24 files changed, 1542 insertions, 812 deletions

diff --git a/accounts/gkleen@eostre.nix b/accounts/gkleen@eostre.nix
index 72818d44..28daf3fd 100644
--- a/accounts/gkleen@eostre.nix
+++ b/accounts/gkleen@eostre.nix
@@ -1,16 +1,16 @@
 { flake, userName, pkgs, ... }:
 {
   imports = with flake.nixosModules.userProfiles.${userName}; [
-    zsh utils tmux
+    utils
   ];
 
   config = {
     home-manager.users.${userName} = {
       home.stateVersion = "20.09";
 
-      nixpkgs.config = {
-        allowUnfree = true;
-      };
+      # nixpkgs.config = {
+      #   allowUnfree = true;
+      # };
 
       home.packages = with pkgs; [
         thunderbird libreoffice element-desktop keepassxc vlc
diff --git a/accounts/gkleen@installer.nix b/accounts/gkleen@installer.nix
index c7a418f8..5fe1db38 100644
--- a/accounts/gkleen@installer.nix
+++ b/accounts/gkleen@installer.nix
@@ -1,7 +1,11 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 
 {
-  home-manager.users.${userName} = { config, ... } : {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName} = { config, ... } : {
     home.stateVersion = config.home.version.release;
   };
 }
diff --git a/accounts/gkleen@sif/default.nix b/accounts/gkleen@sif/default.nix
index 58cfb425..64434bb8 100644
--- a/accounts/gkleen@sif/default.nix
+++ b/accounts/gkleen@sif/default.nix
@@ -4,33 +4,6 @@ with lib;
 
 let
   cfg = config.home-manager.users.${userName};
-  emacsScratch = pkgs.stdenv.mkDerivation (sources.emacs-scratch_el // rec {
-    phases = [ "installPhase" ];
-
-    installPhase = ''
-      mkdir -p $out/share/emacs/site-lisp
-      cp $src/scratch.el $out/share/emacs/site-lisp/default.el
-    '';
-  });
-  muteScript = pkgs.stdenv.mkDerivation {
-    name = "mute";
-    src = ./scripts/mute.zsh;
-
-    buildInputs = with pkgs; [ makeWrapper ];
-
-    phases = [ "installPhase" ];
-
-    installPhase = ''
-      mkdir -p $out/bin
-      install -m 0755 $src $out/bin/mute
-      wrapProgram $out/bin/mute \
-        --prefix PATH : ${pkgs.zsh}/bin \
-        --prefix PATH : ${pkgs.findutils}/bin \
-        --prefix PATH : ${pkgs.util-linux}/bin \
-        --prefix PATH : ${pkgs.coreutils}/bin \
-        --prefix PATH : ${pkgs.pulseaudio}/bin
-    '';
-  };
   wrapElectron = { package, bin ? package.meta.mainProgram or package.pname or (pkgs.lib.strings.nameFromURL package.name "-"), outBin ? bin, sandbox ? true }: pkgs.symlinkJoin {
     name = "${package.name}-wrapped";
     buildInputs = with pkgs; [ makeWrapper ];
@@ -47,10 +20,6 @@ let
     '';
   };
 
-  wrappedChrome = wrapElectron { package = pkgs.google-chrome; outBin = "google-chrome"; };
-  wrappedZulip = wrapElectron { package = pkgs.zulip; bin = "zulip"; outBin = "zulip"; };
-  wrappedElementDesktop = wrapElectron { package = pkgs.element-desktop; bin = "element-desktop"; };
-  wrappedRocketChatDesktop = wrapElectron { package = pkgs.rocketchat-desktop; bin = "rocketchat-desktop"; outBin = "rocketchat"; };
   wrappedYTMDesktop = wrapElectron { package = pkgs.ytmdesktop; sandbox = false; };
 
   wrappedKeepassxc = pkgs.symlinkJoin {
@@ -63,7 +32,7 @@ let
         text = ''
           [D-BUS Service]
           Name=org.keepassxc.KeePassXC.MainWindow
-          Exec=${pkgs.coreutils}/bin/false
+          Exec=${lib.getExe' pkgs.coreutils "false"}
           SystemdService=keepassxc.service
         '';
       })
@@ -73,7 +42,7 @@ let
         text = ''
           [D-BUS Service]
           Name=org.freedesktop.secrets
-          Exec=${pkgs.coreutils}/bin/false
+          Exec=${lib.getExe' pkgs.coreutils "false"}
           SystemdService=keepassxc.service
         '';
       })
@@ -81,28 +50,38 @@ let
   };
 
   lockCommand = "${lib.getExe' config.systemd.package "systemctl"} --user start gtklock.service";
+
+  editor = pkgs.symlinkJoin {
+    inherit (cfg.services.emacs.package) name;
+    buildInputs = with pkgs; [ makeWrapper ];
+    paths = [ cfg.services.emacs.package ];
+    postBuild = ''
+      wrapProgram $out/bin/emacsclient \
+        --inherit-argv0 \
+        --add-flags ${lib.escapeShellArg (lib.escapeShellArgs cfg.services.emacs.client.arguments)}
+    '';
+  };
 in {
   imports = with flake.nixosModules.userProfiles.${userName}; [
-    mpv yt-dlp (args: import ./xcompose.nix (inputs // args))
+    zsh tmux mpv yt-dlp (args: import ./xcompose.nix (inputs // args))
   ];
 
   config = {
-    services.displayManager.defaultSession = "Hyprland"; # "none+xmonad";
-
     home-manager.users.${userName} = {
       imports = [
         ./libvirt
         ./niri
-        flakeInputs.nix-index-database.hmModules.nix-index
+        ./synadm
+        flakeInputs.nix-index-database.homeModules.nix-index
         flakeInputs.impermanence.nixosModules.home-manager.impermanence
       ];
 
       home.stateVersion = "20.09";
 
-      nixpkgs.config = {
-        allowUnfree = true;
-        zathura.useMupdf = false;
-      };
+      # nixpkgs.config = {
+      #   allowUnfree = true;
+      #   zathura.useMupdf = false;
+      # };
 
       nix.registry = {
         "flk" = {
@@ -112,14 +91,14 @@ in {
           };
           to = {
             type = "git";
-            url = "file:///home/gkleen/config/nixos-flakes";
+            url = "file:///home/gkleen/projects/machines";
           };
         };
       };
 
       programs = {
         ssh = {
-          matchBlocks = import ./ssh-hosts.nix { inherit pkgs; }; # customUtils.nixImport { dir = ./ssh-hosts; };
+          matchBlocks = import ./ssh-hosts.nix inputs; # customUtils.nixImport { dir = ./ssh-hosts; };
           extraConfig = ''
             Match host uniworx3.ifi.lmu.de,uniworx4.ifi.lmu.de,uniworx5.ifi.lmu.de,uni2workgw.ifi.lmu.de,blackbeard.tcs.ifi.lmu.de,gitlab2.rz.ifi.lmu.de,oregon.tcs.ifi.lmu.de !exec "nc -z -w 1 %h %p &>/dev/null"
               ProxyJump remote.cip.ifi.lmu.de
@@ -137,8 +116,8 @@ in {
               ''}
 
             Match host *.mathinst.loc,*.math.lmu.de !host ssh.math.lmu.de !exec "nc -z -w 1 %h %p &>/dev/null"
-              # ProxyCommand ${pkgs.socat}/bin/socat - SOCKS4A:127.0.0.1:%h:%p,socksport=8118
-              ProxyJump ssh.math.lmu.de
+              ProxyCommand ${lib.getExe pkgs.socat} - SOCKS4A:127.0.0.1:%h:%p,socksport=8118
+              # ProxyJump ssh.math.lmu.de
 
             Match host *.cipmath.loc !host cip04.cipmath.loc,mgmt-cls01.cipmath.loc !exec "nc -z -w 1 %h %p &>/dev/null"
               ProxyJump cip04
@@ -155,22 +134,31 @@ in {
 
         emacs = {
           enable = true;
-                package = pkgs.emacs29-pgtk;
+                package = pkgs.emacs-pgtk;
           extraPackages = epkgs: with epkgs; [
             evil evil-dvorak undo-tree magit haskell-tng-mode nix-mode
             yaml-mode json-mode shakespeare-mode smart-mode-line
-            highlight-parentheses highlight-symbol ag sass-mode lua-mode
-            fira-code-mode use-package wanderlust # notmuch
-            git-gutter emacsScratch
-            edit-server mediawiki editorconfig typescript-mode
-            markdown-mode nftables-mode rustic lsp-mode lsp-ui
-            direnv company projectile tomorrow-night-paradise-theme
+            highlight-parentheses highlight-symbol ag sass-mode
+            lua-mode fira-code-mode use-package wanderlust # notmuch
+            git-gutter scratch edit-server mediawiki editorconfig
+            typescript-mode markdown-mode nftables-mode rustic
+            lsp-mode lsp-ui direnv company projectile
+            tomorrow-night-paradise-theme
             treesit-grammars.with-all-grammars magit-delta scad-mode
           ];
           overrides = self: super: {
             tomorrow-night-paradise-theme = super.trivialBuild {
               inherit (sources.tomorrow-night-paradise-theme) pname version src;
             };
+            scratch = pkgs.stdenv.mkDerivation {
+              inherit (sources.emacs-scratch_el) pname version src;
+
+              phases = [ "unpackPhase" "installPhase" ];
+
+              installPhase = ''
+                install -Dt $out/share/emacs/site-lisp scratch.el
+              '';
+            };
           };
         };
         firefox = {
@@ -184,6 +172,7 @@ in {
             };
           };
         };
+        chromium.enable = true;
 
         zathura = {
           enable = true;
@@ -199,13 +188,93 @@ in {
           gpu-api = "vulkan";
         };
 
-        zsh.initExtra = ''
-          source ${./zshrc}
+        zsh.initContent = let
+          zshrc = pkgs.resholve.mkDerivation {
+            pname = "zshrc";
+            version = "0.0.0";
+
+            src = ./zshrc;
+
+            dontUnpack = true;
+            dontConfigure = true;
+            dontBuild = true;
+
+            installPhase = ''
+              mkdir -p $out/share
+              install "$src" $out/share/zshrc
+            '';
+
+            solutions = {
+              default = {
+                scripts = [ "share/zshrc" ];
+                interpreter = "none";
+                inputs = with pkgs; [
+                  coreutils
+                  rpm
+                  binutils
+                  squashfsTools
+                  unzip
+                  cfg.programs.git.package
+                  magickWrapped
+                  curl
+                  file
+                  gnutar
+                  cpio
+                  magic-wormhole
+                  cfg.programs.zsh.package
+                  fuse
+                  util-linux
+                  findutils
+                  qrencode
+                  tty-clock
+                  cfg.programs.jq.package
+                  eza
+                  less
+                  config.systemd.package
+                  config.programs.ssh.package
+                  gnused
+                  miniserve
+                  p7zip
+                ];
+                execer = with pkgs; [
+                  "cannot:${lib.getExe' rpm "rpm2cpio"}"
+                  "cannot:${lib.getExe' squashfsTools "unsquashfs"}"
+                  "cannot:${lib.getExe' unzip "unzip"}"
+                  "cannot:${lib.getExe cfg.programs.git.package}"
+                  "cannot:${lib.getExe cpio}"
+                  "cannot:${lib.getExe' magic-wormhole "wormhole"}"
+                  "cannot:${lib.getExe' fuse "fusermount"}"
+                  "cannot:${lib.getExe less}"
+                  "cannot:${lib.getExe' config.systemd.package "systemctl"}"
+                  "cannot:${lib.getExe config.programs.ssh.package}"
+                  "cannot:${lib.getExe' p7zip "7z"}"
+                ];
+                wrapper = with pkgs; [
+                  "${lib.getExe' magickWrapped "magick"}:${lib.getExe' imagemagick "magick"}"
+                ];
+                fake = {
+                  builtin = ["print"];
+                  external = ["sudo" "umount"];
+                };
+              };
+            };
+          };
+          magickWrapped = pkgs.symlinkJoin {
+            inherit (pkgs.imagemagick) name;
+            paths = [ pkgs.imagemagick ];
+
+            buildInputs = with pkgs; [ makeWrapper ];
+            postBuild = ''
+              wrapProgram $out/bin/magick \
+                --prefix PATH : ${lib.makeBinPath (with pkgs; [ ghostscript ])}
+            '';
+          };
+        in ''
+          source ${zshrc}/share/zshrc
         '';
         zsh.dirHashes = let
           flakeHashes = mapAttrs' (n: v: nameValuePair (inputNames.${n} or n) (toString v)) flakeInputs;
           inputNames = {
-            "nixpkgs" = "nixos";
           };
         in flakeHashes // {
           u2w = "$HOME/projects/uni2work";
@@ -217,6 +286,16 @@ in {
           pro = "$HOME/projects/pro";
           media = "$HOME/media";
         };
+        jq.colors = {
+          arrays = "1;37";
+          "false" = "0;37";
+          "null" = "2;37";
+          numbers = "0;37";
+          objectKeys = "1;34";
+          objects = "1;37";
+          strings = "0;32";
+          "true" = "0;37";
+        };
 
         obs-studio = {
           enable = true;
@@ -226,7 +305,7 @@ in {
         gh = {
           enable = true;
           settings = {
-            editor = "${config.home-manager.users.${userName}.programs.emacs.package}/bin/emacsclient";
+            editor = lib.getExe' editor "emacsclient";
             gitProtocol = "ssh";
           };
         };
@@ -252,16 +331,10 @@ in {
             # notify_on_cmd_finish = "invisible 120";
           };
           keybindings = {
-            "kitty_mod+n" = "detach_window";
+            "kitty_mod+n" = "new_os_window_with_cwd";
             "kitty_mod+m" = "detach_window ask";
-          };
-        };
-        wpaperd = {
-          enable = true;
-          settings.default = {
-            path = "~/.wallpapers";
-            duration = "8h";
-            mode = "center";
+            "kitty_mod+enter" = "new_window_with_cwd";
+            "kitty_mod+t" = "new_tab_with_cwd";
           };
         };
         fuzzel = {
@@ -274,7 +347,7 @@ in {
               font = "Fira Sans";
             };
             colors = {
-              background = "000000aa";
+              background = "000000cc";
               text = "cdd6f4ff";
               match = "94e2d5ff";
               selection = "585b70ff";
@@ -287,26 +360,46 @@ in {
             };
           };
         };
+        pandoc = {
+          enable = true;
+          extraAbbreviations = ["i.A." "d.h." "D.h." "gdw."];
+        };
+        nushell = {
+          enable = true;
+          settings.show_banner = false;
+        };
+        fd.enable = true;
       };
 
       services = {
+        wpaperd = {
+          enable = true;
+          settings.default = {
+            path = "~/.wallpapers";
+            duration = "15m";
+            mode = "center";
+          };
+        };
         emacs = {
           enable = true;
           socketActivation.enable = true;
           client = {
             enable = true;
-            arguments = mkForce ["--reuse-frame" "--alternate-editor" "\"\""];
+            arguments = mkForce ["--create-frame" "--alternate-editor" (lib.getExe cfg.services.emacs.package)];
           };
         };
         gpg-agent = {
           enable = true;
           enableSshSupport = true;
           extraConfig = ''
-            pinentry-program ${pkgs.pinentry-gtk2}/bin/pinentry
+            pinentry-program ${lib.getExe' pkgs.pinentry-gtk2 "pinentry"}
             grab
           '';
         };
-        xembed-sni-proxy.enable = true;
+        xembed-sni-proxy = {
+          enable = true;
+          package = pkgs.kdePackages.plasma-workspace;
+        };
         udiskie = {
           enable = true;
           automount = false;
@@ -339,7 +432,7 @@ in {
                 batch = "true";
                 log = "false";
                 repeat = "watch";
-                sshcmd = "${pkgs.openssh}/bin/ssh";
+                sshcmd = lib.getExe' pkgs.openssh "ssh";
                 ui = "text";
               };
             };
@@ -362,7 +455,7 @@ in {
             { event = "lock"; command = lockCommand; }
           ];
           timeouts = [
-            { timeout = 330; command = lockCommand; }
+            { timeout = 600; command = lockCommand; }
           ];
           extraArgs = [
             "-w"
@@ -401,6 +494,13 @@ in {
         };
       };
 
