11 files changed, 255 insertions, 205 deletions

diff --git a/hosts/sif/default.nix b/hosts/sif/default.nix
index 088e1022..4cdd4aa7 100644
--- a/hosts/sif/default.nix
+++ b/hosts/sif/default.nix
@@ -12,9 +12,8 @@ let
 in {
   imports = with flake.nixosModules.systemProfiles; [
     ./hw.nix
-    ./mail ./libvirt
-    tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines
-    networkmanager
+    ./email ./libvirt ./greetd
+    tmpfs-root bcachefs initrd-all-crypto-modules default-locale openssh rebuild-machines niri-unstable networkmanager lanzaboote
     flakeInputs.nixos-hardware.nixosModules.lenovo-thinkpad-p1
     flakeInputs.impermanence.nixosModules.impermanence
     flakeInputs.nixVirt.nixosModules.default
@@ -35,6 +34,10 @@ in {
       initrd = {
         systemd = {
           emergencyAccess = config.users.users.root.hashedPassword;
+          extraBin = {
+            "vim" = lib.getExe pkgs.vim;
+            "grep" = lib.getExe pkgs.gnugrep;
+          };
         };
         luks.devices = {
           nvm0 = { device = "/dev/disk/by-uuid/bef17e86-d929-4a60-97cb-6bfa133face7"; bypassWorkqueues = true; };
@@ -48,12 +51,8 @@ in {
 
       blacklistedKernelModules = [ "nouveau" ];
 
-      # Use the systemd-boot EFI boot loader.
+      lanzaboote.configurationLimit = 15;
       loader = {
-        systemd-boot = {
-          enable = true;
-          configurationLimit = 15;
-        };
         efi.canTouchEfiVariables = true;
         timeout = null;
       };
@@ -61,15 +60,20 @@ in {
       plymouth.enable = true;
 
       kernelPackages = pkgs.linuxPackages_latest;
-      extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
-      kernelModules = ["v4l2loopback"];
       kernelPatches = [
         { name = "edac-config";
           patch = null;
-          extraConfig = ''
-            EDAC y
-            EDAC_IE31200 y
-          '';
+          extraStructuredConfig = with lib.kernel; {
+            EDAC = yes;
+            EDAC_IE31200 = yes;
+          };
+        }
+        { name = "zswap-default";
+          patch = null;
+          extraStructuredConfig = with lib.kernel; {
+            ZSWAP_DEFAULT_ON = yes;
+            ZSWAP_SHRINKER_DEFAULT_ON = yes;
+          };
         }
       ];
 
@@ -93,6 +97,8 @@ in {
         server ptbtime2.ptb.de prefer iburst nts
         server ptbtime3.ptb.de prefer iburst nts
         server ptbtime4.ptb.de prefer iburst nts
+        pool ntppool1.time.nl prefer iburst nts
+        pool ntppool2.time.nl prefer iburst nts
 
         authselectmode require
         minsources 3
@@ -121,40 +127,16 @@ in {
         rulesetFile = ./ruleset.nft;
       };
 
-      # firewall = {
-      #   enable = true;
-      #   allowedTCPPorts = [ 22 # ssh
-      #                       8000 # quickserve
-      #                     ];
-      # };
-
-      # wlanInterfaces = {
-      #   wlan0 = {
-      #     device = "wlp82s0";
-      #   };
-      # };
-
-      # bonds = {
-      #   "lan" = {
-      #     interfaces = [ "wlan0" "enp0s31f6" "dock0" ];
-      #     driverOptions = {
-      #       miimon = "1000";
-      #       mode = "active-backup";
-      #       primary_reselect = "always";
-      #     };
-      #   };
-      # };
-
       useDHCP = false;
       useNetworkd = true;
-
-      # interfaces."tinc.yggdrasil" = {
-      #   virtual = true;
-      #   virtualType = config.services.tinc.networks.yggdrasil.interfaceType;
-      #   macAddress = "5c:93:21:c3:61:39";
-      # };
     };
 
