From fcb5d44b931b777aaf62d68f31c0a5142c23363c Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Sun, 6 Nov 2022 09:57:21 +0100
Subject: [PATCH 01/31] ma gui: restructure main-laptop

---
 makefu/2configs/gui/look-up.nix | 13 +++++++++++++
 makefu/2configs/main-laptop.nix | 12 +-----------
 2 files changed, 14 insertions(+), 11 deletions(-)
 create mode 100644 makefu/2configs/gui/look-up.nix

diff --git a/makefu/2configs/gui/look-up.nix b/makefu/2configs/gui/look-up.nix
new file mode 100644
index 000000000..d27f5cff7
--- /dev/null
+++ b/makefu/2configs/gui/look-up.nix
@@ -0,0 +1,13 @@
+{
+  systemd.services.look-up = {
+    startAt = "*:30";
+    serviceConfig = {
+      ExecStart= pkgs.writeDash "look-up" ''
+        set -x
+        eval "export '$(egrep -z DBUS_SESSION_BUS_ADDRESS /proc/$(${pkgs.procps}/bin/pgrep -u ${user} ${window-manager})/environ)'"
+        ${pkgs.libnotify}/bin/notify-send -u critical -t 9999999 'look up once in a while'
+      '';
+      User = user;
+    };
+  };
+}
diff --git a/makefu/2configs/main-laptop.nix b/makefu/2configs/main-laptop.nix
index cb78c823f..a7181cfe9 100644
--- a/makefu/2configs/main-laptop.nix
+++ b/makefu/2configs/main-laptop.nix
@@ -12,6 +12,7 @@ let
 in {
   imports = [
     ./gui/base.nix
+    ./gui/look-up.nix
     ./fetchWallpaper.nix
     ./zsh-user.nix
     ./tools/core.nix
@@ -72,15 +73,4 @@ in {
   location.latitude = 48.7;
   location.longitude = 9.1;
 
-  systemd.services.look-up = {
-    startAt = "*:30";
-    serviceConfig = {
-      ExecStart= pkgs.writeDash "look-up" ''
-        set -x
-        eval "export '$(egrep -z DBUS_SESSION_BUS_ADDRESS /proc/$(${pkgs.procps}/bin/pgrep -u ${user} ${window-manager})/environ)'"
-        ${pkgs.libnotify}/bin/notify-send -u critical -t 9999999 'look up once in a while'
-      '';
-      User = user;
-    };
-  };
 }

From ae39dfcefee2fe3cb369dabed074f14f5af7d6b5 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Thu, 17 Nov 2022 13:43:18 +0100
Subject: [PATCH 02/31] airsensor-py: fix py39 issues

---
 makefu/5pkgs/airsensor-py/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/makefu/5pkgs/airsensor-py/default.nix b/makefu/5pkgs/airsensor-py/default.nix
index 4eae26c0d..86ea22d8d 100644
--- a/makefu/5pkgs/airsensor-py/default.nix
+++ b/makefu/5pkgs/airsensor-py/default.nix
@@ -2,7 +2,7 @@
 with pkgs.python3Packages;
 buildPythonApplication rec {
     name = "airsensor-py-${version}";
-    version = "2017-12-05";
+    version = "1.0.0";
     propagatedBuildInputs = [
       pyusb
       click
@@ -11,7 +11,7 @@ buildPythonApplication rec {
     src = fetchFromGitHub {
       owner = "makefu";
       repo = "airsensor-py";
-      rev = "7ac5f185dc848fca1b556e4c0396dd73f6a93995";
-      sha256 = "0387b025y8kb0zml7916p70hmzc3y18kqh46b9xv5qayljxymq2w";
+      rev = "1.0.0";
+      sha256 = "1jpvvl965bg3ymvr58c433jyy0smczn65fnqsskxn7basznii5g8";
     };
 }

From 1eda659c24a118bcba849beb0fbf0ac9b5d32076 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= <kmein@posteo.de>
Date: Thu, 1 Dec 2022 17:02:06 +0100
Subject: [PATCH 03/31] kartei: add alertmanager.kmein.r alias

---
 kartei/kmein/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kartei/kmein/default.nix b/kartei/kmein/default.nix
index 39125e35c..d2aa89229 100644
--- a/kartei/kmein/default.nix
+++ b/kartei/kmein/default.nix
@@ -82,6 +82,7 @@ in
           "makanek.r"
           "makanek.kmein.r"
           "grafana.kmein.r"
+          "alertmanager.kmein.r"
           "names.kmein.r"
           "graph.r"
           "rrm.r"

From 48ee52673e79f46e53fbfd86a9258a1a106d8ffc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= <kmein@posteo.de>
Date: Thu, 1 Dec 2022 19:57:54 +0100
Subject: [PATCH 04/31] kartei: add prometheus.kmein.r alias

---
 kartei/kmein/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kartei/kmein/default.nix b/kartei/kmein/default.nix
index d2aa89229..1a5a57d1a 100644
--- a/kartei/kmein/default.nix
+++ b/kartei/kmein/default.nix
@@ -83,6 +83,7 @@ in
           "makanek.kmein.r"
           "grafana.kmein.r"
           "alertmanager.kmein.r"
+          "prometheus.kmein.r"
           "names.kmein.r"
           "graph.r"
           "rrm.r"

From 217dffa8efce1db7618905e780c64eacf0d63d41 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Sun, 4 Dec 2022 21:53:01 +0100
Subject: [PATCH 05/31] ma ham: add heizung

---
 makefu/2configs/home/ham/automation/fenster_auf.nix   |  2 +-
 .../2configs/home/ham/automation/shutdown_button.nix  |  3 +++
 makefu/2configs/home/ham/default.nix                  |  6 ++++++
 makefu/2configs/home/ham/multi/heizung.nix            | 11 +++++++++++
 makefu/2configs/home/ham/sensor/dwd.nix               |  2 ++
 makefu/2configs/home/ham/sensor/outside.nix           |  9 +++++++--
 6 files changed, 30 insertions(+), 3 deletions(-)
 create mode 100644 makefu/2configs/home/ham/multi/heizung.nix

diff --git a/makefu/2configs/home/ham/automation/fenster_auf.nix b/makefu/2configs/home/ham/automation/fenster_auf.nix
index b3682fe0c..698327ff4 100644
--- a/makefu/2configs/home/ham/automation/fenster_auf.nix
+++ b/makefu/2configs/home/ham/automation/fenster_auf.nix
@@ -88,7 +88,7 @@ in {
       duschfenster_lang_offen.name = "Duschfenster lange offen";
       ist_sommer = {
         name = "Es ist Sommer";
-        initial = true; # TODO
+        initial = false; # TODO
       };
     };
 
diff --git a/makefu/2configs/home/ham/automation/shutdown_button.nix b/makefu/2configs/home/ham/automation/shutdown_button.nix
index ec1a25567..ec84bbe94 100644
--- a/makefu/2configs/home/ham/automation/shutdown_button.nix
+++ b/makefu/2configs/home/ham/automation/shutdown_button.nix
@@ -47,6 +47,9 @@ in {
         { service = "media_player.media_stop";
           target.entity_id = all_media_player;
         }
+        { service = "script.turn_on";
+          target.entity_id = "script.alle_heizungen_aus";
+        }
       ];
     }
   ];
diff --git a/makefu/2configs/home/ham/default.nix b/makefu/2configs/home/ham/default.nix
index b08152935..861ec27aa 100644
--- a/makefu/2configs/home/ham/default.nix
+++ b/makefu/2configs/home/ham/default.nix
@@ -18,6 +18,7 @@ in {
     # ./multi/flurlicht.nix
     ./multi/kurzzeitwecker.nix
     ./multi/the_playlist.nix
+    ./multi/heizung.nix
     # ./multi/fliegen-couter.nix
 
     ./device_tracker/openwrt.nix
@@ -192,5 +193,10 @@ in {
     configDir = hassdir;
   };
 
+  krebs.secret.files."hass-secrets" = {
+    source-path = toString <secrets> + "/hass/secrets.yaml";
+    path = "/var/lib/hass/secrets.yaml";
+    owner.name = "hass";
+  };
   state = [ "/var/lib/hass/known_devices.yaml" ];
 }
diff --git a/makefu/2configs/home/ham/multi/heizung.nix b/makefu/2configs/home/ham/multi/heizung.nix
new file mode 100644
index 000000000..73f90dfe0
--- /dev/null
+++ b/makefu/2configs/home/ham/multi/heizung.nix
@@ -0,0 +1,11 @@
+{
+  services.home-assistant.config =
+    {
+      # 18 Grad
+      script.alle_heizungen_aus.sequence = [{
+        service = "climate.set_temperature";
+        target.entity_id = [ "climate.wohnzimmer_heizung" ];
+        data.temperature = "18.0";
+      }];
+    };
+}
diff --git a/makefu/2configs/home/ham/sensor/dwd.nix b/makefu/2configs/home/ham/sensor/dwd.nix
index c1d55d03c..623f099a3 100644
--- a/makefu/2configs/home/ham/sensor/dwd.nix
+++ b/makefu/2configs/home/ham/sensor/dwd.nix
@@ -4,5 +4,7 @@
       { platform = "dwd_weather_warnings";
         region_name = "Stadt Stuttgart";
       }
+      { platform = "nina";
+      }
   ];
 }
diff --git a/makefu/2configs/home/ham/sensor/outside.nix b/makefu/2configs/home/ham/sensor/outside.nix
index 332746be8..d05e8a1f6 100644
--- a/makefu/2configs/home/ham/sensor/outside.nix
+++ b/makefu/2configs/home/ham/sensor/outside.nix
@@ -4,8 +4,7 @@
   services.home-assistant.config.sensor =
   [
     { platform = "darksky";
-      api_key = lib.removeSuffix "\n"
-        (builtins.readFile <secrets/hass/darksky.apikey>);
+      api_key = "!secret darksky";
       language = "de";
       monitored_conditions = [
         "summary" "icon"
@@ -21,5 +20,11 @@
       units =  "si" ;
       scan_interval = "00:30:00";
     }
+    {
+      platform = "open_meteo";
+    }
+    {
+      platform = "met";
+    }
   ];
 }

From 1df762657baf7d0c27a178113e613c94e6b12aa3 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 5 Dec 2022 16:17:24 +0100
Subject: [PATCH 06/31] k pkgs.ukrepl: init

---
 krebs/5pkgs/simple/ukrepl.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 krebs/5pkgs/simple/ukrepl.nix

diff --git a/krebs/5pkgs/simple/ukrepl.nix b/krebs/5pkgs/simple/ukrepl.nix
new file mode 100644
index 000000000..bdea4181f
--- /dev/null
+++ b/krebs/5pkgs/simple/ukrepl.nix
@@ -0,0 +1,11 @@
+{ lib, pkgs,stdenv }:
+let 
+  src = pkgs.fetchFromGitHub {
+    owner = "makefu";
+    repo = "ukrepl";
+    rev = "0baa5cc4d5c3c17af704b69a800dd1f520ded8e3";
+    hash = "sha256:1lnhkf02f18fvf3l2fcszvs4x115lql17akabd5ph9ff9z33k8rv";
+  };
+in
+  pkgs.writers.writePython3Bin "ukrepl" {} (builtins.readFile (src + "/ukrepl"))
+