+      qt.kde.settings = {
+        kwalletrc = {
+          KSecretD.Enabled = false;
+          Wallet."Default Wallet" = "store";
+        };
+      };
+
       xsession.preferStatusNotifierItems = true;
 
       xresources.properties = import ./xresources.nix;
@@ -409,20 +509,19 @@ in {
         packages = with pkgs; [
           fira fira-code pwvucontrol wrappedKeepassxc wl-clipboard-rs
           mumble pulseaudio-ctl pamixer libnotify screen-message
-          wrappedYTMDesktop libsForQt5.qt5ct playerctl evince
+          wrappedYTMDesktop libsForQt5.qt5ct playerctl evince papers
           thunderbird zoom-us xdg-desktop-portal steam steam-run
           wireshark virt-manager rclone cached-nix-shell worktime
-          fira-code-symbols libreoffice xournalpp google-chrome
+          fira-code-symbols libreoffice xournalpp
           nixos-shell virt-viewer freerdp gnome-icon-theme
           paper-icon-theme sshpassSecret weechat element-desktop
-          matrix-synapse-tools.synadm
-          flakeInputs.deploy-rs.packages.${config.nixpkgs.system}.deploy-rs
-          sieve-connect gimp inkscape udiskie glab nitrokey-app
+          sieve-connect gimp3 inkscape udiskie glab nitrokey-app
           pynitrokey gtklock wlrctl remmina openscad spice-record
-          libguestfs-with-appliance nerd-fonts.fira-mono
+          nerd-fonts.fira-mono
           nerd-fonts.symbols-only nerd-fonts.fira-code powerline-fonts
-          swtpm
-        ];
+          swtpm (hunspell.withDicts (dicts: with dicts; [en_GB-large de_DE]))
+          libation libqalculate
+        ] ++ mapAttrsToList (_name: pkg: pkgs.callPackage pkg {}) (customUtils.nixImport { dir = ./utils; });
 
         file = {
           ".backup-munin".source = ./backup-patterns;
@@ -442,12 +541,9 @@ in {
           QT_QPA_PLATFORMTHEME = "qt5ct";
           LIBVIRT_DEFAULT_URI = "qemu:///system";
           STACK_XDG = 1;
-          EDITOR = pkgs.writeShellScript "editor" ''
-            args=("--reuse-frame" "--alternate-editor" "")
-            args+=("$@")
-            exec -a emacsclient ${cfg.services.emacs.package}/bin/emacsclient "''${args[@]}"
-          '';
-          RCLONE_PASSWORD_COMMAND = "${pkgs.libsecret}/bin/secret-tool lookup service rclone";
+          EDITOR = lib.getExe' editor "emacsclient";
+          RCLONE_PASSWORD_COMMAND = "${lib.getExe' pkgs.libsecret "secret-tool"} lookup service rclone";
+          SYSTEMD_TINT_BACKGROUND = "false";
         };
 
         extraProfileCommands = ''
@@ -460,7 +556,7 @@ in {
           source = ./wireplumber;
           recursive = true;
           onChange = ''
-            ${pkgs.systemd}/bin/systemctl --user try-restart wireplumber
+            ${lib.getExe' config.systemd.package "systemctl"} --user try-restart wireplumber
           '';
         };
         "stack/config.yaml" = {
@@ -484,9 +580,17 @@ in {
             General = {
               dot_as_separator = 0;
             };
+            Mode = {
+              calculate_as_you_type = 1;
+            };
           };
         };
-        "emacs/init.el".source = ./emacs.el;
+        "emacs/init.el".source = pkgs.substitute {
+          src = ./emacs.el;
+          substitutions = [
+            "--subst-var-by" "ksshaskpass" (lib.getExe pkgs.kdePackages.ksshaskpass)
+          ];
+        };
         "systemd/user/xdg-desktop-portal.service.d/after-graphical-session.conf".text = ''
           [Unit]
           After=graphical-session.target
@@ -502,31 +606,10 @@ in {
       };
 
       xdg.dataFile = {
-        "pandoc/abbreviations" = {
-          source = pkgs.runCommand "pandoc-abbreviations" {
-            buildInputs = [ pkgs.pandoc pkgs.coreutils ];
-          } (let
-            germanAbbrevs = pkgs.fetchFromGitHub {
-              owner = "jfilter";
-              repo = "german-abbreviations";
-              rev = "8eb9dae93b6f05d7c53374cd217ab2dc89558e0c";
-              sha256 = "SaD3tSqzen6Y3SPICe6/9vhe4iMHlArZ3kFQaEk7Hps=";
-            };
-          in ''
-            cat \
-              <(pandoc --print-default-data-file=abbreviations) \
-              <(grep -E '^[^ ]+\.$' ${germanAbbrevs}/german_abbreviations.txt) \
-              ${pkgs.writeText "abbrevs.txt" ''
-                i.A.
-                d.h.
-                D.h.
-                gdw.
-              ''} \
-              | sort | uniq >$out
-          '');
-        };
         "dbus-1/services/org.keepassxc.KeePassXC.service".source = "${wrappedKeepassxc}/share/dbus-1/services/org.keepassxc.KeePassXC.service";
         "dbus-1/services/org.freedesktop.secrets.service.service".source = "${wrappedKeepassxc}/share/dbus-1/services/org.freedesktop.secrets.service.service";
+        "dbus-1/services/org.kde.kwalletd6.service".source = "${pkgs.kdePackages.kwallet}/share/dbus-1/services/org.kde.kwalletd6.service";
+        "dbus-1/services/org.kde.kwalletd5.service".source = "${pkgs.kdePackages.kwallet}/share/dbus-1/services/org.kde.kwalletd5.service";
         "emoji-data/list.txt".source = pkgs.stdenv.mkDerivation {
           inherit (sources.emoji-data) pname src;
           version = lib.removePrefix "v" sources.emoji-data.version;
@@ -612,13 +695,13 @@ in {
           name = "Rainbow";
           exec = toString (pkgs.writeShellScript "rainbow" ''
             exec -- \
-              ${config.systemd.package}/bin/systemd-run --wait --user --slice-inherit \
+              ${lib.getExe' config.systemd.package "systemd-run"} --wait --user --slice-inherit \
               --property 'CPUAccounting=yes' --property 'CPUQuotaPeriodSec=50ms' \
-              --property 'Environment=DSCP=46' \
-              -- ${pkgs.dscp}/bin/dscp ${pkgs.google-chrome}/bin/google-chrome-stable \
+              -E DSCP=46 -E NIXOS_OZONE_WL \
+              -- ${lib.getExe pkgs.dscp} ${lib.getExe cfg.programs.chromium.package} \
               --class=Rainbow \
-              --kiosk "https://web.openrainbow.com" \
-              --user-data-dir=''${HOME}/.config/google-chrome-rainbow
+              --app="https://web.openrainbow.com" \
+              --user-data-dir=''${HOME}/.config/chromium-rainbow
           '');
           icon = pkgs.fetchurl {
             url = "https://web.openrainbow.com/rb/2.139.17/assets/skins/rainbow/images/homepage/logo__rainbow.svg";
@@ -628,6 +711,53 @@ in {
             StartupWMClass = "Rainbow";
           };
         };
+        kimai = {
+          name = "Kimai";
+          exec = toString (pkgs.writeShellScript "kimai" ''
+            exec -- \
+              ${lib.getExe cfg.programs.chromium.package} \
+              --class=Kimai \
+              --app="https://kimai.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/chromium-kimai
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.kimai.org/images/kimai_logo.png";
+            hash = "sha256-lnlOttzR2SwXA70R+egJUkeKr4U5V0avqTk8uX4bqfs=";
+          };
+          settings = {
+            StartupWMClass = "Kimai";
+            StartupNotify = "true";
+          };
+        };
+        audiobookshelf = {
+          name = "Audiobookshelf";
+          exec = toString (pkgs.writeShellScript "audiobookshelf" ''
+            exec -- \
+              ${lib.getExe cfg.programs.chromium.package} \
+              --class=Audiobookshelf \
+              --app="https://audiobookshelf.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/chromium-audiobookshelf
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.audiobookshelf.org/Logo.png";
+            hash = "sha256-JGPk+WNT1C4DC4lSMb0K0YmAMT5LvmSOeO0QRzkc7Lk=";
+          };
+          settings = {
+            StartupWMClass = "Audiobookshelf";
+            StartupNotify = "true";
+          };
+        };
+        thunderbird-lmu = {
+          name = "Thunderbird (LMU)";
+          exec = "thunderbird --name thunderbird -P lmu %U";
+          icon = "thunderbird";
+          genericName = "Email Client";
+          categories = [ "Network" "Chat" "Email" "Feed" "GTK" "News" ];
+          settings = {
+            StartupWMClass = "thunderbird";
+            StartupNotify = "true";
+          };
+        };
       };
 
       fonts = {
diff --git a/accounts/gkleen@sif/emacs.el b/accounts/gkleen@sif/emacs.el
index 5cee16b0..3beefba6 100644
--- a/accounts/gkleen@sif/emacs.el
+++ b/accounts/gkleen@sif/emacs.el
@@ -51,7 +51,7 @@
 
 ;; (require 'scratch)
 (global-set-key (kbd "C-x B") 'scratch-create)
-(setq initial-major-mode 'scratch-mode)
+;; (setq initial-major-mode 'scratch-mode)
 (setq initial-scratch-message "")
 
 (global-set-key (kbd "C-x K") 'kill-current-buffer)
@@ -254,3 +254,5 @@ necessarily running."
 (bind-key "C-x C-m" #'move-file)
 
 (let ((ssh_auth_sock (string-chop-newline (shell-command-to-string "gpgconf --list-dirs agent-ssh-socket")))) (setenv "SSH_AUTH_SOCK" ssh_auth_sock))
+(setenv "SSH_ASKPASS_REQUIRE" "prefer")
+(setenv "SSH_ASKPASS" "@ksshaskpass@")
diff --git a/accounts/gkleen@sif/firefox-chrome.css b/accounts/gkleen@sif/firefox-chrome.css
index 8900e2b9..726f1e4b 100644
--- a/accounts/gkleen@sif/firefox-chrome.css
+++ b/accounts/gkleen@sif/firefox-chrome.css
@@ -4,6 +4,21 @@
     font-size:12px;
 }
 
+#sidebar-main:has([expanded]) {
+    min-width:20em !important;
+    max-width:20em !important;
+}
+
+#sidebar, #sidebar-box {
+    min-width:35em !important;
+    max-width:35em !important;
+}
+
+#sidebar-box {
+    margin-right: var(--space-small);
+}
+
+/*
 #sidebar {
     min-width:20em !important;
     max-width:20em !important;
@@ -19,8 +34,21 @@
 }
 
 #toolbar-menubar[inactive="true"] + #TabsToolbar {
-  visibility: collapse !important;
+    visibility: collapse !important;
 }
 
 #sidebar-box[sidebarcommand="tabcenter-reborn_ariasuni-sidebar-action"] #sidebar-header { visibility: collapse !important; }
 #sidebar-box[sidebarcommand="_3c078156-979c-498b-8990-85f7987dd929_-sidebar-action"] #sidebar-header { visibility: collapse !important; }
+*/
+
+.titlebar-buttonbox-container{ display: none; }
+#vertical-spacer { display: none; }
+#tabbrowser-tabs[orient="vertical"] .tab-background {
+    border-radius: var(--border-radius-small) !important;
+}
+hbox:has(> #tabs-newtab-button) {
+    display: none;
+}
+#sidebar-main .tools-and-extensions {
+    justify-content: space-around !important;
+}
diff --git a/accounts/gkleen@sif/niri/default.nix b/accounts/gkleen@sif/niri/default.nix
index 4a207589..35a3d799 100644
--- a/accounts/gkleen@sif/niri/default.nix
+++ b/accounts/gkleen@sif/niri/default.nix
@@ -1,6 +1,11 @@
-{ config, hostConfig, pkgs, lib, ... }:
+{ config, hostConfig, pkgs, lib, flakeInputs, ... }:
 let
-  niri = config.programs.niri.package;
+  cfg = config.programs.niri;
+
+  kdl = flakeInputs.niri-flake.lib.kdl;
+  sleaf = name: arg: kdl.node name [arg] [];
+
+  niri = cfg.package;
   terminal = lib.getExe config.programs.kitty.package;
   makoctl = lib.getExe' config.services.mako.package "makoctl";
   loginctl = lib.getExe' hostConfig.systemd.package "loginctl";
@@ -28,7 +33,15 @@ let
 
       while IFS=$'\n' read -r window_json; do
         if [[ -n $(jq -c "$window_select" <<<"$window_json") ]]; then
-          niri msg action focus-window --id "$(jq -r '.id' <<<"$window_json")"
+          if jq -e '.is_focused' <<<"$window_json" >/dev/null; then
+            niri msg action focus-workspace-previous
+          else
+            if [[ $(jq -r --arg workspace_name "$workspace_name" 'map(select(.name == $workspace_name)) | .[0].is_focused' <<<"$workspaces_json") != "true" ]] && [[ $(jq -r --arg workspace_name "$workspace_name" 'map(select(.name == $workspace_name)) | .[0].id' <<<"$workspaces_json") = $(jq -r '.workspace_id' <<<"$window_json") ]]; then
+                niri msg action focus-workspace "$workspace_name"
+            else
+                niri msg action focus-window --id "$(jq -r '.id' <<<"$window_json")"
+            fi
+          fi
           exit 0
         fi
       done < <(niri msg -j windows | jq -c '.[]')
@@ -37,7 +50,6 @@ let
     '';
   };
   focus-or-spawn-action = config.lib.niri.actions.spawn (lib.getExe focus_or_spawn);
-  focus-or-spawn-action-app_id = app_id: focus-or-spawn-action ''select(.app_id == "${app_id}")'';
 
   with_adjacent_workspace = pkgs.writeShellApplication {
     name = "with-adjacent-workspace";
@@ -74,9 +86,9 @@ let
       jq --arg active_workspace "$active_workspace" -c "$action" <<<"$workspace_json" | tee /dev/stderr | socat STDIO "$NIRI_SOCKET"
     '';
   };
-  with-adjacent-workspace-action = config.lib.niri.actions.spawn (lib.getExe with_adjacent_workspace) "^pwctl|eff|kpxc|bmgr|edit|term$";
+  with-adjacent-workspace-action = config.lib.niri.actions.spawn (lib.getExe with_adjacent_workspace) "^${lib.concatMapStringsSep "|" ({ name, ...}: name) cfg.scratchspaces}$";
   focus-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"FocusWorkspace":{"reference":{"Id": .id}}}}'';
-  move-column-to-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}}}}'';
+  move-column-to-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}, "focus": true}}}'';
 
   with_unnamed_workspace = pkgs.writeShellApplication {
     name = "with-unnamed-workspace";
@@ -89,13 +101,29 @@ let
       active_output="$(jq -r '.[] | select(.is_focused) | .output' <<<"$workspaces_json")"
       active_workspace="$(jq -r '.[] | select(.is_focused) | .id' <<<"$workspaces_json")"
 
-      workspace_json="$(jq -c --arg active_output "$active_output" 'map(select(.output == $active_output and .name == null)) | sort_by(.idx) | .[0]' <<<"$workspaces_json")"
+      history_json="$(socat STDIO UNIX-CONNECT:"$XDG_RUNTIME_DIR"/niri-workspace-history.sock)"
+      workspace_json="$(jq -c --arg active_output "$active_output" --argjson history "$history_json" 'map(select(.output == $active_output and .name == null)) | map({"value": ., "history_idx": ((. as $workspace | ($history[$active_output] | index($workspace | .id))) as $active_idx | if $active_idx then $active_idx else ($history[$active_output] | length) + 1 end)}) | sort_by(.history_idx, .value.idx) | map(.value) | .[0]' <<<"$workspaces_json")"
       [[ -n $workspace_json && $workspace_json != null ]] || exit 0
       jq --arg active_workspace "$active_workspace" -c "$action" <<<"$workspace_json" | tee /dev/stderr | socat STDIO "$NIRI_SOCKET"
     '';
   };
   with-unnamed-workspace-action = config.lib.niri.actions.spawn (lib.getExe with_unnamed_workspace);
 
