21 files changed, 684 insertions, 221 deletions
diff --git a/accounts/gkleen@eostre.nix b/accounts/gkleen@eostre.nix
index 72818d44..28daf3fd 100644
--- a/accounts/gkleen@eostre.nix
+++ b/accounts/gkleen@eostre.nix
@@ -1,16 +1,16 @@
 { flake, userName, pkgs, ... }:
 {
  imports = with flake.nixosModules.userProfiles.${userName}; [
-    zsh utils tmux
+    utils
  ];
  config = {
    home-manager.users.${userName} = {
      home.stateVersion = "20.09";
-      nixpkgs.config = {
+      # nixpkgs.config = {
-        allowUnfree = true;
+      #   allowUnfree = true;
-      };
+      # };
      home.packages = with pkgs; [
        thunderbird libreoffice element-desktop keepassxc vlc
diff --git a/accounts/gkleen@installer.nix b/accounts/gkleen@installer.nix
index c7a418f8..5fe1db38 100644
--- a/accounts/gkleen@installer.nix
+++ b/accounts/gkleen@installer.nix
@@ -1,7 +1,11 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 {
-  home-manager.users.${userName} = { config, ... } : {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName} = { config, ... } : {
    home.stateVersion = config.home.version.release;
  };
 }
diff --git a/accounts/gkleen@sif/default.nix b/accounts/gkleen@sif/default.nix
index 11f24f31..706eb241 100644
--- a/accounts/gkleen@sif/default.nix
+++ b/accounts/gkleen@sif/default.nix
@@ -50,9 +50,20 @@ let
  };
  lockCommand = "${lib.getExe' config.systemd.package "systemctl"} --user start gtklock.service";
+  editor = pkgs.symlinkJoin {
+    inherit (cfg.services.emacs.package) name;
+    buildInputs = with pkgs; [ makeWrapper ];
+    paths = [ cfg.services.emacs.package ];
+    postBuild = ''
+      wrapProgram $out/bin/emacsclient \
+        --inherit-argv0 \
+        --add-flags ${lib.escapeShellArg (lib.escapeShellArgs cfg.services.emacs.client.arguments)}
+    '';
+  };
 in {
  imports = with flake.nixosModules.userProfiles.${userName}; [
-    mpv yt-dlp (args: import ./xcompose.nix (inputs // args))
+    zsh tmux mpv yt-dlp (args: import ./xcompose.nix (inputs // args))
  ];
  config = {
@@ -60,16 +71,17 @@ in {
      imports = [
        ./libvirt
        ./niri
+        ./synadm
        flakeInputs.nix-index-database.hmModules.nix-index
        flakeInputs.impermanence.nixosModules.home-manager.impermanence
      ];
      home.stateVersion = "20.09";
-      nixpkgs.config = {
+      # nixpkgs.config = {
-        allowUnfree = true;
+      #   allowUnfree = true;
-        zathura.useMupdf = false;
+      #   zathura.useMupdf = false;
-      };
+      # };
      nix.registry = {
        "flk" = {
@@ -175,13 +187,91 @@ in {
          gpu-api = "vulkan";
        };
-        zsh.initExtra = ''
+        zsh.initContent = let
-          source ${./zshrc}
+          zshrc = pkgs.resholve.mkDerivation {
+            pname = "zshrc";
+            version = "0.0.0";
+            src = ./zshrc;
+            dontUnpack = true;
+            dontConfigure = true;
+            dontBuild = true;
+            installPhase = ''
+              mkdir -p $out/share
+              install "$src" $out/share/zshrc
+            '';
+            solutions = {
+              default = {
+                scripts = [ "share/zshrc" ];
+                interpreter = "none";
+                inputs = with pkgs; [
+                  coreutils
+                  rpm
+                  binutils
+                  squashfsTools
+                  unzip
+                  cfg.programs.git.package
+                  magickWrapped
+                  curl
+                  file
+                  gnutar
+                  cpio
+                  magic-wormhole
+                  cfg.programs.zsh.package
+                  fuse
+                  util-linux
+                  findutils
+                  qrencode
+                  tty-clock
+                  cfg.programs.jq.package
+                  eza
+                  less
+                  config.systemd.package
+                  config.programs.ssh.package
+                  gnused
+                  miniserve
+                ];
+                execer = with pkgs; [
+                  "cannot:${lib.getExe' rpm "rpm2cpio"}"
+                  "cannot:${lib.getExe' squashfsTools "unsquashfs"}"
+                  "cannot:${lib.getExe' unzip "unzip"}"
+                  "cannot:${lib.getExe cfg.programs.git.package}"
+                  "cannot:${lib.getExe cpio}"
+                  "cannot:${lib.getExe' magic-wormhole "wormhole"}"
+                  "cannot:${lib.getExe' fuse "fusermount"}"
+                  "cannot:${lib.getExe less}"
+                  "cannot:${lib.getExe' config.systemd.package "systemctl"}"
+                  "cannot:${lib.getExe config.programs.ssh.package}"
+                ];
+                wrapper = with pkgs; [
+                  "${lib.getExe' magickWrapped "magick"}:${lib.getExe' imagemagick "magick"}"
+                ];
+                fake = {
+                  builtin = ["print"];
+                  external = ["sudo" "umount"];
+                };
+              };
+            };
+          };
+          magickWrapped = pkgs.symlinkJoin {
+            inherit (pkgs.imagemagick) name;
+            paths = [ pkgs.imagemagick ];
+            buildInputs = with pkgs; [ makeWrapper ];
+            postBuild = ''
+              wrapProgram $out/bin/magick \
+                --prefix PATH : ${lib.makeBinPath (with pkgs; [ ghostscript ])}
+            '';
+          };
+        in ''
+          source ${zshrc}/share/zshrc
        '';
        zsh.dirHashes = let
          flakeHashes = mapAttrs' (n: v: nameValuePair (inputNames.${n} or n) (toString v)) flakeInputs;
          inputNames = {
-            "nixpkgs" = "nixos";
          };
        in flakeHashes // {
          u2w = "$HOME/projects/uni2work";
@@ -193,6 +283,16 @@ in {
          pro = "$HOME/projects/pro";
          media = "$HOME/media";
        };
+        jq.colors = {
+          arrays = "1;37";
+          "false" = "0;37";
+          "null" = "2;37";
+          numbers = "0;37";
+          objectKeys = "1;34";
+          objects = "1;37";
+          strings = "0;32";
+          "true" = "0;37";
+        };
        obs-studio = {
          enable = true;
@@ -202,7 +302,7 @@ in {
        gh = {
          enable = true;
          settings = {
-            editor = lib.getExe' config.home-manager.users.${userName}.programs.emacs.package "emacsclient";
+            editor = lib.getExe' editor "emacsclient";
            gitProtocol = "ssh";
          };
        };
@@ -228,16 +328,10 @@ in {
            # notify_on_cmd_finish = "invisible 120";
          };
          keybindings = {
-            "kitty_mod+n" = "detach_window";
+            "kitty_mod+n" = "new_os_window_with_cwd";
            "kitty_mod+m" = "detach_window ask";
-          };
+            "kitty_mod+enter" = "new_window_with_cwd";
-        };
+            "kitty_mod+t" = "new_tab_with_cwd";
-        wpaperd = {
-          enable = true;
-          settings.default = {
-            path = "~/.wallpapers";
-            duration = "15m";
-            mode = "center";
          };
        };
        fuzzel = {
@@ -250,7 +344,7 @@ in {
              font = "Fira Sans";
            };
            colors = {
-              background = "000000aa";
+              background = "000000cc";
              text = "cdd6f4ff";
              match = "94e2d5ff";
              selection = "585b70ff";
@@ -267,15 +361,28 @@ in {
          enable = true;
          extraAbbreviations = ["i.A." "d.h." "D.h." "gdw."];
        };
+        nushell = {