From b1d1322e25459f1f7c79a866b2abf06fc5535e33 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 8 Dec 2022 16:12:00 +0100
Subject: [PATCH 07/31] tv pinentry-urxvt: show tinted screenshots

---
 tv/5pkgs/simple/pinentry-urxvt/default.nix | 74 +++++++++++++++++++++-
 1 file changed, 71 insertions(+), 3 deletions(-)

diff --git a/tv/5pkgs/simple/pinentry-urxvt/default.nix b/tv/5pkgs/simple/pinentry-urxvt/default.nix
index 65b76c077..6e4f6b002 100644
--- a/tv/5pkgs/simple/pinentry-urxvt/default.nix
+++ b/tv/5pkgs/simple/pinentry-urxvt/default.nix
@@ -20,7 +20,11 @@ let
           type = lib.types.str;
         };
         display = lib.mkOption {
-          default = ":0";
+          default = null;
+          type = lib.types.nullOr lib.types.str;
+        };
+        xwud.className = lib.mkOption {
+          default = "PinentryUrxvtXwudFloat";
           type = lib.types.str;
         };
       };
@@ -30,12 +34,76 @@ let
 
 in
 
+  # pinentry-urxvt - A mechanism for PIN entry utilizing rxvt-unicode
+  #
+  # This spawns a PIN entry terminal on top of a tinted screenshot of the
+  # current display's root window.  The display for spawning the terminal can
+  # be predefined, in which case both the current and the predefined display
+  # will show the screenshot.
+  #
+  # The purpose of the screenshot, aside from looking nice, is to prevent entry
+  # of the PIN into the wrong window, e.g. by accidentally moving the cursor
+  # while typing.  If necessary, the screenshot can be closed by sending 'q',
+  # 'Q', or ctrl-c while its focused.
+  #
   pkgs.write "pinentry-urxvt" {
     "/bin/pinentry".link = pkgs.writeDash "pinentry-urxvt-wrapper" ''
       set -efu
+
+      trap cleanup EXIT
+
+      cleanup() {
+        rm "$screenshot"
+        # Kill process group in order to kill screenshot windows.
+        ${pkgs.utillinux}/bin/kill 0
+      }
+
+      screenshot=$(${pkgs.coreutils}/bin/mktemp -t pinentry-urxvt.screenshot.XXXXXXXX)
+
+      ${pkgs.xorg.xwd}/bin/xwd -root |
+      ${pkgs.imagemagick}/bin/convert xwd:- -fill \#424242 -colorize 80% xwd:"$screenshot"
+
+      show_screenshot() {
+        ${pkgs.exec "pinentry-urxvt.show_screenshot" {
+            filename = "${pkgs.xorg.xwud}/bin/xwud";
+            argv = [
+              cfg.xwud.className
+              "-noclick"
+            ];
+        }} < "$screenshot" &
+        wait_for_screenshot $!
+      }
+
+      # Wait for the xwud window by trying to intercept the call to munmap().
+      # If it cannot be intercepted within 0.1s, assume that attaching strace
+      # wasn't fast enough or xwud doesn't call munmap() anymore.  In either
+      # case fall back to search the window by class name, assuming there can
+      # be only one per display.
+      wait_for_screenshot() {
+        if ! \
+          ${pkgs.coreutils}/bin/timeout 0.1 \
+          ${pkgs.strace}/bin/strace -p "$1" -e munmap 2>&1 |
+          read -r _
+        then
+          until ${pkgs.xdotool}/bin/xdotool search \
+                    --classname ${lib.shell.escape cfg.xwud.className}
+          do
+            ${pkgs.coreutils}/bin/sleep 0.1
+          done
+        fi
+      }
+
+      show_screenshot
+
+      ${lib.optionalString (cfg.display != null) /* sh */ ''
+        if test "$DISPLAY" != ${lib.shell.escape cfg.display}; then
+          export DISPLAY=${lib.shell.escape cfg.display}
+          show_screenshot
+        fi
+      ''}
+
       exec 3<&0 4>&1 5>&2
-      export DISPLAY=${lib.shell.escape cfg.display}
-      exec ${pkgs.rxvt_unicode}/bin/urxvt \
+      ${pkgs.rxvt_unicode}/bin/urxvt \
         -name ${lib.shell.escape cfg.appName} \
         -e ${pkgs.writeDash "pinentry-urxvt-tty" ''
           set -efu

From eb3285feea223f3aa2a54beeccbe3a9135067616 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 00:28:58 +0100
Subject: [PATCH 08/31] lib.mapNixDir: admit just files with .nix suffix

---
 lib/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/default.nix b/lib/default.nix
index 7c3b0370e..d65c891a3 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -95,9 +95,12 @@ let
             path = dirPath + "/${relPath}";
           in
             nameValuePair (toPackageName name) (f path))
-          (filter
-            (name: name != "default.nix" && !hasPrefix "." name)
-            (attrNames (readDir dirPath))));
+          (attrNames
+            (filterAttrs
+              (name: type:
+                (type == "regular" && hasSuffix ".nix" name && name != "default.nix") ||
+                (type == "directory" && !hasPrefix "." name))
+              (readDir dirPath))));
 
     # https://tools.ietf.org/html/rfc5952
     normalize-ip6-addr =

From e6863fe8c68ff3ad704b1eef4b71fb4870b83bdf Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 00:30:08 +0100
Subject: [PATCH 09/31] lib: add isNixDirEntry

---
 lib/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/default.nix b/lib/default.nix
index d65c891a3..ad3a78a04 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -96,11 +96,11 @@ let
           in
             nameValuePair (toPackageName name) (f path))
           (attrNames
-            (filterAttrs
-              (name: type:
-                (type == "regular" && hasSuffix ".nix" name && name != "default.nix") ||
-                (type == "directory" && !hasPrefix "." name))
-              (readDir dirPath))));
+            (filterAttrs isNixDirEntry (readDir dirPath))));
+
+    isNixDirEntry = name: type:
+      (type == "regular" && hasSuffix ".nix" name && name != "default.nix") ||
+      (type == "directory" && !hasPrefix "." name);
 
     # https://tools.ietf.org/html/rfc5952
     normalize-ip6-addr =

From 5b579b8fb96c073ddf55935ee1dbb360a22f18b9 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 01:33:39 +0100
Subject: [PATCH 10/31] lib: add lib reference

---
 lib/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/default.nix b/lib/default.nix
index ad3a78a04..149b97a72 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -194,3 +194,4 @@ let
 in
 
 lib
+// { inherit lib; }

From e56f5d7e61e46852ebe1b4904d6f4085091bd469 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 00:30:44 +0100
Subject: [PATCH 11/31] tv pkgs: use isNixDirEntry

---
 tv/5pkgs/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index 5a018a166..494cb9e63 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -14,7 +14,6 @@ fix
   (foldl' (flip extends) (_: super)
     (map
       (name: import (./. + "/${name}"))
-      (filter
-        (name: name != "default.nix" && !hasPrefix "." name)
-        (pushBack "override"
-          (attrNames (readDir ./.))))))
+      (pushBack "override"
+        (attrNames
+          (filterAttrs isNixDirEntry (readDir ./.))))))

From 6d64096cd99db27357bf2d038bdfdfc2d3a3aeae Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 01:31:56 +0100
Subject: [PATCH 12/31] tv: normalize lib imports