+  with_empty_unnamed_workspace = pkgs.writeShellApplication {
+    name = "with-empty-unnamed-workspace";
+    runtimeInputs = [ niri pkgs.gojq pkgs.socat ];
+    text = ''
+      action="$1"
+      shift
+
+      workspaces_json="$(niri msg -j workspaces)"
+      active_output="$(jq '.[] | select(.is_focused) | .output' <<<"$workspaces_json")"
+      target_workspace_id="$(jq --argjson active_output "$active_output" 'map(select(.active_window_id == null and .name == null and .output == $active_output)) | sort_by(.idx) | .[0].id' <<<"$workspaces_json")"
+      jq --argjson workspace_id "$target_workspace_id" -nc "$action" | tee /dev/stderr | socat STDIO "$NIRI_SOCKET"
+    '';
+  };
+  with-empty-unnamed-workspace-action = config.lib.niri.actions.spawn (lib.getExe with_empty_unnamed_workspace);
+
   with_select_window = pkgs.writeShellApplication {
     name = "with-select-window";
     runtimeInputs = [ niri pkgs.gojq pkgs.socat config.programs.fuzzel.package pkgs.gawk ];
@@ -107,7 +135,7 @@ let
 
       windows_json="$(niri msg -j windows)"
       active_workspace="$(jq -r '.[] | select(.is_focused) | .workspace_id' <<<"$windows_json")"
-      window_ix="$(gojq -r --arg active_workspace "$active_workspace" '.[] | select('"$window_select"') | "\(.title)\u0000icon\u001f\(.app_id)"' <<<"$windows_json" | fuzzel --log-level=warning --dmenu --index)"
+      window_ix="$(gojq -r --arg active_workspace "$active_workspace" '.[] | select('"$window_select"') | "\(.title)\u0000icon\u001f\(.app_id)"' <<<"$windows_json" | fuzzel --width=60 --log-level=warning --dmenu --index)"
       # shellcheck disable=SC2016
       window_json="$(gojq -rc --arg active_workspace "$active_workspace" --arg window_ix "$window_ix" 'map(select('"$window_select"')) | .[($window_ix | tonumber)]' <<<"$windows_json")"
 
@@ -117,6 +145,25 @@ let
     '';
   };
   with-select-window-action = config.lib.niri.actions.spawn (lib.getExe with_select_window);
+
+  with_predicate_window = pred: pkgs.writeShellApplication {
+    name = "with-predicate-window";
+    runtimeInputs = [ niri pkgs.gojq pkgs.socat ];
+    text = ''
+      action="$1"
+      shift
+
+      windows_json="$(niri msg -j windows)"
+      window_json="$(gojq -rc 'map(select(${pred})) | .[0]' <<<"$windows_json")"
+
+      [[ -z "$window_json" || $window_json = "null" ]] && exit 1
+
+      jq -c "$action" <<<"$window_json" | socat STDIO "$NIRI_SOCKET"
+    '';
+  };
+
+  with-urgent-window-action = config.lib.niri.actions.spawn (lib.getExe (with_predicate_window ".is_urgent"));
+  with-focused-window-action = config.lib.niri.actions.spawn (lib.getExe (with_predicate_window ".is_focused"));
 in {
   imports = [
     ./waybar.nix
@@ -124,6 +171,65 @@ in {
     ./swayosd.nix
   ];
 
+  options = {
+    programs.niri.scratchspaces = lib.mkOption {
+      type = lib.types.listOf (lib.types.submodule ({ config, ... }: {
+        options = {
+          name = lib.mkOption {
+            type = lib.types.str;
+          };
+          match = lib.mkOption {
+            type = lib.types.listOf (lib.types.attrsOf kdl.types.kdl-args);
+            default = [];
+          };
+          exclude = lib.mkOption {
+            type = lib.types.listOf (lib.types.attrsOf kdl.types.kdl-args);
+            default = [];
+          };
+          windowRuleExtra = lib.mkOption {
+            type = kdl.types.kdl-nodes;
+            default = [];
+          };
+          key = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+          moveKey = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = let
+              keys = lib.splitString "+" config.key;
+              defMoveKey = lib.concatStringsSep "+" (lib.flatten [
+                (lib.take (lib.length keys - 1) keys)
+                ["Shift"]
+                (lib.takeEnd 1 keys)
+              ]);
+            in if config.key == null then null else defMoveKey;
+          };
+          spawn = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.str);
+            default = null;
+          };
+          app-id = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+          selector = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+        };
+
+        config = lib.mkMerge [
+          (lib.mkIf (config.app-id != null) {
+            match = lib.mkDefault [ { app-id = "^${lib.escapeRegex config.app-id}$"; } ];
+            selector = lib.mkDefault "select(.app_id == \"${config.app-id}\")";
+          })
+        ];
+      }));
+      default = [];
+    };
+  };
+
   config = {
     systemd.user.services.xwayland-satellite = {
       Unit = {
@@ -150,479 +256,754 @@ in {
         { event = "after-resume"; command = "${lib.getExe niri} msg action power-on-monitors"; }
       ];
       timeouts = [
-        { timeout = 300;
+        { timeout = 540;
           command = "${lib.getExe niri} msg action power-off-monitors";
         }
       ];
     };
 