+    environment.etc."NetworkManager/dnsmasq.d/dnssec.conf" = {
+      text = ''
+        conf-file=${pkgs.dnsmasq}/share/dnsmasq/trust-anchors.conf
+        dnssec
+      '';
+    };
     environment.etc."NetworkManager/dnsmasq.d/libvirt_dnsmasq.conf" = {
       text = ''
         except-interface=virbr0
@@ -397,19 +379,6 @@ in {
     ];
 
     services = {
-      uucp = {
-        enable = true;
-        nodeName = "sif";
-        remoteNodes = {
-          "ymir" = {
-            publicKeys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG6KNtsCOl5fsZ4rV7udTulGMphJweLBoKapzerWNoLY root@ymir"];
-            hostnames = ["ymir.yggdrasil.li" "ymir.niflheim.yggdrasil"];
-          };
-        };
-
-        defaultCommands = lib.mkForce [];
-      };
-
       avahi.enable = true;
 
       fwupd.enable = true;
@@ -428,8 +397,8 @@ in {
 
       logind = {
         lidSwitch = "suspend";
-        lidSwitchDocked = "lock";
-        lidSwitchExternalPower = "lock";
+        lidSwitchDocked = "ignore";
+        lidSwitchExternalPower = "ignore";
       };
 
       atd = {
@@ -438,7 +407,7 @@ in {
       };
 
       xserver = {
-        enable = true;
+        enable = false;
 
         xkb = {
           layout = "us";
@@ -464,47 +433,18 @@ in {
       };
       libinput.enable = true;
 
-      greetd = {
-        enable = true;
-      #   settings.default_session.command = let
-      #     cfg = config.programs.regreet;
-      #   in pkgs.writeShellScript "greeter" ''
-      #       modprobe -r nvidia_drm
+      envfs.enable = false;
 
-      #       exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}
-      #     '';
-      };
+      displayManager.defaultSession = "Niri";
     };
 
-    programs.regreet = {
-      enable = true;
-      theme = {
-        package = pkgs.equilux-theme;
-        name = "Equilux-compact";
-      };
-      iconTheme = {
-        package = pkgs.paper-icon-theme;
-        name = "Paper-Mono-Dark";
-      };
-      font = {
-        package = pkgs.fira;
-        name = "Fira Sans";
-        # size = 6;
-      };
-      cageArgs = [ "-s" "-m" "last" ];
-      settings = {
-        GTK.application_prefer_dark_theme = true;
-      };
-    };
-    programs.hyprland.enable = true;
-
     systemd.tmpfiles.settings = {
       "10-localtime"."/etc/localtime".L.argument = "/.bcachefs/etc/localtime";
 
-      "10-regreet"."/var/cache/regreet/cache.toml".C.argument = toString ((pkgs.formats.toml {}).generate "cache.toml" {
-        last_user = "gkleen";
-        user_to_last_sess.gkleen = "Hyprland";
-      });
+      # "10-regreet"."/var/cache/regreet/cache.toml".C.argument = toString ((pkgs.formats.toml {}).generate "cache.toml" {
+      #   last_user = "gkleen";
+      #   user_to_last_sess.gkleen = "Niri";
+      # });
     };
 
     users = {
@@ -613,15 +553,15 @@ in {
       };
 
       nvidia = {
-        open = true;
+        open = false;
         modesetting.enable = true;
         powerManagement.enable = true;
-        prime = {
-          nvidiaBusId = "PCI:1:0:0";
-          intelBusId = "PCI:0:2:0";
-          reverseSync.enable = true;
-          offload.enableOffloadCmd = true;
-        };
+        # prime = {
+        #   nvidiaBusId = "PCI:1:0:0";
+        #   intelBusId = "PCI:0:2:0";
+        #   reverseSync.enable = true;
+        #   offload.enableOffloadCmd = true;
+        # };
       };
 
       graphics = {
@@ -664,25 +604,6 @@ in {
 
     environment.etc."X11/xorg.conf.d/50-wacom.conf".source = lib.mkForce ./wacom.conf;
 