---
 tv/1systems/alnus/config.nix                        | 3 +--
 tv/1systems/alnus/lib                               | 1 +
 tv/1systems/au/lib                                  | 1 +
 tv/1systems/bu/config.nix                           | 6 ++----
 tv/1systems/bu/lib                                  | 1 +
 tv/1systems/lib                                     | 1 +
 tv/1systems/mu/config.nix                           | 3 +--
 tv/1systems/mu/lib                                  | 1 +
 tv/1systems/nomic/config.nix                        | 3 +--
 tv/1systems/nomic/lib                               | 1 +
 tv/1systems/querel/config.nix                       | 3 +--
 tv/1systems/querel/lib                              | 1 +
 tv/1systems/wu/config.nix                           | 3 +--
 tv/1systems/wu/lib                                  | 1 +
 tv/1systems/xu/config.nix                           | 3 +--
 tv/1systems/xu/lib                                  | 1 +
 tv/1systems/zu/config.nix                           | 3 +--
 tv/2configs/backup.nix                              | 5 ++---
 tv/2configs/bash/default.nix                        | 7 ++-----
 tv/2configs/bash/lib                                | 1 +
 tv/2configs/binary-cache/default.nix                | 2 +-
 tv/2configs/binary-cache/lib                        | 1 +
 tv/2configs/br.nix                                  | 2 +-
 tv/2configs/default.nix                             | 3 +--
 tv/2configs/exim-retiolum.nix                       | 7 ++-----
 tv/2configs/exim-smarthost.nix                      | 7 ++-----
 tv/2configs/gitconfig.nix                           | 7 ++-----
 tv/2configs/gitrepos.nix                            | 7 ++-----
 tv/2configs/htop.nix                                | 7 ++-----
 tv/2configs/hw/AO753.nix                            | 7 ++-----
 tv/2configs/hw/lib                                  | 1 +
 tv/2configs/hw/w110er.nix                           | 5 ++---
 tv/2configs/hw/x220.nix                             | 6 ++----
 tv/2configs/imgur.nix                               | 3 +--
 tv/2configs/lib                                     | 1 +
 tv/2configs/nginx/default.nix                       | 7 ++-----
 tv/2configs/nginx/lib                               | 1 +
 tv/2configs/nginx/public_html.nix                   | 7 ++-----
 tv/2configs/pki/default.nix                         | 2 +-
 tv/2configs/pki/lib                                 | 1 +
 tv/2configs/ppp.nix                                 | 2 +-
 tv/2configs/pulse.nix                               | 6 ++----
 tv/2configs/repo-sync/lib                           | 1 +
 tv/2configs/repo-sync/wiki.nix                      | 5 ++---
 tv/2configs/retiolum.nix                            | 7 ++-----
 tv/2configs/ssh.nix                                 | 7 ++-----
 tv/2configs/sshd.nix                                | 2 +-
 tv/2configs/urlwatch.nix                            | 2 +-
 tv/2configs/vim.nix                                 | 6 ++----
 tv/2configs/xdg.nix                                 | 7 ++-----
 tv/2configs/xp-332.nix                              | 2 +-
 tv/2configs/xserver/Xmodmap.nix                     | 2 +-
 tv/2configs/xserver/default.nix                     | 5 ++---
 tv/2configs/xserver/lib                             | 1 +
 tv/2configs/xserver/sxiv.nix                        | 2 +-
 tv/2configs/xserver/urxvt.nix                       | 2 +-
 tv/2configs/xserver/xserver.conf.nix                | 5 ++---
 tv/3modules/Xresources.nix                          | 2 +-
 tv/3modules/charybdis/config.nix                    | 2 +-
 tv/3modules/charybdis/default.nix                   | 3 ++-
 tv/3modules/charybdis/lib                           | 1 +
 tv/3modules/dnsmasq.nix                             | 2 +-
 tv/3modules/ejabberd/default.nix                    | 4 ++--
 tv/3modules/ejabberd/lib                            | 1 +
 tv/3modules/focus.nix                               | 2 +-
 tv/3modules/hosts.nix                               | 7 ++-----
 tv/3modules/hw.nix                                  | 2 +-
 tv/3modules/im.nix                                  | 2 +-
 tv/3modules/iptables.nix                            | 6 ++----
 tv/3modules/lib                                     | 1 +
 tv/3modules/org.freedesktop.machine1.host-shell.nix | 3 ++-
 tv/3modules/slock.nix                               | 2 +-
 tv/3modules/x0vncserver.nix                         | 4 +---
 tv/5pkgs/default.nix                                | 2 +-
 tv/5pkgs/haskell/default.nix                        | 2 +-
 tv/5pkgs/haskell/lib                                | 1 +
 tv/5pkgs/lib                                        | 1 +
 tv/5pkgs/override/default.nix                       | 2 +-
 tv/5pkgs/override/lib                               | 1 +
 tv/5pkgs/rpi/default.nix                            | 4 +---
 tv/5pkgs/rpi/lib                                    | 1 +
 tv/5pkgs/simple/bash-fzf-history.nix                | 2 +-
 tv/5pkgs/simple/default.nix                         | 2 +-
 tv/5pkgs/simple/lib                                 | 1 +
 tv/5pkgs/simple/pinentry-urxvt/default.nix          | 3 +--
 tv/5pkgs/simple/pinentry-urxvt/lib                  | 1 +
 tv/5pkgs/simple/q/default.nix                       | 4 ++--
 tv/5pkgs/simple/q/lib                               | 1 +
 tv/5pkgs/vim/default.nix                            | 2 +-
 tv/5pkgs/vim/hack.nix                               | 2 +-
 tv/5pkgs/vim/lib                                    | 1 +
 tv/5pkgs/vim/nix.nix                                | 2 +-
 tv/5pkgs/vim/vim.nix                                | 2 +-
 tv/lib                                              | 1 +
 94 files changed, 121 insertions(+), 158 deletions(-)
 create mode 120000 tv/1systems/alnus/lib
 create mode 120000 tv/1systems/au/lib
 create mode 120000 tv/1systems/bu/lib
 create mode 120000 tv/1systems/lib
 create mode 120000 tv/1systems/mu/lib
 create mode 120000 tv/1systems/nomic/lib
 create mode 120000 tv/1systems/querel/lib
 create mode 120000 tv/1systems/wu/lib
 create mode 120000 tv/1systems/xu/lib
 create mode 120000 tv/2configs/bash/lib
 create mode 120000 tv/2configs/binary-cache/lib
 create mode 120000 tv/2configs/hw/lib
 create mode 120000 tv/2configs/lib
 create mode 120000 tv/2configs/nginx/lib
 create mode 120000 tv/2configs/pki/lib
 create mode 120000 tv/2configs/repo-sync/lib
 create mode 120000 tv/2configs/xserver/lib
 create mode 120000 tv/3modules/charybdis/lib
 create mode 120000 tv/3modules/ejabberd/lib
 create mode 120000 tv/3modules/lib
 create mode 120000 tv/5pkgs/haskell/lib
 create mode 120000 tv/5pkgs/lib
 create mode 120000 tv/5pkgs/override/lib
 create mode 120000 tv/5pkgs/rpi/lib
 create mode 120000 tv/5pkgs/simple/lib
 create mode 120000 tv/5pkgs/simple/pinentry-urxvt/lib
 create mode 120000 tv/5pkgs/simple/q/lib
 create mode 120000 tv/5pkgs/vim/lib
 create mode 120000 tv/lib

diff --git a/tv/1systems/alnus/config.nix b/tv/1systems/alnus/config.nix
index c36fbc4bf..90501d56d 100644
--- a/tv/1systems/alnus/config.nix
+++ b/tv/1systems/alnus/config.nix
@@ -1,6 +1,5 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
-
   imports = [
     <stockholm/tv>
     <stockholm/tv/2configs/hw/x220.nix>
diff --git a/tv/1systems/alnus/lib b/tv/1systems/alnus/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/1systems/alnus/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/1systems/au/lib b/tv/1systems/au/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/1systems/au/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/1systems/bu/config.nix b/tv/1systems/bu/config.nix
index 11cdac398..22e5f1484 100644
--- a/tv/1systems/bu/config.nix
+++ b/tv/1systems/bu/config.nix
@@ -1,7 +1,5 @@
-{ config, pkgs, ... }: let
-  lib = import ../../../lib;
-in {
-
+with import ./lib;
+{ config, pkgs, ... }: {
   imports = [
     ./disks.nix
     <stockholm/tv>
diff --git a/tv/1systems/bu/lib b/tv/1systems/bu/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/1systems/bu/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/1systems/lib b/tv/1systems/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/1systems/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/1systems/mu/config.nix b/tv/1systems/mu/config.nix
index 00bd5da15..00cdf84c1 100644
--- a/tv/1systems/mu/config.nix
+++ b/tv/1systems/mu/config.nix
@@ -1,6 +1,5 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
-
   imports = [
     <stockholm/tv>
     <stockholm/tv/2configs/br.nix>
diff --git a/tv/1systems/mu/lib b/tv/1systems/mu/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/1systems/mu/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/1systems/nomic/config.nix b/tv/1systems/nomic/config.nix
index 4dc0b4e82..fb67814db 100644
--- a/tv/1systems/nomic/config.nix
+++ b/tv/1systems/nomic/config.nix
@@ -1,6 +1,5 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
-
   krebs.build.host = config.krebs.hosts.nomic;
 
   imports = [
diff --git a/tv/1systems/nomic/lib b/tv/1systems/nomic/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/1systems/nomic/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/1systems/querel/config.nix b/tv/1systems/querel/config.nix
index 44c7685e8..8df29f75e 100644
--- a/tv/1systems/querel/config.nix
+++ b/tv/1systems/querel/config.nix
@@ -1,6 +1,5 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
-
   imports = [
     <stockholm/tv>
     <stockholm/tv/2configs/retiolum.nix>
diff --git a/tv/1systems/querel/lib b/tv/1systems/querel/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/1systems/querel/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/1systems/wu/config.nix b/tv/1systems/wu/config.nix
index bf250cefa..4d45f6d40 100644
--- a/tv/1systems/wu/config.nix
+++ b/tv/1systems/wu/config.nix
@@ -1,6 +1,5 @@
-with import <stockholm/lib>;
+with import ../lib;
 { config, pkgs, ... }: {
-
   krebs.build.host = config.krebs.hosts.wu;
 
   imports = [
diff --git a/tv/1systems/wu/lib b/tv/1systems/wu/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/1systems/wu/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/1systems/xu/config.nix b/tv/1systems/xu/config.nix
index 8a86e209b..1d143ce3a 100644
--- a/tv/1systems/xu/config.nix
+++ b/tv/1systems/xu/config.nix
@@ -1,6 +1,5 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
-
   krebs.build.host = config.krebs.hosts.xu;
 
   imports = [
diff --git a/tv/1systems/xu/lib b/tv/1systems/xu/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/1systems/xu/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/1systems/zu/config.nix b/tv/1systems/zu/config.nix
index 8a3040a36..169fa6bd6 100644
--- a/tv/1systems/zu/config.nix
+++ b/tv/1systems/zu/config.nix
@@ -1,6 +1,5 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
-
   krebs.build.host = config.krebs.hosts.zu;
 
   imports = [
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index a5e0cf4c7..c8ab73b50 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -1,6 +1,5 @@
-{ config, lib, ... }:
-with import <stockholm/lib>;
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   krebs.backup.plans = {
   } // mapAttrs (_: recursiveUpdate {
     snapshots = {
diff --git a/tv/2configs/bash/default.nix b/tv/2configs/bash/default.nix
index 92e2499a9..c0855bb26 100644
--- a/tv/2configs/bash/default.nix
+++ b/tv/2configs/bash/default.nix
@@ -1,8 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   programs.bash = {
     interactiveShellInit = /* sh */ ''
       HISTCONTROL='erasedups:ignorespace'
diff --git a/tv/2configs/bash/lib b/tv/2configs/bash/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/2configs/bash/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/2configs/binary-cache/default.nix b/tv/2configs/binary-cache/default.nix
index 58791f4f6..66d740715 100644
--- a/tv/2configs/binary-cache/default.nix
+++ b/tv/2configs/binary-cache/default.nix
@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }: with import <stockholm/lib>;
+{ config, lib, pkgs, ... }: with import ./lib;
 {
   environment.etc."binary-cache.pubkey".text =
     config.krebs.build.host.binary-cache.pubkey;
diff --git a/tv/2configs/binary-cache/lib b/tv/2configs/binary-cache/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/2configs/binary-cache/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/2configs/br.nix b/tv/2configs/br.nix
index e6a46e903..4a8db2e38 100644
--- a/tv/2configs/br.nix
+++ b/tv/2configs/br.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
 
   imports = [
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index c9047023e..5710f28f4 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -1,6 +1,5 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
-
   boot.tmpOnTmpfs = true;
 
   krebs.enable = true;
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index 3d4ada46b..fefc6dd24 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
@@ -1,8 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   environment.systemPackages = [
     pkgs.eximlog
   ];
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index 4a0dcf616..e905536df 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -1,8 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   environment.systemPackages = [
     pkgs.eximlog
   ];
diff --git a/tv/2configs/gitconfig.nix b/tv/2configs/gitconfig.nix
index 771a4b2a4..fb9b78e6a 100644
--- a/tv/2configs/gitconfig.nix
+++ b/tv/2configs/gitconfig.nix
@@ -1,8 +1,5 @@
-{ config, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   environment.etc.gitconfig.text = ''
     [alias]
       patch = !${pkgs.git}/bin/git --no-pager diff --no-color
diff --git a/tv/2configs/gitrepos.nix b/tv/2configs/gitrepos.nix
index 4fba5fe7b..d8e7755fe 100644
--- a/tv/2configs/gitrepos.nix
+++ b/tv/2configs/gitrepos.nix
@@ -1,8 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-let {
+with import ./lib;
+{ config, pkgs, ... }: let {
 
   body = {
 
diff --git a/tv/2configs/htop.nix b/tv/2configs/htop.nix
index e78caeb5f..09372980f 100644
--- a/tv/2configs/htop.nix
+++ b/tv/2configs/htop.nix
@@ -1,8 +1,5 @@
-{ pkgs, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ pkgs, ... }: {
   nixpkgs.config.packageOverrides = super: {
     htop = pkgs.symlinkJoin {
       name = "htop";
diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix
index dd6fcfe67..b998fcf7c 100644
--- a/tv/2configs/hw/AO753.nix
+++ b/tv/2configs/hw/AO753.nix
@@ -1,8 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   imports = [
     ../smartd.nix
 