+          enable = true;
+          settings.show_banner = false;
+        };
+        fd.enable = true;
      };
      services = {
+        wpaperd = {
+          enable = true;
+          settings.default = {
+            path = "~/.wallpapers";
+            duration = "15m";
+            mode = "center";
+          };
+        };
        emacs = {
          enable = true;
          socketActivation.enable = true;
          client = {
            enable = true;
-            arguments = mkForce ["--reuse-frame" "--alternate-editor" "\"\""];
+            arguments = mkForce ["--create-frame" "--alternate-editor" (lib.getExe cfg.services.emacs.package)];
          };
        };
        gpg-agent = {
@@ -384,6 +491,13 @@ in {
        };
      };
+      qt.kde.settings = {
+        kwalletrc = {
+          KSecretD.Enabled = false;
+          Wallet."Default Wallet" = "store";
+        };
+      };
      xsession.preferStatusNotifierItems = true;
      xresources.properties = import ./xresources.nix;
@@ -392,20 +506,19 @@ in {
        packages = with pkgs; [
          fira fira-code pwvucontrol wrappedKeepassxc wl-clipboard-rs
          mumble pulseaudio-ctl pamixer libnotify screen-message
-          wrappedYTMDesktop libsForQt5.qt5ct playerctl evince
+          wrappedYTMDesktop libsForQt5.qt5ct playerctl evince papers
          thunderbird zoom-us xdg-desktop-portal steam steam-run
          wireshark virt-manager rclone cached-nix-shell worktime
          fira-code-symbols libreoffice xournalpp google-chrome
          nixos-shell virt-viewer freerdp gnome-icon-theme
          paper-icon-theme sshpassSecret weechat element-desktop
-          flakeInputs.deploy-rs.packages.${config.nixpkgs.system}.deploy-rs
+          sieve-connect gimp3 inkscape udiskie glab nitrokey-app
-          sieve-connect gimp inkscape udiskie glab nitrokey-app
          pynitrokey gtklock wlrctl remmina openscad spice-record
          libguestfs-with-appliance nerd-fonts.fira-mono
          nerd-fonts.symbols-only nerd-fonts.fira-code powerline-fonts
          swtpm (hunspellWithDicts (with hunspellDicts; [en_GB-large de_DE]))
-          # synadm
+          libation libqalculate
-        ];
+        ] ++ mapAttrsToList (_name: pkg: pkgs.callPackage pkg {}) (customUtils.nixImport { dir = ./utils; });
        file = {
          ".backup-munin".source = ./backup-patterns;
@@ -425,12 +538,9 @@ in {
          QT_QPA_PLATFORMTHEME = "qt5ct";
          LIBVIRT_DEFAULT_URI = "qemu:///system";
          STACK_XDG = 1;
-          EDITOR = pkgs.writeShellScript "editor" ''
+          EDITOR = lib.getExe' editor "emacsclient";
-            args=("--reuse-frame" "--alternate-editor" "")
-            args+=("$@")
-            exec -a emacsclient ${lib.getExe' cfg.services.emacs.package "emacsclient"} "''${args[@]}"
-          '';
          RCLONE_PASSWORD_COMMAND = "${lib.getExe' pkgs.libsecret "secret-tool"} lookup service rclone";
+          SYSTEMD_TINT_BACKGROUND = "false";
        };
        extraProfileCommands = ''
@@ -467,9 +577,17 @@ in {
            General = {
              dot_as_separator = 0;
            };
+            Mode = {
+              calculate_as_you_type = 1;
+            };
          };
        };
-        "emacs/init.el".source = ./emacs.el;
+        "emacs/init.el".source = pkgs.substitute {
+          src = ./emacs.el;
+          substitutions = [
+            "--subst-var-by" "ksshaskpass" (lib.getExe pkgs.kdePackages.ksshaskpass)
+          ];
+        };
        "systemd/user/xdg-desktop-portal.service.d/after-graphical-session.conf".text = ''
          [Unit]
          After=graphical-session.target
@@ -487,6 +605,8 @@ in {
      xdg.dataFile = {
        "dbus-1/services/org.keepassxc.KeePassXC.service".source = "${wrappedKeepassxc}/share/dbus-1/services/org.keepassxc.KeePassXC.service";
        "dbus-1/services/org.freedesktop.secrets.service.service".source = "${wrappedKeepassxc}/share/dbus-1/services/org.freedesktop.secrets.service.service";
+        "dbus-1/services/org.kde.kwalletd6.service".source = "${pkgs.kdePackages.kwallet}/share/dbus-1/services/org.kde.kwalletd6.service";
+        "dbus-1/services/org.kde.kwalletd5.service".source = "${pkgs.kdePackages.kwallet}/share/dbus-1/services/org.kde.kwalletd5.service";
        "emoji-data/list.txt".source = pkgs.stdenv.mkDerivation {
          inherit (sources.emoji-data) pname src;
          version = lib.removePrefix "v" sources.emoji-data.version;
@@ -574,10 +694,10 @@ in {
            exec -- \
              ${lib.getExe' config.systemd.package "systemd-run"} --wait --user --slice-inherit \
              --property 'CPUAccounting=yes' --property 'CPUQuotaPeriodSec=50ms' \
-              --property 'Environment=DSCP=46' \
+              -E DSCP=46 -E NIXOS_OZONE_WL \
              -- ${lib.getExe pkgs.dscp} ${lib.getExe' pkgs.google-chrome "google-chrome-stable"} \
              --class=Rainbow \
-              --kiosk "https://web.openrainbow.com" \
+              --app="https://web.openrainbow.com" \
              --user-data-dir=''${HOME}/.config/google-chrome-rainbow
          '');
          icon = pkgs.fetchurl {
@@ -588,6 +708,53 @@ in {
            StartupWMClass = "Rainbow";
          };
        };
+        kimai = {
+          name = "Kimai";
+          exec = toString (pkgs.writeShellScript "kimai" ''
+            exec -- \
+              ${lib.getExe' pkgs.google-chrome "google-chrome-stable"} \
+              --class=Kimai \
+              --app="https://kimai.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/google-chrome-kimai
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.kimai.org/images/kimai_logo.png";
+            hash = "sha256-lnlOttzR2SwXA70R+egJUkeKr4U5V0avqTk8uX4bqfs=";
+          };
+          settings = {
+            StartupWMClass = "Kimai";
+            StartupNotify = "true";
+          };
+        };
+        audiobookshelf = {
+          name = "Audiobookshelf";
+          exec = toString (pkgs.writeShellScript "audiobookshelf" ''
+            exec -- \
+              ${lib.getExe' pkgs.google-chrome "google-chrome-stable"} \
+              --class=Audiobookshelf \
+              --app="https://audiobookshelf.yggdrasil.li" \
+              --user-data-dir=''${HOME}/.config/google-chrome-audiobookshelf
+          '');
+          icon = pkgs.fetchurl {
+            url = "https://www.audiobookshelf.org/Logo.png";
+            hash = "sha256-JGPk+WNT1C4DC4lSMb0K0YmAMT5LvmSOeO0QRzkc7Lk=";
+          };
+          settings = {
+            StartupWMClass = "Audiobookshelf";
+            StartupNotify = "true";
+          };
+        };
+        thunderbird-lmu = {
+          name = "Thunderbird (LMU)";
+          exec = "thunderbird --name thunderbird -P lmu %U";
+          icon = "thunderbird";
+          genericName = "Email Client";
+          categories = [ "Network" "Chat" "Email" "Feed" "GTK" "News" ];
+          settings = {
+            StartupWMClass = "thunderbird";
+            StartupNotify = "true";
+          };
+        };
      };
      fonts = {
diff --git a/accounts/gkleen@sif/emacs.el b/accounts/gkleen@sif/emacs.el
index 5cee16b0..3beefba6 100644
--- a/accounts/gkleen@sif/emacs.el
+++ b/accounts/gkleen@sif/emacs.el
@@ -51,7 +51,7 @@
 ;; (require 'scratch)
 (global-set-key (kbd "C-x B") 'scratch-create)
-(setq initial-major-mode 'scratch-mode)
+;; (setq initial-major-mode 'scratch-mode)
 (setq initial-scratch-message "")
 (global-set-key (kbd "C-x K") 'kill-current-buffer)
@@ -254,3 +254,5 @@ necessarily running."
