fix

still not working

.gitignore

@@ -1,2 +1,2 @@
 /result
-/roles/wireless.nix
+hardware-configuration.nix

configuration.nix

@@ -5,38 +5,41 @@
 { config, pkgs, ... }:
 
 {
-  imports =
-    [
-      <nixos-hardware/lenovo/thinkpad/x220>
-      <home-manager/nixos>
-      
-      # Include the results of the hardware scan.
-      ./hardware-configuration.nix
+  imports = [
+    # custom modules
+    ./modules/colors.nix
 
-      ./roles/admin.nix
-      ./roles/dev.nix
-      ./roles/base.nix
-      ./roles/desktop.nix
-      ./roles/wireless.nix
-      ./roles/vpn.nix
-    ];
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
 
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking.hostName = "raven";
-  networking.hostId = "e3a397c5";
+    # roles
+    ./roles/admin.nix
+    ./roles/base.nix
+    ./roles/desktop.nix
+    ./roles/dev.nix
+    ./roles/mail.nix
+    ./roles/network.nix
+    ./roles/nix.nix
+    ./roles/vpn.nix
+    ./roles/work.nix
+  ];
 
   networking.useDHCP = false;
-  networking.interfaces.enp0s25.useDHCP = true;
-  networking.interfaces.wlp3s0.useDHCP = true;
 
   i18n.defaultLocale = "en_US.UTF-8";
   time.timeZone = "Europe/Berlin";
 
   services.openssh.enable = true;
+
   networking.firewall.enable = true;
 
+  nixpkgs.config.permittedInsecurePackages = [
+    "openssl-1.0.2u"
+    "python3.10-kerberos-1.3.1"
+  ];
+
+  # removed for mobile working
+  # system.autoUpgrade.enable = true;
   system.stateVersion = "20.03"; # We can stay here
 }
 

dotfiles/alacritty.yml

@@ -1,37 +1,41 @@
 font:
   normal:
-    family: Cascadia Code
-  size: 12
+    family: CaskaydiaCove Nerd Font
+  size: 8
 
-background_opacity: 0.9
 draw_bold_text_with_bright_colors: true
 
 colors:
   primary:
-    background: "0x2D2A2E"
-    foreground: "0xFCFCFA"
+    background: '0xf8f8f8'
+    foreground: '0x2a2b33'
 
   normal:
-    black: "0x2d2a2e"
-    red: "0xcc6666"
-    green: "0xa9dc76"
-    yellow: "0xffd866"
-    blue: "0x78dce8"
-    magenta: "0xff6181"
-    cyan: "0x55dbbe"
-    white: "0xd6d6d6"
+    black:   '0x000000'
+    red:     '0xde3d35'
+    green:   '0x3e953a'
+    yellow:  '0xd2b67b'
+    blue:    '0x2f5af3'
+    magenta: '0xa00095'
+    cyan:    '0x3e953a'
+    white:   '0xbbbbbb'
+
   bright:
-    black: "0x757878"
-    red: "0xcc6666"
-    green: "0xa9dc76"
-    yellow: "0xffd866"
-    blue: "0x78dce8"
-    magenta: "0xff6181"
-    cyan: "0x55dbbe"
-    white: "0xd6d6d6"
+    black:   '0x000000'
+    red:     '0xde3d35'
+    green:   '0x3e953a'
+    yellow:  '0xd2b67b'
+    blue:    '0x2f5af3'
+    magenta: '0xa00095'
+    cyan:    '0x3e953a'
+    white:   '0xffffff'
 
 window:
   dynamic_title: true
+  opacity: 0.9
 
 env:
   TERM: xterm-256color
+
+key_bindings:
+  - { key: Escape, mods: Control, action: ToggleViMode }

dotfiles/certs/NetzmarktCA.crt

@@ -0,0 +1,44 @@
+-----BEGIN CERTIFICATE-----
+MIIHrjCCBZagAwIBAgIJAJwE8QiSIPupMA0GCSqGSIb3DQEBCwUAMIHpMQswCQYD
+VQQGEwJERTEPMA0GA1UECBMGQmF5ZXJuMREwDwYDVQQHEwhFcmxhbmdlbjEwMC4G
+A1UEChQnTmV0em1hcmt0IEludGVybmV0c2VydmljZSBHbWJIICYgQ28uIEtHMRAw
+DgYDVQQLEwdUZWNobmlrMTMwMQYDVQQDFCpOZXR6bWFya3QgSW50ZXJuZXRzZXJ2
+aWNlIEdtYkggJiBDby4gS0cgQ0ExFTATBgNVBCkTDE5ldHptYXJrdCBDQTEmMCQG
+CSqGSIb3DQEJARYXaG9zdG1hc3RlckBuZXR6bWFya3QuZGUwHhcNMTUxMTIwMTIy
+NTAwWhcNMjUxMTE3MTIyNTAwWjCB6TELMAkGA1UEBhMCREUxDzANBgNVBAgTBkJh
+eWVybjERMA8GA1UEBxMIRXJsYW5nZW4xMDAuBgNVBAoUJ05ldHptYXJrdCBJbnRl
+cm5ldHNlcnZpY2UgR21iSCAmIENvLiBLRzEQMA4GA1UECxMHVGVjaG5pazEzMDEG
+A1UEAxQqTmV0em1hcmt0IEludGVybmV0c2VydmljZSBHbWJIICYgQ28uIEtHIENB
+MRUwEwYDVQQpEwxOZXR6bWFya3QgQ0ExJjAkBgkqhkiG9w0BCQEWF2hvc3RtYXN0
+ZXJAbmV0em1hcmt0LmRlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+yPeH1i0beXEdMvyNATA9zc4CLCajROCVgypJ3+7sZ6wuNWxUbdSFQMm8v94h7BEL
+bCPJ6TT1B96GA4nfC0yOz1RhiUdLDJ8jv9Y1NEIBujBU2tvL2/93+dkMT/xZ2APj
+IPcYfdTUuWuK3y/WC+/OZ7ZKgCkQdXjy+tJagHBiYnYSIugSlwe7ToAg8gy/PmkO
+f7af5jtIVkRWyTtYI6paYzXmcgjafFptWPcb8bJX9MnCycB5/Af4VwHZszKf4Gmw
+Om/KvlzUHClBpCYUa/rLTmd8AyjAYJMpQ3yd4JBlsf5ao1ZeWFvCJjQHPiJYvLVD
+vApcUaXkbkWbGODC8YS8d4r5pwoEWeUwxomNVDElIIoQOM3Agi6ms0Hfp9/S+lK/
+i9IgQXNOXTtjkLZRImUmjDk//QOoNjBh9z+g62YGaThDTgxlf4J7RD/HqTmLSKjE
+UwlWGduVTsUQR5uKs/tD5hsc5dpE3UI+n1J8PWlXcKfJnEjfgYPJ7jTDpBB6Oozj
+JtH7DkdOhHPZkZQzIuOLNtxqlgNSYHv7VNSmr3LvRTQto9x5NnGgMgliyKuI1aBt
+p+gSnOezGMSQobRBH0cvXVk7dWm+BeZtTmU03SsAFIfhVAnAisWfbHWD6GDUQ/9m
+F1SWMMJgCT/xSL43Md1riQV5/0mciHlhUxl0xKMBcTECAwEAAaOCAVUwggFRMB0G
+A1UdDgQWBBT1WEHH26TJcfvJRGFcGaWzrbKS6DCCASAGA1UdIwSCARcwggETgBT1
+WEHH26TJcfvJRGFcGaWzrbKS6KGB76SB7DCB6TELMAkGA1UEBhMCREUxDzANBgNV
+BAgTBkJheWVybjERMA8GA1UEBxMIRXJsYW5nZW4xMDAuBgNVBAoUJ05ldHptYXJr
+dCBJbnRlcm5ldHNlcnZpY2UgR21iSCAmIENvLiBLRzEQMA4GA1UECxMHVGVjaG5p
+azEzMDEGA1UEAxQqTmV0em1hcmt0IEludGVybmV0c2VydmljZSBHbWJIICYgQ28u
+IEtHIENBMRUwEwYDVQQpEwxOZXR6bWFya3QgQ0ExJjAkBgkqhkiG9w0BCQEWF2hv
+c3RtYXN0ZXJAbmV0em1hcmt0LmRlggkAnATxCJIg+6kwDAYDVR0TBAUwAwEB/zAN
+BgkqhkiG9w0BAQsFAAOCAgEAgALHwsIX7HgBysOPlkdmY+Bl9OvXpjJWrIiowl8U
+6YBwWDhA7CBsnkgpPfzdT3yWpzBFLKh+8DcnWOJ7G9AH4/Ypx2YgoQSxH/XQSqgd
+ojrP9YrzIo1If2+5uLIP8k4OyBOsR7ZG0zWCLMrvI+xkoirx/FKhiwR5ircmjvLG
+GYrkJVdreTx9duNHvSSIocOmf5BYa+FcElyit5EipPajupeDJLOb2MUpLES6YJX4
+q7jVcNLQpE/8L0BrT9SLwRce+mxYHu5PJ9uZDtYAgTOxVoh6xAcjC+llPo52PPse
+DGtCwDRrMqAJWzljZCDq7juU1BG/3C46rZV0T1sDaxscSFhUNdptQYt5prCKdvoY
+vg8G8ADldbJqnp5JlHkzsgcSP6Tj5h1ZAs99w3u7AtZfaX1no1/qTqObkyjZhMn9
+OVsYDTGLBCdEvS74YzPgZfSQt5jinR4THnybb0qm4Iluy8C3QHylHvTNbzksEpwp
+UdJL1pIAX6TD66B/KAXRg3fyn9mZnCilhCezbIx6NS5ZuZw6aQAUiOTV/eoQX/4V
+jH0v9cA6Yk/4pCoeQlHRJfIdBUsBvnTrzI6yszqKi56me113mD8SbS3f6AAiyiHf
+LNs/3aF+4/CmK7BsuelDgZASSx1Lol1UMqcKIbiTHr024V4LPUlQQQhwWVTCVxba
+k00=
+-----END CERTIFICATE-----