diff --git a/tv/2configs/hw/lib b/tv/2configs/hw/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/2configs/hw/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/2configs/hw/w110er.nix b/tv/2configs/hw/w110er.nix
index 09dd9a49d..bf749a98a 100644
--- a/tv/2configs/hw/w110er.nix
+++ b/tv/2configs/hw/w110er.nix
@@ -1,6 +1,5 @@
-{ pkgs, ... }: let
-  lib = import <stockholm/lib>;
-in {
+with import ./lib;
+{ pkgs, ... }: {
   imports = [
     ../smartd.nix
     {
diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix
index c3ec7b40e..ee3c7dc04 100644
--- a/tv/2configs/hw/x220.nix
+++ b/tv/2configs/hw/x220.nix
@@ -1,7 +1,5 @@
-{ config, pkgs, ... }: let
-  lib = import <stockholm/lib>;
-in
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   imports = [
     ../smartd.nix
     {
diff --git a/tv/2configs/imgur.nix b/tv/2configs/imgur.nix
index 1df67f939..e22122761 100644
--- a/tv/2configs/imgur.nix
+++ b/tv/2configs/imgur.nix
@@ -1,6 +1,5 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
-
   services.nginx.virtualHosts."ni.r" = {
     locations."/image" = {
       extraConfig = /* nginx */ ''
diff --git a/tv/2configs/lib b/tv/2configs/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/2configs/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/2configs/nginx/default.nix b/tv/2configs/nginx/default.nix
index efea3a844..6844df99b 100644
--- a/tv/2configs/nginx/default.nix
+++ b/tv/2configs/nginx/default.nix
@@ -1,8 +1,5 @@
-{ config, lib, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, ... }: {
   services.nginx = {
     enableReload = true;
 
diff --git a/tv/2configs/nginx/lib b/tv/2configs/nginx/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/2configs/nginx/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/2configs/nginx/public_html.nix b/tv/2configs/nginx/public_html.nix
index 43d7189ef..c2403cd8d 100644
--- a/tv/2configs/nginx/public_html.nix
+++ b/tv/2configs/nginx/public_html.nix
@@ -1,8 +1,5 @@
-{ config, lib, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, ... }: {
   services.nginx = {
     enable = true;
     virtualHosts.default = {
diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix
index 51a5c716f..415755b16 100644
--- a/tv/2configs/pki/default.nix
+++ b/tv/2configs/pki/default.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: let
 
   certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source;
diff --git a/tv/2configs/pki/lib b/tv/2configs/pki/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/2configs/pki/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/2configs/ppp.nix b/tv/2configs/ppp.nix
index c801401b2..24d2831c4 100644
--- a/tv/2configs/ppp.nix
+++ b/tv/2configs/ppp.nix
@@ -1,5 +1,5 @@
+with import ./lib;
 { config, pkgs, ... }: let
-  lib = import <stockholm/lib>;
   cfg = {
     pin = "@${toString <secrets/o2.pin>}";
     ttys.ppp = "/dev/ttyACM0";
diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index 513a0eb17..7a07e8154 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -1,7 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-let
+with import ./lib;
+{ config, pkgs, ... }: let
   pkg = pkgs.pulseaudio;
   runDir = "/run/pulse";
 
diff --git a/tv/2configs/repo-sync/lib b/tv/2configs/repo-sync/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/2configs/repo-sync/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/2configs/repo-sync/wiki.nix b/tv/2configs/repo-sync/wiki.nix
index 913439906..515e731c4 100644
--- a/tv/2configs/repo-sync/wiki.nix
+++ b/tv/2configs/repo-sync/wiki.nix
@@ -1,6 +1,5 @@
-{ config, pkgs, ... }: let
-  lib = import <stockholm/lib>;
-in {
+with import ./lib;
+{ config, pkgs, ... }: {
   krebs.repo-sync.enable = true;
   krebs.repo-sync.repos.wiki.branches.hotdog = {
     origin.url = "http://cgit.hotdog.r/wiki";
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
index 3c3b2adf0..de77de381 100644
--- a/tv/2configs/retiolum.nix
+++ b/tv/2configs/retiolum.nix
@@ -1,8 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   krebs.tinc.retiolum = {
     enable = true;
     connectTo = filter (ne config.krebs.build.host.name) [
diff --git a/tv/2configs/ssh.nix b/tv/2configs/ssh.nix
index 84d247362..ad828813d 100644
--- a/tv/2configs/ssh.nix
+++ b/tv/2configs/ssh.nix
@@ -1,8 +1,5 @@
-{ config, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   # Override NixOS's "Allow DSA keys for now."
   environment.etc."ssh/ssh_config".text = mkForce ''
     AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix
index 79af5b01f..4da8c8216 100644
--- a/tv/2configs/sshd.nix
+++ b/tv/2configs/sshd.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, ... }: let
   cfg.host = config.krebs.build.host;
 in {
diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index 619b04459..7ba364ff3 100644
--- a/tv/2configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: let
   exec = filename: args: url: {
     inherit url;
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index e296a0c8e..909213d3d 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -1,7 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-let {
+with import ./lib;
+{ config, pkgs, ... }: let {
   body = {
     environment.systemPackages = [
       vim-wrapper
diff --git a/tv/2configs/xdg.nix b/tv/2configs/xdg.nix
index 18bac9b38..b7c14af5a 100644
--- a/tv/2configs/xdg.nix
+++ b/tv/2configs/xdg.nix
@@ -1,8 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, pkgs, ... }: {
   environment.variables.XDG_RUNTIME_DIR = "/run/xdg/$LOGNAME";
 
   systemd.tmpfiles.rules = let
diff --git a/tv/2configs/xp-332.nix b/tv/2configs/xp-332.nix
index a97fb3679..51fd1ae8c 100644
--- a/tv/2configs/xp-332.nix
+++ b/tv/2configs/xp-332.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: {
 
   environment.etc."utsushi.conf".text = ''
diff --git a/tv/2configs/xserver/Xmodmap.nix b/tv/2configs/xserver/Xmodmap.nix
index 8e8e3dfdd..8e555e927 100644
--- a/tv/2configs/xserver/Xmodmap.nix
+++ b/tv/2configs/xserver/Xmodmap.nix
@@ -1,6 +1,6 @@
 { config, pkgs, ... }:
 
-with import <stockholm/lib>;
+with import ./lib;
 
 pkgs.writeText "Xmodmap" ''
   !keycode 66 = Caps_Lock
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 8bedb0e81..f534b557e 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -1,6 +1,5 @@
-{ config, pkgs, ... }@args:
-with import <stockholm/lib>;
-let
+with import ./lib;
+{ config, pkgs, ... }@args: let
   cfg = {
     cacheDir = cfg.dataDir;
     configDir = "/var/empty";
diff --git a/tv/2configs/xserver/lib b/tv/2configs/xserver/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/2configs/xserver/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/2configs/xserver/sxiv.nix b/tv/2configs/xserver/sxiv.nix
index 10e450da4..eb862f887 100644
--- a/tv/2configs/xserver/sxiv.nix
+++ b/tv/2configs/xserver/sxiv.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: let
   cfg.user = config.krebs.build.user;
 in {
diff --git a/tv/2configs/xserver/urxvt.nix b/tv/2configs/xserver/urxvt.nix
index 2d504e165..3502c6356 100644
--- a/tv/2configs/xserver/urxvt.nix
+++ b/tv/2configs/xserver/urxvt.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: let
   cfg.user = config.krebs.build.user;
 in {
diff --git a/tv/2configs/xserver/xserver.conf.nix b/tv/2configs/xserver/xserver.conf.nix
index 99038e5fc..3fdfebf1b 100644
--- a/tv/2configs/xserver/xserver.conf.nix
+++ b/tv/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
+with import ./lib;
+{ config, pkgs, ... }:
 
 let
   cfg = config.services.xserver;
diff --git a/tv/3modules/Xresources.nix b/tv/3modules/Xresources.nix
index ab233dd65..266531de9 100644
--- a/tv/3modules/Xresources.nix
+++ b/tv/3modules/Xresources.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: let
   cfg = {
     enable = config.services.xserver.enable && config.tv.Xresources != {};
diff --git a/tv/3modules/charybdis/config.nix b/tv/3modules/charybdis/config.nix
index dccbfde67..4669345eb 100644
--- a/tv/3modules/charybdis/config.nix
+++ b/tv/3modules/charybdis/config.nix
@@ -1,4 +1,4 @@
-{ config, ... }: with import <stockholm/lib>; let
+{ config, ... }: with import ./lib; let
   cfg = config.tv.charybdis;
 in toFile "charybdis.conf" ''
   /* doc/example.conf - brief example configuration file
diff --git a/tv/3modules/charybdis/default.nix b/tv/3modules/charybdis/default.nix
index 96aae702a..4a0f99503 100644
--- a/tv/3modules/charybdis/default.nix
+++ b/tv/3modules/charybdis/default.nix
@@ -1,4 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
+with import ./lib;
+{ config, pkgs, ... }@args: let
   cfg = config.tv.charybdis;
 in {
   options.tv.charybdis = {
diff --git a/tv/3modules/charybdis/lib b/tv/3modules/charybdis/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/3modules/charybdis/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/3modules/dnsmasq.nix b/tv/3modules/dnsmasq.nix
index ab24ac089..e1dfdea34 100644
--- a/tv/3modules/dnsmasq.nix
+++ b/tv/3modules/dnsmasq.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, ... }: let
   cfg = config.tv.dnsmasq;
 in {
diff --git a/tv/3modules/ejabberd/default.nix b/tv/3modules/ejabberd/default.nix
index edc5296b0..e3a41a57b 100644
--- a/tv/3modules/ejabberd/default.nix
+++ b/tv/3modules/ejabberd/default.nix
@@ -1,5 +1,5 @@
-{ config, lib, pkgs, ... }@args: with import <stockholm/lib>; let
-
+with import ./lib;
+{ config, pkgs, ... }: let
   cfg = config.tv.ejabberd;
 