 (bind-key "C-x C-m" #'move-file)
 (let ((ssh_auth_sock (string-chop-newline (shell-command-to-string "gpgconf --list-dirs agent-ssh-socket")))) (setenv "SSH_AUTH_SOCK" ssh_auth_sock))
+(setenv "SSH_ASKPASS_REQUIRE" "prefer")
+(setenv "SSH_ASKPASS" "@ksshaskpass@")
diff --git a/accounts/gkleen@sif/niri/default.nix b/accounts/gkleen@sif/niri/default.nix
index 216a98ea..8752f3e3 100644
--- a/accounts/gkleen@sif/niri/default.nix
+++ b/accounts/gkleen@sif/niri/default.nix
@@ -35,7 +35,11 @@ let
          if jq -e '.is_focused' <<<"$window_json" >/dev/null; then
            niri msg action focus-workspace-previous
          else
-            niri msg action focus-window --id "$(jq -r '.id' <<<"$window_json")"
+            if [[ $(jq -r --arg workspace_name "$workspace_name" 'map(select(.name == $workspace_name)) | .[0].is_focused' <<<"$workspaces_json") != "true" ]] && [[ $(jq -r --arg workspace_name "$workspace_name" 'map(select(.name == $workspace_name)) | .[0].id' <<<"$workspaces_json") = $(jq -r '.workspace_id' <<<"$window_json") ]]; then
+                niri msg action focus-workspace "$workspace_name"
+            else
+                niri msg action focus-window --id "$(jq -r '.id' <<<"$window_json")"
+            fi
          fi
          exit 0
        fi
@@ -45,7 +49,6 @@ let
    '';
  };
  focus-or-spawn-action = config.lib.niri.actions.spawn (lib.getExe focus_or_spawn);
-  focus-or-spawn-action-app_id = app_id: focus-or-spawn-action ''select(.app_id == "${app_id}")'';
  with_adjacent_workspace = pkgs.writeShellApplication {
    name = "with-adjacent-workspace";
@@ -84,7 +87,7 @@ let
  };
  with-adjacent-workspace-action = config.lib.niri.actions.spawn (lib.getExe with_adjacent_workspace) "^${lib.concatMapStringsSep "|" ({ name, ...}: name) cfg.scratchspaces}$";
  focus-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"FocusWorkspace":{"reference":{"Id": .id}}}}'';
-  move-column-to-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}}}}'';
+  move-column-to-adjacent-workspace = direction: with-adjacent-workspace-action direction ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}, "focus": true}}}'';
  with_unnamed_workspace = pkgs.writeShellApplication {
    name = "with-unnamed-workspace";
@@ -131,7 +134,7 @@ let
      windows_json="$(niri msg -j windows)"
      active_workspace="$(jq -r '.[] | select(.is_focused) | .workspace_id' <<<"$windows_json")"
-      window_ix="$(gojq -r --arg active_workspace "$active_workspace" '.[] | select('"$window_select"') | "\(.title)\u0000icon\u001f\(.app_id)"' <<<"$windows_json" | fuzzel --log-level=warning --dmenu --index)"
+      window_ix="$(gojq -r --arg active_workspace "$active_workspace" '.[] | select('"$window_select"') | "\(.title)\u0000icon\u001f\(.app_id)"' <<<"$windows_json" | fuzzel --width=60 --log-level=warning --dmenu --index)"
      # shellcheck disable=SC2016
      window_json="$(gojq -rc --arg active_workspace "$active_workspace" --arg window_ix "$window_ix" 'map(select('"$window_select"')) | .[($window_ix | tonumber)]' <<<"$windows_json")"
@@ -141,6 +144,25 @@ let
    '';
  };
  with-select-window-action = config.lib.niri.actions.spawn (lib.getExe with_select_window);
+  with_predicate_window = pred: pkgs.writeShellApplication {
+    name = "with-predicate-window";
+    runtimeInputs = [ niri pkgs.gojq pkgs.socat ];
+    text = ''
+      action="$1"
+      shift
+      windows_json="$(niri msg -j windows)"
+      window_json="$(gojq -rc 'map(select(${pred})) | .[0]' <<<"$windows_json")"
+      [[ -z "$window_json" || $window_json = "null" ]] && exit 1
+      jq -c "$action" <<<"$window_json" | socat STDIO "$NIRI_SOCKET"
+    '';
+  };
+  with-urgent-window-action = config.lib.niri.actions.spawn (lib.getExe (with_predicate_window ".is_urgent"));
+  with-focused-window-action = config.lib.niri.actions.spawn (lib.getExe (with_predicate_window ".is_focused"));
 in {
  imports = [
    ./waybar.nix
@@ -171,6 +193,17 @@ in {
            type = lib.types.nullOr lib.types.str;
            default = null;
          };
+          moveKey = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = let
+              keys = lib.splitString "+" config.key;
+              defMoveKey = lib.concatStringsSep "+" (lib.flatten [
+                (lib.take (lib.length keys - 1) keys)
+                ["Shift"]
+                (lib.takeEnd 1 keys)
+              ]);
+            in if config.key == null then null else defMoveKey;
+          };
          spawn = lib.mkOption {
            type = lib.types.nullOr (lib.types.listOf lib.types.str);
            default = null;
@@ -245,11 +278,11 @@ in {
      Service = {
        Type = "simple";
        Sockets = [ "niri-workspace-history.socket" ];
-        ExecStart = pkgs.writers.writePython3 "niri-workspace-history" {} ''
+        ExecStart = pkgs.writers.writePython3 "niri-workspace-history" { flakeIgnore = ["E501"]; } ''
          import os
          import socket
          import json
-          import sys
+          # import sys
          from collections import defaultdict
          from threading import Thread, Lock
          from socketserver import StreamRequestHandler, ThreadingTCPServer
@@ -273,11 +306,9 @@ in {
              workspaces = list()
              def focus_workspace(output, workspace):
-                  global workspace_history, history_lock
                  with history_lock:
-                      workspace_history[output] = [workspace] + [ws for ws in workspace_history[output] if ws != workspace]  # noqa: E501
+                      workspace_history[output] = [workspace] + [ws for ws in workspace_history[output] if ws != workspace]
-                      print(json.dumps(workspace_history), file=sys.stderr)
+                      # print(json.dumps(workspace_history), file=sys.stderr)
              sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
              sock.connect(os.environ["NIRI_SOCKET"])
@@ -299,16 +330,14 @@ in {
          class RequestHandler(StreamRequestHandler):
              def handle(self):
-                  global workspace_history, history_lock
+                  with detaching(TextIOWrapper(self.wfile, encoding='utf-8', write_through=True)) as out:
-                  with detaching(TextIOWrapper(self.wfile, encoding='utf-8', write_through=True)) as out:  # noqa: E501
                      with history_lock:
                          json.dump(workspace_history, out)
          class Server(ThreadingTCPServer):
              def __init__(self):
-                  ThreadingTCPServer.__init__(self, ("", 8000), RequestHandler, bind_and_activate=False)  # noqa: E501
+                  ThreadingTCPServer.__init__(self, ("", 8000), RequestHandler, bind_and_activate=False)
                  self.socket = socket.fromfd(3, self.address_family, self.socket_type)
@@ -334,6 +363,79 @@ in {
        '';
      };
    };
+    systemd.user.services.niri-workspace-sort = {
+      Unit = {
+        BindsTo = [ "niri.service" ];
+        After = [ "niri.service" ];
+      };
+      Install = {
+        WantedBy = [ "niri.service" ];
+      };
+      Service = {
+        Type = "simple";
+        ExecStart = pkgs.writers.writePython3 "niri-workspace-sort" { flakeIgnore = ["E501"]; } ''
+          import os
+          import sys
+          import socket
+          import json
+          outputs = None
+          only = {'HDMI-A-1': {'bmr'}, 'eDP-1': {'vid'}}
+          class Niri(socket.socket):
+              def __init__(self):
+                  super().__init__(socket.AF_UNIX, socket.SOCK_STREAM)
+                  super().connect(os.environ["NIRI_SOCKET"])
+                  self.fh = super().makefile(mode='rw', buffering=1, encoding='utf-8')
+              def cmd(self, obj):
+                  print(json.dumps(obj, separators=(',', ':')), flush=True, file=self.fh)
+              def event_stream(self):
+                  self.cmd("EventStream")
+                  return self.fh
+          with Niri() as niri, Niri().event_stream() as niri_stream:
+              for line in niri_stream:
+                  workspaces = None
+                  if line_json := json.loads(line):
+                      if "WorkspacesChanged" in line_json:
+                          workspaces = line_json["WorkspacesChanged"]["workspaces"]
+                  if workspaces is None:
+                      continue
+                  old_outputs = outputs
+                  outputs = {ws["output"] for ws in workspaces}
+                  if old_outputs is None:
+                      print("Initial outputs: {}".format(outputs), file=sys.stderr)