-    programs.niri.settings = {
-      prefer-no-csd = true;
-      screenshot-path = "${config.home.homeDirectory}/screenshots";
-
-      hotkey-overlay.skip-at-startup = true;
-
-      input = {
-        keyboard = {
-          repeat-delay = 300;
-          repeat-rate = 50;
-
-          xkb = {
-            layout = "us,us";
-            variant = "dvp,";
-            options = "compose:caps,grp:win_space_toggle";
-          };
-        };
-
-        workspace-auto-back-and-forth = true;
-        # focus-follows-mouse.enable = true;
-        warp-mouse-to-focus = true;
-      };
-
-      outputs = {
-        "eDP-1" = {
-          scale = 1.5;
-          position = { x = 0; y = 0; };
-        };
-        "Ancor Communications Inc ASUS PB287Q 0x0000DD9B" = {
-          scale = 1.5;
-          position = { x = 2560; y = 0; };
-        };
-        "HP Inc. HP 727pu CN4417143K" = {
-          mode = { width = 2560; height = 1440; refresh = 119.998; };
-          scale = 1;
-          position = { x = 2560; y = 0; };
-          variable-refresh-rate = "on-demand";
-        };
+    systemd.user.sockets.niri-workspace-history = {
+      Socket = {
+        ListenStream = "%t/niri-workspace-history.sock";
+        SocketMode = "0600";
       };
-
-      environment = {
-        NIXOS_OZONE_WL = "1";
-        QT_QPA_PLATFORM = "wayland";
-        QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
-        GDK_BACKEND = "wayland";
-        SDL_VIDEODRIVER = "wayland";
-        DISPLAY = ":0";
+    };
+    systemd.user.services.niri-workspace-history = {
+      Unit = {
+        BindsTo = [ "niri.service" ];
+        After = [ "niri.service" ];
       };
-
-      debug.render-drm-device = "/dev/dri/by-path/pci-0000:00:02.0-render";
-
-      animations = {
-        slowdown = 0.5;
+      Install = {
+        WantedBy = [ "niri.service" ];
       };
-
-      layout = {
-        gaps = 8;
-        struts = { left = 0; right = 0; top = 0; bottom = 0; };
-        focus-ring = {
-          width = 2;
-          active.gradient = {
-            from = "hsla(195 100% 60% 0.75)";
-            to = "hsla(155 100% 50% 0.75)";
-            angle = 29;
-            relative-to = "workspace-view";
-          };
-          inactive.gradient = {
-            from = "hsla(0 0% 42% 0.66)";
-            to = "hsla(0 0% 35% 0.66)";
-            angle = 29;
-            relative-to = "workspace-view";
-          };
-        };
-
-        preset-column-widths = [
-          { proportion = 1. / 4.; }
-          { proportion = 1. / 3.; }
-          { proportion = 1. / 2.; }
-          { proportion = 2. / 3.; }
-          { proportion = 3. / 4.; }
-        ];
-        default-column-width.proportion = 1. / 2.;
-        preset-window-heights = [
-          { proportion = 1. / 3.; }
-          { proportion = 1. / 2.; }
-          { proportion = 2. / 3.; }
-          { proportion = 1.; }
-        ];
-
-        always-center-single-column = true;
+      Service = {
+        Type = "simple";
+        Sockets = [ "niri-workspace-history.socket" ];
+        ExecStart = pkgs.writers.writePython3 "niri-workspace-history" { flakeIgnore = ["E501"]; } ''
+          import os
+          import socket
+          import json
+          # import sys
+          from collections import defaultdict
+          from threading import Thread, Lock
+          from socketserver import StreamRequestHandler, ThreadingTCPServer
+          from contextlib import contextmanager
+          from io import TextIOWrapper
+
+
+          @contextmanager
+          def detaching(thing):
+              try:
+                  yield thing
+              finally:
+                  thing.detach()
+
+
+          workspace_history = defaultdict(list)
+          history_lock = Lock()
+
+
+          def monitor_niri():
+              workspaces = list()
+
+              def focus_workspace(output, workspace):
+                  with history_lock:
+                      workspace_history[output] = [workspace] + [ws for ws in workspace_history[output] if ws != workspace]
+                      # print(json.dumps(workspace_history), file=sys.stderr)
+
+              sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+              sock.connect(os.environ["NIRI_SOCKET"])
+              sock.send(b"\"EventStream\"\n")
+              for line in sock.makefile(buffering=1, encoding='utf-8'):
+                  if line_json := json.loads(line):
+                      if "WorkspacesChanged" in line_json:
+                          workspaces = line_json["WorkspacesChanged"]["workspaces"]
+                          for ws in workspaces:
+                              if ws["is_focused"]:
+                                  focus_workspace(ws["output"], ws["id"])
+                      if "WorkspaceActivated" in line_json:
+                          for ws in workspaces:
+                              if ws["id"] != line_json["WorkspaceActivated"]["id"]:
+                                  continue
+                              focus_workspace(ws["output"], ws["id"])
+                              break
+
+
+          class RequestHandler(StreamRequestHandler):
+              def handle(self):
+                  with detaching(TextIOWrapper(self.wfile, encoding='utf-8', write_through=True)) as out:
+                      with history_lock:
+                          json.dump(workspace_history, out)
+
+
+          class Server(ThreadingTCPServer):
+              def __init__(self):
+                  ThreadingTCPServer.__init__(self, ("", 8000), RequestHandler, bind_and_activate=False)
+                  self.socket = socket.fromfd(3, self.address_family, self.socket_type)
+
+
+          def run_server():
+              with Server() as server:
+                  server.serve_forever()
+
+
+          niri = Thread(target=monitor_niri)
+          niri.daemon = True
+          niri.start()
+
+          server_thread = Thread(target=run_server)
+          server_thread.daemon = True
+          server_thread.start()
+
+          while True:
+              server_thread.join(timeout=0.5)
+              niri.join(timeout=0.5)
+
+              if not (niri.is_alive() and server_thread.is_alive()):
+                  break
+        '';
       };
-
-      cursor.hide-when-typing = true;
-
-      input = {
-        touchpad.enable = false;
-        trackball = {
-          scroll-method = "on-button-down";
-          scroll-button = 278;
-        };
+    };
+    systemd.user.services.niri-workspace-sort = {
+      Unit = {
+        BindsTo = [ "niri.service" ];
+        After = [ "niri.service" ];
       };
-
-      workspaces = {
-        "001" = { name = "pwctl"; open-on-output = "eDP-1"; };
-        "002" = { name = "kpxc"; open-on-output = "eDP-1"; };
-        "003" = { name = "bmgr"; open-on-output = "eDP-1"; };
-        "004" = { name = "term"; open-on-output = "eDP-1"; };
-        "005" = { name = "edit"; open-on-output = "eDP-1"; };
-        "006" = { name = "eff"; open-on-output = "eDP-1"; };
-        "101".name = "comm";
-        "102".name = "web";
-        # "104".name = "read";
-        # "105".name = "mon";
-        "110".name = "vid";
-        "120".name = "bmr";
+      Install = {
+        WantedBy = [ "niri.service" ];
       };
-
-      window-rules = [
-        # {
-        #   geometry-corner-radius =
-        #     let
-        #       allCorners = r: { bottom-left = r; bottom-right = r; top-left = r; top-right = r; };
-        #     in allCorners 4.;
-        #   clip-to-geometry = true;
-        # }
-        {
-          matches = [ { app-id = "^com\.saivert\.pwvucontrol$"; } ];
-          open-on-workspace = "pwctl";
-          open-maximized = true;
-        }
-        {
-          matches = [ { app-id = "^com\.github\.wwmm\.easyeffects$"; } ];
-          open-on-workspace = "eff";
-          open-maximized = true;
-        }
-        {
-          matches = [ { app-id = "^\.blueman-manager-wrapped$"; } ];
-          open-on-workspace = "bmgr";
-          open-maximized = true;
-        }
-        {
-          matches = [ { app-id = "^org\.keepassxc\.KeePassXC$"; } ];
-          block-out-from = "screencast";
-        }
-        {
-          matches = [ { app-id = "^org\.keepassxc\.KeePassXC$"; } ];
-          excludes = [
-            { title = "^Unlock Database.*"; }
-            { title = "^Access Request.*"; }
-            { title = ".*Passkey credentials$"; }
-          ];
-          open-on-workspace = "kpxc";
-          open-maximized = true;
-          open-focused = false;
-        }
-        {
-          matches = [
-            { app-id = "^org\.keepassxc\.KeePassXC$";  title = "^Unlock Database.*"; }
-            { app-id = "^org\.keepassxc\.KeePassXC$";  title = "^Access Request.*"; }
-            { app-id = "^org\.keepassxc\.KeePassXC$";  title = ".*Passkey credentials$"; }
-          ];
-          open-focused = true;
-          open-floating = true;
-        }
-        {
-          matches = [ { app-id = "^kitty-scratch$"; } ];
-          open-on-workspace = "term";
-          open-maximized = true;
-        }
-        {
-          matches = [ { title = "^scratch$"; app-id = "^emacs$"; } ];
-          open-on-workspace = "edit";
-          open-maximized = true;
-        }
-        {
-          matches = [
-            { app-id = "^emacs$"; }
-            { app-id = "^firefox$"; }
-          ];
-          default-column-width.proportion = 2. / 3.;
-        }
-        {
-          matches = [
-            { app-id = "^kitty$"; }
-            { app-id = "^kitty-play$"; }
-          ];
-          default-column-width.proportion = 1. / 3.;
-        }
-        {
-          matches = [
-            { app-id = "^thunderbird$"; }
-            { app-id = "^Element$"; }
-            { app-id = "^Rainbow$"; }
-          ];
-          open-on-workspace = "comm";
-        }
-        {
-          matches = [ { app-id = "^firefox$"; } ];
-          open-on-workspace = "web";
-          open-maximized = true;
-          variable-refresh-rate = true;
-        }
-        # {
-        #   matches = [
-        #     { app-id = "^evince$"; }
-        #     { app-id = "^imv$"; }
-        #     { app-id = "^org\.pwmt\.zathura$"; }
-        #   ];
-        #   open-on-workspace = "read";
-        # }
-        {
-          matches = [ { app-id = "^mpv$"; } ];
-          open-on-workspace = "vid";
-          default-column-width.proportion = 1.;
-          variable-refresh-rate = true;
-        }
-        {
-          matches = [ { app-id = "^kitty-play$"; } ];
-          open-on-workspace = "vid";
-          open-focused = false;
-        }
-        # {
-        #   matches = [
-        #     { app-id = "^qemu$"; }
-        #     { app-id = "^virt-manager$"; }
-        #   ];
-        #   open-on-workspace = "mon";
-        # }
-        {
-          matches = [ { app-id = "^pdfpc$"; } ];
-          default-column-width.proportion = 1.;
-        }
-        {
-          matches = [ { app-id = "^pdfpc$"; title = "^pdfpc - presentation"; } ];
-          open-on-workspace = "bmr";
-          open-fullscreen = true;
-        }
-        {
-          matches = [
-            { app-id = "^Gimp-"; title = "^Quit GIMP$"; }
-            { app-id = "^org\.kde\.polkit-kde-authentication-agent-1$"; }
-          ];
-          open-floating = true;
-        }
-      ];
-      layer-rules = [
-        { matches = [
-            { namespace = "^notifications$"; }
-            { namespace = "^waybar$"; }
-          ];
-          block-out-from = "screencast";
-        }
-      ];
-
-      binds = with config.lib.niri.actions; {
-        "Mod+Slash".action = show-hotkey-overlay;
-
-        "Mod+Return".action = spawn terminal;
-        "Mod+Q".action = close-window;
-        "Mod+O".action = spawn (lib.getExe config.programs.fuzzel.package);
-        "Mod+Shift+O".action = spawn (lib.getExe config.programs.fuzzel.package) "--list-executables-in-path";
-
-        "Mod+Alt+E".action = spawn (lib.getExe' config.services.emacs.package "emacsclient") "-c";
-        "Mod+Alt+Y".action = spawn (lib.getExe (pkgs.writeShellApplication {
-          name = "queue-yt-dlp";
-          runtimeInputs = with pkgs; [ wl-clipboard-rs socat ];
-          text = ''
-            socat STDIO UNIX-CONNECT:"$XDG_RUNTIME_DIR"/yt-dlp.sock <<<$'{ "urls": ["'"$(wl-paste)"$'"] }'
-          '';
-        }));
-        "Mod+Alt+L".action = spawn (lib.getExe (pkgs.writeShellApplication {
-          name = "queue-yt-dlp";
-          runtimeInputs = with pkgs; [ wl-clipboard-rs config.programs.kitty.package ];
-          text = ''
-            exec -- kitty --app-id kitty-play --directory "$HOME"/media mpv "$(wl-paste)"
-          '';
-        }));
-
-        "Mod+U".action = spawn (lib.getExe (pkgs.writeShellApplication {
-          name = "qalc-fuzzel";
-          runtimeInputs = with pkgs; [ wl-clipboard-rs libqalculate config.programs.fuzzel.package coreutils findutils libnotify gnugrep ];
-          text = ''
-            RESULTS_DIR="$HOME/.cache/qalc-fuzzel"
-            prev() {
-              FOUND=false
-              while IFS= read -r line; do
-                [[ -n "$line" ]] || continue
-                FOUND=true
-                echo "$line"
-              done < <(export LC_ALL=C.UTF-8; echo; find "$RESULTS_DIR" -type f -printf $'%T@ %p\n' | sort -n | cut -d' ' -f2- | xargs -r cat)
-              $FOUND || echo
-            }
-            FUZZEL_RES=$(prev | fuzzel --dmenu --prompt "qalc> ") || exit $?
-            if [[ "$FUZZEL_RES" =~ .*\ =\ .* ]]; then
-              QALC_RES="$FUZZEL_RES"
-              QALC_RET=0
-            else
-              QALC_RES=$(qalc "$FUZZEL_RES" 2>&1)
-              QALC_RET=$?
-            fi
-            [[ -n "$QALC_RES" ]] || exit 1
-            EXISTING=false
-            set +o pipefail
-            grep -Fxrl "$QALC_RES" "$RESULTS_DIR" | xargs -r touch
-            [[ ''${PIPESTATUS[0]} -eq 0 ]] && EXISTING=true
-            set -o pipefail
-            if [[ $QALC_RET -eq 0 ]] && ! $EXISTING; then
-              set +o pipefail
-              RES_FILE="$RESULTS_DIR"/$(date -uIs).$(tr -Cd 'a-zA-Z0-9' </dev/random | head -c 10)
-              set -o pipefail
-              cat >"$RES_FILE" <<<"$QALC_RES"
-            fi
-            [[ "$QALC_RES" =~ .*\ =\ (.*) ]] && QALC_RES="''${BASH_REMATCH[1]}"
-            [[ $QALC_RET -eq 0 ]] && wl-copy "$QALC_RES"
-            notify-send "$QALC_RES"
-          '';
-        }));
-        "Mod+E".action = spawn (lib.getExe (pkgs.writeShellApplication {
-          name = "emoji-fuzzel";
-          runtimeInputs = with pkgs; [ config.programs.fuzzel.package wtype wl-clipboard-rs ];
-          text = ''
-            FUZZEL_RES=$(fuzzel --dmenu --prompt "emoji> " <"$HOME"/.local/share/emoji-data/list.txt) || exit $?
-            [[ -n "$FUZZEL_RES" ]] || exit 1
-            wl-copy "$(cut -d ':' -f 1 <<<"$FUZZEL_RES" | tr -d '\n')" && wtype -k XF86Paste
-          '';
-        }));
-        "Print".action = spawn (lib.getExe (pkgs.writeShellApplication {
-          name = "screenshot";
-          runtimeInputs = with pkgs; [ grim slurp wl-clipboard-rs coreutils ];
-          text = ''
-            grim -g "$(slurp -b 00000080 -c FFFFFFFF -s 00000000 -w 1)" - \
-              | tee "$HOME/screenshots/$(date +"%Y-%m-%dT%H:%M:%S").png" \
-              | wl-copy --type image/png
-          '';
-        }));
-        "Shift+Print".action = spawn (lib.getExe (pkgs.writeShellApplication {
-          name = "screenshot";
-          runtimeInputs = with pkgs; [ grim niri gojq wl-clipboard-rs coreutils ];
-          text = ''
-            grim -o "$(niri msg -j workspaces | jq -r '.[] | select(.is_focused) | .output')" - \
-              | tee "$HOME/screenshots/$(date +"%Y-%m-%dT%H:%M:%S").png" \
-              | wl-copy --type image/png
-          '';
-        }));
-        "Mod+B".action = with-select-window-action ".workspace_id == ($active_workspace | tonumber)" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
-        "Mod+Shift+B".action = with-select-window-action "true" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
-
-        "Mod+H".action = focus-column-left;
-        "Mod+T".action = focus-window-down;
-        "Mod+N".action = focus-window-up;
-        "Mod+S".action = focus-column-right;
-
-        "Mod+Shift+H".action = move-column-left;
-        "Mod+Shift+T".action = move-window-down;
-        "Mod+Shift+N".action = move-window-up;
-        "Mod+Shift+S".action = move-column-right;
-
-        "Mod+Control+H".action = focus-monitor-left;
-        "Mod+Control+T".action = focus-monitor-down;
-        "Mod+Control+N".action = focus-monitor-up;
-        "Mod+Control+S".action = focus-monitor-right;
-
-        "Mod+Shift+Control+H".action = move-workspace-to-monitor-left;
-        "Mod+Shift+Control+T".action = move-workspace-to-monitor-down;
-        "Mod+Shift+Control+N".action = move-workspace-to-monitor-up;
-        "Mod+Shift+Control+S".action = move-workspace-to-monitor-right;
-
-        "Mod+G".action = focus-adjacent-workspace "down";
-        "Mod+C".action = focus-adjacent-workspace "up";
-
-        "Mod+Shift+G".action = move-column-to-adjacent-workspace "down";
-        "Mod+Shift+C".action = move-column-to-adjacent-workspace "up";
-
-        "Mod+Shift+Control+G".action = move-workspace-down;
-        "Mod+Shift+Control+C".action = move-workspace-up;
-
-        "Mod+ParenLeft".action = focus-workspace "comm";
-        "Mod+Shift+ParenLeft".action = move-column-to-workspace "comm";
-
-        "Mod+ParenRight".action = focus-workspace "web";
-        "Mod+Shift+ParenRight".action = move-column-to-workspace "web";
-
-        "Mod+BraceRight".action = focus-workspace "read";
-        "Mod+Shift+BraceRight".action = move-column-to-workspace "read";
-
-        "Mod+BraceLeft".action = focus-workspace "mon";
-        "Mod+Shift+BraceLeft".action = move-column-to-workspace "mon";
-
-        "Mod+Asterisk".action = focus-workspace "vid";
-        "Mod+Shift+Asterisk".action = move-column-to-workspace "vid";
-
-        "Mod+Plus".action = with-unnamed-workspace-action ''{"Action":{"FocusWorkspace":{"reference":{"Id": .id}}}}'';
-        "Mod+Shift+Plus".action = with-unnamed-workspace-action ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}}}}'';
-
-        "Mod+M".action = consume-or-expel-window-left;
-        "Mod+W".action = consume-or-expel-window-right;
-
-        "Mod+R".action = switch-preset-column-width;
-        "Mod+Shift+R".action = switch-preset-window-height;
-        "Mod+F".action = center-column;
-        "Mod+Shift+F".action = maximize-column;
-        "Mod+Shift+Ctrl+F".action = fullscreen-window;
-
-        "Mod+V".action = switch-focus-between-floating-and-tiling;
-        "Mod+Shift+V".action = toggle-window-floating;
-
-        "Mod+Left".action = set-column-width "-10%";
-        "Mod+Down".action = set-window-height "-10%";
-        "Mod+Up".action = set-window-height "+10%";
-        "Mod+Right".action = set-column-width "+10%";
-
-        "Mod+Shift+Z" = {
-          action = spawn (lib.getExe niri) "msg" "action" "power-off-monitors";
-          allow-when-locked = true;
-        };
-        "Mod+Shift+L".action = spawn loginctl "lock-session";
-        "Mod+Shift+E".action = quit;
-        "Mod+Shift+Minus" = {
-          action = spawn systemctl "suspend";
-          allow-when-locked = true;
-        };
-        "Mod+Shift+Control+Minus" = {
-          action = spawn systemctl "hibernate";
-          allow-when-locked = true;
-        };
-        "Mod+Shift+P" = {
-          action = spawn (lib.getExe pkgs.playerctl) "-a" "pause";
-          allow-when-locked = true;
-        };
-
-        "XF86MonBrightnessUp" = {
-          action = spawn swayosd-client "--brightness" "raise";
-          allow-when-locked = true;
-        };
-        "XF86MonBrightnessDown" = {
-          action = spawn swayosd-client "--brightness" "lower";
-          allow-when-locked = true;
-        };
-        "XF86AudioRaiseVolume" = {
-          action = spawn swayosd-client "--output-volume" "raise";
-          allow-when-locked = true;
-        };
-        "XF86AudioLowerVolume" = {
-          action = spawn swayosd-client "--output-volume" "lower";
-          allow-when-locked = true;
-        };
-        "XF86AudioMute" = {
-          action = spawn swayosd-client "--output-volume" "mute-toggle";
-          allow-when-locked = true;
-        };
-        "XF86AudioMicMute" = {
-          action = spawn swayosd-client "--input-volume" "mute-toggle";
-          allow-when-locked = true;
-        };
-
-        "Mod+Semicolon".action = spawn makoctl "dismiss" "--group";
-        "Mod+Shift+Semicolon".action = spawn makoctl "dismiss" "--all";
-        "Mod+Period".action = spawn makoctl "menu" (lib.getExe config.programs.fuzzel.package) "--dmenu";
-        "Mod+Comma".action = spawn makoctl "restore";
-
-        "Mod+Control+A".action = focus-or-spawn-action-app_id "com.saivert.pwvucontrol" "pwctl" "pwvucontrol";
-        "Mod+Control+O".action = focus-or-spawn-action-app_id "com.github.wwmm.easyeffects" "eff" "easyeffects";
-        "Mod+Control+P".action = focus-or-spawn-action-app_id "org.keepassxc.KeePassXC" "kpxc" "keepassxc";
-        "Mod+Control+B".action = focus-or-spawn-action-app_id ".blueman-manager-wrapped" "bmgr" "blueman-manager";
-        "Mod+Control+Return".action = focus-or-spawn-action-app_id "kitty-scratch" "term" "kitty" "--app-id" "kitty-scratch";
-        "Mod+Control+E".action = focus-or-spawn-action "select(.app_id == \"emacs\" and .title == \"scratch\")" "edit" "emacsclient" "-c" "--frame-parameters=(quote (name . \"scratch\"))";
+      Service = {
+        Type = "simple";
+        ExecStart = pkgs.writers.writePython3 "niri-workspace-sort" { flakeIgnore = ["E501"]; } ''
+          import os
+          import sys
+          import socket
+          import json
+
+          outputs = None
+          only = {'HDMI-A-1': {'bmr'}, 'eDP-1': {'vid'}}
+
+
+          class Niri(socket.socket):
+              def __init__(self):
+                  super().__init__(socket.AF_UNIX, socket.SOCK_STREAM)
+                  super().connect(os.environ["NIRI_SOCKET"])
+                  self.fh = super().makefile(mode='rw', buffering=1, encoding='utf-8')
+
+              def cmd(self, obj):
+                  print(json.dumps(obj, separators=(',', ':')), flush=True, file=self.fh)
+
+              def event_stream(self):
+                  self.cmd("EventStream")
+                  return self.fh
+
+
+          with Niri() as niri, Niri().event_stream() as niri_stream:
+              for line in niri_stream:
+                  workspaces = None
+                  if line_json := json.loads(line):
+                      if "WorkspacesChanged" in line_json:
+                          workspaces = line_json["WorkspacesChanged"]["workspaces"]
+
+                  if workspaces is None:
+                      continue
+
+                  old_outputs = outputs
+                  outputs = {ws["output"] for ws in workspaces}
+                  if old_outputs is None:
+                      print("Initial outputs: {}".format(outputs), file=sys.stderr)
+                      continue
+
+                  new_outputs = outputs - old_outputs
+                  if not new_outputs:
+                      continue
+                  print("New outputs: {}".format(new_outputs), file=sys.stderr)
+
+                  relevant_workspaces = list(filter(lambda ws: (ws["name"] is not None) or (ws["active_window_id"] is not None), workspaces))
+                  target_output = next(iter(outputs - set(only.keys())))
+                  if not target_output:
+                      continue
+                  for ws in relevant_workspaces:
+                      ws_ident = ws["name"] if ws["name"] is not None else (ws["output"], ws["idx"])
+                      if ws["output"] not in set(only.keys()):
+                          continue
+                      if ws_ident in only[ws["output"]]:
+                          continue
+
+                      print("{} -> {}".format(ws_ident, target_output), file=sys.stderr)
+                      niri.cmd({"Action": {"MoveWorkspaceToMonitor": {"reference": {"Id": ws["id"]}, "output": target_output}}})
+        '';
+        Restart = "on-failure";
+        RestartSec = 10;
       };
     };
+
+    programs.niri.scratchspaces = [
+      { name = "pwctl";
+        key = "Mod+Control+A";
+        spawn = ["pwvucontrol"];
+        app-id = "com.saivert.pwvucontrol";
+      }
+      { name = "kpxc";
+        exclude = [
+          { title = "^Unlock Database.*"; }
+          { title = "^Access Request.*"; }
+          { title = ".*Passkey credentials$"; }
+        ];
+        windowRuleExtra = with kdl; [
+          (sleaf "open-focused" false)
+        ];
+        key = "Mod+Control+P";
+        app-id = "org.keepassxc.KeePassXC";
+        spawn = [ "keepassxc" ];
+      }
+      { name = "bmgr";
+        key = "Mod+Control+B";
+        app-id = ".blueman-manager-wrapped";
+        spawn = [ "blueman-manager" ];
+      }
+      { name = "term";
+        key = "Mod+Control+Return";
+        app-id = "kitty-scratch";
+        spawn = [ "kitty" "--app-id" "kitty-scratch" ];
+      }
+      { name = "edit";
+        match = [ { title = "^scratch$"; app-id = "^emacs$"; } ];
+        key = "Mod+Control+E";
+        selector = "select(.app_id == \"emacs\" and .title == \"scratch\")";
+        spawn = [ "emacsclient" "-c" "--frame-parameters=(quote (name . \"scratch\"))" ];
+      }
+      { name = "eff";
+        key = "Mod+Control+O";
+        app-id = "com.github.wwmm.easyeffects";
+        spawn = [ "easyeffects" ];
+      }
+      { name = "time";
+        key = "Mod+Control+K";
+        app-id = "chrome-kimai.yggdrasil.li__-Default";
+        spawn = [ (toString (pkgs.resholve.writeScript "kimai" {
+          interpreter = pkgs.runtimeShell;
+          inputs = [ pkgs.dex ];
+          execer = [ "cannot:${lib.getExe pkgs.dex}" ];
+        } ''
+          exec dex $HOME/.local/state/nix/profile/share/applications/kimai.desktop
+        '')) ];
+        windowRuleExtra = with kdl; [
+          (sleaf "block-out-from" "screencast")
+        ];
+      }
+    ];
+    programs.niri.config =
+      let
+        inherit (kdl) node plain leaf flag;
+        optional-node = cond: v:
+          if cond
+          then v
+          else null;
+        opt-props = lib.filterAttrs (lib.const (value: value != null));
+        normalize-nodes = nodes: lib.remove null (lib.flatten nodes);
+      in
+        normalize-nodes [
+          (flag "prefer-no-csd")
+
+          (sleaf "screenshot-path" "~/screenshots/%Y-%m-%dT%H:%M:%S.png")
+
+          (plain "hotkey-overlay" [
+            (flag "skip-at-startup")
+          ])
+
+          (plain "input" [
+            (plain "keyboard" [
+              (sleaf "repeat-delay" 300)
+              (sleaf "repeat-rate" 50)
+
+              (plain "xkb" [
+                (sleaf "layout" "us,us")
+                (sleaf "variant" "dvp,")
+                (sleaf "options" "compose:caps,grp:win_space_toggle")
+              ])
+            ])
+
+            (flag "workspace-auto-back-and-forth")
+            # (sleaf "focus-follows-mouse" {})
+            # (flag "warp-mouse-to-focus")
+
+            # (plain "touchpad" [ (flag "off") ])
+            (plain "trackball" [
+              (sleaf "scroll-method" "on-button-down")
+              (sleaf "scroll-button" 278)
+            ])
+            (plain "touch" [
+              (sleaf "map-to-output" "eDP-1")
+            ])
+          ])
+
+          (plain "gestures" [
+            (plain "hot-corners" [(flag "off")])
+          ])
+
+          (plain "environment" (lib.mapAttrsToList sleaf {
+            NIXOS_OZONE_WL = "1";
+            QT_QPA_PLATFORM = "wayland";
+            QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
+            GDK_BACKEND = "wayland";
+            SDL_VIDEODRIVER = "wayland";
+            DISPLAY = ":0";
+            ELECTRON_OZONE_PLATFORM_HINT = "auto";
+            SSH_ASKPASS_REQUIRE = "prefer";
+            SSH_ASKPASS = lib.getExe pkgs.kdePackages.ksshaskpass;
+            SUDO_ASKPASS = lib.getExe pkgs.kdePackages.ksshaskpass;
+          }))
+
+          (node "output" ["eDP-1"] [
+            (sleaf "scale" 1.5)
+            (sleaf "position" { x = 0; y = 0; })
+          ])
+          (node "output" ["Ancor Communications Inc ASUS PB287Q 0x0000DD9B"] [
+            (sleaf "scale" 1.5)
+            (sleaf "position" { x = 2560; y = 0; })
+          ])
+          (node "output" ["HP Inc. HP 727pu CN4417143K"] [
+            (sleaf "mode" "2560x1440@119.998")
+            (sleaf "scale" 1)
+            (sleaf "position" { x = 2560; y = 0; })
+            (flag "variable-refresh-rate")
+          ])
+
+          (plain "debug" [
+            (sleaf "render-drm-device" "/dev/dri/by-path/pci-0000:00:02.0-render")
+          ])
+
+          (plain "animations" [
+            (sleaf "slowdown" 0.5)
+            (plain "workspace-switch" [(flag "off")])
+          ])
+
+          (plain "layout" [
+            (sleaf "gaps" 8)
+            (plain "struts" [
+              (sleaf "left" 26)
+              (sleaf "right" 26)
+              (sleaf "top" 0)
+              (sleaf "bottom" 0)
+            ])
+            (plain "border" [
+              (sleaf "width" 2)
+              (sleaf "active-gradient" {
+                from = "hsla(195 100% 45% 1)";
+                to = "hsla(155 100% 37.5% 1)";
+                angle = 29;
+                relative-to = "workspace-view";
+              })
+              (sleaf "inactive-gradient" {
+                from = "hsla(0 0% 27.7% 1)";
+                to = "hsla(0 0% 23% 1)";
+                angle = 29;
+                relative-to = "workspace-view";
+              })
+            ])
+            (plain "focus-ring" [
+              (flag "off")
+            ])
+
+            (plain "preset-column-widths" (map (prop: sleaf "proportion" prop) [
+              (1. / 4.) (1. / 3.) (1. / 2.) (2. / 3.) (3. / 4.) (1.)
+            ]))
+            (plain "default-column-width" [ (sleaf "proportion" (1. / 2.)) ])
+            (plain "preset-window-heights" (map (prop: sleaf "proportion" prop) [
+              (1. / 3.) (1. / 2.) (2. / 3.) (1.)
+            ]))
+
+            (flag "always-center-single-column")
+
+            (plain "tab-indicator" [
+              (sleaf "gap" 4)
+              (sleaf "width" 8)
+              (sleaf "gaps-between-tabs" 4)
+              (flag "place-within-column")
+              (sleaf "length" { total-proportion = 1.; })
+              (sleaf "active-gradient" {
+                from = "hsla(195 100% 60% 0.75)";
+                to = "hsla(155 100% 50% 0.75)";
+                angle = 29;
+                relative-to = "workspace-view";
+              })
+              (sleaf "inactive-gradient" {
+                from = "hsla(0 0% 42% 0.66)";
+                to = "hsla(0 0% 35% 0.66)";
+                angle = 29;
+                relative-to = "workspace-view";
+              })
+            ])
+          ])
+
+          (plain "cursor" [
+            (flag "hide-when-typing")
+          ])
+
+          (map (name:
+            (node "workspace" [name] [
+              (sleaf "open-on-output" "eDP-1")
+            ])
+          ) (map ({name, ...}: name) cfg.scratchspaces))
+          (map (name:
+            (sleaf "workspace" name)
+          ) ["comm" "web" "vid" "bmr"])
+
+          (plain "window-rule" [
+            (sleaf "clip-to-geometry" true)
+          ])
+
+          (plain "window-rule" [
+            (sleaf "match" { is-floating = true; })
+            (sleaf "geometry-corner-radius" 8)
+            (plain "shadow" [ (flag "on") ])
+          ])
+
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^org\\.keepassxc\\.KeePassXC$"; })
+            (sleaf "block-out-from" "screencast")
+          ])
+          (plain "window-rule" (normalize-nodes [
+            (map (title:
+              (sleaf "match" { app-id = "^org\\.keepassxc\\.KeePassXC$"; inherit title; })
+            ) ["^Unlock Database.*" "^Access Request.*" ".*Passkey credentials$" "Browser Access Request$"])
+            (sleaf "open-focused" true)
+            (sleaf "open-floating" true)
+          ]))
+
+          (map ({ name, match, exclude, windowRuleExtra, ... }:
+            (optional-node (match != []) (plain "window-rule" (normalize-nodes [
+              (map (sleaf "match") match)
+              (map (sleaf "exclude") exclude)
+              (sleaf "open-on-workspace" name)
+              (sleaf "open-maximized" true)
+              windowRuleExtra
+            ])))
+          ) cfg.scratchspaces)
+
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^emacs$"; })
+            (sleaf "match" { app-id = "^firefox$"; })
+            (plain "default-column-width" [(sleaf "proportion" (2. / 3.))])
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^kitty$"; })
+            (sleaf "match" { app-id = "^kitty-play$"; })
+            (plain "default-column-width" [(sleaf "proportion" (1. / 3.))])
+          ])
+
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^thunderbird$"; })
+            (sleaf "match" { app-id = "^Element$"; })
+            (sleaf "match" { app-id = "^chrome-web\.openrainbow\.com__-Default$"; })
+            (sleaf "open-on-workspace" "comm")
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^firefox$"; })
+            (sleaf "open-on-workspace" "web")
+            (sleaf "open-maximized" true)
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^mpv$"; })
+            (sleaf "open-on-workspace" "vid")
+            (plain "default-column-width" [(sleaf "proportion" 1.)])
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^kitty-play$"; })
+            (sleaf "open-on-workspace" "vid")
+            (sleaf "open-focused" false)
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^chrome-audiobookshelf\.yggdrasil\.li__-Default$"; })
+            (sleaf "match" { app-id = "^YouTube Music Desktop App$"; })
+            (sleaf "open-on-workspace" "vid")
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^pdfpc$"; })
+            (plain "default-column-width" [(sleaf "proportion" 1.)])
+          ])
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^pdfpc$"; title = "^.*presentation.*$"; })
+            (plain "default-column-width" [(sleaf "proportion" 1.)])
+            (sleaf "open-fullscreen" true)
+            (sleaf "open-on-workspace" "bmr")
+            (sleaf "open-focused" false)
+          ])
+          (plain "window-rule" (normalize-nodes [
+            (map (sleaf "match") [
+              { app-id = "^Gimp-"; title = "^Quit GIMP$"; }
+              { app-id = "^org\\.kde\\.polkit-kde-authentication-agent-1$"; }
+              { app-id = "^xdg-desktop-portal-gtk$"; }
+            ])
+            (sleaf "open-floating" true)
+          ]))
+          (plain "window-rule" [
+            (sleaf "match" { app-id = "^org\\.pwmt\\.zathura$"; })
+            (sleaf "match" { app-id = "^evince$"; })
+            (sleaf "match" { app-id = "^org\\.gnome\\.Papers$"; })
+            (sleaf "default-column-display" "tabbed")
+          ])
+
+          (plain "layer-rule" [
+            (sleaf "match" { namespace = "^notifications$"; })
+            (sleaf "match" { namespace = "^waybar$"; })
+            (sleaf "match" { namespace = "^launcher$"; })
+            (sleaf "block-out-from" "screencast")
+          ])
+
+          (plain "binds"
+            (let
+              bind = name: cfg: node name [(lib.removeAttrs cfg ["action"])] (lib.mapAttrsToList leaf (lib.removeAttrs cfg.action ["__functor"]));
+            in
+              normalize-nodes [
+                (lib.mapAttrsToList bind (with config.lib.niri.actions; {
+                  "Mod+Slash".action = show-hotkey-overlay;
+
+                  "Mod+Return".action = spawn terminal;
+                  "Mod+Shift+Return".action =
+                    let
+                      nushellKitty = pkgs.symlinkJoin {
+                        name = "nushell-kitty";
+                        paths = [ config.programs.kitty.package ];
+                        buildInputs = [ pkgs.makeWrapper ];
+                        postBuild = ''
+                          wrapProgram $out/bin/kitty \
+                            --add-flags "--config ${pkgs.writeText "kitty.conf" ''
+                              include $HOME/${config.xdg.configFile."kitty/kitty.conf".target}
+                              shell ${lib.getExe config.programs.nushell.package}
+                            ''}"
+                        '';
+                      };
+                    in spawn (lib.getExe' nushellKitty "kitty");
+                  "Mod+Q".action = close-window;
+                  "Mod+O".action = spawn (lib.getExe config.programs.fuzzel.package);
+                  "Mod+Shift+O".action = spawn (lib.getExe config.programs.fuzzel.package) "--list-executables-in-path";
+
+                  "Mod+Alt+E".action = spawn (lib.getExe' config.services.emacs.package "emacsclient") "-c";
+                  "Mod+Alt+Y".action = spawn (lib.getExe (pkgs.writeShellApplication {
+                    name = "queue-yt-dlp";
+                    runtimeInputs = with pkgs; [ wl-clipboard-rs socat ];
+                    text = ''
+                      socat STDIO UNIX-CONNECT:"$XDG_RUNTIME_DIR"/yt-dlp.sock <<<$'{ "urls": ["'"$(wl-paste)"$'"] }'
+                    '';
+                  }));
+                  "Mod+Alt+L".action = spawn (lib.getExe (pkgs.writeShellApplication {
+                    name = "queue-yt-dlp";
+                    runtimeInputs = with pkgs; [ wl-clipboard-rs config.programs.kitty.package ];
+                    text = ''
+                      exec -- kitty --app-id kitty-play --directory "$HOME"/media mpv "$(wl-paste)"
+                    '';
+                  }));
+                  "Mod+Alt+M".action = spawn (lib.getExe' pkgs.screen-message "sm") "-n" "Fira Mono" "-a" "1" "-f" "#fff" "-b" "#000";
+
+                  "Mod+U".action = spawn (lib.getExe (pkgs.writeShellApplication {
+                    name = "qalc-fuzzel";
+                    runtimeInputs = with pkgs; [ wl-clipboard-rs libqalculate config.programs.fuzzel.package coreutils findutils libnotify gnugrep ];
+                    text = ''
+                      RESULTS_DIR="$HOME/.cache/qalc-fuzzel"
+                      prev() {
+                        FOUND=false
+                        while IFS= read -r line; do
+                          [[ -n "$line" ]] || continue
+                          FOUND=true
+                          echo "$line"
+                        done < <(export LC_ALL=C.UTF-8; echo; find "$RESULTS_DIR" -type f -printf $'%T@ %p\n' | sort -n | cut -d' ' -f2- | xargs -r cat)
+                        $FOUND || echo
+                      }
+                      FUZZEL_RES=$(prev | fuzzel --dmenu --prompt "qalc> " --width=60) || exit $?
+                      if [[ "$FUZZEL_RES" =~ .*\ =\ .* ]]; then
+                        QALC_RES="$FUZZEL_RES"
+                        QALC_RET=0
+                      else
+                        QALC_RES=$(qalc -set "autocalc off" "$FUZZEL_RES" 2>&1)
+                        QALC_RET=$?
+                      fi
+                      [[ -n "$QALC_RES" ]] || exit 1
+                      EXISTING=false
+                      set +o pipefail
+                      grep -Fxrl "$QALC_RES" "$RESULTS_DIR" | xargs -r touch
+                      [[ ''${PIPESTATUS[0]} -eq 0 ]] && EXISTING=true
+                      set -o pipefail
+                      if [[ $QALC_RET -eq 0 ]] && ! $EXISTING; then
+                        set +o pipefail
+                        RES_FILE="$RESULTS_DIR"/$(date -uIs).$(tr -Cd 'a-zA-Z0-9' </dev/random | head -c 10)
+                        set -o pipefail
+                        cat >"$RES_FILE" <<<"$QALC_RES"
+                      fi
+                      [[ "$QALC_RES" =~ .*\ =\ (.*) ]] && QALC_RES="''${BASH_REMATCH[1]}"
+                      [[ $QALC_RET -eq 0 ]] && wl-copy "$QALC_RES"
+                      notify-send "$QALC_RES"
+                    '';
+                  }));
+                  "Mod+Shift+U".action =
+                    let
+                      qalcKitty = pkgs.symlinkJoin {
+                        name = "qalc-kitty";
+                        paths = [ config.programs.kitty.package ];
+                        buildInputs = [ pkgs.makeWrapper ];
+                        postBuild = ''
+                          wrapProgram $out/bin/kitty \
+                            --add-flags "--config ${pkgs.writeText "kitty.conf" ''
+                              include $HOME/${config.xdg.configFile."kitty/kitty.conf".target}
+                              shell ${lib.getExe pkgs.libqalculate}
+                            ''}"
+                        '';
+                      };
+                    in spawn (lib.getExe' qalcKitty "kitty");
+                  "Mod+E".action = spawn (lib.getExe (pkgs.writeShellApplication {
+                    name = "emoji-fuzzel";
+                    runtimeInputs = with pkgs; [ config.programs.fuzzel.package wtype wl-clipboard-rs ];
+                    text = ''
+                      FUZZEL_RES=$(fuzzel --dmenu --prompt "emoji> " --cache "$HOME"/.cache/fuzzel-emoji --width=60 <"$HOME"/.local/share/emoji-data/list.txt) || exit $?
+                      [[ -n "$FUZZEL_RES" ]] || exit 1
+                      wl-copy "$(cut -d ':' -f 1 <<<"$FUZZEL_RES" | tr -d '\n')" && wtype -k XF86Paste
+                    '';
+                  }));
+                  "Print".action = screenshot;
+                  "Control+Print".action = screenshot-window;
+                  "Shift+Print".action = kdl.magic-leaf "screenshot-screen";
+                  "Mod+B".action = with-select-window-action ".workspace_id == ($active_workspace | tonumber)" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
+                  "Mod+Shift+B".action = with-select-window-action "true" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
+
+                  "Mod+Escape" = {
+                    allow-inhibiting = false;
+                    action = toggle-keyboard-shortcuts-inhibit;
+                  };
+
+                  "Mod+H".action = focus-column-left;
+                  "Mod+T".action = focus-window-down;
+                  "Mod+N".action = focus-window-up;
+                  "Mod+S".action = focus-column-right;
+
+                  "Mod+Shift+H".action = move-column-left;
+                  "Mod+Shift+T".action = move-window-down;
+                  "Mod+Shift+N".action = move-window-up;
+                  "Mod+Shift+S".action = move-column-right;
+
+                  "Mod+Control+H".action = focus-monitor-left;
+                  "Mod+Control+T".action = focus-monitor-down;
+                  "Mod+Control+N".action = focus-monitor-up;
+                  "Mod+Control+S".action = focus-monitor-right;
+
+                  "Mod+Shift+Control+H".action = move-workspace-to-monitor-left;
+                  "Mod+Shift+Control+T".action = move-workspace-to-monitor-down;
+                  "Mod+Shift+Control+N".action = move-workspace-to-monitor-up;
+                  "Mod+Shift+Control+S".action = move-workspace-to-monitor-right;
+
+                  "Mod+G".action = focus-adjacent-workspace "down";
+                  "Mod+C".action = focus-adjacent-workspace "up";
+
+                  "Mod+Shift+G".action = move-column-to-adjacent-workspace "down";
+                  "Mod+Shift+C".action = move-column-to-adjacent-workspace "up";
+
+                  "Mod+Shift+Control+G".action = move-workspace-down;
+                  "Mod+Shift+Control+C".action = move-workspace-up;
+
+                  "Mod+ParenLeft".action = focus-workspace "comm";
+                  "Mod+Shift+ParenLeft".action = kdl.magic-leaf "move-column-to-workspace" "comm";
+
+                  "Mod+ParenRight".action = focus-workspace "web";
+                  "Mod+Shift+ParenRight".action = kdl.magic-leaf "move-column-to-workspace" "web";
+
+                  "Mod+BraceRight".action = focus-workspace "read";
+                  "Mod+Shift+BraceRight".action = kdl.magic-leaf "move-column-to-workspace" "read";
+
+                  "Mod+BraceLeft".action = focus-workspace "mon";
+                  "Mod+Shift+BraceLeft".action = kdl.magic-leaf "move-column-to-workspace" "mon";
+
+                  "Mod+Asterisk".action = focus-workspace "vid";
+                  "Mod+Shift+Asterisk".action = kdl.magic-leaf "move-column-to-workspace" "vid";
+
+                  "Mod+Plus".action = with-unnamed-workspace-action ''{"Action":{"FocusWorkspace":{"reference":{"Id": .id}}}}'';
+                  "Mod+Shift+Plus".action = with-unnamed-workspace-action ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}, "focus": true}}}'';
+
+                  "Mod+M".action = consume-or-expel-window-left;
+                  "Mod+W".action = consume-or-expel-window-right;
+
+                  "Mod+Shift+M".action = toggle-column-tabbed-display;
+
+                  "Mod+R".action = switch-preset-column-width;
+                  "Mod+Shift+R".action = maximize-column;
+                  "Mod+Shift+Ctrl+R".action = switch-preset-window-height;
+                  "Mod+F".action = center-column;
+                  "Mod+Shift+F".action = toggle-windowed-fullscreen;
+                  "Mod+Ctrl+Shift+F".action = fullscreen-window;
+
+                  "Mod+V".action = switch-focus-between-floating-and-tiling;
+                  "Mod+Shift+V".action = toggle-window-floating;
+
+                  "Mod+Left".action = set-column-width "-10%";
+                  "Mod+Down".action = set-window-height "-10%";
+                  "Mod+Up".action = set-window-height "+10%";
+                  "Mod+Right".action = set-column-width "+10%";
+
+                  "Mod+Shift+Z" = {
+                    action = spawn (lib.getExe niri) "msg" "action" "power-off-monitors";
+                    allow-when-locked = true;
+                  };
+                  "Mod+Shift+L".action = spawn loginctl "lock-session";
+                  "Mod+Shift+E".action = quit;
+                  "Mod+Shift+Minus" = {
+                    action = spawn systemctl "suspend";
+                    allow-when-locked = true;
+                  };
+                  "Mod+Shift+Control+Minus" = {
+                    action = spawn systemctl "hibernate";
+                    allow-when-locked = true;
+                  };
+                  "Mod+Shift+P" = {
+                    action = spawn (lib.getExe pkgs.playerctl) "-a" "pause";
+                    allow-when-locked = true;
+                  };
+
+                  "XF86MonBrightnessUp" = {
+                    action = spawn swayosd-client "--brightness" "raise";
+                    allow-when-locked = true;
+                  };
+                  "XF86MonBrightnessDown" = {
+                    action = spawn swayosd-client "--brightness" "lower";
+                    allow-when-locked = true;
+                  };
+                  "XF86AudioRaiseVolume" = {
+                    action = spawn swayosd-client "--output-volume" "raise";
+                    allow-when-locked = true;
+                  };
+                  "XF86AudioLowerVolume" = {
+                    action = spawn swayosd-client "--output-volume" "lower";
+                    allow-when-locked = true;
+                  };
+                  "XF86AudioMute" = {
+                    action = spawn swayosd-client "--output-volume" "mute-toggle";
+                    allow-when-locked = true;
+                  };
+                  "XF86AudioMicMute" = {
+                    action = spawn swayosd-client "--input-volume" "mute-toggle";
+                    allow-when-locked = true;
+                  };
+
+                  "Mod+Semicolon".action = spawn makoctl "dismiss" "--group";
+                  "Mod+Shift+Semicolon".action = spawn makoctl "dismiss" "--all";
+                  "Mod+Period".action = spawn makoctl "menu" "--" (lib.getExe config.programs.fuzzel.package) "--dmenu";
+                  "Mod+Comma".action = spawn makoctl "restore";
+
+                  "Mod+Control+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"FocusWorkspace\":{\"reference\":{\"Id\": $workspace_id}}}}";
+                  "Mod+Control+Shift+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"MoveColumnToWorkspace\":{\"reference\":{\"Id\": $workspace_id}, \"focus\": true}}}";
+
+                  "Mod+X".action = set-dynamic-cast-window;
+                  "Mod+Shift+X".action = set-dynamic-cast-monitor;
+                  "Mod+Control+Shift+X".action = clear-dynamic-cast-target;
+
+                  "Mod+D".action = with-urgent-window-action "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
+                  "Mod+Shift+D".action = with-focused-window-action "{\"Action\":{\"UnsetUrgent\":{\"id\": .id}}}";
+
+                  "Mod+K".action = spawn (lib.getExe' pkgs.worktime "worktime-ui");
+                  "Mod+Shift+K".action = spawn (lib.getExe' pkgs.worktime "worktime-stop");
+                }))
+                (map ({ name, selector, spawn, key, ...}: if key != null && selector != null && spawn != null then bind key { action = focus-or-spawn-action selector name spawn; } else null) cfg.scratchspaces)
+                (map ({ name, moveKey, ...}: if moveKey != null then bind moveKey { action = kdl.magic-leaf "move-column-to-workspace" name; } else null) cfg.scratchspaces)
+              ]
+            ))
+        ];
   };
 }
diff --git a/accounts/gkleen@sif/niri/mako.nix b/accounts/gkleen@sif/niri/mako.nix
index 0a10555a..703d5f7b 100644
--- a/accounts/gkleen@sif/niri/mako.nix
+++ b/accounts/gkleen@sif/niri/mako.nix
@@ -3,33 +3,30 @@
   config = {
     services.mako = {
       enable = true;
-      font = "Fira Sans 10";
-      format = "<i>%s</i>\\n%b";
-      margin = "2";
-      maxVisible = -1;
-      backgroundColor = "#000000dd";
-      progressColor = "source #223544ff";
-      width = 384;
-      extraConfig = ''
-        outer-margin=1
-        max-history=100
-        max-icon-size=48
+      settings = {
+        font = "Fira Sans 10";
+        format = "<i>%s</i>\\n%b";
+        margin = "2";
+        max-visible = -1;
+        background-color = "#000000dd";
+        progress-color = "source #223544ff";
+        width = 384;
+        outer-margin = 1;
+        max-history = 100;
+        max-icon-size = 48;
 