   gen-dhparam = pkgs.writeDash "gen-dhparam" ''
diff --git a/tv/3modules/ejabberd/lib b/tv/3modules/ejabberd/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/3modules/ejabberd/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/3modules/focus.nix b/tv/3modules/focus.nix
index b1a7b2e52..c16d44243 100644
--- a/tv/3modules/focus.nix
+++ b/tv/3modules/focus.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 {
   options.tv.focus.enable = mkEnableOption "tv.focus";
 }
diff --git a/tv/3modules/hosts.nix b/tv/3modules/hosts.nix
index 118740510..2d382e266 100644
--- a/tv/3modules/hosts.nix
+++ b/tv/3modules/hosts.nix
@@ -1,8 +1,5 @@
-{ config, ... }:
-
-with import <stockholm/lib>;
-
-{
+with import ./lib;
+{ config, ... }: {
   options.tv.hosts = mkOption {
     type = types.attrsOf types.host;
     default =
diff --git a/tv/3modules/hw.nix b/tv/3modules/hw.nix
index 6eb722d2f..db1a77c85 100644
--- a/tv/3modules/hw.nix
+++ b/tv/3modules/hw.nix
@@ -1,5 +1,5 @@
+with import ./lib;
 let
-  lib = import <stockholm/lib>;
   local.types.screen = lib.types.submodule {
     options.width = lib.mkOption {
       type = lib.types.uint;
diff --git a/tv/3modules/im.nix b/tv/3modules/im.nix
index e98a57327..76a61b191 100644
--- a/tv/3modules/im.nix
+++ b/tv/3modules/im.nix
@@ -1,6 +1,6 @@
+with import ./lib;
 { config, pkgs, ... }: let
   im = config.tv.im;
-  lib = import <stockholm/lib>;
 in {
   options = {
     tv.im.client.enable = lib.mkEnableOption "tv.im.client" // {
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
index 9cf0bd5a2..c4bf4644d 100644
--- a/tv/3modules/iptables.nix
+++ b/tv/3modules/iptables.nix
@@ -1,7 +1,5 @@
-{ config, lib, pkgs, ... }:
-
-with import <stockholm/lib>;
-let {
+with import ./lib;
+{ config, pkgs, ... }: let {
   cfg = config.tv.iptables;
 
   body = {
diff --git a/tv/3modules/lib b/tv/3modules/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/3modules/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/3modules/org.freedesktop.machine1.host-shell.nix b/tv/3modules/org.freedesktop.machine1.host-shell.nix
index e1a5323d6..7d31edf9d 100644
--- a/tv/3modules/org.freedesktop.machine1.host-shell.nix
+++ b/tv/3modules/org.freedesktop.machine1.host-shell.nix
@@ -1,4 +1,5 @@
-{ config, ... }: let lib = import ../../lib; in {
+with import ./lib;
+{ config, ... }: {
   options.org.freedesktop.machine1.host-shell.access = lib.mkOption {
     default = {};
     type =
diff --git a/tv/3modules/slock.nix b/tv/3modules/slock.nix
index 926adc8e0..a08303215 100644
--- a/tv/3modules/slock.nix
+++ b/tv/3modules/slock.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: let
   cfg = config.tv.slock;
 in {
diff --git a/tv/3modules/x0vncserver.nix b/tv/3modules/x0vncserver.nix
index 4dbb34df0..f19bfebcc 100644
--- a/tv/3modules/x0vncserver.nix
+++ b/tv/3modules/x0vncserver.nix
@@ -1,8 +1,6 @@
-with import <stockholm/lib>;
+with import ./lib;
 { config, pkgs, ... }: let
-
   cfg = config.tv.x0vncserver;
-
 in {
   options.tv.x0vncserver = {
     display = mkOption {
diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index 494cb9e63..245d0542b 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -1,4 +1,4 @@
-with import ../../lib;
+with import ./lib;
 let
   pushBack = x: xs:
     if elem x xs then
diff --git a/tv/5pkgs/haskell/default.nix b/tv/5pkgs/haskell/default.nix
index 33fd2506a..f05223d72 100644
--- a/tv/5pkgs/haskell/default.nix
+++ b/tv/5pkgs/haskell/default.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 let
   overrides = self: super:
     mapNixDir (path: self.callPackage path {}) [
diff --git a/tv/5pkgs/haskell/lib b/tv/5pkgs/haskell/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/5pkgs/haskell/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/5pkgs/lib b/tv/5pkgs/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/5pkgs/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/5pkgs/override/default.nix b/tv/5pkgs/override/default.nix
index f719a9f69..87b7ce929 100644
--- a/tv/5pkgs/override/default.nix
+++ b/tv/5pkgs/override/default.nix
@@ -1,4 +1,4 @@
-with import ../../../lib;
+with import ./lib;
 self: super:
 
 mapNixDir (path: import path self super) ./.
diff --git a/tv/5pkgs/override/lib b/tv/5pkgs/override/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/5pkgs/override/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/5pkgs/rpi/default.nix b/tv/5pkgs/rpi/default.nix
index f0ac47f6a..e41d6373f 100644
--- a/tv/5pkgs/rpi/default.nix
+++ b/tv/5pkgs/rpi/default.nix
@@ -1,6 +1,4 @@
-let
-  lib = import <stockholm/lib>;
-in
+with import ./lib;
 
 self: super:
 
diff --git a/tv/5pkgs/rpi/lib b/tv/5pkgs/rpi/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/5pkgs/rpi/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/5pkgs/simple/bash-fzf-history.nix b/tv/5pkgs/simple/bash-fzf-history.nix
index 88a8e9e4a..1166ec7fd 100644
--- a/tv/5pkgs/simple/bash-fzf-history.nix
+++ b/tv/5pkgs/simple/bash-fzf-history.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { pkgs
 
 , edit-key ? "ctrl-e"
diff --git a/tv/5pkgs/simple/default.nix b/tv/5pkgs/simple/default.nix
index 9fb45dd1a..82a19a9b1 100644
--- a/tv/5pkgs/simple/default.nix
+++ b/tv/5pkgs/simple/default.nix
@@ -1,4 +1,4 @@
-with import ../../../lib;
+with import ./lib;
 
 self: super:
 
diff --git a/tv/5pkgs/simple/lib b/tv/5pkgs/simple/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/5pkgs/simple/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/5pkgs/simple/pinentry-urxvt/default.nix b/tv/5pkgs/simple/pinentry-urxvt/default.nix
index 6e4f6b002..c768a9f5b 100644
--- a/tv/5pkgs/simple/pinentry-urxvt/default.nix
+++ b/tv/5pkgs/simple/pinentry-urxvt/default.nix
@@ -1,8 +1,7 @@
+with import ./lib;
 { pkgs, ... }@args:
 
 let
-  lib = import <stockholm/lib>;
-
   # config cannot be declared in the input attribute set because that would
   # cause callPackage to inject the wrong config.  Instead, get it from ...
   # via args.
diff --git a/tv/5pkgs/simple/pinentry-urxvt/lib b/tv/5pkgs/simple/pinentry-urxvt/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/5pkgs/simple/pinentry-urxvt/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/5pkgs/simple/q/default.nix b/tv/5pkgs/simple/q/default.nix
index e17282e17..2ae71db52 100644
--- a/tv/5pkgs/simple/q/default.nix
+++ b/tv/5pkgs/simple/q/default.nix
@@ -1,5 +1,5 @@
-{ pkgs, ... }:
-with import <stockholm/lib>;
+with import ./lib;
+{ pkgs }:
 let
   q-cal = let
 
diff --git a/tv/5pkgs/simple/q/lib b/tv/5pkgs/simple/q/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/5pkgs/simple/q/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/5pkgs/vim/default.nix b/tv/5pkgs/vim/default.nix
index e0e2761d2..c143592ad 100644
--- a/tv/5pkgs/vim/default.nix
+++ b/tv/5pkgs/vim/default.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 
 self: super: {
   tv = super.tv // {
diff --git a/tv/5pkgs/vim/hack.nix b/tv/5pkgs/vim/hack.nix
index 0e949688d..922d85ba2 100644
--- a/tv/5pkgs/vim/hack.nix
+++ b/tv/5pkgs/vim/hack.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { pkgs }:
 
 pkgs.tv.vim.makePlugin (pkgs.writeTextFile (let
diff --git a/tv/5pkgs/vim/lib b/tv/5pkgs/vim/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/5pkgs/vim/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file
diff --git a/tv/5pkgs/vim/nix.nix b/tv/5pkgs/vim/nix.nix
index 01f769f16..43caf46c2 100644
--- a/tv/5pkgs/vim/nix.nix
+++ b/tv/5pkgs/vim/nix.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { pkgs }:
 
 pkgs.tv.vim.makePlugin (pkgs.write "vim-syntax-nix-nested" {
diff --git a/tv/5pkgs/vim/vim.nix b/tv/5pkgs/vim/vim.nix
index 6034dbda8..c5693a243 100644
--- a/tv/5pkgs/vim/vim.nix
+++ b/tv/5pkgs/vim/vim.nix
@@ -1,4 +1,4 @@
-with import <stockholm/lib>;
+with import ./lib;
 { pkgs }:
 
 pkgs.tv.vim.makePlugin (pkgs.writeTextFile (let
diff --git a/tv/lib b/tv/lib
new file mode 120000
index 000000000..dc598c56d
--- /dev/null
+++ b/tv/lib
@@ -0,0 +1 @@
+../lib
\ No newline at end of file

From 3a0d3fed99265617503236e573733cb5c27e7139 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 04:42:09 +0100
Subject: [PATCH 13/31] =?UTF-8?q?tv:=20XMONAD=5FSPAWN=5FWORKSPACE=20?=
 =?UTF-8?q?=E2=86=92=20=5FCURRENT=5FDESKTOP=5FNAME?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tv/2configs/bash/default.nix           | 16 ++++++++++++++--
 tv/2configs/default.nix                |  2 +-
 tv/5pkgs/haskell/xmonad-tv/src/main.hs |  9 +--------
 3 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/tv/2configs/bash/default.nix b/tv/2configs/bash/default.nix
index c0855bb26..e38566b78 100644
--- a/tv/2configs/bash/default.nix
+++ b/tv/2configs/bash/default.nix
@@ -14,8 +14,20 @@ with import ./lib;
 
       case $UID in
         ${shell.escape (toString config.krebs.users.tv.uid)})
-          if test ''${SHLVL-1} = 1; then
-            case ''${XMONAD_SPAWN_WORKSPACE-} in
+          if test ''${SHLVL-1} = 1 && test -n "''${DISPLAY-}"; then
+            _CURRENT_DESKTOP_NAME=''${_CURRENT_DESKTOP_NAME-$(
+              ${pkgs.xorg.xprop}/bin/xprop -notype -root \
+                  32i _NET_CURRENT_DESKTOP \
+                  8s _NET_DESKTOP_NAMES \
+                |
+              ${pkgs.gnused}/bin/sed -r 's/.* = //;s/"//g;s/, /\a/g' |
+              {
+                read -r _NET_CURRENT_DESKTOP
+                IFS=$'\a' read -ra _NET_DESKTOP_NAMES
+                echo "''${_NET_DESKTOP_NAMES[$_NET_CURRENT_DESKTOP]}"
+              }
+            )}
+            case $_CURRENT_DESKTOP_NAME in
               stockholm)
                 cd ~/stockholm
               ;;
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 5710f28f4..9babb92c2 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -37,7 +37,7 @@ with import ./lib;
     {
       i18n.defaultLocale = mkDefault "C.UTF-8";
       security.sudo.extraConfig = ''
-        Defaults env_keep+="SSH_CLIENT XMONAD_SPAWN_WORKSPACE"
+        Defaults env_keep+="SSH_CLIENT _CURRENT_DESKTOP_NAME"
         Defaults mailto="${config.krebs.users.tv.mail}"
         Defaults !lecture
       '';
diff --git a/tv/5pkgs/haskell/xmonad-tv/src/main.hs b/tv/5pkgs/haskell/xmonad-tv/src/main.hs
index d346bfd66..c921d428b 100644
--- a/tv/5pkgs/haskell/xmonad-tv/src/main.hs
+++ b/tv/5pkgs/haskell/xmonad-tv/src/main.hs
@@ -118,13 +118,6 @@ spawnRootTerm =
         Nothing
 