+                      continue
+                  new_outputs = outputs - old_outputs
+                  if not new_outputs:
+                      continue
+                  print("New outputs: {}".format(new_outputs), file=sys.stderr)
+                  relevant_workspaces = list(filter(lambda ws: (ws["name"] is not None) or (ws["active_window_id"] is not None), workspaces))
+                  target_output = next(iter(outputs - set(only.keys())))
+                  if not target_output:
+                      continue
+                  for ws in relevant_workspaces:
+                      ws_ident = ws["name"] if ws["name"] is not None else (ws["output"], ws["idx"])
+                      if ws["output"] not in set(only.keys()):
+                          continue
+                      if ws_ident in only[ws["output"]]:
+                          continue
+                      print("{} -> {}".format(ws_ident, target_output), file=sys.stderr)
+                      niri.cmd({"Action": {"MoveWorkspaceToMonitor": {"reference": {"Id": ws["id"]}, "output": target_output}}})
+        '';
+        Restart = "on-failure";
+        RestartSec = 10;
+      };
+    };
    programs.niri.scratchspaces = [
      { name = "pwctl";
@@ -347,7 +449,7 @@ in {
          { title = "^Access Request.*"; }
          { title = ".*Passkey credentials$"; }
        ];
-        windowRuleExtra = [
+        windowRuleExtra = with kdl; [
          (kdl.leaf "open-focused" false)
        ];
        key = "Mod+Control+P";
@@ -375,6 +477,20 @@ in {
        app-id = "com.github.wwmm.easyeffects";
        spawn = [ "easyeffects" ];
      }
+      { name = "time";
+        key = "Mod+Control+K";
+        app-id = "chrome-kimai.yggdrasil.li__-Default";
+        spawn = [ (toString (pkgs.resholve.writeScript "kimai" {
+          interpreter = pkgs.runtimeShell;
+          inputs = [ pkgs.dex ];
+          execer = [ "cannot:${lib.getExe pkgs.dex}" ];
+        } ''
+          exec dex $HOME/.local/state/nix/profile/share/applications/kimai.desktop
+        '')) ];
+        windowRuleExtra = with kdl; [
+          (leaf "block-out-from" "screencast")
+        ];
+      }
    ];
    programs.niri.config =
      let
@@ -419,6 +535,10 @@ in {
            ])
          ])
+          (plain "gestures" [
+            (plain "hot-corners" [(flag "off")])
+          ])
          (plain "environment" (lib.mapAttrsToList leaf {
            NIXOS_OZONE_WL = "1";
            QT_QPA_PLATFORM = "wayland";
@@ -426,6 +546,10 @@ in {
            GDK_BACKEND = "wayland";
            SDL_VIDEODRIVER = "wayland";
            DISPLAY = ":0";
+            ELECTRON_OZONE_PLATFORM_HINT = "auto";
+            SSH_ASKPASS_REQUIRE = "prefer";
+            SSH_ASKPASS = lib.getExe pkgs.kdePackages.ksshaskpass;
+            SUDO_ASKPASS = lib.getExe pkgs.kdePackages.ksshaskpass;
          }))
          (node "output" "eDP-1" [
@@ -455,8 +579,8 @@ in {
          (plain "layout" [
            (leaf "gaps" 8)
            (plain "struts" [
-              (leaf "left" 0)
+              (leaf "left" 26)
-              (leaf "right" 0)
+              (leaf "right" 26)
              (leaf "top" 0)
              (leaf "bottom" 0)
            ])
@@ -540,7 +664,7 @@ in {
          (plain "window-rule" [
            (map (title:
              (leaf "match" { app-id = "^org\\.keepassxc\\.KeePassXC$"; inherit title; })
-            ) ["^Unlock Database.*" "^Access Request.*" ".*Passkey credentials$"])
+            ) ["^Unlock Database.*" "^Access Request.*" ".*Passkey credentials$" "Browser Access Request$"])
            (leaf "open-focused" true)
            (leaf "open-floating" true)
          ])
@@ -569,7 +693,7 @@ in {
          (plain "window-rule" [
            (leaf "match" { app-id = "^thunderbird$"; })
            (leaf "match" { app-id = "^Element$"; })
-            (leaf "match" { app-id = "^Rainbow$"; })
+            (leaf "match" { app-id = "^chrome-web\.openrainbow\.com__-Default$"; })
            (leaf "open-on-workspace" "comm")
          ])
          (plain "window-rule" [
@@ -588,11 +712,16 @@ in {
            (leaf "open-focused" false)
          ])
          (plain "window-rule" [
+            (leaf "match" { app-id = "^chrome-audiobookshelf\.yggdrasil\.li__-Default$"; })
+            (leaf "match" { app-id = "^YouTube Music Desktop App$"; })
+            (leaf "open-on-workspace" "vid")
+          ])
+          (plain "window-rule" [
            (leaf "match" { app-id = "^pdfpc$"; })
            (plain "default-column-width" [(leaf "proportion" 1.)])
          ])
          (plain "window-rule" [
-            (leaf "match" { app-id = "^pdfpc$"; title = "^pdfpc - presentation$"; })
+            (leaf "match" { app-id = "^pdfpc$"; title = "^.*presentation.*$"; })
            (plain "default-column-width" [(leaf "proportion" 1.)])
            (leaf "open-fullscreen" true)
            (leaf "open-on-workspace" "bmr")
@@ -609,6 +738,7 @@ in {
          (plain "window-rule" [
            (leaf "match" { app-id = "^org\\.pwmt\\.zathura$"; })
            (leaf "match" { app-id = "^evince$"; })
+            (leaf "match" { app-id = "^org\\.gnome\\.Papers$"; })
            (leaf "default-column-display" "tabbed")
          ])
@@ -636,6 +766,21 @@ in {
                  "Mod+Slash".action = show-hotkey-overlay;
                  "Mod+Return".action = spawn terminal;
+                  "Mod+Shift+Return".action =
+                    let
+                      nushellKitty = pkgs.symlinkJoin {
+                        name = "nushell-kitty";
+                        paths = [ config.programs.kitty.package ];
+                        buildInputs = [ pkgs.makeWrapper ];
+                        postBuild = ''
+                          wrapProgram $out/bin/kitty \
+                            --add-flags "--config ${pkgs.writeText "kitty.conf" ''
+                              include $HOME/${config.xdg.configFile."kitty/kitty.conf".target}
+                              shell ${lib.getExe config.programs.nushell.package}
+                            ''}"
+                        '';
+                      };
+                    in spawn (lib.getExe' nushellKitty "kitty");
                  "Mod+Q".action = close-window;
                  "Mod+O".action = spawn (lib.getExe config.programs.fuzzel.package);
                  "Mod+Shift+O".action = spawn (lib.getExe config.programs.fuzzel.package) "--list-executables-in-path";
@@ -671,12 +816,12 @@ in {
                        done < <(export LC_ALL=C.UTF-8; echo; find "$RESULTS_DIR" -type f -printf $'%T@ %p\n' | sort -n | cut -d' ' -f2- | xargs -r cat)
                        $FOUND || echo
                      }
-                      FUZZEL_RES=$(prev | fuzzel --dmenu --prompt "qalc> ") || exit $?
+                      FUZZEL_RES=$(prev | fuzzel --dmenu --prompt "qalc> " --width=60) || exit $?
                      if [[ "$FUZZEL_RES" =~ .*\ =\ .* ]]; then
                        QALC_RES="$FUZZEL_RES"
                        QALC_RET=0
                      else
-                        QALC_RES=$(qalc "$FUZZEL_RES" 2>&1)
+                        QALC_RES=$(qalc -set "autocalc off" "$FUZZEL_RES" 2>&1)
                        QALC_RET=$?
                      fi
                      [[ -n "$QALC_RES" ]] || exit 1
@@ -696,18 +841,33 @@ in {
                      notify-send "$QALC_RES"
                    '';
                  }));
+                  "Mod+Shift+U".action =
+                    let
+                      qalcKitty = pkgs.symlinkJoin {
+                        name = "qalc-kitty";
+                        paths = [ config.programs.kitty.package ];
+                        buildInputs = [ pkgs.makeWrapper ];
+                        postBuild = ''
+                          wrapProgram $out/bin/kitty \
+                            --add-flags "--config ${pkgs.writeText "kitty.conf" ''
+                              include $HOME/${config.xdg.configFile."kitty/kitty.conf".target}
+                              shell ${lib.getExe pkgs.libqalculate}
+                            ''}"
+                        '';
+                      };
+                    in spawn (lib.getExe' qalcKitty "kitty");
                  "Mod+E".action = spawn (lib.getExe (pkgs.writeShellApplication {
                    name = "emoji-fuzzel";
                    runtimeInputs = with pkgs; [ config.programs.fuzzel.package wtype wl-clipboard-rs ];
                    text = ''
-                      FUZZEL_RES=$(fuzzel --dmenu --prompt "emoji> " <"$HOME"/.local/share/emoji-data/list.txt) || exit $?