dotfiles/certs/vcenter.netzmarkt.lan.crt

@@ -0,0 +1,24 @@
+-----BEGIN CERTIFICATE-----
+MIIEDTCCAvWgAwIBAgIJAMjDX/Mpgd+WMA0GCSqGSIb3DQEBCwUAMIGRMQswCQYD
+VQQDDAJDQTESMBAGCgmSJomT8ixkARkWAm5tMRMwEQYKCZImiZPyLGQBGRYDbGFu
+MQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEaMBgGA1UECgwRdm0w
+MjAuaHYubW5ldC5sYW4xGzAZBgNVBAsMElZNd2FyZSBFbmdpbmVlcmluZzAeFw0x
+NzA0MTgwODAxMDRaFw0yNzA0MTYwODAxMDRaMIGRMQswCQYDVQQDDAJDQTESMBAG
+CgmSJomT8ixkARkWAm5tMRMwEQYKCZImiZPyLGQBGRYDbGFuMQswCQYDVQQGEwJV
+UzETMBEGA1UECAwKQ2FsaWZvcm5pYTEaMBgGA1UECgwRdm0wMjAuaHYubW5ldC5s
+YW4xGzAZBgNVBAsMElZNd2FyZSBFbmdpbmVlcmluZzCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBALoAMLvSM2IwLF5FVTtulCzuFPARSlOpVQjcMZ7gP5XA
+PdpsyNiL0C4K68tuN78ZxTU1p+/agW+PpU1oKlkUddUOoSaLbRAYW/xj3gBJ0uc7
+s0X6kuluw5f5B8RuTpnkhXTpQqVLBPsB1d02aS0OndRv4SNxZAVqwguGVw5UB2uv
+r9SSp1RhYK9qyP+EGABLzrD+qjsIhpSxSs9I7Up+D3MDi3WethqlDFPVXlEfD32Q
+NsNRLdAL6dd+GWFE3h82MaxfXhpUJHGcw5Wsz50/09I1Qfq6Hqkb7B6OLRAEz7gD
+slocjv2sXPxMvLXIdJOZlEveattI16L7XqDVu6AlDF0CAwEAAaNmMGQwHQYDVR0O
+BBYEFO8TgXPcRudSgtHFjCwHh0wPwqIrMB8GA1UdEQQYMBaBDmVtYWlsQGFjbWUu
+Y29thwR/AAABMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMA0G
+CSqGSIb3DQEBCwUAA4IBAQAIZkCrG1OB36JsLnyQG4WYbFIYkg9yu/fYpdwwThng
+GGy1z0qMEsTvCidUaIb8eMf/IIy/5VmDFLNtoiuhJcvfMoCOUnqykHZi9NN3Rloz
+laS7JIV06+bFHjBnlR/15xF/Jr0hx8qclUzsYgYE2RAB3ET6Z4GiWaCmuGX7Uwh8
+kt+bRz344bhEbdDrUioyk1qon3oaIhLc7jarr235JOfCnTZFLn/3kJzdcxHsTEIn
+Q9MAQz5BO2G6NnEMuH1gAizVK9Xdfv4ePHCWVKkn+OKbKgVPOY/iJ4Ayk1Ya4Npq
+B1hUaVxHPdq+PipXll4tShnmc6BM6tYyrJhOWBkiRSQS
+-----END CERTIFICATE-----

dotfiles/starship.toml

@@ -1,28 +1,30 @@
 add_newline = false
 
-prompt_order = [
-    "username",
-    "hostname",
-    "kubernetes",
-    "directory",
-    "git_branch",
-    "git_commit",
-    "git_state",
-    "git_status",
-    "nix_shell",
-    "cmd_duration",
-    "custom",
-    "line_break",
-    "jobs",
-    "battery",
-    "character",
-]
+format = """
+$username\
+$hostname\
+$kubernetes\
+$directory\
+$git_branch\
+$git_commit\
+$git_state\
+$git_status\
+$nix_shell\
+$cmd_duration\
+$custom\
+$line_break\
+$jobs\
+$battery\
+$character\
+"""
 
 [username]
 show_always = true
+format = "[$user]($style)@"
 
 [hostname]
 ssh_only = false
+format = "[$hostname]($style) "
 
-[character]
-use_symbol_for_status = false
+[git_branch]
+format = "[$symbol$branch]($style)"

dotfiles/sway/config

@@ -1,15 +1,47 @@
+# colors
+set $black #000000
+set $red #e75544
+set $cyan #3c74f6
+set $white #fafafa
+set $yellow #908550
+set $violet #a73ca6
+#set $black2 #323232
+set $white2 #f0f0f0
+
 # config
 set $mod Mod1
 set $left h
 set $down j
 set $up k
 set $right l
+#set $term wezterm
 set $term alacritty
-set $menu bemenu-run
+set $wallpaper /home/stefan/wall.png
+set $lock swaylock -t -i $wallpaper --scaling=fill
+set $font CaskaydiaCove Nerd Font 10
+set $menucolor -H 23 -b \
+    --tf=$white --tb=$cyan  \
+    --ff=$black --fb=$white \
+    --cf=$cyan  --cb=$white \
+    --nf=$black --nb=$white \
+    --af=$black --ab=$white2 \
+    --hf=$white --hb=$cyan  \
+    --sf=$white --sb=$cyan
+set $menu bemenu-run -p run $menucolor
+set $otpmenu ykman oath accounts code -s "$(ykman oath accounts list | bemenu -i $menucolor)" | wl-copy
+font $font
 
-output * bg /home/stefan/Sync/wall/nasa-yZygONrUBe8-unsplash.jpg fill
-output eDP-1 scale 1.3
-output DP-1 res 5120x1440
+input "1:1:AT_Translated_Set_2_keyboard" xkb_layout de
+input "0:0:TUXEDO_Keyboard" xkb_layout de
+input 1130:35:HID_046a:0023 xkb_layout de
+input "2362:628:PIXA3854:00_093A:0274_Touchpad" click_method clickfinger
+
+output * bg $wallpaper fill
+output "BenQ Corporation BenQ SW2700 83H03922SL0" res --custom 2560x1440@60Hz
+output "BenQ Corporation BenQ SW2700 83H03922SL0" pos 1440 720
+output "BNQ BenQ PD2705Q W4N00777019" pos 0 0
+output "Dell Inc. Dell U4919DW HZVZWP2" res 5120x1440
+output eDP-1 scale 1.25
 
 # user keybinds
 bindsym $mod+Return exec $term
@@ -18,42 +50,31 @@ bindsym $mod+d exec $menu
 floating_modifier $mod normal
 bindsym $mod+Shift+c reload
 bindsym $mod+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' -b 'Yes, exit sway' 'swaymsg exit'
-bindsym $mod+Shift+p exec keepassxc
-bindsym $mod+z exec swaylock -t
+bindsym $mod+o exec keepassxc
+bindsym $mod+Shift+o exec $otpmenu
+bindsym $mod+z exec $lock
 bindsym $mod+Up exec light -A 5
 bindsym $mod+Down exec light -U 5
+bindsym $mod+c exec alacritty --class float -t pyCalc -e python
+bindsym $mod+i exec alacritty --class float -t insect -e insect
+bindsym $mod+m exec swayr switch-to
+bindsym $mod+n exec emacsclient -cn
 bindsym Print exec grim -g "$(slurp)" - | wl-copy -t image/png
+bindswitch --reload --locked lid:on output eDP-1 disable
+bindswitch --reload --locked lid:off output eDP-1 enable
 
 # app rules
 for_window [app_id="org.keepassxc.KeePassXC"] floating enable
+for_window [title="Firefox — Sharing Indicator"] floating enable
+for_window [title="Picture-in-Picture"] floating enable
+for_window [title="pyCalc"] floating enable
+for_window [title="insect"] floating enable
 
-# font
-font Cascadia Code 10
-
-# colors
-set $black  #2d2a2e
-set $base00 #2d2a2e
-set $base01 #cc6666
-set $base02 #a9dc76
-set $base03 #ffd866
-set $base04 #78dce8
-set $base05 #55dbbe
-set $base06 #ff6181
-set $base07 #eeeeee
-set $base08 #323232
-set $base09 #cc6666
-set $base0A #ffd866
-set $base0B #78dce8
-set $base0C #55dbbe
-set $base0D #ff6181
-set $base0E #a6dc76
-set $base0F #ffffff
-
-#                       border  background text    indicator
-client.focused          $base04 $base00    $base07 $base04    $base04
-client.focused_inactive $base00 $base00    $base07 $base00    $base00
-client.unfocused        $black  $black     $base07 $base00    $base00
-client.urgent           $base01 $base01    $base00 $base08    $base07
+#                        border   backgnd  text    indicator  childborder
+client.focused           $cyan    $white   $black  $violet    $cyan
+client.focused_inactive  $white2  $white2  $black  $white2    $white
+client.unfocused         $white2  $white2  $black  $white2    $white
+client.urgent            $red     $red     $white  $white2    $black
 
 
 # movement
@@ -110,23 +131,56 @@ mode "resize" {
 }
 bindsym $mod+r mode "resize"
 
+mode "umlaut" {
+    bindsym s exec wtype ß
+    bindsym a exec wtype ä
+    bindsym o exec wtype ö
+    bindsym u exec wtype ü
+    bindsym Shift+a exec wtype Ä
+    bindsym Shift+o exec wtype Ö
+    bindsym Shift+u exec wtype Ü
+    bindsym Return mode "default"
+    bindsym Escape mode "default"
+}
+bindsym $mod+u mode "umlaut"
+
 bar {
+  font $font
   position bottom
   colors {
-    background $black
-    statusline $base07
-    separator  $base04
-
-    #                  border  back    text
-    focused_workspace  $base04 $base04 $base00
-    active_workspace   $base04 $base04 $base00
-    urgent_workspace   $base01 $base01 $base07
-    inactive_workspace $base00 $base00 $base07
+    background $white
+    statusline $black
+    separator  $cyan
 