-        [grouped]
-        format=<b>(%g)</b> <i>%s</i>\n%b
-
-        [urgency=low]
-        text-color=#999999ff
-
-        [urgency=critical]
-        background-color=#900000dd
-
-        [app-name=Element]
-        group-by=summary
-
-        [mode=silent]
-        invisible=1
-      '';
+        grouped.format = "<b>(%g)</b> <i>%s</i>\\n%b";
+        "urgency=low".text-color = "#999999ff";
+        "urgency=critical".background-color = "#900000dd";
+        "app-name=Element".group-by = "summary";
+        "app-name=poweralertd" = {
+          history = false;
+          ignore-timeout = true;
+          default-timeout = 2000;
+        };
+        "app-name=worktime".history = false;
+        "mode=silent".invisible = true;
+      };
       package = pkgs.symlinkJoin {
         name = "${pkgs.mako.name}-wrapped";
         paths = with pkgs; [ mako ];
diff --git a/accounts/gkleen@sif/niri/swayosd.nix b/accounts/gkleen@sif/niri/swayosd.nix
index 984927c2..54ebb302 100644
--- a/accounts/gkleen@sif/niri/swayosd.nix
+++ b/accounts/gkleen@sif/niri/swayosd.nix
@@ -3,9 +3,10 @@
   config = {
     services.swayosd = {
       enable = true;
-      topMargin = 0.946154;
+      topMargin = 0.4769706078;
       stylePath = pkgs.runCommand "style.css" {
-        src = pkgs.writeText "style.scss" ''
+        passAsFile = [ "src" ];
+        src = ''
           window#osd {
             padding: 12px 20px;
             border-radius: 999px;
@@ -59,7 +60,7 @@
           }
         '';
         buildInputs = with pkgs; [sass];
-      } "scss -C --sourcemap=none --style=compact $src $out";
+      } "scss -C --sourcemap=none --style=compact $srcPath $out";
     };
   };
 }
diff --git a/accounts/gkleen@sif/niri/waybar.nix b/accounts/gkleen@sif/niri/waybar.nix
index c3820508..c02a9a76 100644
--- a/accounts/gkleen@sif/niri/waybar.nix
+++ b/accounts/gkleen@sif/niri/waybar.nix
@@ -20,15 +20,21 @@ in {
         {
           layer = "top";
           position = "top";
-          height = 14;
+          height = 21;
           output = [ "eDP-1" "DP-2" "DP-3" ];
           modules-left = [ "niri/workspaces" ];
           modules-center = [ "niri/window" ];
           modules-right = [ "custom/worktime" "custom/worktime-today"
             "custom/weather"
             "custom/keymap"
-            "privacy" "tray" "wireplumber" "backlight" "battery" "idle_inhibitor" "custom/mako" "clock" ];
+            "privacy" "tray" "wireplumber" "backlight" "battery" "idle_inhibitor" "custom/mako" "custom/lid_inhibitor" "clock" ];
 