+                      FUZZEL_RES=$(fuzzel --dmenu --prompt "emoji> " --cache "$HOME"/.cache/fuzzel-emoji --width=60 <"$HOME"/.local/share/emoji-data/list.txt) || exit $?
                      [[ -n "$FUZZEL_RES" ]] || exit 1
                      wl-copy "$(cut -d ':' -f 1 <<<"$FUZZEL_RES" | tr -d '\n')" && wtype -k XF86Paste
                    '';
                  }));
                  "Print".action = screenshot;
                  "Control+Print".action = screenshot-window;
-                  # "Shift+Print".action = screenshot-screen;
+                  "Shift+Print".action = kdl.magic-leaf "screenshot-screen";
                  "Mod+B".action = with-select-window-action ".workspace_id == ($active_workspace | tonumber)" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
                  "Mod+Shift+B".action = with-select-window-action "true" "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
@@ -746,22 +906,22 @@ in {
                  "Mod+Shift+Control+C".action = move-workspace-up;
                  "Mod+ParenLeft".action = focus-workspace "comm";
-                  "Mod+Shift+ParenLeft".action = move-column-to-workspace "comm";
+                  "Mod+Shift+ParenLeft".action = kdl.magic-leaf "move-column-to-workspace" "comm";
                  "Mod+ParenRight".action = focus-workspace "web";
-                  "Mod+Shift+ParenRight".action = move-column-to-workspace "web";
+                  "Mod+Shift+ParenRight".action = kdl.magic-leaf "move-column-to-workspace" "web";
                  "Mod+BraceRight".action = focus-workspace "read";
-                  "Mod+Shift+BraceRight".action = move-column-to-workspace "read";
+                  "Mod+Shift+BraceRight".action = kdl.magic-leaf "move-column-to-workspace" "read";
                  "Mod+BraceLeft".action = focus-workspace "mon";
-                  "Mod+Shift+BraceLeft".action = move-column-to-workspace "mon";
+                  "Mod+Shift+BraceLeft".action = kdl.magic-leaf "move-column-to-workspace" "mon";
                  "Mod+Asterisk".action = focus-workspace "vid";
-                  "Mod+Shift+Asterisk".action = move-column-to-workspace "vid";
+                  "Mod+Shift+Asterisk".action = kdl.magic-leaf "move-column-to-workspace" "vid";
                  "Mod+Plus".action = with-unnamed-workspace-action ''{"Action":{"FocusWorkspace":{"reference":{"Id": .id}}}}'';
-                  "Mod+Shift+Plus".action = with-unnamed-workspace-action ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}}}}'';
+                  "Mod+Shift+Plus".action = with-unnamed-workspace-action ''{"Action":{"MoveColumnToWorkspace":{"reference":{"Id": .id}, "focus": true}}}'';
                  "Mod+M".action = consume-or-expel-window-left;
                  "Mod+W".action = consume-or-expel-window-right;
@@ -769,10 +929,11 @@ in {
                  "Mod+Shift+M".action = toggle-column-tabbed-display;
                  "Mod+R".action = switch-preset-column-width;
-                  "Mod+Shift+R".action = switch-preset-window-height;
+                  "Mod+Shift+R".action = maximize-column;
+                  "Mod+Shift+Ctrl+R".action = switch-preset-window-height;
                  "Mod+F".action = center-column;
-                  "Mod+Shift+F".action = maximize-column;
+                  "Mod+Shift+F".action = toggle-windowed-fullscreen;
-                  "Mod+Shift+Ctrl+F".action = fullscreen-window;
+                  "Mod+Ctrl+Shift+F".action = fullscreen-window;
                  "Mod+V".action = switch-focus-between-floating-and-tiling;
                  "Mod+Shift+V".action = toggle-window-floating;
@@ -828,13 +989,24 @@ in {
                  "Mod+Semicolon".action = spawn makoctl "dismiss" "--group";
                  "Mod+Shift+Semicolon".action = spawn makoctl "dismiss" "--all";
-                  "Mod+Period".action = spawn makoctl "menu" (lib.getExe config.programs.fuzzel.package) "--dmenu";
+                  "Mod+Period".action = spawn makoctl "menu" "--" (lib.getExe config.programs.fuzzel.package) "--dmenu";
                  "Mod+Comma".action = spawn makoctl "restore";
                  "Mod+Control+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"FocusWorkspace\":{\"reference\":{\"Id\": $workspace_id}}}}";
-                  "Mod+Control+Shift+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"MoveColumnToWorkspace\":{\"reference\":{\"Id\": $workspace_id}}}}";
+                  "Mod+Control+Shift+W".action = with-empty-unnamed-workspace-action "{\"Action\":{\"MoveColumnToWorkspace\":{\"reference\":{\"Id\": $workspace_id}, \"focus\": true}}}";
+                  "Mod+X".action = set-dynamic-cast-window;
+                  "Mod+Shift+X".action = set-dynamic-cast-monitor;
+                  "Mod+Control+Shift+X".action = clear-dynamic-cast-target;
+                  "Mod+D".action = with-urgent-window-action "{\"Action\":{\"FocusWindow\":{\"id\": .id}}}";
+                  "Mod+Shift+D".action = with-focused-window-action "{\"Action\":{\"UnsetUrgent\":{\"id\": .id}}}";
+                  "Mod+K".action = spawn (lib.getExe' pkgs.worktime "worktime-ui");
+                  "Mod+Shift+K".action = spawn (lib.getExe' pkgs.worktime "worktime-stop");
                }))
                (map ({ name, selector, spawn, key, ...}: if key != null && selector != null && spawn != null then bind key { action = focus-or-spawn-action selector name spawn; } else null) cfg.scratchspaces)
+                (map ({ name, moveKey, ...}: if moveKey != null then bind moveKey { action = kdl.magic-leaf "move-column-to-workspace" name; } else null) cfg.scratchspaces)
              ]
            ))
        ];
diff --git a/accounts/gkleen@sif/niri/mako.nix b/accounts/gkleen@sif/niri/mako.nix
index 2788fb82..eba26caa 100644
--- a/accounts/gkleen@sif/niri/mako.nix
+++ b/accounts/gkleen@sif/niri/mako.nix
@@ -3,37 +3,31 @@
  config = {
    services.mako = {
      enable = true;
-      font = "Fira Sans 10";
+      settings = {
-      format = "<i>%s</i>\\n%b";
+        font = "Fira Sans 10";
-      margin = "2";
+        format = "<i>%s</i>\\n%b";
-      maxVisible = -1;
+        margin = "2";
-      backgroundColor = "#000000dd";
+        max-visible = -1;
-      progressColor = "source #223544ff";
+        background-color = "#000000dd";
-      width = 384;
+        progress-color = "source #223544ff";
-      extraConfig = ''
+        width = 384;
-        outer-margin=1
+        outer-margin = 1;
-        max-history=100
+        max-history = 100;
-        max-icon-size=48
+        max-icon-size = 48;