+    #                   border   back     text
+    focused_workspace   $cyan    $cyan    $white
+    active_workspace    $cyan    $cyan    $white
+    urgent_workspace    $red     $red     $black
+    inactive_workspace  $white   $white   $black
   }
+
   status_command i3status-rs /etc/sway/status.toml
 }
 
-include /etc/sway/config.d/*
+set $gnome-schema org.gnome.desktop.interface
+exec_always {
+    gsettings set $gnome-schema cursor-theme Adwaita
+    gsettings set $gnome-schema icon-theme 'capitaine-cursors-white'
+    gsettings set $gnome-schema cursor-theme 'capitaine-cursors-white'
+}
 
-exec mako
+# autostarts
+exec swaync
+exec emacs --daemon
+exec swayidle before-sleep "$lock"
+exec /run/current-system/sw/libexec/polkit-gnome-authentication-agent-1
+exec systemctl --user import-environment DBUS_SESSION_BUS_ADDRESS XDG_RUNTIME_DIR
+exec dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP
+exec bash -c '[ "$HOSTNAME" == sphere ] && cloudstation'
+exec swayrd
+exec xinput set-prop "PIXA3854:00 093A:0274 Touchpad" 365 1
+
+
+# pastebin
+exec wl-paste --primary -t text --watch clipman store
+bindsym $mod+p exec clipman pick -t "bemenu" --tool-args='-b --fn "$font" -l 10 $menucolor'

dotfiles/sway/status.toml

@@ -1,94 +1,83 @@
 [theme]
-name = "plain"
+theme = "plain"
 [theme.overrides]
-idle_bg = "#2d2a2e"
-idle_fg = "#eeeeee"
-info_bg = "#2d2a2e"
-info_fg = "#eeeeee"
-good_bg = "#2d2a2e"
-good_fg = "#a9dc76"
-warning_bg = "#2d2a2e"
-warning_fg = "#ffd866"
-critical_bg = "#2a2e38"
-critical_fg = "#ff665c"
-separator_bg = "#2d2a2e"
-separator_fg = "#555555"
+idle_bg = "#fafafa"
+idle_fg = "#000000"
+info_bg = "#fafafa"
+info_fg = "#000000"
+good_bg = "#fafafa"
+good_fg = "#000000"
+warning_bg = "#fafafa"
+warning_fg = "#908550"
+critical_bg = "#fafafa"
+critical_fg = "#e75544"
+separator_bg = "#fafafa"
+separator_fg = "#3c74f6"
 separator = "|"
 
+
 [icons]
-name = "none"
+icons = "none"
 [icons.overrides]
-bat = "  "
-bat_full = "  "
-bat_charging = "   "
-bat_discharging = "  "
-backlight_empty = "  "
-backlight_partial1 = "  "
-backlight_partial2 = "  "
-backlight_partial3 = "  "
-backlight_full = "  "
-volume_full = "  "
-volume_half = "  "
-volume_empty = "  "
-volume_muted= "MUTE"
-cogs = "  "
-memory_mem = "  "
-headphones = "  "
-net_wireless = " "
+backlight = [
+  "󰌶",
+  "󱩏",
+  "󱩒",
+  "󱩕",
+  "󰛨",
+]
+bat = [
+  "󱃍 ",
+  "󰁻",
+  "󰁾",
+  "󰂁",
+  "󰁹",
+]
+bat_charging = ""
+cogs = ""
+disk_drive = "󱛟"
+headphones = "  "
+memory_mem = "󰍛"
+net_down = "󰅛"
+net_up = "󰱓"
 net_vpn = " "
 net_wired = ""
-net_up = "UP"
-net_down = "DOWN"
-thermometer = "  "
-
+net_wireless = " 󰖩"
+thermometer = " 󰔏 "
+time = "󰥔"
+volume_muted = "󰖁 MUTE"
+volume = [
+  "",
+  "󰕾",
+  "",
+]
 
 [[block]]
 block = "net"
-device = "wg"
-ip = true
-ssid = false
-speed_up = false
-speed_down = false
-hide_inactive = true
-hide_missing = true
+device = "wlp166s0"
+format = " $icon $ip$frequency "
 
 [[block]]
-block = "net"
-device = "wlp3s0"
-ip = true
-ssid = true
-speed_up = false
-speed_down = false
-hide_inactive = true
-hide_missing = true
-
-[[block]]
-block = "temperature"
-collapsed = false
-interval = 10
-chip = "coretemp-isa-0000"
-format = "{min}..{max}°"
+block = "custom"
+command = '''echo " $(cat /sys/class/thermal/thermal_zone0/temp | head -c 2) °C"'''
 
 [[block]]
 block = "disk_space"
 path = "/"
-alias = " /"
 info_type = "available"
-unit = "GB"
+format = " $icon $available "
 interval = 20
 warning = 20.0
 alert = 10.0
 
 [[block]]
 block = "memory"
-display_type = "memory"
-format_mem = "{Mup}%"
-clickable = false
+format = " $icon $mem_used/$mem_total "
 
 [[block]]
 block = "load"
 interval = 1
-format = "{1m}"
+format = " $icon $1m "
 
 [[block]]
 block = "sound"
@@ -99,11 +88,23 @@ block = "backlight"
 
 [[block]]
 block = "battery"
-device = "BAT0"
+device = "BAT1"
 interval = 10
-format = "{percentage}%"
+format = " $icon $percentage ($time) "
+full_format = " $icon $percentage "
 
 [[block]]
 block = "time"
 interval = 60
-format = "%Y-%m-%d %H:%M"
+format = " $timestamp.datetime(f:'%Y-%m-%d %H:%M') "
+
+[[block]]
+block = "notify"
+driver = "swaync"
+format = " $icon {($notification_count.eng(w:1)) |}"
+[[block.click]]
+button = "left"
+action = "show"
+[[block.click]]
+button = "right"
+action = "toggle_paused"

dotfiles/wezterm.lua

@@ -0,0 +1,39 @@
+local wezterm = require 'wezterm';
+
+return {
+  audible_bell = "Disabled",
+  bold_brightens_ansi_colors = true,
+  color_scheme = "One Light (base16)",
+  enable_tab_bar = false,
+  enable_wayland = true,
+  font_size = 12,
+  font = wezterm.font("CaskaydiaCove Nerd Font"),
+  window_background_opacity = 0.97,
+  window_close_confirmation = 'NeverPrompt',
+  default_prog = { '/run/current-system/sw/bin/bash' },
+
+  keys = {
+    {
+      key = 'Escape',
+      mods = 'CTRL',
+      action = wezterm.action.QuickSelect,
+    },
+  },
+
+  window_padding = {
+    left = 0,
+    right = 0,
+    top = 0,
+    bottom = 0,
+  },
+
+  quick_select_patterns = {
+    '^([^ ]+) +(?:ClusterIP|Bound)',
+    '^([^ ]+) +(?:[0-9]+/[0-9]+)',
+    '^([^ ]+) +(?:[0-9]+ )',
+    '^([^ ]+) +(?:Opaque|kubernetes\\.io|helm\\.sh)',
+    '^([^ ]+) +(?:Active)',
+    '[^ ]+@[^ ]+.service',
+    'git push.*',
+  },
+}

hardware-configuration.nix

@@ -1,44 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, ... }:
-
-{
-  imports =
-    [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
-    ];
-
-  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
-  boot.initrd.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-
-  boot.initrd.luks.devices = {
-    swap = {
-      device = "/dev/disk/by-uuid/fe87a31c-7d0b-4073-98fc-fa825de77181";
-      allowDiscards = true;
-    };
-  };
-
-  fileSystems."/" =
-    { device = "tank/root/nixos";
-      fsType = "zfs";
-    };
-
-  fileSystems."/home" =
-    { device = "tank/home";
-      fsType = "zfs";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/0C2D-2799";
-      fsType = "vfat";
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/2ac33f61-0db5-4f94-8148-93f2166b2f29"; }
-    ];
-
-  nix.maxJobs = lib.mkDefault 4;
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-}

hardware/desktop.nix

@@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+let unstable = import <nixos-unstable> { config.allowUnfree = true; };
+in {
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules =
+    [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ "amdgpu" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "tank/root/nixos";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "tank/root/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/587C-36F9";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ ];
+
+  # custom
+  boot.extraModprobeConfig = ''
+    options snd_usb_audio device_setup=1
+  '';
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot.enable = true;
+  networking.hostId = "ef3a5d57";
+  networking.hostName = "home";
+  hardware.opengl.enable = true;
+}