+          "custom/lid_inhibitor" = {
+            format = "{}";
+            return-type = "json";
+            exec = lib.getExe pkgs.waybar-systemd-inhibit;
+            on-click = lib.getExe' pkgs.waybar-systemd-inhibit "waybar-systemd-inhibit-toggle";
+          };
           "custom/mako" = {
             format = "{}";
             return-type = "json";
@@ -61,7 +67,7 @@ in {
                       text = f"<span font=\"Symbols Nerd Font Mono\" size=\"90%\">{icon}</span>"  # noqa: E501
                       if is_silent:
                           text = f"<span color=\"#ffffff\">{text}</span>"
-                      print(json.dumps({'text': text}, separators=(',', ':')), flush=True)  # noqa: E501
+                      print(json.dumps({'text': text, 'tooltip': ', '.join(modes)}, separators=(',', ':')), flush=True)  # noqa: E501
 
                   async def on_properties_changed(interface_name, changed_properties, invalidated_properties):  # noqa: E501
                       if "Modes" not in invalidated_properties:
@@ -122,16 +128,16 @@ in {
           };
           "custom/worktime" = {
             interval = 60;
-            exec = lib.getExe pkgs.worktime;
-            tooltip = false;
+            exec = "${lib.getExe pkgs.worktime} time --waybar";
+            return-type = "json";
           };
           "custom/worktime-today" = {
             interval = 60;
-            exec = "${lib.getExe pkgs.worktime} today";
-            tooltip = false;
+            exec = "${lib.getExe pkgs.worktime} today --waybar";
+            return-type = "json";
           };
           "niri/workspaces" = {
-            ignore = ["eff" "pwctl" "kpxc" "bmgr" "edit" "term"];
+            ignore = map ({ name, ... }: name) config.programs.niri.scratchspaces;
           };
           "niri/window" = {
             separate-outputs = true;
@@ -211,13 +217,13 @@ in {
           layer = "top";
           position = "top";
           height = 14;
-          output = [ "!eDP-1" "!DP-2" "!DP-3" ];
+          output = [ "!eDP-1" "!DP-2" "!DP-3" "*" ];
           modules-left = [ "niri/workspaces" ];
           modules-center = [ "niri/window" ];
           modules-right = [ "clock" ];
 
           "niri/workspaces" = {
-            ignore = ["pwctl" "kpxc" "bmgr" "edit" "term"];
+            ignore = map ({ name, ... }: name) config.programs.niri.scratchspaces;
           };
           "niri/window" = {
             separate-outputs = true;
@@ -254,10 +260,10 @@ in {
         }
 
         .modules-left {
-          margin-left: 12px;
+          margin-left: 38px;
         }
         .modules-right {
-          margin-right: 12px;
+          margin-right: 38px;
         }
 
         .module {
@@ -293,7 +299,7 @@ in {
         #tray {
           margin: 0;
         }
-        #battery, #idle_inhibitor, #backlight, #wireplumber, #custom-mako {
+        #battery, #idle_inhibitor, #backlight, #wireplumber, #custom-mako, #custom-lid_inhibitor {
           color: @grey;
           margin: 0 5px 0 2px;
         }
@@ -302,7 +308,11 @@ in {
           margin-left: 6px;
         }
         #custom-mako {
-          margin-right: 2px;
+          margin-right: 4px;
+          margin-left: 3px;
+        }
+        #custom-lid_inhibitor {
+          margin-right: 3px;
           margin-left: 3px;
         }
         #battery {
@@ -323,8 +333,14 @@ in {
         #idle_inhibitor.activated {
           color: @white;
         }
+        #custom-worktime.running, #custom-worktime-today.running {
+          color: @white;
+        }
+        #custom-worktime.over, #custom-worktime-today.over {
+          color: @orange;
+        }
 
-        #idle_inhibitor {
+        #idle_inhibitor, #custom-lid_inhibitor {
           padding-top: 1px;
         }
 