+      };
-        [grouped]
+      criteria = {
-        format=<b>(%g)</b> <i>%s</i>\n%b
+        grouped.format = "<b>(%g)</b> <i>%s</i>\\n%b";
+        "urgency=low".text-color = "#999999ff";
-        [urgency=low]
+        "urgency=critical".background-color = "#900000dd";
-        text-color=#999999ff
+        "app-name=Element".group-by = "summary";
+        "app-name=poweralertd" = {
-        [urgency=critical]
+          history = false;
-        background-color=#900000dd
+          ignore-timeout = true;
+          default-timeout = 2000;
-        [app-name=Element]
+        };
-        group-by=summary
+        "app-name=worktime".history = false;
+        "mode=silent".invisible = true;
-        [app-name=poweralertd]
+      };
-        ignore-timeout=1
-        default-timeout=2000
-        [mode=silent]
-        invisible=1
-      '';
      package = pkgs.symlinkJoin {
        name = "${pkgs.mako.name}-wrapped";
        paths = with pkgs; [ mako ];
diff --git a/accounts/gkleen@sif/niri/swayosd.nix b/accounts/gkleen@sif/niri/swayosd.nix
index 984927c2..54ebb302 100644
--- a/accounts/gkleen@sif/niri/swayosd.nix
+++ b/accounts/gkleen@sif/niri/swayosd.nix
@@ -3,9 +3,10 @@
  config = {
    services.swayosd = {
      enable = true;
-      topMargin = 0.946154;
+      topMargin = 0.4769706078;
      stylePath = pkgs.runCommand "style.css" {
-        src = pkgs.writeText "style.scss" ''
+        passAsFile = [ "src" ];
+        src = ''
          window#osd {
            padding: 12px 20px;
            border-radius: 999px;
@@ -59,7 +60,7 @@
          }
        '';
        buildInputs = with pkgs; [sass];
-      } "scss -C --sourcemap=none --style=compact $src $out";
+      } "scss -C --sourcemap=none --style=compact $srcPath $out";
    };
  };
 }
diff --git a/accounts/gkleen@sif/niri/waybar.nix b/accounts/gkleen@sif/niri/waybar.nix
index bae818f6..c02a9a76 100644
--- a/accounts/gkleen@sif/niri/waybar.nix
+++ b/accounts/gkleen@sif/niri/waybar.nix
@@ -20,15 +20,21 @@ in {
        {
          layer = "top";
          position = "top";
-          height = 14;
+          height = 21;
          output = [ "eDP-1" "DP-2" "DP-3" ];
          modules-left = [ "niri/workspaces" ];
          modules-center = [ "niri/window" ];
          modules-right = [ "custom/worktime" "custom/worktime-today"
            "custom/weather"
            "custom/keymap"
-            "privacy" "tray" "wireplumber" "backlight" "battery" "idle_inhibitor" "custom/mako" "clock" ];
+            "privacy" "tray" "wireplumber" "backlight" "battery" "idle_inhibitor" "custom/mako" "custom/lid_inhibitor" "clock" ];
+          "custom/lid_inhibitor" = {
+            format = "{}";
+            return-type = "json";
+            exec = lib.getExe pkgs.waybar-systemd-inhibit;
+            on-click = lib.getExe' pkgs.waybar-systemd-inhibit "waybar-systemd-inhibit-toggle";
+          };
          "custom/mako" = {
            format = "{}";
            return-type = "json";
@@ -211,7 +217,7 @@ in {
          layer = "top";
          position = "top";
          height = 14;
-          output = [ "!eDP-1" "!DP-2" "!DP-3" ];
+          output = [ "!eDP-1" "!DP-2" "!DP-3" "*" ];
          modules-left = [ "niri/workspaces" ];
          modules-center = [ "niri/window" ];
          modules-right = [ "clock" ];
@@ -254,10 +260,10 @@ in {
        }
        .modules-left {
-          margin-left: 12px;
+          margin-left: 38px;
        }
        .modules-right {
-          margin-right: 12px;
+          margin-right: 38px;
        }
        .module {
@@ -293,7 +299,7 @@ in {
        #tray {
          margin: 0;
        }
-        #battery, #idle_inhibitor, #backlight, #wireplumber, #custom-mako {
+        #battery, #idle_inhibitor, #backlight, #wireplumber, #custom-mako, #custom-lid_inhibitor {
          color: @grey;
          margin: 0 5px 0 2px;
        }
@@ -302,7 +308,11 @@ in {
          margin-left: 6px;
        }
        #custom-mako {
-          margin-right: 2px;
+          margin-right: 4px;
+          margin-left: 3px;
+        }
+        #custom-lid_inhibitor {
+          margin-right: 3px;
          margin-left: 3px;
        }
        #battery {
@@ -330,7 +340,7 @@ in {
          color: @orange;
        }
-        #idle_inhibitor {
+        #idle_inhibitor, #custom-lid_inhibitor {
          padding-top: 1px;
        }
@@ -340,6 +350,7 @@ in {
        }
        #clock {
          /* margin-right: 5px; */
+          font-feature-settings: "tnum";
        }
      '';
    };
diff --git a/accounts/gkleen@sif/synadm/default.nix b/accounts/gkleen@sif/synadm/default.nix
new file mode 100644
index 00000000..0a8e0d4c
--- /dev/null
+++ b/accounts/gkleen@sif/synadm/default.nix
@@ -0,0 +1,9 @@
+{ config, pkgs, ... }:
+{
+  home.packages = with pkgs; [ synadm ];
+  sops.secrets."synadm.yaml" = {
+    format = "binary";
+    sopsFile = ./synadm_yaml;
+    path = config.xdg.configHome + "/synadm.yaml";
+  };
+}
diff --git a/accounts/gkleen@sif/synadm/synadm_yaml b/accounts/gkleen@sif/synadm/synadm_yaml
new file mode 100644
index 00000000..8d951ccc
--- /dev/null
+++ b/accounts/gkleen@sif/synadm/synadm_yaml
@@ -0,0 +1,15 @@
+{
+        "data": "ENC[AES256_GCM,data:qJy4Pmbbxja4jmW7OaHsD0mQZ7anZwLhiVmAgkavb+CqwWGDnUBXdz22/MHCbxng5NshcFSpBoCBhgY6B9V2bUiES6bH9AtMlDcs9ebKGMArBTUTnQ2MjWQGfQTqraWdNgy+n327uj9swwCH8EZXdYH/Hlv0t/re470W+VOHeXhGghQ3Y9IGz2sgfvMGr8QxaJNydZz85rgs5QUP/PglCwWIOw2mY1EX2vYwnmiAo49LmIEaxWvRi++KHaeBveDt0nlkJwzUlipL2VOKWxkgpK3yGucQn2mz+FRe1btp+4KGm8H17eUI9FO9sBwq,iv:kgM921ovwCgDYHQj3c5Rupy/8JxHehxUD2jb1k9Ik2Y=,tag:3TLQkJbv679VWy8V2TMugw==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bzVHUGNxZTF2WC9MYmZr\neGdVVzJXN3lGdEk3cTBER3J6UTFtcUJna2d3CjdNQmRXd2haZW1MYlJzNkk1dWVD\nVTFQc2gvS0JrejJ6SFh2MXpPWDZpRE0KLS0tIE0wTC85bEpvSnlGdGFkZVFhNjFZ\nbzRiZkxMWUg2ODNVUlBmNFlPNGRrZlkK1VXLJWcssv3ETyZSSM/Hhn5VIaI9iov9\nzShZA9Zx/FX6PYTuUMC29pJ57gKourcIxa/7HwSv/xYn1A6WcYfgSg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-05-18T11:03:42Z",
+                "mac": "ENC[AES256_GCM,data:yonJC68PhilAgEHNNJQ8nO53Qo3rx/LnfiOWfuMm24bOUIH9QM3WZZxpigd7bHI4eC4TqRb4LvcSi0nEURTRAhwiTqGNrWbpw2Iv3n5dhLEN9aTcetG5ZuhaXqfVUoML45/ovdBZG/0l8+XIHqxN2M/g/h4JwKoR/6lqzcrVhgo=,iv:xvxBJwy+E5zUdjhGPdZPdy7tnBIEj50hfiDJFsS3wNg=,tag:L4Fas36ZOg4h0QQwC4gjNA==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/accounts/gkleen@sif/systemd.nix b/accounts/gkleen@sif/systemd.nix
index 2237b708..90cccc58 100644
--- a/accounts/gkleen@sif/systemd.nix
+++ b/accounts/gkleen@sif/systemd.nix
@@ -242,7 +242,7 @@ in {
          "-${lib.getExe pkgs.playerctl} -a pause"