hardware/framework.nix

@@ -0,0 +1,84 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+let
+  #nixkernel = import <nixos-kernel> {};
+in
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" "i915" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "workpool/nixos/root";
+      fsType = "zfs";
+    };
+
+  fileSystems."/home" =
+    { device = "workpool/nixos/home";
+      fsType = "zfs";
+    };
+
+  fileSystems."/var/lib/docker" =
+    { device = "workpool/nixos/docker";
+      fsType = "zfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/AA17-42AD";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/18ae41eb-e32e-46a3-9e22-3395c37782df"; }
+    ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp166s0.useDHCP = lib.mkDefault true;
+
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  # custom
+  boot.loader.systemd-boot.enable = true;
+  networking.hostId = "f0000001";
+  networking.hostName = "sphere";
+  services.tlp.enable = true;
+  services.hardware.bolt.enable = true;
+
+  # framework hardware
+  #boot.kernelPackages = nixkernel.linuxPackages_5_19;
+  #boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+  boot.kernelParams = [
+    "mem_sleep_default=deep"
+    "nvme.noacpi=1"
+    "i915.enable_psr=1"
+  ];
+  boot.blacklistedKernelModules = [ "hid-sensor-hub" ];
+  hardware.acpilight.enable = true;
+  services.xserver.dpi = 125;
+  environment.variables = {
+    VDPAU_DRIVER = lib.mkIf config.hardware.opengl.enable (lib.mkDefault "va_gl");
+  };
+  hardware.graphics.extraPackages = with pkgs; [
+    vaapiIntel
+    libvdpau-va-gl
+    intel-media-driver
+  ];
+  services.tlp.settings = {
+    CPU_ENERGY_PERF_POLICY_ON_AC = "performance";
+    CPU_ENERGY_PERF_POLICY_ON_BAT = "performance";
+  };
+}

hardware/vison14.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+let
+  tuxedo-keyboard =
+    pkgs.callPackage (import ../packages/tuxedo-keyboard.nix) { };
+  tuxedo-cc =
+    pkgs.callPackage (import ../packages/tuxedo-control-center/default.nix) { };
+in {
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules =
+    [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ tuxedo-keyboard ];
+  environment.systemPackages = with pkgs; [ tuxedo-cc ];
+
+  fileSystems."/" = {
+    device = "private/root/nixos";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "private/root/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/tmp" = {
+    device = "private/root/tmp";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/7E36-C774";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ ];
+
+  nix.maxJobs = lib.mkDefault 8;
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+
+  # custom
+  boot.loader.systemd-boot.enable = true;
+  hardware.cpu.intel.updateMicrocode = true;
+  networking.hostId = "eff291c7";
+  networking.hostName = "ds9";
+  services.tlp.enable = true;
+}

hardware/x220-discovery.nix

@@ -0,0 +1,50 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, ... }:
+
+let unstable = import <nixos-unstable> { config.allowUnfree = true; };
+in {
+  imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ehci_pci"
+    "ahci"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "cube/root/nixos";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "cube/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/2AD7-4F18";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ ];
+
+  nix.maxJobs = lib.mkDefault 4;
+  powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
+
+  # custom
+  boot.loader.systemd-boot.enable = true;
+  networking.hostId = "ef3a5d57";
+  networking.hostName = "discovery";
+  powerManagement.powertop.enable = true;
+  services.tlp.enable = true;
+
+}

hardware/x360-raven.nix

@@ -0,0 +1,58 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, ... }:
+
+let unstable = import <nixos-unstable> { config.allowUnfree = true; };
+in {
+  imports = [
+    <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
+    <nixos-hardware/common/cpu/amd>
+    <nixos-hardware/common/pc/laptop/acpi_call.nix>
+    <nixos-hardware/common/pc/laptop/ssd>
+  ];
+
+  services.tlp.enable = true;
+  powerManagement.powertop.enable = true;
+  systemd.tmpfiles.rules = [
+    "w /sys/class/drm/card0/device/power_dpm_force_performance_level - - - - low"
+  ];
+
+  boot.initrd.availableKernelModules =
+    [ "nvme" "xhci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelParams = [ "amdgpu.dpm=1" ];
+  #boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.kernelPackages = unstable.linuxPackages_latest;
+  #boot.kernelPackages = unstable.linux_testing;
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "raven";
+  networking.hostId = "e3a397c5";
+
+  networking.interfaces.wlo1.useDHCP = true;
+  networking.resolvconf.useLocalResolver = true;
+
+  fileSystems."/" = {
+    device = "tank/root/nixos";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "tank/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/B048-FBC8";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ ];
+
+  nix.maxJobs = lib.mkDefault 8;
+}

hardware/xps15-sphere.nix

@@ -0,0 +1,64 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, ... }:
+
+let unstable = import <nixos-unstable> { config.allowUnfree = true; };
+in {
+  imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
+
+  boot.extraModulePackages = [ ];
+  boot.initrd.availableKernelModules =
+    [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.kernelModules = [ "i915" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.kernelParams = [ "intel_pstate=active" ];
+  boot.extraModprobeConfig = ''
+    options snd_usb_audio device_setup=1
+  '';
+
+  nixpkgs.config.packageOverrides = pkgs: {
+    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
+  };
+  hardware.opengl = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver # LIBVA_DRIVER_NAME=iHD
+      vaapiIntel # LIBVA_DRIVER_NAME=i965
+      vaapiVdpau
+      libvdpau-va-gl
+    ];
+  };
+  environment.variables = {
+    VDPAU_DRIVER = lib.mkIf config.hardware.opengl.enable (lib.mkDefault "va_gl");
+  };
+
+  fileSystems."/" = {
+    device = "tank/work/nixos";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "tank/work/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/DC7B-5E2D";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ ];
+
+  nix.maxJobs = lib.mkDefault 12;
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+
+  # custom
+  boot.loader.systemd-boot.enable = true;
+  hardware.cpu.intel.updateMicrocode = true;
+  networking.hostId = "eff291c4";
+  networking.hostName = "sphere";
+  services.tlp.enable = true;
+  services.hardware.bolt.enable = true;
+
+}

modules/colors.nix

@@ -0,0 +1,48 @@
+{ config, lib, pkgs, ... }:
+
+with lib; {
+  options = {
+    colors = {
+      background = mkOption {
+        type = types.str;
+        default = "19181A";
+      };
+      foreground = mkOption {
+        type = types.str;
+        default = "FCFCFA";
+      };
+      black = mkOption {
+        type = types.str;
+        default = "19181A";
+      };
+      red = mkOption {
+        type = types.str;
+        default = "cc6666";
+      };
+      green = mkOption {
+        type = types.str;
+        default = "a9dc76";
+      };
+      yellow = mkOption {
+        type = types.str;
+        default = "ffd866";
+      };
+      cyan = mkOption {
+        type = types.str;
+        default = "78dce8";
+      };
+      magenta = mkOption {
+        type = types.str;
+        default = "FC9867";
+      };
+      blue = mkOption {
+        type = types.str;
+        default = "AB9DF2";
+      };
+      white = mkOption {
+        type = types.str;
+        default = "FCFCFA";
+      };
+    };
+  };
+}

packages/certmanager.nix

@@ -0,0 +1,28 @@
+with import <nixpkgs> { };
+
+stdenv.mkDerivation rec {
+  name = "cert-manager";
+  version = "v1.7.1";
+  src = fetchurl {
+    url =
+      "https://github.com/cert-manager/cert-manager/releases/download/${version}/cmctl-linux-amd64.tar.gz";
+    sha256 = "1z5n2rcfhrl1vm5vxqa1759m3prlv08mmg96n16p4gwkdxycznx4";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  unpackPhase = ''
+    tar xvpzf $src
+  '';
+
+  installPhase = ''
+    install -m 755 -D cmctl $out/bin/cmctl
+  '';
+
+  meta = with lib; {
+    homepage = "https://cert-manager.io";
+    description = "cert-manager CLI";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ foosinn ];
+  };
+}

packages/cloudstation.nix

@@ -0,0 +1,66 @@
+{ stdenv, buildFHSUserEnv, fetchurl, lib, pkgs, writeScript }:
+
+let
+  version = "4.3.3";
+  release = "4469";
+  cloudstation = stdenv.mkDerivation rec {
+    name = "cloudstation-unpack";
+    buildInputs = [ pkgs.dpkg pkgs.qt5.qtbase ];
+    src = fetchurl {
+      url =
+        "https://global.download.synology.com/download/Tools/CloudStationDrive/${version}-${release}/Ubuntu/Installer/x86_64/synology-cloud-station-drive-${release}.x86_64.deb";
+      sha256 = "0v84yb70knmmjzp7lyn6jgy5bnfsfd47wmqh29phybqg4zk3d47j";
+    };
+    unpackPhase = ''
+      dpkg-deb -x $src .
+    '';
+    installPhase = ''
+      mkdir -p $out/bin
+      cp -R opt/Synology/CloudStation/* $out/
+      ls -lah $out
+      chmod +x $out/lib/*
+      cp $out/lib/plugins/platforms/libqxcb.so $out/lib/plugins/
+
+      # fix xcb plugin
+      echo -e "[Paths]\nPlugins = ${pkgs.qt5.qtbase.bin}/${pkgs.qt5.qtbase.qtPluginPrefix}" > $out/bin/qt.conf
+    '';
+    dontWrapQtApps = true;
+  };
+
+in buildFHSUserEnv {
+  name = "cloudstation";
+
+  targetPkgs = pkgs:
+    with pkgs;
+    with xorg; [
+      cloudstation
+      curl
+      dbus
+      fontconfig
+      freetype
+      glib
+      libICE
+      libSM
+      libX11
+      libxcb
+      openssl
+      qt5.qtbase
+      qt5.qttools
+      qt5.qtwayland
+      qt5.qtx11extras
+      sqlite
+      stdenv.cc.cc.lib
+      xkeyboard_config
+      zlib
+    ];
+
+  runScript = writeScript "cloudstation" ''
+    #!/usr/bin/env bash
+    export QT_PLUGIN_PATH="${pkgs.qt5.qtbase.bin}/${pkgs.qt5.qtbase.qtPluginPrefix}"
+    export QT_QPA_PLATFORM=xcb
+    ${cloudstation}/bin/launcher
+
+    export LD_LIBRARY_PATH="/home/stefan/.CloudStation/CloudStation.app/lib:$LD_LIBRARY_PATH"
+    ~/.CloudStation/CloudStation.app/bin/cloud-drive-ui
+  '';
+}