-    systemd.services."ac-plugged" = {
-      description = "Inhibit handling of lid-switch and sleep";
-
-      path = with pkgs; [ systemd coreutils ];
-
-      script = ''
-        exec systemd-inhibit --what=handle-lid-switch --why="AC is connected" --mode=block sleep infinity
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-      };
-    };
-
-    services.udev.extraRules = with pkgs; lib.mkAfter ''
-      SUBSYSTEM=="power_supply", ENV{POWER_SUPPLY_ONLINE}=="0", RUN+="${systemd}/bin/systemctl --no-block stop ac-plugged.service"
-      SUBSYSTEM=="power_supply", ENV{POWER_SUPPLY_ONLINE}=="1", RUN+="${systemd}/bin/systemctl --no-block start ac-plugged.service"
-    '';
-
     systemd.services."nix-daemon".serviceConfig = {
       MemoryAccounting = true;
       MemoryHigh = "50%";
@@ -695,6 +616,7 @@ in {
 
     services.dbus.packages = with pkgs;
       [ dbus dconf
+        xdg-desktop-portal-gtk
       ];
 
     services.udisks2.enable = true;
@@ -703,12 +625,8 @@ in {
       light.enable = true;
       wireshark.enable = true;
       dconf.enable = true;
-    };
-
-    zramSwap = {
-      enable = true;
-      algorithm = "zstd";
-      writebackDevice = "/dev/disk/by-label/swap";
+      niri.enable = true;
+      fuse.userAllowOther = true;
     };
 
     services.pcscd.enable = true;
@@ -728,6 +646,16 @@ in {
     environment.sessionVariables."GTK_USE_PORTAL" = "1";
     xdg.portal = {
       enable = true;
+      extraPortals = with pkgs; [ xdg-desktop-portal-gtk ];
+      config.niri = {
+        default = ["gnome" "gtk"];
+        "org.freedesktop.impl.portal.FileChooser" = ["gtk"];
+        "org.freedesktop.impl.portal.OpenFile" = ["gtk"];
+        "org.freedesktop.impl.portal.Access" = ["gtk"];
+        "org.freedesktop.impl.portal.Notification" = ["gtk"];
+        "org.freedesktop.impl.portal.Secret" = ["gnome-keyring"];
+        "org.freedesktop.impl.portal.Inhibit" = ["none"];
+      };
     };
 