 
-spawnTermAt :: String -> X ()
-spawnTermAt ws = do
-    env <- io getEnvironment
-    let env' = ("XMONAD_SPAWN_WORKSPACE", ws) : env
-    forkFile {-pkg:rxvt_unicode-}"urxvtc" [] (Just env')
-
-
 myKeys :: XConfig Layout -> Map (KeyMask, KeySym) (X ())
 myKeys conf = Map.fromList $
     [ ((_4  , xK_Escape ), forkFile {-pkg-}"slock" [] Nothing)
@@ -133,7 +126,7 @@ myKeys conf = Map.fromList $
     , ((_4  , xK_o      ), forkFile {-pkg:fzmenu-}"otpmenu" [] Nothing)
     , ((_4  , xK_p      ), forkFile {-pkg:fzmenu-}"passmenu" [] Nothing)
 
-    , ((_4  , xK_x      ), chooseAction spawnTermAt)
+    , ((_4  , xK_x      ), forkFile {-pkg:rxvt_unicode-}"urxvtc" [] Nothing)
     , ((_4C , xK_x      ), spawnRootTerm)
 
     , ((_C  , xK_Menu   ), toggleWS)

From 02cc22b95eab2f6db7c04ca3560f9c42fb67a9a7 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 04:58:02 +0100
Subject: [PATCH 14/31] tv vim: set ttymouse=sgr

---
 tv/2configs/vim.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 909213d3d..b8819ee36 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -77,6 +77,7 @@ with import ./lib;
     set showmatch
     set timeoutlen=0
     set ttimeoutlen=0
+    set ttymouse=sgr
     set undodir=${dirs.undodir}
     set undofile
     set undolevels=1000000

From 3996bc0804dcfb6176f407dc951d814407c47cf2 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Thu, 8 Dec 2022 22:45:09 +0100
Subject: [PATCH 15/31] tv: init alacritty-tv

---
 tv/5pkgs/simple/alacritty-font-size.nix | 67 ++++++++++++++++++
 tv/5pkgs/simple/alacritty-tv.nix        | 93 +++++++++++++++++++++++++
 2 files changed, 160 insertions(+)
 create mode 100644 tv/5pkgs/simple/alacritty-font-size.nix
 create mode 100644 tv/5pkgs/simple/alacritty-tv.nix

diff --git a/tv/5pkgs/simple/alacritty-font-size.nix b/tv/5pkgs/simple/alacritty-font-size.nix
new file mode 100644
index 000000000..84bc3f616
--- /dev/null
+++ b/tv/5pkgs/simple/alacritty-font-size.nix
@@ -0,0 +1,67 @@
+{ pkgs }:
+
+pkgs.writeDashBin "font-size-alacritty" ''
+  # usage: font-size-alacritty (+N|-N|=N)
+  # Increase by, decrease by, or set font size to the value N.
+
+  set -efu
+
+  min_size=8
+
+  op=''${1%%[0-9]*}
+  op=''${op:-=}
+
+  value=''${1#[=+-]}
+
+  window_id=$(${pkgs.xdotool}/bin/xdotool getactivewindow)
+
+  current_size=$(
+    ${pkgs.xorg.xprop}/bin/xprop -notype -id $window_id FONT_SIZE |
+    ${pkgs.gnused}/bin/sed -rn 's/.* = ([0-9]+)$/\1/p'
+  )
+
+  # usage: set_font_size WINDOW_ID FONT_SIZE
+  set_font_size() {
+    ${pkgs.alacritty}/bin/alacritty msg config -w $1 font.size=$2
+    ${pkgs.xorg.xprop}/bin/xprop -id $1 -f FONT_SIZE 32c -set FONT_SIZE $2
+  }
+
+  # usage: reset_font_size WINDOW_ID
+  reset_font_size() {
+    ${pkgs.alacritty}/bin/alacritty msg config -w $1 font.size=$min_size
+    ${pkgs.xorg.xprop}/bin/xprop -id $1 -remove FONT_SIZE
+  }
+
+  # usage: make_next_size
+  make_next_size() {
+    case $op in
+      -) next_size=$(expr $current_size - $value) ;;
+      =) next_size=$value ;;
+      +)
+        next_size=$(expr $current_size + $value)
+        test $next_size -ge $min_size || next_size=$min_size
+        ;;
+    esac
+  }
+
+  if test -z "$current_size"; then
+    current_size=0
+    make_next_size
+    if test $next_size -ge $min_size; then
+      ${pkgs.alacritty}/bin/alacritty msg config -w $window_id \
+          font.normal.family='Input Mono' \
+          font.normal.style=Condensed \
+          font.bold.family='Input Mono' \
+          font.bold.style=Bold
+      set_font_size $window_id $next_size
+    fi
+  else
+    make_next_size
+    if test $next_size -ge $min_size; then
+      set_font_size $window_id $next_size
+    else
+      ${pkgs.alacritty}/bin/alacritty msg config -w $window_id -r
+      reset_font_size $window_id
+    fi
+  fi
+''
diff --git a/tv/5pkgs/simple/alacritty-tv.nix b/tv/5pkgs/simple/alacritty-tv.nix
new file mode 100644
index 000000000..466ff27c5
--- /dev/null
+++ b/tv/5pkgs/simple/alacritty-tv.nix
@@ -0,0 +1,93 @@
+{ pkgs }:
+
+let
+  lib = import ./lib;
+  font-size = arg: {
+    program = "${pkgs.font-size-alacritty}/bin/font-size-alacritty";
+    args = [arg];
+  };
+  config = {
+    bell.animation = "EaseOut";
+    bell.duration = 50;
+    bell.color = "#ff00ff";
+    colors.cursor.cursor      = "#f042b0";
+    colors.primary.background = "#202020";
+    colors.primary.foreground = "#d0d7d0";
+    colors.normal.black       = "#000000";
+    colors.normal.red         = "#cd0000";
+    colors.normal.green       = "#00cd00";
+    colors.normal.yellow      = "#bc7004";
+    colors.normal.blue        = "#4343be";
+    colors.normal.magenta     = "#cb06cb";
+    colors.normal.cyan        = "#04c9c9";
+    colors.normal.white       = "#bebebe";
+    colors.bright.black       = "#727272";
+    colors.bright.red         = "#fb6262";
+    colors.bright.green       = "#72fb72";
+    colors.bright.yellow      = "#fbfb72";
+    colors.bright.blue        = "#7272fb";
+    colors.bright.magenta     = "#fb53fb";
+    colors.bright.cyan        = "#72fbfb";
+    colors.bright.white       = "#fbfbfb";
+    draw_bold_text_with_bright_colors = true;
+    font.normal.family = "Clean";
+    font.bold.family = "Clean";
+    font.bold.style = "Regular";
+    font.size = 10;
+    hints.enabled = [
+      {
+        regex = "(ipfs:|ipns:|magnet:|mailto:|gemini:|gopher:|https:|http:|news:|file:|git:|ssh:|ftp:)[^\\u0000-\\u001F\\u007F-\\u009F<>\"\\s{-}\\^⟨⟩`]+";
+        mouse.enabled = true;
+        post_processing = true;
+        action = "Select";
+      }
+    ];
+    key_bindings = [
+      { key = "Up";   mods = "Shift|Control"; command = font-size "=14"; }
+      { key = "Up";   mods = "Control";       command = font-size "+1"; }
+      { key = "Down"; mods = "Control";       command = font-size "-1"; }
+      { key = "Down"; mods = "Shift|Control"; command = font-size "=0"; }
+    ];
+    scrolling.multiplier = 8;
+  };
+  config-file = pkgs.writeJSON "alacritty-tv.json" config;
+in
+
+pkgs.symlinkJoin {
+  name = "alacritty-tv";
+  paths = [
+    (pkgs.writeDashBin "alacritty" ''
+      # usage:
+      #   alacritty [--singleton] [ARGS...]
+
+      set -efu
+
+      # Use home so Alacritty can find the configuration without arguments.
+      # HOME will be reset once in Alacritty.
+      HOME=$TMPDIR/Alacritty
+      export HOME
+
+      # Install stored configuration if it has changed.
+      # This allows for both declarative updates and runtime modifications.
+      ${pkgs.coreutils}/bin/mkdir -p "$HOME"
+      ref=$(${pkgs.coreutils}/bin/cat "$HOME"/ref)
+      if test "$ref" != ${config-file}; then
+        echo ${config-file} > "$HOME"/ref
+        ${pkgs.coreutils}/bin/cp ${config-file} "$HOME"/.alacritty.yml
+      fi
+
+      case ''${1-} in
+        --singleton)
+          shift
+          if ! ${pkgs.alacritty}/bin/alacritty msg create-window "$@"; then
+            ${pkgs.alacritty}/bin/alacritty "$@" &
+          fi
+          ;;
+        *)
+          exec ${pkgs.alacritty}/bin/alacritty "$@"
+          ;;
+      esac
+    '')
+    pkgs.alacritty
+  ];
+}

From ee44d27ef7df359ac82cfb4c0fbdf99714b06988 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 15:04:18 +0100
Subject: [PATCH 16/31] krebs-pages: import current krebscode.github.com