packages/nagstamon.nix

@@ -0,0 +1,47 @@
+{ lib, fetchFromGitHub, python311Packages, wrapQtAppsHook, pkgs }:
+
+let
+  pname = "nagstamon";
+  version = "v3.12.0";
+
+in python311Packages.buildPythonApplication rec {
+  inherit pname;
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "HenriWahl";
+    repo = "Nagstamon";
+    rev = version;
+    sha256 = "sha256-SI0FPTqJquaVyl/gpp883eGLq7tZ6J0fqn0jp77M8GM=";
+  };
+
+  doCheck = false;
+
+  nativeBuildInputs = [ wrapQtAppsHook ];
+  postFixup = ''
+    makeQtWrapper $out/bin/nagstamon.py $out/bin/nagstamon
+  '';
+
+  propagatedBuildInputs = [
+    python311Packages.beautifulsoup4
+    python311Packages.configparser
+    python311Packages.dateutil
+    python311Packages.keyring
+    python311Packages.lxml
+    python311Packages.psutil
+    python311Packages.pyqt5_with_qtmultimedia
+    python311Packages.requests
+    python311Packages.requests-kerberos
+    python311Packages.setuptools
+    python311Packages.xlib
+    pkgs.libsForQt5.qt5.qtwayland
+  ];
+
+  meta = with lib; {
+    description = "A status monitor for the desktop";
+    homepage = "https://nagstamon.ifw-dresden.de/";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ foosinn ];
+    inherit version;
+  };
+}

packages/neovim.nix

@@ -1,8 +1,12 @@
-with import <nixos-unstable> {};
+with import <nixos-unstable> { };
 
 neovim.override {
+  vimAlias = true;
+
   configure = {
     customRC = ''
+      source ${pkgs.fzf}/share/vim-plugins/fzf/plugin/fzf.vim
+
       set hidden
 
       " langserver
@@ -11,7 +15,7 @@ neovim.override {
         \ 'python': ['pyls'],
         \ 'rust': ['rust-analyzer'],
         \ }
-       
+
       " basic builtin
       set background=dark
       set shiftwidth=4
@@ -27,6 +31,7 @@ neovim.override {
       set relativenumber
       set mouse=a
       set shortmess+=c
+      set clipboard=unnamedplus
 
       " better search
       set incsearch
@@ -64,9 +69,10 @@ neovim.override {
       let g:which_key_map =  {}
 
       let g:which_key_map.f = { 'name': '+files' }
-      noremap <leader>ff :FZF<cr>
-      noremap <leader>fc :saveas
-      
+      noremap <leader>ff :Files<cr>
+      noremap <leader>fn :NnnPicker %:p:h<cr>
+      noremap <leader>fc :saveas %:p:h
+
       let g:which_key_map.y = { 'name': '+yank' }
       noremap <leader>yp :read !wl-paste<cr>
       noremap <leader>yy :read !wl-paste<cr>
@@ -78,8 +84,9 @@ neovim.override {
       noremap <leader>bd :bd<cr>
       noremap <leader>bn :bn<cr>
       noremap <leader>bp :bp<cr>
-      
-      let g:which_key_map.b = { 'name': '+lang' }
+
+      let g:which_key_map.m = { 'name': '+lang' }
+      noremap <leader>md  :call LanguageClient_textDocument_codeAction()<cr>
       noremap <leader>mc  :call LanguageClient#textDocument_references()<cr>
       noremap <leader>mf  :call LanguageClient#textDocument_formatting()<cr>
       noremap <leader>mgg :call LanguageClient#textDocument_definition()<cr>
@@ -87,6 +94,11 @@ neovim.override {
       noremap <leader>mm  :call LanguageClient#textDocument_hover()<cr>
       noremap <leader>mr  :call LanguageClient#textDocument_rename()<cr>
       noremap <leader>ms  :call LanguageClient#workspace_symbol()<cr>
+      noremap <leader>ma  :fzf_lsp_action<cr>
+      noremap <leader>ml  :fzf_lsp_layout<cr>
+
+      let g:which_key_map.g = { 'name': '+git' }
+      noremap <leader>gs :call LazyGit<cr>
 
       " lang specifics
       let g:rustfmt_autosave = 1
@@ -98,10 +110,13 @@ neovim.override {
         airline
         easymotion
         editorconfig-vim
-        fugitive
-        fzf
+        fzf-lsp-nvim
+        fzf-vim
+        fzfWrapper
         LanguageClient-neovim
+        lazygit-nvim
         ncm2
+        nnn-vim
         surround
         syntastic
         vim-addon-nix

