          autocd = true;
+          enableCompletion = true;
+          enableVteIntegration = true;
+          history = {
+            append = true;
+            expireDuplicatesFirst = true;
+            extended = true;
+            findNoDups = true;
+          };
+          syntaxHighlighting.enable = true;
+          zsh-abbr = {
+            enable = true;
+            abbreviations = {
+              re = "systemctl restart";
+              ure = "systemctl --user restart";
+              st = "systemctl status";
+              ust = "systemctl --user status";
+            };
+            globalAbbreviations = {
+              "L" = "| less";
+              "S" = "&> /dev/null";
+              "G" = "| grep";
+              "B" = "&> /dev/null &";
+              "BB" = "&> /dev/null &!";
+              "J" = lib.mkIf config.programs.jq.enable "| jq '.'";
+            };
+          };
+
+          plugins = [
+            { name = "powerlevel10k";
+              file = "share/zsh-powerlevel10k/powerlevel10k.zsh-theme";
+              src = pkgs.zsh-powerlevel10k;
+            }
+          ];
+          initContent = lib.mkMerge [
+            (lib.mkBefore ''
+              if [[ $TERM == "dumb" ]]; then
+                unsetopt zle
+                PS1='$ '
+                return
+              fi
+            '')
+            (lib.mkOrder 550 ''
+              source "$HOME/${config.xdg.configFile."zsh/.p10k.zsh".target}"
+            '')
+            (lib.mkAfter ''
+              source ${./zshrc}
+            '')
+          ];
+        };
+
+        xdg.configFile."zsh/.p10k.zsh".source = ./p10k.zsh;
+      };
     };
 
-    home.file.${p10kZsh}.source = ./p10k.zsh;
+    programs.zsh.enable = true;
+    environment.pathsToLink = [ "/share/zsh" ];
+    environment.shellAliases = lib.mkOverride 90 {};
+
+    nixpkgs.externalConfig.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+      "zsh-abbr"
+    ];
   };
 }
diff --git a/user-profiles/zsh/zshrc b/user-profiles/zsh/zshrc
index a83a8069..af3aca64 100644
--- a/user-profiles/zsh/zshrc
+++ b/user-profiles/zsh/zshrc
@@ -24,7 +24,12 @@ setopt ignore_eof
 bindkey -e
 bindkey ';5C' emacs-forward-word
 bindkey ';5D' emacs-backward-word
+bindkey '^[[1;5C' emacs-forward-word
+bindkey '^[[1;5D' emacs-backward-word
+bindkey '^H' backward-kill-word
 
 autoload -Uz url-quote-magic bracketed-paste-magic
 zle -N self-insert url-quote-magic
-zle -N bracketed-paste bracketed-paste-magic
\ No newline at end of file
+zle -N bracketed-paste bracketed-paste-magic
+
+setopt extended_glob
diff --git a/users/gkleen/default.nix b/users/gkleen/default.nix
index 4ddf4be3..5ce93de7 100644
--- a/users/gkleen/default.nix
+++ b/users/gkleen/default.nix
@@ -1,7 +1,7 @@
 { flake, userName, pkgs, customUtils, lib, ... }:
 {
   imports = with flake.nixosModules.userProfiles.${userName}; [
-    zsh tmux utils direnv
+    utils direnv
   ];
 
   users.users.${userName} = {
@@ -29,9 +29,39 @@
         userName = "Gregor Kleen";
         delta.enable = true;
         extraConfig = {
-          pull.rebase = false;
+          core.excludesfile = toString ./gitignore;
+          pull.rebase = true;
           submodule.recurse = true;
           init.defaultBranch = "main";
+          column.ui = "auto";
+          branch.sort = "-committerdate";
+          tag.sort = "version:refname";
+          diff = {
+            algorithm = "histogram";
+            colorMoved = "plain";
+            mnemonicPrefix = true;
+            renames = true;
+          };
+          push = {
+            default = "simple";
+            autoSetupRemote = true;
+            followTags = true;
+          };
+          fetch = {
+            prune = true;
+            pruneTags = true;
+            all = true;
+          };
+          rerere = {
+            enabled = true;
+            autoupdate = true;
+          };
+          rebase = {
+            autoSquash = true;
+            autoStash = true;
+            updateRefs = true;
+          };
+          merge.conflictstyle = "zdiff3";
         };
       };
 
diff --git a/users/gkleen/gitignore b/users/gkleen/gitignore
new file mode 100644
index 00000000..f7082b20
--- /dev/null
+++ b/users/gkleen/gitignore
@@ -0,0 +1,2 @@
+**/#*#
+**/.#*
diff --git a/users/root.nix b/users/root.nix
index b61f9cfd..ed1acd50 100644
--- a/users/root.nix
+++ b/users/root.nix
@@ -3,7 +3,7 @@ let
   haveGKleen = flake.nixosModules.accounts ? "gkleen@${hostName}";
 in {
   imports = with flake.nixosModules.userProfiles.${userName}; [
-    zsh tmux direnv utils
+    direnv utils
   ];
 
   users.users.${userName} = lib.mkIf haveGKleen {