From https://github.com/krebscode/krebscode.github.com
Commit 4676108df07c2a058c4b98f6b0c3ace36fe861b2
---
 .../simple/krebs-pages/fixtures/index.html    |  21 +--
 .../krebs-pages/fixtures/thesauron.html       | 133 ------------------
 2 files changed, 6 insertions(+), 148 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/krebs-pages/fixtures/thesauron.html

diff --git a/krebs/5pkgs/simple/krebs-pages/fixtures/index.html b/krebs/5pkgs/simple/krebs-pages/fixtures/index.html
index e6b7034b3..68b2cbad6 100644
--- a/krebs/5pkgs/simple/krebs-pages/fixtures/index.html
+++ b/krebs/5pkgs/simple/krebs-pages/fixtures/index.html
@@ -24,19 +24,10 @@
   }
 </script>
 <body>
-  <p>
-    <a href="http://krebscode.github.io/minikrebs/linuxtag">
-      Linuxtag Heckenkrebs Presentation
-    </a>
-  </p>
-  <p>
-    <a href="http://krebscode.github.io/writeups">
-      CTF Writeups
-    </a>
-  </p>
-  <p>
-    <a href="thesauron.html">
-      Thesauron
-    </a>
-  </p>
+  <p><a href='https://cgit.krebsco.de/krops/about/'>krops</a></p>
+  <p><a href='https://github.com/krebs/cholerab/blob/master/thesauron.adoc'>Thesauron</a></p>
+  <p><a href='https://nixos.wiki/'>Project: The new NixOS wiki</a></p>
+  <p><a target="_blank" href="https://www.amazon.de/?&_encoding=UTF8&tag=krebscode06-21&linkCode=ur2&linkId=d4430b368b8aceeca92101cd4a4cdd1d&camp=1638&creative=6742">Go through this amazon affiliate link and generate krebsgold</a><img src="//ir-de.amazon-adsystem.com/e/ir?t=krebscode06-21&l=ur2&o=3" width="1" height="1" border="0" alt="" style="border:none !important; margin:0px !important;" /></p>
+  <p>  <a href="https://s.click.aliexpress.com/e/_A5luNt" target="_parent">Go through this aliexpress affiliate link and generate krebsgold</a></p>
+
 </body>
diff --git a/krebs/5pkgs/simple/krebs-pages/fixtures/thesauron.html b/krebs/5pkgs/simple/krebs-pages/fixtures/thesauron.html
deleted file mode 100644
index bcf1c5d48..000000000
--- a/krebs/5pkgs/simple/krebs-pages/fixtures/thesauron.html
+++ /dev/null
@@ -1,133 +0,0 @@
-<p>Cholerab n.
-[de]
-- Kunstwort aus Kollaboration und Cholera. Beschreibt den Zustand, dass
- Zusammenarbeit niemals gut, einfach und ohne Schmerzen funktioniert.
-- Teamwork-Plattform für Krebscode.</p>
-
-<p>eigentlich adv.
-[de]
-- Hinweis darauf, dass der Inhalt eines Satzes eine Soll-Realität beschreibt,
- die nicht der Fall ist.
-Antonym: tatsaechlich</p>
-
-<p>ghost n.
-[de]
-- Host im Darknet welcher evtl. irgendwie noch da ist (als dd image auf anderen
- Festplatten) aber wohl nie wieder kommen wird.
-Siehe: Wiederbelebung</p>
-
-<p>KD;RP abbr. (pronounciation: kah-derp)
-[en]
-- Short for Krebs Darknet / Retiolum Prefix.</p>
-
-<p>krebs
-[de]
-- krebs ist ein soziales Experiment, eine Organisation, das zweit aelteste
- Softwareprojekt im Shack und viel verteilte infrastruktur.</p>
-
-<p>kremium
-[en]
-- coinage derived from the words premium and krebs
-see: broken
-usage: Reaktor ircbot has unfixed broken behavior since ever-&gt;&#8220;Kremium Software&#8221;</p>
-
-<p>KRI abbr. (pronounciation: [en] cry)
-[en]
-- Short for Krebs Request for Implementation.
- Derived from Scheme Requests for Implementation (SRFI).</p>
-
-<p>litterate programming n.
-[en]
-- any code that has not been proved mathematically.</p>
-
-<p>Nahziel n.
-[de]
-- Ziel mit höchst möglicher Priorität.</p>
-
-<p>Nahzielerfahrung n.
-[de]
-- das Erlebnis der (endgültigen) Nichterreichung eines Nahziels (obwohl
- nur noch wenig ((quasi-) infinitesimal viel) nötig gewesen wäre).</p>
-
-<p>parentheses of fear
-[en]
-- unnecessary parentheses, usually used when order of precedence is unknown.
- - Examples: 1 + (2 * 3)</p>
-
-<p>Protip n.
-[en]
-- (Probably vague) description how a task can be solved.
- - Antonym: Spoiler
- - Example:
- - To defeat the Cyberdaemon, shoot at it until it dies.
- - RTFM</p>
-
-<p>Punching Lemma n.
-[de]
-- Sozialer Druck zur Aufrechterhaltung der Ordnung in dem sozialen Geflaecht
- von Krebs</p>
-
-<p>ref, n.
-[en]
-- A reference like an URI, ISBN, name of a person, etc.</p>
-
-<p>reftrace, n.
-[en]
-- A stacktrace-like representation of refs that lead to some (any kind of)
- conclusion. Usually generated by a human. The conclusion can be either on
- the top or on the bottom of the stack. If the order is ambiguous, then it
- should be communicated explicitly.
- - Example: (conclusion first)
- - http://en.wikipedia.org/wiki/Stack_trace
- - google &#8220;stacktrace&#8221; (first entry / 2014&#8211;12&#8211;05T12:13:58Z)
- - think about some example [this could be omitted, as it&#8217;s obvious&#8230;]</p>
-
-<p>Retiolum n.
-[en]
-- The official darknet of Krebs which utilizes the Retiolum Prefix to
- address individual nodes.</p>
-
-<p>Retiolum Prefix n.
-[en]
-- The universally accepted IPv6-prefix, 42::/16. Anyone can has a
- /128-subnet and, if require, anything larger.</p>
-
-<p>Retiolum Realtime Map n.
-[en]
-- The network map of the public visible part of Retiolum.</p>
-
-<p>RRM [abbr.][en]
-- Short for Retiolum Retiolum Map.</p>
-
-<p>Sanatorium n.
-[en]
-- The Krebs Control and Command Center.
-- An Retiolum-based IRC-channel where all Reaktor-enabled nodes gather
- and lurk for relevant input.</p>
-
-<p>Spoiler n.
-[en]
-- A subset of walkthrough, i.e. any individual steps may be omitted.
- - Antonym: Protip</p>
-
-<p>tatsaechlich, adv.
-[de]
-- Hinweis darauf, dass der Inhalt eines Satzes exakt der Realität entspricht.
-Antonym: eigentlich</p>
-
-<p>Verkrebsung n.
-[de]
-- Synonym fuer die Installation von Krebs (oder eine einzelnen Krebs
- Komponente) auf einem beliebigem System.</p>
-
-<p>Walkthrough n.
-[en]
-- Description of the individual steps to complete a task.
- - Examples:
- - program code
- - small-step semantics</p>
-
-<p>Wiederbelebung n.
-[de]
-- Ein ghost wird im Darknet wieder erreichbar
-Siehe: ghost</p>

From 69ddda1380d3d533ee24d8ec5d97e59e2b82b305 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 15:50:25 +0100
Subject: [PATCH 17/31] krebs.pages: init

---
 krebs/3modules/default.nix     |  1 +
 krebs/3modules/krebs-pages.nix | 44 ++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 krebs/3modules/krebs-pages.nix

diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 0ac8cb743..b92190b5b 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -34,6 +34,7 @@ let
       ./iptables.nix
       ./kapacitor.nix
       ./konsens.nix
+      ./krebs-pages.nix
       ./monit.nix
       ./nixpkgs.nix
       ./on-failure.nix
diff --git a/krebs/3modules/krebs-pages.nix b/krebs/3modules/krebs-pages.nix
new file mode 100644
index 000000000..a2a5b723e
--- /dev/null
+++ b/krebs/3modules/krebs-pages.nix
@@ -0,0 +1,44 @@
+{ config, modulesPath, pkgs, ... }: let
+  cfg = config.krebs.pages;
+  lib = import ../../lib;
+  extraTypes.nginx-vhost = lib.types.submodule (
+    lib.recursiveUpdate
+      (import (modulesPath + "/services/web-servers/nginx/vhost-options.nix")
+              { inherit config lib; })
+      {}
+  );
+in {
+  options.krebs.pages = {
+    enable = lib.mkEnableOption "krebs-pages";
+    domain = lib.mkOption {
+      type = lib.types.hostname;
+      default = "krebsco.de";
+    };
+    nginx = lib.mkOption {
+      type = extraTypes.nginx-vhost;
+      default = {};
+      example = lib.literalExpression /* nix */ ''
+        {
+          # To enable encryption and let let's encrypt take care of certificate
+          enableACME = true;
+          forceSSL = true;
+        }
+      '';
+      description = lib.mkDoc ''
+        With this option, you can customize the nginx virtualHost settings.
+      '';
+    };
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.krebs-pages;
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    services.nginx = {
+      enable = lib.mkDefault true;
+      virtualHosts.${cfg.domain} = lib.mkMerge [ cfg.nginx {
+        root = lib.mkForce cfg.package;
+      }];
+    };
+  };
+}

From 0d19e5948545eeab67ba3cf052e396137e9cafd1 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 14:52:14 +0100
Subject: [PATCH 18/31] krebsco.de: point apex to ni

---
 kartei/tv/default.nix      | 2 ++
 krebs/3modules/default.nix | 4 ----
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/kartei/tv/default.nix b/kartei/tv/default.nix
index 428e1c3b9..1d33fcadd 100644
--- a/kartei/tv/default.nix
+++ b/kartei/tv/default.nix
@@ -171,6 +171,8 @@ in {
           cgit.ni     60 IN AAAA ${config.krebs.hosts.ni.nets.internet.ip6.addr}
           search.ni   60 IN A ${config.krebs.hosts.ni.nets.internet.ip4.addr}
           search.ni   60 IN AAAA ${config.krebs.hosts.ni.nets.internet.ip6.addr}
+          krebsco.de. 60 IN A ${config.krebs.hosts.ni.nets.internet.ip4.addr}
+          krebsco.de. 60 IN AAAA ${config.krebs.hosts.ni.nets.internet.ip6.addr}
           krebsco.de. 60 IN MX 5 ni
           krebsco.de. 60 IN TXT "v=spf1 mx -all"
           tv          300 IN NS ni
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index b92190b5b..6babac72e 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -84,10 +84,6 @@ let
           @ IN SOA dns19.ovh.net. tech.ovh.net. (2015052000 86400 3600 3600000 86400)
                                 IN NS     ns19.ovh.net.
                                 IN NS     dns19.ovh.net.
-                                IN A      185.199.108.153
-                                IN A      185.199.109.153
-                                IN A      185.199.110.153
-                                IN A      185.199.111.153
         '';
       };
     };

From f207532a0e34d6316ffc904e88097ee2c87b1505 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 16:01:25 +0100
Subject: [PATCH 19/31] hotdog: enable krebs.pages

---
 krebs/1systems/hotdog/config.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index a34df4bdc..9849937d5 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -22,6 +22,7 @@
 
   krebs.build.host = config.krebs.hosts.hotdog;
   krebs.github-hosts-sync.enable = true;
+  krebs.pages.enable = true;
 
   boot.isContainer = true;
   networking.useDHCP = false;

From 45fb53515a011e54e8dc35bce29c76e07577af07 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 15:53:12 +0100
Subject: [PATCH 20/31] tv nginx krebs-pages: RIP

---
 tv/2configs/nginx/krebs-pages.nix | 13 -------------
 1 file changed, 13 deletions(-)
 delete mode 100644 tv/2configs/nginx/krebs-pages.nix

diff --git a/tv/2configs/nginx/krebs-pages.nix b/tv/2configs/nginx/krebs-pages.nix
deleted file mode 100644
index 4dd643db7..000000000
--- a/tv/2configs/nginx/krebs-pages.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ config, pkgs, ... }:
-{
-  services.nginx = {
-    virtualHosts.krebs-pages = {
-      serverAliases = [
-        "krebs.${config.krebs.build.host.name}.r"
-      ];
-      extraConfig = ''
-        root ${pkgs.krebs-pages};
-      '';
-    };
-  };
-}