packages/notcoal/Cargo.lock.patch

@@ -0,0 +1,549 @@
+diff --git a/Cargo.lock b/Cargo.lock
+new file mode 100644
+index 0000000..a7de0d9
+--- /dev/null
++++ b/Cargo.lock
+@@ -0,0 +1,543 @@
++# This file is automatically @generated by Cargo.
++# It is not intended for manual editing.
++version = 3
++
++[[package]]
++name = "aho-corasick"
++version = "0.7.18"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
++dependencies = [
++ "memchr",
++]
++
++[[package]]
++name = "ansi_term"
++version = "0.12.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
++dependencies = [
++ "winapi",
++]
++
++[[package]]
++name = "arrayref"
++version = "0.3.6"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "a4c527152e37cf757a3f78aae5a06fbeefdb07ccc535c980a3208ee3060dd544"
++
++[[package]]
++name = "arrayvec"
++version = "0.5.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
++
++[[package]]
++name = "atty"
++version = "0.2.14"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
++dependencies = [
++ "hermit-abi",
++ "libc",
++ "winapi",
++]
++
++[[package]]
++name = "base64"
++version = "0.9.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "489d6c0ed21b11d038c31b6ceccca973e65d73ba3bd8ecb9a2babf5546164643"
++dependencies = [
++ "byteorder",
++ "safemem",
++]
++
++[[package]]
++name = "base64"
++version = "0.13.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "904dfeac50f3cdaba28fc6f57fdcddb75f49ed61346676a78c4ffe55877802fd"
++
++[[package]]
++name = "bitflags"
++version = "1.3.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
++
++[[package]]
++name = "blake2b_simd"
++version = "0.5.11"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "afa748e348ad3be8263be728124b24a24f268266f6f5d58af9d75f6a40b5c587"
++dependencies = [
++ "arrayref",
++ "arrayvec",
++ "constant_time_eq",
++]
++
++[[package]]
++name = "byteorder"
++version = "1.4.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
++
++[[package]]
++name = "cfg-if"
++version = "1.0.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
++
++[[package]]
++name = "clap"
++version = "2.34.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
++dependencies = [
++ "ansi_term",
++ "atty",
++ "bitflags",
++ "strsim",
++ "textwrap",
++ "unicode-width",
++ "vec_map",
++]
++
++[[package]]
++name = "constant_time_eq"
++version = "0.1.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
++
++[[package]]
++name = "crossbeam-utils"
++version = "0.8.7"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b5e5bed1f1c269533fa816a0a5492b3545209a205ca1a54842be180eb63a16a6"
++dependencies = [
++ "cfg-if",
++ "lazy_static",
++]
++
++[[package]]
++name = "dirs"
++version = "1.0.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3fd78930633bd1c6e35c4b42b1df7b0cbc6bc191146e512bb3bedf243fcc3901"
++dependencies = [
++ "libc",
++ "redox_users",
++ "winapi",
++]
++
++[[package]]
++name = "encoding"
++version = "0.2.33"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "6b0d943856b990d12d3b55b359144ff341533e516d94098b1d3fc1ac666d36ec"
++dependencies = [
++ "encoding-index-japanese",
++ "encoding-index-korean",
++ "encoding-index-simpchinese",
++ "encoding-index-singlebyte",
++ "encoding-index-tradchinese",
++]
++
++[[package]]
++name = "encoding-index-japanese"
++version = "1.20141219.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "04e8b2ff42e9a05335dbf8b5c6f7567e5591d0d916ccef4e0b1710d32a0d0c91"
++dependencies = [
++ "encoding_index_tests",
++]
++
++[[package]]
++name = "encoding-index-korean"
++version = "1.20141219.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "4dc33fb8e6bcba213fe2f14275f0963fd16f0a02c878e3095ecfdf5bee529d81"
++dependencies = [
++ "encoding_index_tests",
++]
++
++[[package]]
++name = "encoding-index-simpchinese"
++version = "1.20141219.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d87a7194909b9118fc707194baa434a4e3b0fb6a5a757c73c3adb07aa25031f7"
++dependencies = [
++ "encoding_index_tests",
++]
++
++[[package]]
++name = "encoding-index-singlebyte"
++version = "1.20141219.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3351d5acffb224af9ca265f435b859c7c01537c0849754d3db3fdf2bfe2ae84a"
++dependencies = [
++ "encoding_index_tests",
++]
++
++[[package]]
++name = "encoding-index-tradchinese"
++version = "1.20141219.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "fd0e20d5688ce3cab59eb3ef3a2083a5c77bf496cb798dc6fcdb75f323890c18"
++dependencies = [
++ "encoding_index_tests",
++]
++
++[[package]]
++name = "encoding_index_tests"
++version = "0.1.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "a246d82be1c9d791c5dfde9a2bd045fc3cbba3fa2b11ad558f27d01712f00569"
++
++[[package]]
++name = "getrandom"
++version = "0.1.16"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
++dependencies = [
++ "cfg-if",
++ "libc",
++ "wasi",
++]
++
++[[package]]
++name = "heck"
++version = "0.3.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
++dependencies = [
++ "unicode-segmentation",
++]
++
++[[package]]
++name = "hermit-abi"
++version = "0.1.19"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
++dependencies = [
++ "libc",
++]
++
++[[package]]
++name = "itoa"
++version = "1.0.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1aab8fc367588b89dcee83ab0fd66b72b50b72fa1904d7095045ace2b0c81c35"
++
++[[package]]
++name = "lazy_static"
++version = "1.4.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
++
++[[package]]
++name = "libc"
++version = "0.2.119"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "1bf2e165bb3457c8e098ea76f3e3bc9db55f87aa90d52d0e6be741470916aaa4"
++
++[[package]]
++name = "mailparse"
++version = "0.6.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "99c0af7aaefb167bb908763399ea2904dab08ca4fd8c2a3277516d4e488b5fe3"
++dependencies = [
++ "base64 0.9.3",
++ "encoding",
++ "quoted_printable",
++]
++
++[[package]]
++name = "memchr"
++version = "2.4.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
++
++[[package]]
++name = "notcoal"
++version = "0.3.0"
++dependencies = [
++ "dirs",
++ "mailparse",
++ "notmuch",
++ "regex",
++ "rust-ini",
++ "serde",
++ "serde_json",
++ "structopt",
++]
++
++[[package]]
++name = "notmuch"
++version = "0.5.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "831623c1b68968505126423f34dc887aa610daf543efc05df948c673e4e022e9"
++dependencies = [
++ "libc",
++ "supercow",
++]
++
++[[package]]
++name = "proc-macro2"
++version = "0.4.30"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "cf3d2011ab5c909338f7887f4fc896d35932e29146c12c8d01da6b22a80ba759"
++dependencies = [
++ "unicode-xid 0.1.0",
++]
++
++[[package]]
++name = "proc-macro2"
++version = "1.0.36"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "c7342d5883fbccae1cc37a2353b09c87c9b0f3afd73f5fb9bba687a1f733b029"
++dependencies = [
++ "unicode-xid 0.2.2",
++]
++
++[[package]]
++name = "quote"
++version = "0.6.13"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "6ce23b6b870e8f94f81fb0a363d65d86675884b34a09043c81e5562f11c1f8e1"
++dependencies = [
++ "proc-macro2 0.4.30",
++]
++
++[[package]]
++name = "quote"
++version = "1.0.15"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "864d3e96a899863136fc6e99f3d7cae289dafe43bf2c5ac19b70df7210c0a145"
++dependencies = [
++ "proc-macro2 1.0.36",
++]
++
++[[package]]
++name = "quoted_printable"
++version = "0.4.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3fee2dce59f7a43418e3382c766554c614e06a552d53a8f07ef499ea4b332c0f"
++
++[[package]]
++name = "redox_syscall"
++version = "0.1.57"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
++
++[[package]]
++name = "redox_users"
++version = "0.3.5"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "de0737333e7a9502c789a36d7c7fa6092a49895d4faa31ca5df163857ded2e9d"
++dependencies = [
++ "getrandom",
++ "redox_syscall",
++ "rust-argon2",
++]
++
++[[package]]
++name = "regex"
++version = "1.5.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
++dependencies = [
++ "aho-corasick",
++ "memchr",
++ "regex-syntax",
++]
++
++[[package]]
++name = "regex-syntax"
++version = "0.6.25"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
++
++[[package]]
++name = "rust-argon2"
++version = "0.8.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "4b18820d944b33caa75a71378964ac46f58517c92b6ae5f762636247c09e78fb"
++dependencies = [
++ "base64 0.13.0",
++ "blake2b_simd",
++ "constant_time_eq",
++ "crossbeam-utils",
++]
++
++[[package]]
++name = "rust-ini"
++version = "0.13.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3e52c148ef37f8c375d49d5a73aa70713125b7f19095948a923f80afdeb22ec2"
++
++[[package]]
++name = "ryu"
++version = "1.0.9"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "73b4b750c782965c211b42f022f59af1fbceabdd026623714f104152f1ec149f"
++
++[[package]]
++name = "safemem"
++version = "0.3.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ef703b7cb59335eae2eb93ceb664c0eb7ea6bf567079d843e09420219668e072"
++
++[[package]]
++name = "serde"
++version = "1.0.136"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ce31e24b01e1e524df96f1c2fdd054405f8d7376249a5110886fb4b658484789"
++dependencies = [
++ "serde_derive",
++]
++
++[[package]]
++name = "serde_derive"
++version = "1.0.136"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "08597e7152fcd306f41838ed3e37be9eaeed2b61c42e2117266a554fab4662f9"
++dependencies = [
++ "proc-macro2 1.0.36",
++ "quote 1.0.15",
++ "syn 1.0.86",
++]
++
++[[package]]
++name = "serde_json"
++version = "1.0.79"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8e8d9fa5c3b304765ce1fd9c4c8a3de2c8db365a5b91be52f186efc675681d95"
++dependencies = [
++ "itoa",
++ "ryu",
++ "serde",
++]
++
++[[package]]
++name = "strsim"
++version = "0.8.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
++
++[[package]]
++name = "structopt"
++version = "0.2.18"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "16c2cdbf9cc375f15d1b4141bc48aeef444806655cd0e904207edc8d68d86ed7"
++dependencies = [
++ "clap",
++ "structopt-derive",
++]
++
++[[package]]
++name = "structopt-derive"
++version = "0.2.18"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "53010261a84b37689f9ed7d395165029f9cc7abb9f56bbfe86bee2597ed25107"
++dependencies = [
++ "heck",
++ "proc-macro2 0.4.30",
++ "quote 0.6.13",
++ "syn 0.15.44",
++]
++
++[[package]]
++name = "supercow"
++version = "0.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "171758edb47aa306a78dfa4ab9aeb5167405bd4e3dc2b64e88f6a84bbe98bd63"
++
++[[package]]
++name = "syn"
++version = "0.15.44"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "9ca4b3b69a77cbe1ffc9e198781b7acb0c7365a883670e8f1c1bc66fba79a5c5"
++dependencies = [
++ "proc-macro2 0.4.30",
++ "quote 0.6.13",
++ "unicode-xid 0.1.0",
++]
++
++[[package]]
++name = "syn"
++version = "1.0.86"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8a65b3f4ffa0092e9887669db0eae07941f023991ab58ea44da8fe8e2d511c6b"
++dependencies = [
++ "proc-macro2 1.0.36",
++ "quote 1.0.15",
++ "unicode-xid 0.2.2",
++]
++
++[[package]]
++name = "textwrap"
++version = "0.11.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
++dependencies = [
++ "unicode-width",
++]
++
++[[package]]
++name = "unicode-segmentation"
++version = "1.9.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "7e8820f5d777f6224dc4be3632222971ac30164d4a258d595640799554ebfd99"
++
++[[package]]
++name = "unicode-width"
++version = "0.1.9"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
++
++[[package]]
++name = "unicode-xid"
++version = "0.1.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "fc72304796d0818e357ead4e000d19c9c174ab23dc11093ac919054d20a6a7fc"
++
++[[package]]
++name = "unicode-xid"
++version = "0.2.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
++
++[[package]]
++name = "vec_map"
++version = "0.8.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
++
++[[package]]
++name = "wasi"
++version = "0.9.0+wasi-snapshot-preview1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
++
++[[package]]
++name = "winapi"
++version = "0.3.9"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
++dependencies = [
++ "winapi-i686-pc-windows-gnu",
++ "winapi-x86_64-pc-windows-gnu",
++]
++
++[[package]]
++name = "winapi-i686-pc-windows-gnu"
++version = "0.4.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
++
++[[package]]
++name = "winapi-x86_64-pc-windows-gnu"
++version = "0.4.0"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

packages/notcoal/default.nix

@@ -0,0 +1,24 @@
+{ lib, stdenv, rustPlatform, fetchFromGitHub, pkgs }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "notcoal";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "eaon";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "19gaba6asid5vplcy9q0ama40dvwwxglc40ks5240lydrvgfrimq";
+  };
+
+  cargoPatches = [ ./Cargo.lock.patch ];
+  cargoSha256 = "09bmlpl6rx2pk5w6vv2i1lsl6vr1733zy9jjvi5kkk1mqwinq8ai";
+  cargoBuildFlags = [ "--features=standalone" ];
+
+  buildInputs = with pkgs; [ bash notmuch ];
+
+  meta = with lib; {
+    description = "An email tagger for notmuch";
+    homepage = "https://ghom.niij.org/eaon/notcoal";
+  };
+}

packages/oc311.nix

@@ -0,0 +1,28 @@
+with import <nixpkgs> { };
+
+stdenv.mkDerivation {
+  name = "oc311";
+  version = "3.11";
+  src = fetchurl {
+    url =
+      "https://github.com/openshift/origin/releases/download/v3.11.0/openshift-origin-client-tools-v3.11.0-0cbc58b-linux-64bit.tar.gz";
+    sha256 = "4b0f07428ba854174c58d2e38287e5402964c9a9355f6c359d1242efd0990da3";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  unpackPhase = ''
+    tar xvpzf $src --strip-components=1
+  '';
+
+  installPhase = ''
+    install -m 755 -D oc $out/bin/oc3
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.odk.io";
+    description = "openshift311 client";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ foosinn ];
+  };
+}

packages/oc46.nix

@@ -0,0 +1,28 @@
+with import <nixpkgs> { };
+
+stdenv.mkDerivation rec {
+  name = "oc46";
+  version = "4.6";
+  src = fetchurl {
+    url =
+      "https://github.com/openshift/okd/releases/download/4.6.0-0.okd-2021-02-14-205305/openshift-client-linux-4.6.0-0.okd-2021-02-14-205305.tar.gz";
+    sha256 = "741c456f1d5227eb40722b0dac328c78dceba5103fd306cf7fe57a9474eb3d35";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  unpackPhase = ''
+    tar xvpzf $src
+  '';
+
+  installPhase = ''
+    install -m 755 -D oc $out/bin/oc
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.odk.io";
+    description = "openshift 4.6 client";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ foosinn ];
+  };
+}