     environment.persistence."/.bcachefs" = {
@@ -735,19 +663,18 @@ in {
       directories = [
         "/nix"
         "/root"
+        "/home"
         "/var/log"
         "/var/lib/sops-nix"
         "/var/lib/nixos"
         "/var/lib/systemd"
-        "/home"
         "/var/lib/chrony"
         "/var/lib/fprint"
         "/var/lib/bluetooth"
         "/var/lib/upower"
         "/var/lib/postfix"
         "/etc/NetworkManager/system-connections"
-        { directory = "/var/uucp"; user = "uucp"; group = "uucp"; mode = "0700"; }
-        { directory = "/var/spool/uucp"; user = "uucp"; group = "uucp"; mode = "0750"; }
+        config.boot.lanzaboote.pkiBundle
       ];
       files = [
       ];
diff --git a/hosts/sif/email/default.nix b/hosts/sif/email/default.nix
new file mode 100644
index 00000000..4eda236e
--- /dev/null
+++ b/hosts/sif/email/default.nix
@@ -0,0 +1,110 @@
+{ config, lib, pkgs, ... }:
+{
+  services.postfix = {
+    enable = true;
+    enableSmtp = false;
+    enableSubmission = false;
+    setSendmail = true;
+    networksStyle = "host";
+    hostname = "sif.midgard.yggdrasil";
+    destination = [];
+    recipientDelimiter = "+";
+    config = {
+      mydomain = "yggdrasil.li";
+
+      local_transport = "error:5.1.1 No local delivery";
+      alias_database = [];
+      alias_maps = [];
+      local_recipient_maps = [];
+
+      inet_interfaces = "loopback-only";
+
+      message_size_limit = "0";
+
+      authorized_submit_users = "inline:{ gkleen= }";
+      authorized_flush_users = "inline:{ gkleen= }";
+      authorized_mailq_users = "inline:{ gkleen= }";
+
+      smtp_generic_maps = "inline:{ root=root+sif }";
+
+      mynetworks = ["127.0.0.0/8" "[::1]/128"];
+      smtpd_client_restrictions = ["permit_mynetworks" "reject"];
+      smtpd_relay_restrictions = ["permit_mynetworks" "reject"];
+
+      sender_dependent_default_transport_maps = ''regexp:${pkgs.writeText "sender_relay" ''
+        /@(cip|stud)\.ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtp.ifi.lmu.de
+        /@ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtpin1.ifi.lmu.de:587
+        /@math(ematik)?\.(lmu|uni-muenchen)\.de$/ smtps:smtp.math.lmu.de:465
+        /@(campus\.)?lmu\.de$/ smtp:postout.lrz.de
+      ''}'';
+      sender_bcc_maps = ''regexp:${pkgs.writeText "sender_bcc" ''
+        /^uni2work(-[^@]*)?@ifi\.lmu\.de$/ uni2work@ifi.lmu.de
+        /@ifi\.lmu\.de$/ gregor.kleen@ifi.lmu.de
+      ''}'';
+      relayhost = "[surtr.yggdrasil.li]:465";
+      default_transport = "relay";
+
+      smtp_sasl_auth_enable = true;
+      smtp_sender_dependent_authentication = true;
+      smtp_sasl_tls_security_options = "noanonymous";
+      smtp_sasl_mechanism_filter = ["plain"];
+      smtp_sasl_password_maps = "regexp:/run/credentials/postfix.service/sasl_passwd";
+      smtp_cname_overrides_servername = false;
+      smtp_always_send_ehlo = true;
+      smtp_tls_security_level = "dane";
+
+      smtp_tls_loglevel = "1";
+      smtp_dns_support_level = "dnssec";
+    };
+    masterConfig = {
+      submission = {
+        type = "inet";