From 7ca0326011d755d69c4306dddf9c6b44a43f5b87 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 16:58:06 +0100
Subject: [PATCH 21/31] krebsco.de: point apex to ponte

---
 kartei/krebs/default.nix | 5 +++++
 kartei/tv/default.nix    | 2 --
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/kartei/krebs/default.nix b/kartei/krebs/default.nix
index 6da73ff83..8cc292dd0 100644
--- a/kartei/krebs/default.nix
+++ b/kartei/krebs/default.nix
@@ -165,6 +165,11 @@ in {
     ponte = {
       cores = 1;
       owner = config.krebs.users.krebs;
+      extraZones = {
+        "krebsco.de" = /* bindzone */ ''
+          krebsco.de. 60 IN A ${config.krebs.hosts.ponte.nets.internet.ip4.addr}
+        '';
+      };
       nets = rec {
         internet = {
           ip4 = {
diff --git a/kartei/tv/default.nix b/kartei/tv/default.nix
index 1d33fcadd..428e1c3b9 100644
--- a/kartei/tv/default.nix
+++ b/kartei/tv/default.nix
@@ -171,8 +171,6 @@ in {
           cgit.ni     60 IN AAAA ${config.krebs.hosts.ni.nets.internet.ip6.addr}
           search.ni   60 IN A ${config.krebs.hosts.ni.nets.internet.ip4.addr}
           search.ni   60 IN AAAA ${config.krebs.hosts.ni.nets.internet.ip6.addr}
-          krebsco.de. 60 IN A ${config.krebs.hosts.ni.nets.internet.ip4.addr}
-          krebsco.de. 60 IN AAAA ${config.krebs.hosts.ni.nets.internet.ip6.addr}
           krebsco.de. 60 IN MX 5 ni
           krebsco.de. 60 IN TXT "v=spf1 mx -all"
           tv          300 IN NS ni

From 034c7a2d9d158522cda29bda311534ab7dc130d7 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 16:58:28 +0100
Subject: [PATCH 22/31] ponte: fix internet prefix

---
 kartei/krebs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kartei/krebs/default.nix b/kartei/krebs/default.nix
index 8cc292dd0..b3af3797e 100644
--- a/kartei/krebs/default.nix
+++ b/kartei/krebs/default.nix
@@ -172,9 +172,9 @@ in {
       };
       nets = rec {
         internet = {
-          ip4 = {
+          ip4 = rec {
             addr = "141.147.36.79";
-            prefix = "0.0.0.0/0";
+            prefix = "${addr}/32";
           };
         };
         retiolum = {

From 54300dfe750340d1e61947400ea86f71dad877af Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 17:00:03 +0100
Subject: [PATCH 23/31] ponte: enable krebs.pages

---
 krebs/1systems/ponte/config.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix
index 8250ebad9..de01b92ca 100644
--- a/krebs/1systems/ponte/config.nix
+++ b/krebs/1systems/ponte/config.nix
@@ -8,4 +8,11 @@
   ];
 
   krebs.build.host = config.krebs.hosts.ponte;
+
+  krebs.pages.enable = true;
+  krebs.pages.nginx.addSSL = true;
+  krebs.pages.nginx.enableACME = true;
+
+  security.acme.acceptTerms = true;
+  security.acme.certs.${config.krebs.pages.domain}.email = "spam@krebsco.de";
 }

From 8062bf67e3481214883f0d41a624c0ccfb1cf275 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 17:11:30 +0100
Subject: [PATCH 24/31] ponte: open TCP 80 and 443

---
 krebs/1systems/ponte/config.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix
index de01b92ca..ba817692f 100644
--- a/krebs/1systems/ponte/config.nix
+++ b/krebs/1systems/ponte/config.nix
@@ -7,6 +7,8 @@
     <stockholm/krebs/2configs/matterbridge.nix>
   ];
 
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
   krebs.build.host = config.krebs.hosts.ponte;
 
   krebs.pages.enable = true;

From ea30ea8661dbc83f8d2f96f2c511aa04992d3ffe Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 17:42:52 +0100
Subject: [PATCH 25/31] ponte firewall: disable logging

---
 krebs/1systems/ponte/config.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix
index ba817692f..f896c507b 100644
--- a/krebs/1systems/ponte/config.nix
+++ b/krebs/1systems/ponte/config.nix
@@ -8,6 +8,8 @@
   ];
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.logRefusedConnections = false;
+  networking.firewall.logRefusedUnicastsOnly = false;
 
   krebs.build.host = config.krebs.hosts.ponte;
 

From b17cd6133b92b9f936ee83f86bb8ff8f54e9565d Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 18:07:20 +0100
Subject: [PATCH 26/31] ponte: modify internet-facing SSH port

---
 krebs/1systems/ponte/config.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix
index f896c507b..2f55995cf 100644
--- a/krebs/1systems/ponte/config.nix
+++ b/krebs/1systems/ponte/config.nix
@@ -11,6 +11,21 @@
   networking.firewall.logRefusedConnections = false;
   networking.firewall.logRefusedUnicastsOnly = false;
 
+  # Move Internet-facing SSH port to reduce logspam.
+  networking.firewall.extraCommands = let
+    host = config.krebs.build.host;
+  in /* sh */ ''
+    iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+    iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+    iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT
+    iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+
+    ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+    ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+    ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT
+    ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+  '';
+
   krebs.build.host = config.krebs.hosts.ponte;
 
   krebs.pages.enable = true;

From c2f5b1c40669b13459a170b9ec14d9a78193cef0 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 18:13:25 +0100
Subject: [PATCH 27/31] ponte: add internet alias

---
 kartei/krebs/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kartei/krebs/default.nix b/kartei/krebs/default.nix
index b3af3797e..e5626d923 100644
--- a/kartei/krebs/default.nix
+++ b/kartei/krebs/default.nix
@@ -176,6 +176,9 @@ in {
             addr = "141.147.36.79";
             prefix = "${addr}/32";
           };
+          aliases = [
+            "ponte.i"
+          ];
         };
         retiolum = {
           via = internet;

From 9051f57095d4edfd22a68aa2798e38a44a2c94cb Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 18:38:06 +0100
Subject: [PATCH 28/31] kartei tv: move krebs-pages mirror from xu to ni

---
 kartei/tv/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kartei/tv/default.nix b/kartei/tv/default.nix
index 428e1c3b9..f7e86c598 100644
--- a/kartei/tv/default.nix
+++ b/kartei/tv/default.nix
@@ -198,6 +198,7 @@ in {
           aliases = [
             "ni.r"
             "cgit.ni.r"
+            "krebs.ni.r"
             "search.ni.r"
           ];
           tinc.pubkey = ''
@@ -319,7 +320,6 @@ in {
           aliases = [
             "xu.r"
             "cgit.xu.r"
-            "krebs.xu.r"
           ];
           tinc.pubkey = ''
             -----BEGIN RSA PUBLIC KEY-----
@@ -369,7 +369,7 @@ in {
     "http://cgit.krebsco.de" = {
       desc = "Git repositories";
     };
-    "http://krebs.xu.r" = {
+    "http://krebs.ni.r" = {
       desc = "krebs-pages mirror";
     };
   };

From fe01fe6bf411623582f8f21d5b8adb0e4729a7c1 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 9 Dec 2022 21:53:09 +0100
Subject: [PATCH 29/31] tv pinentry-urxvt: kill only screenshot displayers

---
 tv/5pkgs/simple/pinentry-urxvt/default.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/tv/5pkgs/simple/pinentry-urxvt/default.nix b/tv/5pkgs/simple/pinentry-urxvt/default.nix
index c768a9f5b..ad8039ff2 100644
--- a/tv/5pkgs/simple/pinentry-urxvt/default.nix
+++ b/tv/5pkgs/simple/pinentry-urxvt/default.nix
@@ -52,25 +52,26 @@ in
       trap cleanup EXIT
 
       cleanup() {
+        ${pkgs.utillinux}/bin/kill -- $(${pkgs.coreutils}/bin/cat "$displayers")
+        rm "$displayers"
         rm "$screenshot"
-        # Kill process group in order to kill screenshot windows.
-        ${pkgs.utillinux}/bin/kill 0
       }
 
-      screenshot=$(${pkgs.coreutils}/bin/mktemp -t pinentry-urxvt.screenshot.XXXXXXXX)
+      displayers=$(${pkgs.coreutils}/bin/mktemp -t pinentry-urxvt.$$.displayers.XXXXXXXX)
+      screenshot=$(${pkgs.coreutils}/bin/mktemp -t pinentry-urxvt.$$.screenshot.XXXXXXXX)
 
       ${pkgs.xorg.xwd}/bin/xwd -root |
       ${pkgs.imagemagick}/bin/convert xwd:- -fill \#424242 -colorize 80% xwd:"$screenshot"
 
-      show_screenshot() {
-        ${pkgs.exec "pinentry-urxvt.show_screenshot" {
+      display_screenshot() {
+        ${pkgs.exec "pinentry-urxvt.display_screenshot" {
             filename = "${pkgs.xorg.xwud}/bin/xwud";
             argv = [
               cfg.xwud.className
               "-noclick"
             ];
         }} < "$screenshot" &
-        wait_for_screenshot $!
+        wait_for_screenshot $! && echo $! >>"$displayers"
       }
 
       # Wait for the xwud window by trying to intercept the call to munmap().
@@ -92,12 +93,12 @@ in
         fi
       }
 
-      show_screenshot
+      display_screenshot
 
       ${lib.optionalString (cfg.display != null) /* sh */ ''
         if test "$DISPLAY" != ${lib.shell.escape cfg.display}; then
           export DISPLAY=${lib.shell.escape cfg.display}
-          show_screenshot
+          display_screenshot
         fi
       ''}
 

From 5293108bf766ed9a53600578c4bdade262ecaf9b Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 12 Dec 2022 16:09:24 +0100
Subject: [PATCH 30/31] nix-writers: 3.5.0 -> 3.6.1

---
 submodules/nix-writers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/submodules/nix-writers b/submodules/nix-writers
index f65c77bdc..09c6cc17f 160000
--- a/submodules/nix-writers
+++ b/submodules/nix-writers
@@ -1 +1 @@
-Subproject commit f65c77bdcc58be2081a0ffbda849289c5191b5e8
+Subproject commit 09c6cc17f02c810cebc790d637c12a9c692b3829

From 54ddded30dfc02c53baf33c078fafdd9aaf3c70d Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 12 Dec 2022 16:16:38 +0100
Subject: [PATCH 31/31] nix-writers: 3.6.1 -> 3.6.2

---
 submodules/nix-writers | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/submodules/nix-writers b/submodules/nix-writers
index 09c6cc17f..0c8de1504 160000
--- a/submodules/nix-writers
+++ b/submodules/nix-writers
@@ -1 +1 @@
-Subproject commit 09c6cc17f02c810cebc790d637c12a9c692b3829
+Subproject commit 0c8de150426476b5287cf2787bbd85263691a802