packages/openscad-language-server.nix

@@ -0,0 +1,23 @@
+{ pkgs, lib, rustPlatform }:
+
+let
+  pname = "openscad-language-server";
+  version = "0.1.0";
+  src = pkgs.fetchFromGitHub {
+    owner = "dzhu";
+    repo = pname;
+    rev = version;
+    sha256 = "00msajwwy531ji93xk83lbnbp19asyk1b8ai0hi2awb63vpdr4xg";
+  };
+in
+rustPlatform.buildRustPackage {
+  inherit pname;
+  inherit version;
+  inherit src;
+
+  cargoSha256 = "0w245d5n0v8b02y0rc1lqx1svi9dnif4gvsas46h9g68206yijcf";
+
+  meta = with lib; {
+    description = "openscad language server";
+  };
+}

packages/openshift-install-4.5.nix

@@ -0,0 +1,29 @@
+with import <nixpkgs> { };
+
+stdenv.mkDerivation rec {
+  name = "openshift-install-4.5";
+  version = "4.5.0-0";
+  release = "2020-10-03-012432";
+  src = fetchurl {
+    url =
+      "https://github.com/openshift/okd/releases/download/${version}.okd-${release}/openshift-install-linux-${version}.okd-${release}.tar.gz";
+    sha256 = "f497193e8918840a4fd3267839affdc91ec166c5fd2ae3fdc64f498b5fc56f55";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  unpackPhase = ''
+    tar xvpzf $src
+  '';
+
+  installPhase = ''
+    install -m 755 -D openshift-install $out/bin/openshift-install
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.odk.io";
+    description = "openshift 4.5 installer";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ foosinn ];
+  };
+}

packages/skaffold.nix

@@ -0,0 +1,30 @@
+with import <nixpkgs> { };
+
+stdenv.mkDerivation rec {
+  name = "skaffold";
+  version = "1.17.2";
+  src = fetchurl {
+    url =
+      "https://github.com/GoogleContainerTools/skaffold/releases/download/v${version}/skaffold-linux-amd64";
+    sha256 = "55dea8be16fa3abd81820a6a03f5d708beb5e152fe71e00f00744a4dd321c55a";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  unpackPhase = ''
+    cp $src skaffold
+  '';
+
+  installPhase = ''
+    install -m 755 -D skaffold $out/bin/skaffold
+    echo $out/bin/skaffold
+    ls -lah $out/bin/skaffold
+  '';
+
+  meta = with lib; {
+    homepage = "https://skaffold.dev";
+    description = "skaffold";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ foosinn ];
+  };
+}

packages/tuxedo-cc.nix

@@ -0,0 +1,94 @@
+{ lib, stdenv, makeWrapper, fetchurl, rpmextract, autoPatchelfHook, alsa-lib
+, cups, gdk-pixbuf, glib, gtk3, libnotify, libuuid, libX11, libXScrnSaver
+, libXcomposite, libXcursor, libXdamage, libXext, libXfixes, libXi, libXrandr
+, libXrender, libXtst, libxcb, libxshmfence, mesa, nspr, nss, pango, systemd
+, libappindicator-gtk3, libdbusmenu
+
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tuxedo-control-center";
+  version = "1.1.0";
+
+  src = fetchurl {
+    url =
+      "https://rpm.tuxedocomputers.com/opensuse/15.2/x86_64/tuxedo-control-center_${version}.rpm";
+    sha256 = "0rqhfi1slnh0kkn1vnxqynxm6yb4w1mhk4vi92vj0lrxlwdxf80c";
+  };
+
+  nativeBuildInputs = [
+    rpmextract
+    makeWrapper
+    alsa-lib
+    autoPatchelfHook
+    cups
+    libXdamage
+    libX11
+    libXScrnSaver
+    libXtst
+    libxshmfence
+    mesa
+    nss
+    libXrender
+    gdk-pixbuf
+    gtk3
+    systemd
+  ];
+
+  libPath = lib.makeLibraryPath [
+    alsa-lib
+    gdk-pixbuf
+    glib
+    gtk3
+    libnotify
+    libX11
+    libXcomposite
+    libuuid
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXrandr
+    libXrender
+    libXtst
+    nspr
+    nss
+    libxcb
+    pango
+    systemd
+    libXScrnSaver
+    libappindicator-gtk3
+    libdbusmenu
+  ];
+
+  unpackPhase = ''
+    mkdir -p $out/bin
+    cd $out
+    rpmextract $src
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    #wrapProgram $out/opt/${pname}/${pname} \
+    #    --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/${pname}
+
+    #wrapProgram $out/opt/${pname}/resources/dist/${pname}/data/service/tccd \
+    #    --prefix LD_LIBRARY_PATH : ${libPath}:$out/opt/${pname}
+
+    ln -s $out/opt/${pname}/${pname} $out/bin/
+    ln -s $out/opt/${pname}/resources/dist/${pname}/data/service/tccd $out/bin/
+    find $out
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description =
+      "A tool to help you control performance, energy, fan and comfort settings on TUXEDO laptops.";
+    homepage = "github.com/tuxedocomputers/tuxedo-control-center";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ];
+  };
+}

packages/tuxedo-control-center/default.nix

@@ -0,0 +1,157 @@
+{ pkgs, lib, stdenv, makeDesktopItem, desktop-file-utils,
+
+python,
+
+makeWrapper, nodejs, electron_9, fetchFromGitHub }:
+
+let
+  baseName = "tuxedo-control-center";
+  version = "1.0.14";
+
+  baseNodePackages = (import ./node-composition.nix {
+    inherit pkgs nodejs;
+    inherit (stdenv.hostPlatform) system;
+  });
+
+  nodePackages = baseNodePackages.package.override {
+    src = fetchFromGitHub {
+      owner = "tuxedocomputers";
+      repo = "tuxedo-control-center";
+      rev = "v${version}";
+      sha256 = "00gpsvjbli9f6vj31lbs7flmcz215r91iz6rg1kbzklc3y5k2ifj";
+    };
+
+    # Electron tries to download itself if this isn't set. We don't
+    # like that in nix so let's prevent it.
+    #
+    # This means we have to provide our own electron binaries when
+    # wrapping this program.
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+
+    # Angular prompts for analytics, which in turn fails the build.
+    #
+    # We can disable analytics using false or empty string
+    # (See https://github.com/angular/angular-cli/blob/1a39c5202a6fe159f8d7db85a1c186176240e437/packages/angular/cli/models/analytics.ts#L506)
+    NG_CLI_ANALYTICS = "false";
+  };
+
+  desktopItem = makeDesktopItem {
+    name = "tuxedo-control-center";
+    exec = "tuxedo-control-center %U";
+    comment = "An application helping you to tune your TUXEDO";
+    desktopName = "TUXEDO Control Center";
+    icon = "tuxedo-control-center";
+    categories = "System;";
+  };
+
+in stdenv.mkDerivation rec {
+  name = "${baseName}-${version}";
+  src = "${nodePackages}/lib/node_modules/tuxedo-control-center/";
+
+  nativeBuildInputs = [
+    desktop-file-utils # for desktop-file-validate
+  ];
+
+  buildInputs = [
+    nodejs
+    makeWrapper
+
+    # For node-gyp
+    python
+  ];
+
+  # TCC by default writes its config to /etc/tcc, which is
+  # inconvenient. Change this to a more standard location.
+  #
+  # It also hardcodes binary path.
+  postPatch = ''
+    substituteInPlace src/common/classes/TccPaths.ts \
+      --replace "/etc/tcc" "/var/lib/tcc" \
+      --replace "/opt/tuxedo-control-center/resources/dist/tuxedo-control-center/data/service/tccd" "$out/bin/tccd"
+  '';
+
+  buildPhase = ''
+    set -x
+    # We already have `node_modules` in the current directory but we
+    # need it's binaries on `PATH` so we can use them!
+    export PATH="./node_modules/.bin:$PATH"
+
+    # Prevent npm from checking for updates
+    export NO_UPDATE_NOTIFIER=true
+
+    # The order of `npm` commands matches what `npm run build-prod` does but we split
+    # it out so we can customise the native builds in `npm run build-service`.
+    npm run clean
+    npm run build-electron
+
+    # We don't use `npm run build-service` here because it uses `pkg` which packages
+    # node binaries in a way unsuitable for nix. Instead we're doing it ourself.
+    tsc -p ./src/service-app
+    cp ./src/package.json ./dist/tuxedo-control-center/service-app/package.json
+
+    # We need to tell npm where to find node or `node-gyp` will try to download it.
+    # This also _needs_ to be lowercase or `npm` won't detect it
+    export npm_config_nodedir=${nodejs}
+    npm run build-native   # Builds to ./build/Release/TuxedoIOAPI.node
+
+    npm run build-ng-prod
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp -R ./dist/tuxedo-control-center/* $out
+
+    ln -s $src/node_modules $out/node_modules
+
+    # Parts of the code expect the icons to live under `data/dist-data`. Let's just
+    # copy the whole thing since the system assumes it has access to all the `dist-data`
+    # files.
+    mkdir -p $out/data/dist-data
+    cp -R ./src/dist-data/* $out/data/dist-data/
+
+    # Install `tccd`
+    mkdir -p $out/data/service
+    cp ./build/Release/TuxedoIOAPI.node $out/data/service/TuxedoIOAPI.node
+    makeWrapper ${nodejs}/bin/node $out/data/service/tccd \
+                --add-flags "$out/service-app/service-app/main.js" \
+                --prefix NODE_PATH : $out/data/service \
+                --prefix NODE_PATH : $out/node_modules
+    mkdir -p $out/bin
+    ln -s $out/data/service/tccd $out/bin/tccd
+
+    # Install `tuxedo-control-center`
+    #
+    # We use `--no-tccd-version-check` because the app uses the electron context
+    # to determine the app version, but the electron context is wrong if electron
+    # is invoked directly on a JavaScript file.
+    #
+    # The fix is to run electron on a folder with a `package.json` but the `tuxedo-control-center`
+    # package.json expects all files to live under `dist/` and I'm not a huge fan of that
+    # structure so we just disable the check and call it a day.
+    makeWrapper ${electron_9}/bin/electron $out/bin/tuxedo-control-center \
+                --add-flags "$out/e-app/e-app/main.js" \
+                --add-flags "--no-tccd-version-check" \
+                --prefix NODE_PATH : $out/node_modules
+
+    mkdir -p $out/share/polkit-1/actions/
+    cp $out/data/dist-data/de.tuxedocomputers.tcc.policy $out/share/polkit-1/actions/de.tuxedocomputers.tcc.policy
+
+    mkdir -p $out/etc/dbus-1/system.d/
+    cp $out/data/dist-data/com.tuxedocomputers.tccd.conf $out/etc/dbus-1/system.d/com.tuxedocomputers.tccd.conf
+
+    # Put our icons in the right spot
+    mkdir -p $out/share/icons/hicolor/scalable/apps/
+    cp $out/data/dist-data/tuxedo-control-center_256.svg \
+       $out/share/icons/hicolor/scalable/apps/tuxedo-control-center.svg
+
+    ${desktopItem.buildCommand}
+  '';
+
+  meta = with lib; {
+    description = "Fan and power management GUI for Tuxedo laptops";
+    homepage = "https://github.com/tuxedocomputers/tuxedo-control-center/";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.blitz ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