+        private = false;
+        command = "smtpd";
+        args = [
+          "-o" "syslog_name=postfix/$service_name"
+        ];
+      };
+      smtp = { };
+      smtps = {
+        type = "unix";
+        private = true;
+        privileged = true;
+        chroot = false;
+        command = "smtp";
+        args = [
+          "-o" "smtp_tls_wrappermode=yes"
+          "-o" "smtp_tls_security_level=encrypt"
+        ];
+      };
+      relay = {
+        command = "smtp";
+        args = [
+          "-o" "smtp_fallback_relay="
+          "-o" "smtp_tls_security_level=verify"
+          "-o" "smtp_tls_wrappermode=yes"
+          "-o" "smtp_tls_cert_file=${./relay.crt}"
+          "-o" "smtp_tls_key_file=/run/credentials/postfix.service/relay.key"
+        ];
+      };
+    };
+  };
+
+  systemd.services.postfix = {
+    serviceConfig.LoadCredential = [
+      "sasl_passwd:${config.sops.secrets."postfix-sasl-passwd".path}"
+      "relay.key:${config.sops.secrets."relay-key".path}"
+    ];
+  };
+
+  sops.secrets = {
+    postfix-sasl-passwd = {
+      key = "sasl-passwd";
+      sopsFile = ./secrets.yaml;
+    };
+    relay-key = {
+      format = "binary";
+      sopsFile = ./relay.key;
+    };
+  };
+}
diff --git a/hosts/sif/email/relay.crt b/hosts/sif/email/relay.crt
new file mode 100644
index 00000000..ac13e7cb
--- /dev/null
+++ b/hosts/sif/email/relay.crt
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBjDCCAQygAwIBAgIPQAAAAGgLfNoL/PSMAsutMAUGAytlcTAXMRUwEwYDVQQD
+DAx5Z2dkcmFzaWwubGkwHhcNMjUwNDI1MTIwOTQ1WhcNMzUwNDI2MTIxNDQ1WjAR
+MQ8wDQYDVQQDDAZna2xlZW4wKjAFBgMrZXADIQB3outi3/3F4YO7Q97WAAaMHW0a
+m+Blldrgee+EZnWnD6N1MHMwHwYDVR0jBBgwFoAUTtn+VjMw6Ge1f68KD8dT1CWn
+l3YwHQYDVR0OBBYEFFOa4rYZYMbXUVdKv98NB504GUhjMA4GA1UdDwEB/wQEAwID
+6DAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMAUGAytlcQNzABC0
+0UgIt7gLZrU1TmzGoqPBris8R1DbKOJacicF5CU0MIIjHcX7mPFW8KtB4qm6KcPq
+kF6IaEPmgKpX3Nubk8HJik9vhIy9ysfINcVTvzXx8pO1bxbvREJRyA/apj10nzav
+yauId0cXHvN6g5RLAMsMAA==
+-----END CERTIFICATE-----
diff --git a/hosts/sif/email/relay.key b/hosts/sif/email/relay.key
new file mode 100644
index 00000000..412a44e0
--- /dev/null
+++ b/hosts/sif/email/relay.key
@@ -0,0 +1,19 @@
+{
+        "data": "ENC[AES256_GCM,data:lBlTuzOS75pvRmcTKT4KhHMH44RlE2SvCFAUP+GfsXws1Uai7DZ1MmbhvxxCa+pcLW19+sQYxrXLRNZWby1yOeKBJ2UQeYV5LOk9LSL/WIE3FZkCo5Dv0O0gSFKjjb61WN22a4JnHbLWADf/mLT3GZv91XfvFDo=,iv:ho8wQH3UNzX9JPW5gVcUGtxZzdVwsMFus0Z4KYe5t48=,tag:dAgZyHOva2xVVhE1nTl+lg==,type:str]",
+        "sops": {
+                "age": [
+                        {
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6eTVRSUdFNUZGZmcxSUlT\nWmlsOGNyWXIzMGNTZjlKbXlhcEdZUXFRVkR3Cll0T0RMd0h2UW16QkR3SHlhYmNZ\nNDFrYXh3Rkp5NWsvcWc3UFJJaHVwT1UKLS0tIHhXVEI0VHBZVkpDQ1FzWENjMmJH\nb1FQWXVUUTBiZ1pKWG00MTNqVEo2SjAKK3VOU+QgRuxWYWEcrJiVMRFCprBICz4F\ngD+9zuPUzPezyJkYwTs+M+wX5GYkXppqm5W58yQLS2UDD38sr+SRjg==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1fj65apkhfkrwyv5tx6zcs9nkjg8267fy733qph30sc7zfn7vapjqkd5kne",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWmJmZDVFazN2bDY1TkNG\nNXpJN2twMFFjZUxMTVdSNzJwQTFiYktrcGdrCjk4eFVHTko0bFVMSlFFWm9tbjMr\nbWNHMEQ1Rm1qUVhodlB1RGw2aDc4TUEKLS0tIERBK0J5NkN4OXJEZ1ZOZXhNc1Jm\naWNnUmZGbTIxdmNkYi9TZ2h2bGs3MVEKPQGaEf7M/5/xvSOfawpIp50fB3QfFSuz\nPgkrPMneaBeUx+uBYMyEFX4rpzLIBR3pnYMjAfoc+bjWaOtGQuEqyQ==\n-----END AGE ENCRYPTED FILE-----\n"