          "-${lib.getExe (pkgs.writeShellApplication {
            name = "generate-css";
-            runtimeInputs = with pkgs; [cfg.programs.wpaperd.package jq coreutils imagemagick findutils];
+            runtimeInputs = with pkgs; [cfg.services.wpaperd.package jq coreutils imagemagick findutils];
            text = ''
              declare -A monitors
              monitors=()
@@ -333,21 +333,21 @@ in {
        ExecStopPost = "${pkgs.coreutils}/bin/rm -rfv \"$CACHE_DIRECTORY\"";
      };
    };
-    wpaperd = {
+    # wpaperd = {
-      Install = {
+    #   Install = {
-        WantedBy = ["graphical-session.target"];
+    #     WantedBy = ["graphical-session.target"];
-      };
+    #   };
-      Unit = {
+    #   Unit = {
-        After = [ "graphical-session.target" ];
+    #     After = [ "graphical-session.target" ];
-        PartOf = [ "graphical-session.target" ];
+    #     PartOf = [ "graphical-session.target" ];
-      };
+    #   };
-      Service = {
+    #   Service = {
-        ExecStart = lib.getExe cfg.programs.wpaperd.package;
+    #     ExecStart = lib.getExe cfg.services.wpaperd.package;
-        Type = "simple";
+    #     Type = "simple";
-        Restart = "always";
+    #     Restart = "always";
-        RestartSec = "2s";
+    #     RestartSec = "2s";
-      };
+    #   };
-    };
+    # };
    xembed-sni-proxy = {
      Unit = {
        PartOf = lib.mkForce ["tray.target"];
diff --git a/accounts/gkleen@sif/utils/async-yt-dlp.nix b/accounts/gkleen@sif/utils/async-yt-dlp.nix
new file mode 100644
index 00000000..c3b82ec5
--- /dev/null
+++ b/accounts/gkleen@sif/utils/async-yt-dlp.nix
@@ -0,0 +1,57 @@
+{ writers, python3Packages, ... }:
+writers.writePython3Bin "async-yt-dlp" {
+  libraries = with python3Packages; [ yt-dlp ];
+  flakeIgnore = ["E501"];
+} ''
+import sys
+import os
+import yt_dlp
+import yt_dlp.options
+from collections import namedtuple
+import socket
+from pathlib import Path
+import json
+create_parser = yt_dlp.options.create_parser
+def parse_patched_options(opts):
+    patched_parser = create_parser()
+    patched_parser.defaults.update({
+        'ignoreerrors': False,
+        'retries': 0,
+        'fragment_retries': 0,
+        'extract_flat': False,
+        'concat_playlist': 'never',
+    })
+    yt_dlp.options.create_parser = lambda: patched_parser
+    try:
+        return yt_dlp.parse_options(opts)
+    finally:
+        yt_dlp.options.create_parser = create_parser
+default_opts = parse_patched_options([]).ydl_opts
+def cli_to_api(opts):
+    opts = parse_patched_options(opts)
+    urls = opts.urls
+    opts = opts.ydl_opts
+    diff = {k: v for k, v in opts.items() if default_opts[k] != v}
+    if 'postprocessors' in diff:
+        diff['postprocessors'] = [pp for pp in diff['postprocessors']
+                                  if pp not in default_opts['postprocessors']]
+    return namedtuple('Options', ('params', 'urls'))(diff, urls)
+if __name__ == '__main__':
+    opts = cli_to_api(sys.argv[1:])
+    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
+        sock.connect(str(Path(os.environ["XDG_RUNTIME_DIR"]) / "yt-dlp.sock").encode('utf-8'))
+        with sock.makefile(mode='w', buffering=1, encoding='utf-8') as fh:
+            json.dump(opts._asdict(), fh)
+''
diff --git a/accounts/gkleen@sif/utils/sieve-edit.nix b/accounts/gkleen@sif/utils/sieve-edit.nix
new file mode 100644
index 00000000..f985a3f6
--- /dev/null
+++ b/accounts/gkleen@sif/utils/sieve-edit.nix
@@ -0,0 +1,24 @@
+pkgs@{ lib, resholve, zsh, sieve-connect, sops, ... }:
+resholve.writeScriptBin "sieve-edit" {
+  inputs = with pkgs; [sieve-connect sops];
+  interpreter = lib.getExe zsh;
+  execer = with pkgs; [
+    "cannot:${lib.getExe sieve-connect}"
+    "cannot:${lib.getExe sops}"
+  ];
+} ''
+  host=$1; shift
+  case "$host" in
+    surtr)
+      sieve-connect -s surtr.yggdrasil.li -m EXTERNAL --clientkey <(sops decrypt $HOME/projects/machines/hosts/surtr/email/ca/gkleen@sif.key) --clientcert $HOME/projects/machines/hosts/surtr/email/ca/gkleen@sif.crt --edit --remotesieve sieve
+      ;;
+    ymir)
+      sieve-connect -s ymir.yggdrasil.li -u gkleen --edit --remotesieve sieve
+      ;;
+    *)
+      echo "Unknown host: ‘$host’" >&2
+      return 2
+      ;;
+  esac
+''
diff --git a/accounts/gkleen@sif/zshrc b/accounts/gkleen@sif/zshrc
index c628e2e9..abc200c6 100644
--- a/accounts/gkleen@sif/zshrc
+++ b/accounts/gkleen@sif/zshrc
@@ -2,17 +2,14 @@ dir() {
    curlArchive=false
    templateArchive=""
    repoUrl=""
-    nixShell=""
-    findNix=false
    dir=""
    forceShell=false
    wormhole=false
    gitWorktree=""
-    # notmuchMsg=""
-    quickserve=false
    modifyPDF=""
+    miniserve=false
-    while getopts ':t:a:s:Sd:ir:wqg:p:' arg; do
+    while getopts ':t:a:d:ir:wg:p:m' arg; do
        case $arg in
            "t") ;;
            "a")
@@ -23,16 +20,13 @@ dir() {
                    templateArchive=${OPTARG:a}
                fi
                ;;
-            "s") nixShell=${OPTARG:a} ;;
-            "S") findNix=true ;;
            "d") dir=${OPTARG} ;;
            "i") forceShell=true ;;
            "r") repoUrl=${OPTARG} ;;
            "w") wormhole=true ;;
            "g") gitWorktree=${OPTARG} ;;
-            # "n") notmuchMsg=${OPTARG} ;;
-            "q") quickserve=true ;;
            "p") modifyPDF=${OPTARG:a} ;;
+            "m") miniserve=true ;;
            *) printf "Invalid option: %s\n" $arg >&2; exit 2 ;;
        esac
    done
@@ -56,20 +50,34 @@ dir() {
        gitWorktree=""
    fi
+    miniservePIDFile=""
+    if [[ ${miniserve} = "true" ]]; then
+      miniservePIDFile=$(mktemp --tmpdir --suffix=.pid)
+    fi
    cleanup()
    {
-        cd ${modifyPDF:h}
+        if [[ -n ${modifyPDF} ]]; then
-        [[ -n ${modifyPDF} ]] && nix shell 'nixos#imagemagick' -c convert -verbose ${dir}/${modifyPDF:t:r}_*.png(on) ${modifyPDF}
+           cd ${modifyPDF:h}
+           typeset -a pages
+           eval 'pages=(${dir}/${modifyPDF:t:r}_*.png(on))'
+           magick -verbose "$pages" ${modifyPDF}
+           modifyPDF=""
+        fi
+        if [[ -n ${miniservePIDFile} ]]; then
+           command kill --verbose -- $(cat ${miniservePIDFile}) && wait $(cat ${miniservePIDFile})
+           miniservePIDFile=""
+        fi
    }
    (
+        set -o localoptions -o localtraps
+        trap 'return 1' INT TERM
        trap cleanup EXIT
        cd ${dir}
        export dir;
-        ${findNix} && { nixShell=$(findNix) || return $? }
        [[ -n ${repoUrl} ]] && git clone -- ${repoUrl} .