@@ -334,6 +350,7 @@ in {
         }
         #clock {
           /* margin-right: 5px; */
+          font-feature-settings: "tnum";
         }
       '';
     };
diff --git a/accounts/gkleen@sif/ssh-hosts.nix b/accounts/gkleen@sif/ssh-hosts.nix
index 107f1e76..a250509b 100644
--- a/accounts/gkleen@sif/ssh-hosts.nix
+++ b/accounts/gkleen@sif/ssh-hosts.nix
@@ -1,5 +1,12 @@
-{ pkgs, ... }:
-{
+{ lib, pkgs, ... }:
+let
+  autosshProxyPorts = {
+    "ssh.math.lmu.de" = 8118;
+    "mathw0h" = 8122;
+    "mathw0e" = 8124;
+  };
+  autosshProxy = host: "${lib.getExe pkgs.socat} - SOCKS4A:127.0.0.1:%h:%p,socksport=${toString autosshProxyPorts.${host}}";
+in {
   "git.ymir" =
     { hostname = "ymir.yggdrasil.li";
       user = "gitolite";
@@ -290,15 +297,15 @@
     };
   "mathw0d" =
     { hostname = "mathw0d.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mathw0e" =
     { hostname = "mathw0e.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mathw0f" =
     { hostname = "mathw0f.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mathw0g" =
     { hostname = "mathw0g.mathinst.loc";
@@ -306,8 +313,8 @@
   "mathw0h" =
     { hostname = "mathw0h.mathinst.loc";
     };
-  "proxy.mathw0g" =
-    { hostname = "mathw0g.mathinst.loc";
+  "proxy.ssh.math.lmu.de" =
+    { hostname = "ssh.math.lmu.de";
       extraOptions = {
         ControlPath = "none";
         ExitOnForwardFailure = "yes";
@@ -317,7 +324,17 @@
     };
   "proxy.mathw0h" =
     { hostname = "mathw0h.mathinst.loc";
-      proxyJump = "proxy.mathw0g";
+      proxyCommand = autosshProxy "ssh.math.lmu.de";
+      extraOptions = {
+        ControlPath = "none";
+        ExitOnForwardFailure = "yes";
+        ServerAliveCountMax = "15";
+        ServerAliveInterval = "2";
+      };
+    };
+  "proxy.mathw0e" =
+    { hostname = "mathw0e.mathinst.loc";
+      proxyCommand = autosshProxy "mathw0h";
       extraOptions = {
         ControlPath = "none";
         ExitOnForwardFailure = "yes";
@@ -327,7 +344,7 @@
     };
   "vrt-kvm06" =
     { hostname = "vrt-kvm06";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -336,7 +353,7 @@
     };
   "vrt-kvm05" =
     { hostname = "vrt-kvm05";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -345,7 +362,7 @@
     };
   "vrt-kvm04" =
     { hostname = "vrt-kvm04";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -354,7 +371,7 @@
     };
   "vrt-kvm02" =
     { hostname = "vrt-kvm02";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -363,7 +380,7 @@
     };
   "vrt-kvm03" =
     { hostname = "vrt-kvm03";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -372,7 +389,7 @@
     };
   "vrt-kvm01" =
     { hostname = "vrt-kvm01";
-      proxyJump = "mathw0e";
+      proxyCommand = autosshProxy "mathw0e";
       user = "root";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -381,39 +398,44 @@
     };
   "tts-www01" =
     { hostname = "tts-www01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "vpn-wg01" =
     { hostname = "vpn-wg01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "repo-apt01" =
     { hostname = "repo-apt01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "ldap-lmumr01" =
     { hostname = "ldap-lmumr01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "mail-mi01" =
     { hostname = "mail-mi01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mail-www02" =
     { hostname = "mail-www02.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "dpl-fai01" =
     { hostname = "dpl-fai01.mathinst.loc";
       user = "root";
     };
+  "dpl-fai02" =
+    { hostname = "dpl-fai02.mathinst.loc";
+      user = "root";
+      proxyJump = "mgmt01";
+    };
   "math05" =
     { hostname = "math05.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       extraOptions.KexAlgorithms = "+diffie-hellman-group1-sha1";
     };
   "switch01" =
@@ -439,20 +461,20 @@
     };
   "www-mi01" =
     { hostname = "www-mi01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "cip04" =
     { hostname = "cip04.cipmath.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "mgmt-cls01" =
     { user = "root";
       hostname = "mgmt-cls01.cipmath.loc";
-      proxyJump = "ssh.math.lmu.de";
+      proxyCommand = autosshProxy "ssh.math.lmu.de";
     };
   "mgmt01" =
     { hostname = "mgmt01.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
       user = "root";
     };
   "ssh-lb01" =
@@ -471,17 +493,17 @@
   "rdlx02" = { hostname = "rdlx02.mathinst.loc"; proxyJump = "mgmt01"; };
   "math0d" =
     { hostname = "math0d.mathinst.loc";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "dhcp01" =
     { hostname = "dhcp01.mathinst.loc";
       user = "root";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "dhcp02" =
     { hostname = "dhcp02.mathinst.loc";
       user = "root";
-      proxyJump = "mathw0h";
+      proxyCommand = autosshProxy "mathw0h";
     };
   "cc-gpu-l01" =
     { hostname = "cc-gpu-l01.mathinst.loc";
@@ -546,7 +568,7 @@
       user = "root";
     };
   "nas*" =
-    { proxyJump = "mathw0e";
+    { proxyCommand = autosshProxy "mathw0e";
       user = "admin";
       extraOptions = {
         PasswordAuthentication = "yes";
@@ -554,9 +576,4 @@
         HostKeyAlgorithms = "+ecdsa-sha2-nistp256";
       };
     };
-  "game01" =
-    { hostname = "game01.yggdrasil.li";
-      user = "factorio";
-      identityFile = "~/.ssh/gkleen@sif.midgard.yggdrasil";
-    };
 }
diff --git a/accounts/gkleen@sif/synadm/default.nix b/accounts/gkleen@sif/synadm/default.nix
new file mode 100644
index 00000000..0a8e0d4c
--- /dev/null
+++ b/accounts/gkleen@sif/synadm/default.nix
@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  home.packages = with pkgs; [ synadm ];
+  sops.secrets."synadm.yaml" = {
+    format = "binary";
+    sopsFile = ./synadm_yaml;
+    path = config.xdg.configHome + "/synadm.yaml";
+  };
+}
diff --git a/accounts/gkleen@sif/synadm/synadm_yaml b/accounts/gkleen@sif/synadm/synadm_yaml
new file mode 100644
index 00000000..8d951ccc
--- /dev/null
+++ b/accounts/gkleen@sif/synadm/synadm_yaml
@@ -0,0 +1,15 @@
+{
+        "data": "ENC[AES256_GCM,data:qJy4Pmbbxja4jmW7OaHsD0mQZ7anZwLhiVmAgkavb+CqwWGDnUBXdz22/MHCbxng5NshcFSpBoCBhgY6B9V2bUiES6bH9AtMlDcs9ebKGMArBTUTnQ2MjWQGfQTqraWdNgy+n327uj9swwCH8EZXdYH/Hlv0t/re470W+VOHeXhGghQ3Y9IGz2sgfvMGr8QxaJNydZz85rgs5QUP/PglCwWIOw2mY1EX2vYwnmiAo49LmIEaxWvRi++KHaeBveDt0nlkJwzUlipL2VOKWxkgpK3yGucQn2mz+FRe1btp+4KGm8H17eUI9FO9sBwq,iv:kgM921ovwCgDYHQj3c5Rupy/8JxHehxUD2jb1k9Ik2Y=,tag:3TLQkJbv679VWy8V2TMugw==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bzVHUGNxZTF2WC9MYmZr\neGdVVzJXN3lGdEk3cTBER3J6UTFtcUJna2d3CjdNQmRXd2haZW1MYlJzNkk1dWVD\nVTFQc2gvS0JrejJ6SFh2MXpPWDZpRE0KLS0tIE0wTC85bEpvSnlGdGFkZVFhNjFZ\nbzRiZkxMWUg2ODNVUlBmNFlPNGRrZlkK1VXLJWcssv3ETyZSSM/Hhn5VIaI9iov9\nzShZA9Zx/FX6PYTuUMC29pJ57gKourcIxa/7HwSv/xYn1A6WcYfgSg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-18T11:03:42Z",
+                "mac": "ENC[AES256_GCM,data:yonJC68PhilAgEHNNJQ8nO53Qo3rx/LnfiOWfuMm24bOUIH9QM3WZZxpigd7bHI4eC4TqRb4LvcSi0nEURTRAhwiTqGNrWbpw2Iv3n5dhLEN9aTcetG5ZuhaXqfVUoML45/ovdBZG/0l8+XIHqxN2M/g/h4JwKoR/6lqzcrVhgo=,iv:xvxBJwy+E5zUdjhGPdZPdy7tnBIEj50hfiDJFsS3wNg=,tag:L4Fas36ZOg4h0QQwC4gjNA==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/accounts/gkleen@sif/systemd.nix b/accounts/gkleen@sif/systemd.nix
index a89b46c2..18c2315f 100644
--- a/accounts/gkleen@sif/systemd.nix
+++ b/accounts/gkleen@sif/systemd.nix
@@ -6,7 +6,7 @@ let
   cfg = config.home-manager.users.${userName};
 
   autossh-socks-script = pkgs.writeScript "autossh" ''
-    #!${pkgs.zsh}/bin/zsh -xe
+    #!${lib.getExe pkgs.zsh} -xe
 
     host="''${1%:*}"
     port="''${1#*:}"
@@ -15,31 +15,29 @@ let
     cmd=()
 
     if [[ -n "''${SSHPASS_SECRET}" ]]; then
-      cmd+=(${pkgs.sshpassSecret}/bin/sshpass-secret)
+      cmd+=(${lib.getExe' pkgs.sshpassSecret "sshpass-secret"})
       cmd+=("''${(@s/:/)SSHPASS_SECRET}")
       cmd+=(--)
     fi
 
-    cmd+=(${pkgs.openssh}/bin/ssh -vN -D localhost:''${port} "''${host}")
+    cmd+=(${lib.getExe' pkgs.openssh "ssh"} -vN -D 127.0.0.1:''${port} "''${host}")
 
     ( exec -a "''${cmd[1]}" -- ''${cmd} ) &
     pid=$!
 
     newpid=""
     i=200
-    while ! newpid=$(${pkgs.lsof}/bin/lsof -Pi @localhost:"''${port}" -sTCP:LISTEN -t); do
+    while ! newpid=$(${lib.getExe pkgs.lsof} -Pi @localhost:"''${port}" -sTCP:LISTEN -t); do
       if ! kill -0 "''${pid}"; then
         wait "''${pid}"
         exit $?
       fi
       [[ "''${i}" -gt 0 ]] || exit 1
       i=$((''${i} - 1))
-      ${pkgs.coreutils}/bin/sleep 0.1
+      ${lib.getExe' pkgs.coreutils "sleep"} 0.1
     done
 
-    ${config.systemd.package}/bin/systemd-notify --ready
-
-    wait "''${pid}" "''${newpid}"
+    ${lib.getExe' config.systemd.package "systemd-notify"} --pid=''${newpid} --ready
   '';
 in {
   tmpfiles.rules = [
@@ -48,11 +46,11 @@ in {
   ];
 
   services = {
-    sync-keepass = {
+    "sync-keepass@" = {
       Service = {
         Type = "oneshot";
         WorkingDirectory = "~";
-        ExecStart = toString (pkgs.writers.writePython3 "sync-keepass" {
+        ExecStart = "${pkgs.writers.writePython3 "sync-keepass" {
           libraries = with pkgs.python3Packages; [ python-dateutil ];
         } ''
           import json
@@ -61,13 +59,13 @@ in {
           from datetime import datetime
           from dateutil.tz import tzlocal
           from dateutil.parser import isoparse
-          from sys import stderr
+          from sys import stderr, argv
 
 
-          remote_fs = 'surtr'
-          remote_file = 'store.kdbx'
-          target_file = expanduser('~/store.kdbx')
-          meta_file = expanduser('~/.store.kdbx.json')
+          remote_fs = 'surtr' if argv[1] == 'store.kdbx' else 'mathcloud'
+          remote_file = argv[1]
+          target_file = expanduser(f'~/{argv[1]}')
+          meta_file = expanduser(f'~/.{argv[1]}.json')
 
           upload_time = None
           our_last_upload_time = None
@@ -117,7 +115,7 @@ in {
               do_upload()
           elif upload_time is not None and (mod_time is None or upload_time > mod_time) and (our_last_upload_time is None or upload_time > our_last_upload_time):  # noqa: E501
               do_download()
-        '');
+        ''} \"%I\"";
         Environment = [ "RCLONE_PASSWORD_COMMAND=\"${pkgs.coreutils}/bin/cat ${config.sops.secrets.gkleen-rclone.path}\"" "PATH=${pkgs.rclone}/bin" ];
       };
     };
@@ -146,7 +144,7 @@ in {
       Service.ExecStart = "${pkgs.bluez}/bin/mpris-proxy";
       Install.WantedBy = [ "default.target" ];
     };
-    "autossh-socks@proxy.mathw0h:8119" = {
+    "autossh-socks@proxy.ssh.math.lmu.de:8119" = {
       Service = {
         Type = "notify";
         NotifyAccess = "all";
@@ -154,7 +152,7 @@ in {
         Restart = "always";
         RestartSec = "23s";
         ExecStart = "${autossh-socks-script} \"%I\"";
-        Environment = [ "SSHPASS_SECRET=gkleen@mathw0g.math.lmu.de" ];
+        Environment = [ "SSHPASS_SECRET=gkleen@ssh.math.lmu.de" ];
       };
       Unit = {
         StopWhenUnneeded = true;
@@ -175,6 +173,38 @@ in {
         StopWhenUnneeded = true;
       };
     };
+    "autossh-socks@proxy.mathw0h:8123" = {
+      Service = {
+        Type = "notify";
+        NotifyAccess = "all";
+        WorkingDirectory = "~";
+        Restart = "always";
+        RestartSec = "23s";
+        ExecStart = "${autossh-socks-script} \"%I\"";
+        Environment = [ "SSHPASS_SECRET=gkleen@mathw0h.mathinst.loc" ];
+      };
+      Unit = {
+        StopWhenUnneeded = true;
+        StartLimitInterval = "180s";
+        StartLimitBurst = 7;
+      };
+    };
+    "autossh-socks@proxy.mathw0e:8125" = {
+      Service = {
+        Type = "notify";
+        NotifyAccess = "all";
+        WorkingDirectory = "~";
+        Restart = "always";
+        RestartSec = "23s";
+        ExecStart = "${autossh-socks-script} \"%I\"";
+        Environment = [ "SSHPASS_SECRET=gkleen@mathw0e.mathinst.loc" ];
+      };
+      Unit = {
+        StopWhenUnneeded = true;
+        StartLimitInterval = "180s";
+        StartLimitBurst = 7;
+      };
+    };
     swayidle = {
       Service = {
         RuntimeDirectory = "swayidle";
@@ -212,7 +242,7 @@ in {
           "-${lib.getExe pkgs.playerctl} -a pause"
           "-${lib.getExe (pkgs.writeShellApplication {
             name = "generate-css";
-            runtimeInputs = with pkgs; [cfg.programs.wpaperd.package jq coreutils imagemagick findutils];
+            runtimeInputs = with pkgs; [cfg.services.wpaperd.package jq coreutils imagemagick findutils];
             text = ''
               declare -A monitors
               monitors=()
@@ -303,21 +333,21 @@ in {
         ExecStopPost = "${pkgs.coreutils}/bin/rm -rfv \"$CACHE_DIRECTORY\"";
       };
     };
-    wpaperd = {
-      Install = {
-        WantedBy = ["graphical-session.target"];
-      };
-      Unit = {
-        After = [ "graphical-session.target" ];
-        PartOf = [ "graphical-session.target" ];
-      };
-      Service = {
-        ExecStart = lib.getExe cfg.programs.wpaperd.package;
-        Type = "simple";
-        Restart = "always";
-        RestartSec = "2s";
-      };
-    };
+    # wpaperd = {
+    #   Install = {
+    #     WantedBy = ["graphical-session.target"];
+    #   };
+    #   Unit = {
+    #     After = [ "graphical-session.target" ];
+    #     PartOf = [ "graphical-session.target" ];
+    #   };
+    #   Service = {
+    #     ExecStart = lib.getExe cfg.services.wpaperd.package;
+    #     Type = "simple";
+    #     Restart = "always";
+    #     RestartSec = "2s";
+    #   };
+    # };
     xembed-sni-proxy = {
       Unit = {
         PartOf = lib.mkForce ["tray.target"];
@@ -350,13 +380,15 @@ in {
     };
   } // listToAttrs (map ({host, port}: nameValuePair "proxy-to-autossh-socks@${toString port}" {
       Unit = {
-        Requires = ["autossh-socks@${host}:${toString (port + 1)}.service" "proxy-to-autossh-socks@${toString port}.socket"];
+        BindsTo = ["autossh-socks@${host}:${toString (port + 1)}.service" "proxy-to-autossh-socks@${toString port}.socket"];
         After = ["autossh-socks@${host}:${toString (port + 1)}.service" "proxy-to-autossh-socks@${toString port}.socket"];
       };
       Service = {
-        ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd --exit-idle-time=10s localhost:${toString (port + 1)}";
+        ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd --exit-idle-time=60s 127.0.0.1:${toString (port + 1)}";
+        Restart = "always";
+        RestartSec = "23s";
       };
-  }) [{ host = "proxy.mathw0h"; port = 8118; } { host = "proxy.vidhar"; port = 8120; }]);
+  }) [{ host = "proxy.ssh.math.lmu.de"; port = 8118; } { host = "proxy.vidhar"; port = 8120; } { host = "proxy.mathw0h"; port = 8122; } { host = "proxy.mathw0e"; port = 8124; }]);
   sockets = listToAttrs (map (port: nameValuePair "proxy-to-autossh-socks@${toString port}" {
     Socket = {
       ListenStream = "%I";
@@ -364,7 +396,7 @@ in {
     Install = {
       WantedBy = ["default.target"];
     };
-  }) [8118 8120]) // {
+  }) [8118 8120 8122 8124]) // {
     "yt-dlp" = {
       Socket = {
         SocketMode = "0600";
@@ -378,7 +410,7 @@ in {
     };
   };
   timers = {
-    sync-keepass = {
+    "sync-keepass@store.kdbx" = {
       Timer = {
         OnActiveSec = "1m";
         OnUnitActiveSec = "1m";
@@ -388,6 +420,16 @@ in {
         WantedBy = ["default.target"];
       };
     };
+    "sync-keepass@rz.kdbx" = {
+      Timer = {
+        OnActiveSec = "1d";
+        OnUnitActiveSec = "1d";
+      };
+
+      Install = {
+        WantedBy = ["default.target"];
+      };
+    };
   };
   targets = {
     graphical-session = {
diff --git a/accounts/gkleen@sif/utils/async-yt-dlp.nix b/accounts/gkleen@sif/utils/async-yt-dlp.nix
new file mode 100644
index 00000000..c3b82ec5
--- /dev/null
+++ b/accounts/gkleen@sif/utils/async-yt-dlp.nix
@@ -0,0 +1,57 @@
+{ writers, python3Packages, ... }:
+
+writers.writePython3Bin "async-yt-dlp" {
+  libraries = with python3Packages; [ yt-dlp ];
+  flakeIgnore = ["E501"];
+} ''
+import sys
+import os
+
+import yt_dlp
+import yt_dlp.options
+from collections import namedtuple
+import socket
+from pathlib import Path
+import json
+
+create_parser = yt_dlp.options.create_parser
+
+
+def parse_patched_options(opts):
+    patched_parser = create_parser()
+    patched_parser.defaults.update({
+        'ignoreerrors': False,
+        'retries': 0,
+        'fragment_retries': 0,
+        'extract_flat': False,
+        'concat_playlist': 'never',
+    })
+    yt_dlp.options.create_parser = lambda: patched_parser
+    try:
+        return yt_dlp.parse_options(opts)
+    finally:
+        yt_dlp.options.create_parser = create_parser
+
+
+default_opts = parse_patched_options([]).ydl_opts
+
+
+def cli_to_api(opts):
+    opts = parse_patched_options(opts)
+    urls = opts.urls
+    opts = opts.ydl_opts
+
+    diff = {k: v for k, v in opts.items() if default_opts[k] != v}
+    if 'postprocessors' in diff:
+        diff['postprocessors'] = [pp for pp in diff['postprocessors']
+                                  if pp not in default_opts['postprocessors']]
+    return namedtuple('Options', ('params', 'urls'))(diff, urls)
+
+
+if __name__ == '__main__':
+    opts = cli_to_api(sys.argv[1:])
+    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
+        sock.connect(str(Path(os.environ["XDG_RUNTIME_DIR"]) / "yt-dlp.sock").encode('utf-8'))
+        with sock.makefile(mode='w', buffering=1, encoding='utf-8') as fh:
+            json.dump(opts._asdict(), fh)
+''
diff --git a/accounts/gkleen@sif/utils/pdf2pdf.nix b/accounts/gkleen@sif/utils/pdf2pdf.nix
new file mode 100644
index 00000000..9f4cbc3e
--- /dev/null
+++ b/accounts/gkleen@sif/utils/pdf2pdf.nix
@@ -0,0 +1,8 @@
+pkgs@{ lib, resholve, zsh, ghostscript_headless, ... }:
+
+resholve.writeScriptBin "pdf2pdf" {
+  inputs = with pkgs; [ghostscript_headless];
+  interpreter = lib.getExe zsh;
+} ''
+  exec gs -dPDFSETTINGS=/prepress -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -dSAFER -dPreserveAnnots=false "-sOutputFile=''${2}" "''${1}"
+''
diff --git a/accounts/gkleen@sif/utils/sieve-edit.nix b/accounts/gkleen@sif/utils/sieve-edit.nix
new file mode 100644
index 00000000..f985a3f6
--- /dev/null
+++ b/accounts/gkleen@sif/utils/sieve-edit.nix
@@ -0,0 +1,24 @@
+pkgs@{ lib, resholve, zsh, sieve-connect, sops, ... }:
+
+resholve.writeScriptBin "sieve-edit" {
+  inputs = with pkgs; [sieve-connect sops];
+  interpreter = lib.getExe zsh;
+  execer = with pkgs; [
+    "cannot:${lib.getExe sieve-connect}"
+    "cannot:${lib.getExe sops}"
+  ];
+} ''
+  host=$1; shift
+  case "$host" in
+    surtr)
+      sieve-connect -s surtr.yggdrasil.li -m EXTERNAL --clientkey <(sops decrypt $HOME/projects/machines/hosts/surtr/email/ca/gkleen@sif.key) --clientcert $HOME/projects/machines/hosts/surtr/email/ca/gkleen@sif.crt --edit --remotesieve sieve
+      ;;
+    ymir)
+      sieve-connect -s ymir.yggdrasil.li -u gkleen --edit --remotesieve sieve
+      ;;
+    *)
+      echo "Unknown host: ‘$host’" >&2
+      return 2
+      ;;
+  esac
+''
diff --git a/accounts/gkleen@sif/zshrc b/accounts/gkleen@sif/zshrc
index e3f675a1..702990c3 100644
--- a/accounts/gkleen@sif/zshrc
+++ b/accounts/gkleen@sif/zshrc
@@ -2,17 +2,14 @@ dir() {
     curlArchive=false
     templateArchive=""
     repoUrl=""
-    nixShell=""
-    findNix=false
     dir=""
     forceShell=false
     wormhole=false
     gitWorktree=""
-    # notmuchMsg=""
-    quickserve=false
     modifyPDF=""
+    miniserve=false
 