+                        }
+                ],
+                "lastmodified": "2025-04-25T12:14:44Z",
+                "mac": "ENC[AES256_GCM,data:pObl2bJA93az9E3Ya+hA3ekI8TKKZ9NNTi0KzmWZBOiQwi9FuQYtpnmmT80L1KXWyOKJV6wGdAri3mNe/ue2S0TziSbQ/4+Dj4ubFKgkH7thb5q2dFyxw5FzhYzRQiXFqD/pxcNN9uL0lQI2Al0Eci0zX8Kcd1rAQ6RzLEoSmco=,iv:zo/3QFKTUEDxLy1k5yyU7Z1JMZ7cKdYUc6GHjaTTZKQ=,tag:f63Eja3lBfwJCYAOyEt56g==,type:str]",
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.10.2"
+        }
+}
diff --git a/hosts/sif/mail/secrets.yaml b/hosts/sif/email/secrets.yaml
index 3c74b710..3c74b710 100644
--- a/hosts/sif/mail/secrets.yaml
+++ b/hosts/sif/email/secrets.yaml
diff --git a/hosts/sif/greetd/default.nix b/hosts/sif/greetd/default.nix
new file mode 100644
index 00000000..37ca13c5
--- /dev/null
+++ b/hosts/sif/greetd/default.nix
@@ -0,0 +1,49 @@
+{ pkgs, ... }:
+{
+  config = {
+    services.greetd = {
+      enable = true;
+    #   settings.default_session.command = let
+    #     cfg = config.programs.regreet;
+    #   in pkgs.writeShellScript "greeter" ''
+    #       modprobe -r nvidia_drm
+
+    #       exec ${pkgs.dbus}/bin/dbus-run-session ${lib.getExe pkgs.cage} ${lib.escapeShellArgs cfg.cageArgs} -- ${lib.getExe cfg.package}
+    #     '';
+    };
+    systemd.services.greetd.environment = {
+      XKB_DEFAULT_LAYOUT = "us,us";
+      XKB_DEFAULT_VARIANT = "dvp,";
+      XKB_DEFAULT_OPTIONS = "compose:caps,grp:win_space_toggle";
+    };
+    programs.regreet = {
+      enable = true;
+      theme = {
+        package = pkgs.equilux-theme;
+        name = "Equilux-compact";
+      };
+      iconTheme = {
+        package = pkgs.paper-icon-theme;
+        name = "Paper-Mono-Dark";
+      };
+      font = {
+        package = pkgs.fira;
+        name = "Fira Sans";
+        # size = 6;
+      };
+      cageArgs = [ "-s" "-m" "last" ];
+      settings = {
+        GTK.application_prefer_dark_theme = true;
+        widget.clock.format = "%F %H:%M:%S%:z";
+        background = {
+          path = pkgs.runCommand "wallpaper.png" {
+            buildInputs = with pkgs; [ imagemagick ];
+          } ''
+            magick ${./wallpaper.png} -filter Gaussian -resize 6.25% -define filter:sigma=2.5 -resize 1600% "$out"
+          '';
+          fit = "Cover";
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/sif/greetd/wallpaper.png b/hosts/sif/greetd/wallpaper.png
new file mode 100644
index 00000000..20fc761a
--- /dev/null
+++ b/hosts/sif/greetd/wallpaper.png
diff --git a/hosts/sif/hw.nix b/hosts/sif/hw.nix
index d1fb2934..e567c37d 100644
--- a/hosts/sif/hw.nix
+++ b/hosts/sif/hw.nix
@@ -19,10 +19,13 @@
     "/var/lib/sops-nix".neededForBoot = true;
     "/var/lib/systemd".neededForBoot = true;
   };
+  swapDevices = [
+    { label = "swap"; }
+  ];
   # system.etc.overlay.enable = false;
 