        [[ -n ${modifyPDF} ]] && templateArchive=${modifyPDF}
@@ -82,7 +90,7 @@ dir() {
                }
                trap cleanup EXIT
-                if ${curlArchive}; then
+                if [[ $curlArchive = "true" ]]; then
                    archiveFile=$(mktemp -t "archive.XXXXXXXXXX.${templateArchive:t}")
                    curl -L -o ${archiveFile} ${templateArchive}
@@ -91,14 +99,14 @@ dir() {
                fi
                unpack=true
-                while ${unpack}; do
+                while [[ $unpack = "true" ]]; do
                    case $(file --brief --mime-type --dereference ${templateArchive}) in
                        application/zip)
                            unzip ${templateArchive}
                            unpack=false
                        ;;
                        application/vnd.debian.binary-package)
-                            nix shell 'nixos#binutils' --command ar x ${templateArchive}
+                            ar x ${templateArchive}
                            mkdir control data
                            tar -C control -xvaf control.*
                            tar -C data -xvaf data.*
@@ -106,7 +114,7 @@ dir() {
                        ;;
                        application/x-rpm)
                            cpioArchive=$(mktemp -t "archive.XXXXXXXXXX.${templateArchive:t:r}.cpio")
-                            nix shell 'nixos#busybox' --command rpm2cpio ${templateArchive} > ${cpioArchive}
+                            rpm2cpio ${templateArchive} > ${cpioArchive}
                            templateArchive=${cpioArchive}
                            unpack=true
                        ;;
@@ -115,12 +123,12 @@ dir() {
                            unpack=false
                        ;;
                        application/pdf)
-                            nix shell 'nixos#ghostscript' 'nixos#imagemagick' -c convert -verbose -density 400 ${templateArchive} ${modifyPDF:t:r}_%0d.png
+                            magick -verbose -density 400 ${templateArchive} ${modifyPDF:t:r}_%0d.png
                            unpack=false
                        ;;
                        application/octet-stream)
-                            if [[ $(file --brief --dereferenc ${templateArchive}) =~ Squashfs ]]; then
+                            if [[ $(file --brief --dereference ${templateArchive}) =~ Squashfs ]]; then
-                               nix shell 'nixos#squashfsTools' -c unsquashfs -d . ${templateArchive}
+                               unsquashfs -d . ${templateArchive}
                               unpack=false
                            fi
                        ;;
@@ -134,25 +142,21 @@ dir() {
        fi
-        ${wormhole} && wormhole receive --accept-file
+        [[ $wormhole = "true" ]] && wormhole receive --accept-file
-        if ${quickserve}; then
+        if [[ ${#@} -gt 0 ]]; then
-          quickserve --root . --upload . --show-hidden --tar gz
+            ${@}
        fi
+        cd $(pwd) # Needed for mounting to work
-        if [[ ${#@} -eq 0 ]] || ${forceShell}; then
+        if [[ ${miniserve} = "true" ]]; then
-            if [[ ${#@} -gt 0 ]]; then
+           miniserve --random-route --hidden --enable-tar-gz --enable-zip . &
-                if [[ -z ${nixShell} ]]; then
+           echo $! > "${miniservePIDFile}"
-                    ${@}
+        fi
-                else
-                    nix-shell ${nixShell} --run "${@}"
-                fi
-            fi
-            cd $(pwd) # Needed for mounting to work
+        if [[ ${#@} -eq 0 ]] && [[ ${miniserve} != "true" ]] || [[ $forceShell = "true" ]]; then
            isSingleDir() {
                typeset -a contents
                contents=(*(N) .*(N))
@@ -166,18 +170,9 @@ dir() {
            }
            while d=$(isSingleDir); do cd ${d}; done
+            zsh
-            if [[ -z ${nixShell} ]]; then
+        elif [[ ${miniserve} == "true" ]]; then
-                zsh
+            wait $(cat "${miniservePIDFile}")
-            else
-                nix-shell ${nixShell} --run zsh
-            fi
-        else
-            if [[ -z ${nixShell} ]]; then
-                ${@}
-            else
-                nix-shell ${nixShell} --run "${@}"
-            fi
        fi
    )
 }
@@ -185,27 +180,30 @@ dir() {
 tmpdir() {
    cleanup()
    {
-      cd /
+        cd /
        unmount() {
            printf "Unmounting %s\n" ${1} >&2
            fusermount -u ${1} || umount ${1} || sudo umount ${1}
        }
-        if mountpoint -q -- ${dir}; then
+        if [[ -n ${dir} ]]; then
-            unmount ${dir} || return $?
+            if mountpoint -q -- ${dir}; then
-        else
+                unmount ${dir} || return $?
-            while read -d $'\0' subDir; do
+            else
-                mountpoint -q -- ${subDir} || continue
+                while read -d $'\0' subDir; do
-                unmount ${subDir} || return $?
+                    mountpoint -q -- ${subDir} || continue
-            done <<<$(find ${dir} -xdev -type d -print0 | sort -zr)
+                    unmount ${subDir} || return $?
-        fi
+                done <<<$(find ${dir} -xdev -type d -print0 | sort -zr)
+            fi
-        rm -rfv --one-file-system -- ${dir}
+            rm -rfv --one-file-system -- ${dir}
+            dir=""
+        fi
    }
    local tmpdir=""
-    while getopts ':t:a:s:Sd:ir:wqg:p:' arg; do
+    while getopts ':t:a:d:ir:wg:p:m' arg; do
        case $arg in
            "t") tmpdir="=${OPTARG}" ;;
            "?"|":") printf "Invalid option: %s\n" $arg >&2; exit 2 ;;
@@ -213,6 +211,8 @@ tmpdir() {
    done
    (
+        set -o localoptions -o localtraps
+        trap 'return 1' INT TERM
        trap cleanup EXIT
@@ -234,16 +234,6 @@ public-ip() {
    curl -s -H 'Accept: application/json' $@ ifconfig.co | jq -r '.ip'
 }
-nix-ghci() {
-    pkgExpr=""
-    if [[ ${#@} -gt 0 ]]; then
-        pkgExpr="${1}"
-        shift
-    fi
-    nix-shell -p "with (import <nixpkgs> {}); pkgs.haskellPackages.ghcWithPackages (p: with p; [${pkgExpr}])" --run "ghci ${@}"
-}
 swap() {
    f1=${1}
    f2=${2}
@@ -271,14 +261,6 @@ l() {
  ls --long --binary --git --time-style=iso --header $@
 }
-re() {
-  systemctl restart $@
-}
-ure() {
-  systemctl --user restart $@
-}
 ssh-installer() {
  ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityFile=~/.ssh/gkleen@sif.midgard.yggdrasil $@
 }
diff --git a/accounts/gkleen@surtr.nix b/accounts/gkleen@surtr.nix
index 58c4f21d..8f678ac9 100644
--- a/accounts/gkleen@surtr.nix
+++ b/accounts/gkleen@surtr.nix
@@ -1,3 +1,7 @@
-{ userName, ... }: {
+{ flake, userName, ... }: {
-  home-manager.users.${userName}.home.stateVersion = "20.09";
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName}.home.stateVersion = "20.09";
 }
diff --git a/accounts/gkleen@vidhar.nix b/accounts/gkleen@vidhar.nix
index 8509c2f4..3a37c4bd 100644
--- a/accounts/gkleen@vidhar.nix
+++ b/accounts/gkleen@vidhar.nix
@@ -1,4 +1,8 @@
 { flake, pkgs, userName, config, ... }: {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
  config = {
    users.users.${userName} = {
      uid = 1000;
diff --git a/accounts/mherold@eostre.nix b/accounts/mherold@eostre.nix
index 51e4529a..0e2f37aa 100644
--- a/accounts/mherold@eostre.nix
+++ b/accounts/mherold@eostre.nix
@@ -7,9 +7,9 @@
    home-manager.users.${userName} = {
      home.stateVersion = "20.09";
-      nixpkgs.config = {
+      # nixpkgs.config = {
-        allowUnfree = true;
+      #   allowUnfree = true;
-      };
+      # };
      home.packages = with pkgs; [
        thunderbird libreoffice element-desktop keepassxc vlc
diff --git a/accounts/root@installer.nix b/accounts/root@installer.nix
index c7a418f8..5fe1db38 100644
--- a/accounts/root@installer.nix
+++ b/accounts/root@installer.nix
@@ -1,7 +1,11 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 {
-  home-manager.users.${userName} = { config, ... } : {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName} = { config, ... } : {
    home.stateVersion = config.home.version.release;
  };
 }
diff --git a/accounts/root@sif.nix b/accounts/root@sif.nix
index c9e129a0..bb816230 100644
--- a/accounts/root@sif.nix
+++ b/accounts/root@sif.nix
@@ -1,6 +1,10 @@
-{ userName, ... }:
+{ flake, userName, ... }:
 {
-  home-manager.users.${userName} = {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName} = {
    home.stateVersion = "20.09";
    programs.ssh.matchBlocks = {
diff --git a/accounts/root@surtr.nix b/accounts/root@surtr.nix
index 58c4f21d..8f678ac9 100644
--- a/accounts/root@surtr.nix
+++ b/accounts/root@surtr.nix
@@ -1,3 +1,7 @@
-{ userName, ... }: {
+{ flake, userName, ... }: {
-  home-manager.users.${userName}.home.stateVersion = "20.09";
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName}.home.stateVersion = "20.09";
 }
diff --git a/accounts/root@vidhar.nix b/accounts/root@vidhar.nix
index e82414a8..0fc56633 100644
--- a/accounts/root@vidhar.nix
+++ b/accounts/root@vidhar.nix
@@ -1,6 +1,11 @@
-{ config, userName, ... }:
+{ flake, config, userName, ... }:
 {
-  home-manager.users.${userName} = {
+  imports = with flake.nixosModules.userProfiles.${userName}; [
+    zsh tmux
+  ];
+  config.home-manager.users.${userName} = {
    home.stateVersion = "20.09";
    programs.ssh.matchBlocks = {