-    while getopts ':t:a:s:Sd:ir:wqg:p:' arg; do
+    while getopts ':t:a:d:ir:wg:p:m' arg; do
         case $arg in
             "t") ;;
             "a")
@@ -23,16 +20,13 @@ dir() {
                     templateArchive=${OPTARG:a}
                 fi
                 ;;
-            "s") nixShell=${OPTARG:a} ;;
-            "S") findNix=true ;;
             "d") dir=${OPTARG} ;;
             "i") forceShell=true ;;
             "r") repoUrl=${OPTARG} ;;
             "w") wormhole=true ;;
             "g") gitWorktree=${OPTARG} ;;
-            # "n") notmuchMsg=${OPTARG} ;;
-            "q") quickserve=true ;;
             "p") modifyPDF=${OPTARG:a} ;;
+            "m") miniserve=true ;;
             *) printf "Invalid option: %s\n" $arg >&2; exit 2 ;;
         esac
     done
@@ -56,20 +50,34 @@ dir() {
         gitWorktree=""
     fi
 
+    miniservePIDFile=""
+    if [[ ${miniserve} = "true" ]]; then
+      miniservePIDFile=$(mktemp --tmpdir --suffix=.pid)
+    fi
+
     cleanup()
     {
-        cd ${modifyPDF:h}
-        [[ -n ${modifyPDF} ]] && nix shell nixos#imagemagick -c convert -verbose ${dir}/${modifyPDF:t:r}_*.png(on) ${modifyPDF}
+        if [[ -n ${modifyPDF} ]]; then
+           cd ${modifyPDF:h}
+           typeset -a pages
+           eval 'pages=(${dir}/${modifyPDF:t:r}_*.png(on))'
+           magick -verbose "$pages" ${modifyPDF}
+           modifyPDF=""
+        fi
+        if [[ -n ${miniservePIDFile} ]]; then
+           command kill --verbose -- $(cat ${miniservePIDFile}) && wait $(cat ${miniservePIDFile})
+           miniservePIDFile=""
+        fi
     }
 
     (
+        set -o localoptions -o localtraps
+        trap 'return 1' INT TERM
         trap cleanup EXIT
 
         cd ${dir}
         export dir;
 
-        ${findNix} && { nixShell=$(findNix) || return $? }
-
         [[ -n ${repoUrl} ]] && git clone -- ${repoUrl} .
 
         [[ -n ${modifyPDF} ]] && templateArchive=${modifyPDF}
@@ -82,23 +90,23 @@ dir() {
                 }
                 trap cleanup EXIT
 
-                if ${curlArchive}; then
+                if [[ $curlArchive = "true" ]]; then
                     archiveFile=$(mktemp -t "archive.XXXXXXXXXX.${templateArchive:t}")
 
-                    curl -L -o ${archiveFile} ${templateArchive}
+                    curl -SfL -o ${archiveFile} ${templateArchive}
 
                     templateArchive=${archiveFile}
                 fi
 
                 unpack=true
-                while ${unpack}; do
+                while [[ $unpack = "true" ]]; do
                     case $(file --brief --mime-type --dereference ${templateArchive}) in
                         application/zip)
                             unzip ${templateArchive}
                             unpack=false
                         ;;
                         application/vnd.debian.binary-package)
-                            nix shell nixos#binutils --command ar x ${templateArchive}
+                            ar x ${templateArchive}
                             mkdir control data
                             tar -C control -xvaf control.*
                             tar -C data -xvaf data.*
@@ -106,7 +114,7 @@ dir() {
                         ;;
                         application/x-rpm)
                             cpioArchive=$(mktemp -t "archive.XXXXXXXXXX.${templateArchive:t:r}.cpio")
-                            nix shell nixos#busybox --command rpm2cpio ${templateArchive} > ${cpioArchive}
+                            rpm2cpio ${templateArchive} > ${cpioArchive}
                             templateArchive=${cpioArchive}
                             unpack=true
                         ;;
@@ -115,15 +123,19 @@ dir() {
                             unpack=false
                         ;;
                         application/pdf)
-                            nix shell nixos#ghostscript nixos#imagemagick -c convert -verbose -density 400 ${templateArchive} ${modifyPDF:t:r}_%0d.png
+                            magick -verbose -density 400 ${templateArchive} ${modifyPDF:t:r}_%0d.png
                             unpack=false
                         ;;
                         application/octet-stream)
-                            if [[ $(file --brief --dereferenc ${templateArchive}) =~ Squashfs ]]; then
-                               nix shell nixos#squashfsTools -c unsquashfs -d . ${templateArchive}
+                            if [[ $(file --brief --dereference ${templateArchive}) =~ Squashfs ]]; then
+                               unsquashfs -d . ${templateArchive}
                                unpack=false
                             fi
                         ;;
+                        application/x-iso9660-image)
+                          7z x ${templateArchive}
+                          unpack=false
+                        ;;
                         *)
                             tar -xvaf ${templateArchive}
                             unpack=false
@@ -134,25 +146,21 @@ dir() {
         fi
 
 
-        ${wormhole} && wormhole receive --accept-file
+        [[ $wormhole = "true" ]] && wormhole receive --accept-file
 
 
-        if ${quickserve}; then
-          quickserve --root . --upload . --show-hidden --tar gz
+        if [[ ${#@} -gt 0 ]]; then
+            ${@}
         fi
 
+        cd $(pwd) # Needed for mounting to work
 
-        if [[ ${#@} -eq 0 ]] || ${forceShell}; then
-            if [[ ${#@} -gt 0 ]]; then
-                if [[ -z ${nixShell} ]]; then
-                    ${@}
-                else
-                    nix-shell ${nixShell} --run "${@}"
-                fi
-            fi
-
-            cd $(pwd) # Needed for mounting to work
+        if [[ ${miniserve} = "true" ]]; then
+           miniserve --random-route --hidden --enable-tar-gz --enable-zip . &
+           echo $! > "${miniservePIDFile}"
+        fi
 
+        if [[ ${#@} -eq 0 ]] && [[ ${miniserve} != "true" ]] || [[ $forceShell = "true" ]]; then
             isSingleDir() {
                 typeset -a contents
                 contents=(*(N) .*(N))
@@ -166,18 +174,9 @@ dir() {
             }
             while d=$(isSingleDir); do cd ${d}; done
 
-
-            if [[ -z ${nixShell} ]]; then
-                zsh
-            else
-                nix-shell ${nixShell} --run zsh
-            fi
-        else
-            if [[ -z ${nixShell} ]]; then
-                ${@}
-            else
-                nix-shell ${nixShell} --run "${@}"
-            fi
+            zsh
+        elif [[ ${miniserve} == "true" ]]; then
+            wait $(cat "${miniservePIDFile}")
         fi
     )
 }
@@ -185,27 +184,30 @@ dir() {
 tmpdir() {
     cleanup()
     {
-      cd /
+        cd /
         unmount() {
             printf "Unmounting %s\n" ${1} >&2
             fusermount -u ${1} || umount ${1} || sudo umount ${1}
         }
 
-        if mountpoint -q -- ${dir}; then
-            unmount ${dir} || return $?
-        else
-            while read -d $'\0' subDir; do
-                mountpoint -q -- ${subDir} || continue
-                unmount ${subDir} || return $?
-            done <<<$(find ${dir} -xdev -type d -print0 | sort -zr)
-        fi
-
-        rm -rfv --one-file-system -- ${dir}
+        if [[ -n ${dir} ]]; then
+            if mountpoint -q -- ${dir}; then
+                unmount ${dir} || return $?
+            else
+                while read -d $'\0' subDir; do
+                    mountpoint -q -- ${subDir} || continue
+                    unmount ${subDir} || return $?
+                done <<<$(find ${dir} -xdev -type d -print0 | sort -zr)
+            fi
+
+            rm -rfv --one-file-system -- ${dir}
+            dir=""
+        fi
     }
 
     local tmpdir=""
 
-    while getopts ':t:a:s:Sd:ir:wqg:p:' arg; do
+    while getopts ':t:a:d:ir:wg:p:m' arg; do
         case $arg in
             "t") tmpdir="=${OPTARG}" ;;
             "?"|":") printf "Invalid option: %s\n" $arg >&2; exit 2 ;;
@@ -213,6 +215,8 @@ tmpdir() {
     done
 
     (
+        set -o localoptions -o localtraps
+        trap 'return 1' INT TERM
         trap cleanup EXIT
 
 
@@ -231,17 +235,7 @@ clock() {
 }
 
 public-ip() {
-    curl -s -H 'Accept: application/json' $@ ifconfig.co | jq -r '.ip'
-}
-
-nix-ghci() {
-    pkgExpr=""
-    if [[ ${#@} -gt 0 ]]; then
-        pkgExpr="${1}"
-        shift
-    fi
-
-    nix-shell -p "with (import <nixpkgs> {}); pkgs.haskellPackages.ghcWithPackages (p: with p; [${pkgExpr}])" --run "ghci ${@}"
+    curl -sSf -H 'Accept: application/json' $@ ifconfig.co | jq -r '.ip'
 }
 
 swap() {
@@ -271,14 +265,6 @@ l() {
   ls --long --binary --git --time-style=iso --header $@
 }
 
-re() {
-  systemctl --restart $@
-}
-
-ure() {
-  systemctl --user --restart $@
-}
-
 ssh-installer() {
   ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityFile=~/.ssh/gkleen@sif.midgard.yggdrasil $@
 }
@@ -306,20 +292,7 @@ done < <(find ~/projects ~/uni -regextype posix-extended -maxdepth 2 -type d -re
        sed -zr 's|(.*/([0-9]{2}[ws])/(.+))|\1 \2 \3|' | \
        sort -z -r -k2 | sort -z -s -k3 | uniq -z -f 2)
 
-alias '..'='cd ..'
 alias rzadm=$'tmpdir -i sh -c \'mkdir adm; sshfs gkleen@mgmt01:/adm adm\''
 alias mathcloud=$'tmpdir -i rclone mount --daemon mathcloud:// .'
-alias -g L='| less'
-alias -g S='&> /dev/null'
-alias -g G='| grep'
-alias -g B='&> /dev/null &'
-alias -g BB='&> /dev/null &!'
 
 export DEFAULT_USER=gkleen
-
-bindkey -e
-bindkey ';5C' emacs-forward-word
-bindkey ';5D' emacs-backward-word
-bindkey '^[[1;5C' emacs-forward-word
-bindkey '^[[1;5D' emacs-backward-word
-bindkey '^H' backward-kill-word
diff --git a/accounts/gkleen@surtr.nix b/accounts/gkleen@surtr.nix
index 58c4f21d..8f678ac9 100644
--- a/accounts/gkleen@surtr.nix
+++ b/accounts/gkleen@surtr.nix
@@ -1,3 +1,7 @@
-{ userName, ... }: {
-  home-manager.users.${userName}.home.stateVersion = "20.09";
+{ flake, userName, ... }: {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName}.home.stateVersion = "20.09";
 }
diff --git a/accounts/gkleen@vidhar.nix b/accounts/gkleen@vidhar.nix
index 8509c2f4..3a37c4bd 100644
--- a/accounts/gkleen@vidhar.nix
+++ b/accounts/gkleen@vidhar.nix
@@ -1,4 +1,8 @@
 { flake, pkgs, userName, config, ... }: {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
   config = {
     users.users.${userName} = {
       uid = 1000;
diff --git a/accounts/mherold@eostre.nix b/accounts/mherold@eostre.nix
index 51e4529a..0e2f37aa 100644
--- a/accounts/mherold@eostre.nix
+++ b/accounts/mherold@eostre.nix
@@ -7,9 +7,9 @@
     home-manager.users.${userName} = {
       home.stateVersion = "20.09";
 
-      nixpkgs.config = {
-        allowUnfree = true;
-      };
+      # nixpkgs.config = {
+      #   allowUnfree = true;
+      # };
 
       home.packages = with pkgs; [
         thunderbird libreoffice element-desktop keepassxc vlc
diff --git a/accounts/root@installer.nix b/accounts/root@installer.nix
index c7a418f8..5fe1db38 100644
--- a/accounts/root@installer.nix
+++ b/accounts/root@installer.nix
@@ -1,7 +1,11 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 
 {
-  home-manager.users.${userName} = { config, ... } : {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName} = { config, ... } : {
     home.stateVersion = config.home.version.release;
   };
 }
diff --git a/accounts/root@sif.nix b/accounts/root@sif.nix
index c9e129a0..bb816230 100644
--- a/accounts/root@sif.nix
+++ b/accounts/root@sif.nix
@@ -1,6 +1,10 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 {
-  home-manager.users.${userName} = {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName} = {
     home.stateVersion = "20.09";
 
     programs.ssh.matchBlocks = {
diff --git a/accounts/root@surtr.nix b/accounts/root@surtr.nix
index 58c4f21d..8f678ac9 100644
--- a/accounts/root@surtr.nix
+++ b/accounts/root@surtr.nix
@@ -1,3 +1,7 @@
-{ userName, ... }: {
-  home-manager.users.${userName}.home.stateVersion = "20.09";
+{ flake, userName, ... }: {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName}.home.stateVersion = "20.09";
 }
diff --git a/accounts/root@vidhar.nix b/accounts/root@vidhar.nix
index e82414a8..0fc56633 100644
--- a/accounts/root@vidhar.nix
+++ b/accounts/root@vidhar.nix
@@ -1,6 +1,11 @@
-{ config, userName, ... }:
+{ flake, config, userName, ... }:
+
 {
-  home-manager.users.${userName} = {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+
+  config.home-manager.users.${userName} = {
     home.stateVersion = "20.09";
 
     programs.ssh.matchBlocks = {