   boot.initrd.systemd.packages = [
-    (pkgs.writeTextDir "/etc/systemd/system/\\x2ebcachefs.mount.d/block_scan.conf" ''
+    (pkgs.writeTextDir "/etc/systemd/system/sysroot-.bcachefs.mount.d/block_scan.conf" ''
       [Mount]
       Environment=BCACHEFS_BLOCK_SCAN=1
     '')
diff --git a/hosts/sif/libvirt/default.nix b/hosts/sif/libvirt/default.nix
index d0be7dff..9712d0d9 100644
--- a/hosts/sif/libvirt/default.nix
+++ b/hosts/sif/libvirt/default.nix
@@ -8,6 +8,7 @@ with flakeInputs.nixVirt.lib;
       qemu.swtpm.enable = true;
       allowedBridges = ["virbr0" "rz-0971" "rz-2403"];
     };
+    virtualisation.spiceUSBRedirection.enable = true;
     virtualisation.libvirt = {
       enable = true;
       swtpm.enable = true;
diff --git a/hosts/sif/mail/default.nix b/hosts/sif/mail/default.nix
deleted file mode 100644
index f36cd599..00000000
--- a/hosts/sif/mail/default.nix
+++ /dev/null
@@ -1,70 +0,0 @@
-{ config, pkgs, ... }:
-{
-  services.postfix = {
-    enable = true;
-    enableSmtp = true;
-    enableSubmission = false;
-    setSendmail = true;
-    networksStyle = "host";
-    hostname = "sif.midgard.yggdrasil";
-    destination = [];
-    relayHost = "uucp:ymir";
-    recipientDelimiter = "+";
-    masterConfig = {
-      uucp = {
-        type = "unix";
-        private = true;
-        privileged = true;
-        chroot = false;
-        command = "pipe";
-        args = [ "flags=Fqhu" "user=uucp" ''argv=${config.security.wrapperDir}/uux -z -a $sender - $nexthop!rmail ($recipient)'' ];
-      };
-      smtps = {
-        type = "unix";
-        private = true;
-        privileged = true;
-        chroot = false;
-        command = "smtp";
-        args = [ "-o" "smtp_tls_wrappermode=yes" "-o" "smtp_tls_security_level=encrypt" ];
-      };
-    };
-    config = {
-      default_transport = "uucp:ymir";
-
-      inet_interfaces = "loopback-only";
-
-      authorized_submit_users = ["!uucp" "static:anyone"];
-      message_size_limit = "0";
-
-      sender_dependent_default_transport_maps = ''regexp:${pkgs.writeText "sender_relay" ''
-        /@(cip|stud)\.ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtp.ifi.lmu.de
-        /@ifi\.(lmu|uni-muenchen)\.de$/ smtp:smtpin1.ifi.lmu.de:587
-        /@math(ematik)?\.(lmu|uni-muenchen)\.de$/ smtps:smtp.math.lmu.de:465
-        /@(campus\.)?lmu\.de$/ smtp:postout.lrz.de
-      ''}'';
-      sender_bcc_maps = ''regexp:${pkgs.writeText "sender_bcc" ''
-        /^uni2work(-[^@]*)?@ifi\.lmu\.de$/ uni2work@ifi.lmu.de
-        /@ifi\.lmu\.de$/ gregor.kleen@ifi.lmu.de
-      ''}'';
-
-      smtp_sasl_auth_enable = true;
-      smtp_sender_dependent_authentication = true;
-      smtp_sasl_tls_security_options = "noanonymous";
-      smtp_sasl_mechanism_filter = ["plain"];
-      smtp_sasl_password_maps = "regexp:/var/db/postfix/sasl_passwd";
-      smtp_cname_overrides_servername = false;
-      smtp_always_send_ehlo = true;
-      smtp_tls_security_level = "dane";
-
-      smtp_tls_loglevel = "1";
-      smtp_dns_support_level = "dnssec";
-    };
-  };
-
-  sops.secrets.postfix-sasl-passwd = {
-    key = "sasl-passwd";
-    path = "/var/db/postfix/sasl_passwd";
-    owner = "postfix";
-    sopsFile = ./secrets.yaml;
-  };
-}
diff --git a/hosts/sif/ruleset.nft b/hosts/sif/ruleset.nft
index 2af8b2ee..62339f69 100644
--- a/hosts/sif/ruleset.nft
+++ b/hosts/sif/ruleset.nft
@@ -61,7 +61,7 @@ table inet filter {
   counter mosh-rx {}
   counter wg-rx {}
   counter yggdrasil-gre-rx {}
-  counter quickserve-rx {}
+  counter miniserve-rx {}
   counter ausweisapp2-rx {}
 
   counter established-rx {}
@@ -81,7 +81,7 @@ table inet filter {
   counter mosh-tx {}
   counter wg-tx {}
   counter yggdrasil-gre-tx {}
-  counter quickserve-tx {}
+  counter miniserve-tx {}
 
   counter tx {}
 
@@ -134,7 +134,7 @@ table inet filter {
     tcp dport 22 counter name ssh-rx accept
     udp dport 60000-61000 counter name mosh-rx accept
 
-    tcp dport 8000 counter name quickserve-rx accept
+    tcp dport 8080 counter name miniserve-rx accept
     udp dport 24727 counter name ausweisapp2-rx accept
 
     udp dport 51820-51822 counter name wg-rx accept
@@ -173,7 +173,7 @@ table inet filter {
     udp sport 51820-51822 counter name wg-tx
     iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-tx
 
-    tcp sport 8000 counter name quickserve-tx accept
+    tcp sport 8080 counter name miniserve-tx accept
 
     oifname virbr0 udp sport 67 counter name libvirt-dhcp accept
     oifname virbr0 udp sport 547 counter name libvirt-dhcp accept