packages/tuxedo-control-center/node-composition.nix

@@ -0,0 +1,16 @@
+# This file has been generated by node2nix 1.9.0. Do not edit!
+
+{ pkgs ? import <nixpkgs> { inherit system; }, system ? builtins.currentSystem
+, nodejs ? pkgs."nodejs-14_x" }:
+
+let
+  nodeEnv = import ./node-env.nix {
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit pkgs nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in import ./node-packages.nix {
+  inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
+  inherit nodeEnv;
+}
+

packages/tuxedo-control-center/node-env.nix

@@ -0,0 +1,559 @@
+# This file originates from node2nix
+
+{ lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile }:
+
+let
+  # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
+  utillinux = if pkgs ? utillinux then pkgs.utillinux else pkgs.util-linux;
+
+  python = if nodejs ? python then nodejs.python else python2;
+
+  # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
+  tarWrapper = runCommand "tarWrapper" { } ''
+    mkdir -p $out/bin
+
+    cat > $out/bin/tar <<EOF
+    #! ${stdenv.shell} -e
+    $(type -p tar) "\$@" --warning=no-unknown-keyword --delay-directory-restore
+    EOF
+
+    chmod +x $out/bin/tar
+  '';
+
+  # Function that generates a TGZ file from a NPM project
+  buildNodeSourceDist = { name, version, src, ... }:
+
+    stdenv.mkDerivation {
+      name = "node-tarball-${name}-${version}";
+      inherit src;
+      buildInputs = [ nodejs ];
+      buildPhase = ''
+        export HOME=$TMPDIR
+        tgzFile=$(npm pack | tail -n 1) # Hooks to the pack command will add output (https://docs.npmjs.com/misc/scripts)
+      '';
+      installPhase = ''
+        mkdir -p $out/tarballs
+        mv $tgzFile $out/tarballs
+        mkdir -p $out/nix-support
+        echo "file source-dist $out/tarballs/$tgzFile" >> $out/nix-support/hydra-build-products
+      '';
+    };
+
+  includeDependencies = { dependencies }:
+    lib.optionalString (dependencies != [ ]) (lib.concatMapStrings
+      (dependency: ''
+        # Bundle the dependencies of the package
+        mkdir -p node_modules
+        cd node_modules
+
+        # Only include dependencies if they don't exist. They may also be bundled in the package.
+        if [ ! -e "${dependency.name}" ]
+        then
+            ${composePackage dependency}
+        fi
+
+        cd ..
+      '') dependencies);
+
+  # Recursively composes the dependencies of a package
+  composePackage = { name, packageName, src, dependencies ? [ ], ... }@args:
+    builtins.addErrorContext "while evaluating node package '${packageName}'" ''
+      DIR=$(pwd)
+      cd $TMPDIR
+
+      unpackFile ${src}
+
+      # Make the base dir in which the target dependency resides first
+      mkdir -p "$(dirname "$DIR/${packageName}")"
+
+      if [ -f "${src}" ]
+      then
+          # Figure out what directory has been unpacked
+          packageDir="$(find . -maxdepth 1 -type d | tail -1)"
+
+          # Restore write permissions to make building work
+          find "$packageDir" -type d -exec chmod u+x {} \;
+          chmod -R u+w "$packageDir"
+
+          # Move the extracted tarball into the output folder
+          mv "$packageDir" "$DIR/${packageName}"
+      elif [ -d "${src}" ]
+      then
+          # Get a stripped name (without hash) of the source directory.
+          # On old nixpkgs it's already set internally.
+          if [ -z "$strippedName" ]
+          then
+              strippedName="$(stripHash ${src})"
+          fi
+
+          # Restore write permissions to make building work
+          chmod -R u+w "$strippedName"
+
+          # Move the extracted directory into the output folder
+          mv "$strippedName" "$DIR/${packageName}"
+      fi
+
+      # Unset the stripped name to not confuse the next unpack step
+      unset strippedName
+
+      # Include the dependencies of the package
+      cd "$DIR/${packageName}"
+      ${includeDependencies { inherit dependencies; }}
+      cd ..
+      ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
+    '';
+
+  pinpointDependencies = { dependencies, production }:
+    let
+      pinpointDependenciesFromPackageJSON = writeTextFile {
+        name = "pinpointDependencies.js";
+        text = ''
+          var fs = require('fs');
+          var path = require('path');
+
+          function resolveDependencyVersion(location, name) {
+              if(location == process.env['NIX_STORE']) {
+                  return null;
+              } else {
+                  var dependencyPackageJSON = path.join(location, "node_modules", name, "package.json");
+
+                  if(fs.existsSync(dependencyPackageJSON)) {
+                      var dependencyPackageObj = JSON.parse(fs.readFileSync(dependencyPackageJSON));
+
+                      if(dependencyPackageObj.name == name) {
+                          return dependencyPackageObj.version;
+                      }
+                  } else {
+                      return resolveDependencyVersion(path.resolve(location, ".."), name);
+                  }
+              }
+          }
+
+          function replaceDependencies(dependencies) {
+              if(typeof dependencies == "object" && dependencies !== null) {
+                  for(var dependency in dependencies) {
+                      var resolvedVersion = resolveDependencyVersion(process.cwd(), dependency);
+
+                      if(resolvedVersion === null) {
+                          process.stderr.write("WARNING: cannot pinpoint dependency: "+dependency+", context: "+process.cwd()+"\n");
+                      } else {
+                          dependencies[dependency] = resolvedVersion;
+                      }
+                  }
+              }
+          }
+
+          /* Read the package.json configuration */
+          var packageObj = JSON.parse(fs.readFileSync('./package.json'));
+
+          /* Pinpoint all dependencies */
+          replaceDependencies(packageObj.dependencies);
+          if(process.argv[2] == "development") {
+              replaceDependencies(packageObj.devDependencies);
+          }
+          replaceDependencies(packageObj.optionalDependencies);
+
+          /* Write the fixed package.json file */
+          fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
+        '';
+      };
+    in ''
+      node ${pinpointDependenciesFromPackageJSON} ${
+        if production then "production" else "development"
+      }
+
+      ${lib.optionalString (dependencies != [ ]) ''
+        if [ -d node_modules ]
+        then
+            cd node_modules
+            ${
+              lib.concatMapStrings
+              (dependency: pinpointDependenciesOfPackage dependency)
+              dependencies
+            }
+            cd ..
+        fi
+      ''}
+    '';
+
+  # Recursively traverses all dependencies of a package and pinpoints all
+  # dependencies in the package.json file to the versions that are actually
+  # being used.
+
+  pinpointDependenciesOfPackage =
+    { packageName, dependencies ? [ ], production ? true, ... }@args: ''
+      if [ -d "${packageName}" ]
+      then
+          cd "${packageName}"
+          ${pinpointDependencies { inherit dependencies production; }}
+          cd ..
+          ${
+            lib.optionalString (builtins.substring 0 1 packageName == "@")
+            "cd .."
+          }
+      fi
+    '';
+
+  # Extract the Node.js source code which is used to compile packages with
+  # native bindings
+  nodeSources = runCommand "node-sources" { } ''
+    tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
+    mv node-* $out
+  '';
+
+  # Script that adds _integrity fields to all package.json files to prevent NPM from consulting the cache (that is empty)
+  addIntegrityFieldsScript = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      function augmentDependencies(baseDir, dependencies) {
+          for(var dependencyName in dependencies) {
+              var dependency = dependencies[dependencyName];
+
+              // Open package.json and augment metadata fields
+              var packageJSONDir = path.join(baseDir, "node_modules", dependencyName);
+              var packageJSONPath = path.join(packageJSONDir, "package.json");
+
+              if(fs.existsSync(packageJSONPath)) { // Only augment packages that exist. Sometimes we may have production installs in which development dependencies can be ignored
+                  console.log("Adding metadata fields to: "+packageJSONPath);
+                  var packageObj = JSON.parse(fs.readFileSync(packageJSONPath));
+
+                  if(dependency.integrity) {
+                      packageObj["_integrity"] = dependency.integrity;
+                  } else {
+                      packageObj["_integrity"] = "sha1-000000000000000000000000000="; // When no _integrity string has been provided (e.g. by Git dependencies), add a dummy one. It does not seem to harm and it bypasses downloads.
+                  }
+
+                  if(dependency.resolved) {
+                      packageObj["_resolved"] = dependency.resolved; // Adopt the resolved property if one has been provided
+                  } else {
+                      packageObj["_resolved"] = dependency.version; // Set the resolved version to the version identifier. This prevents NPM from cloning Git repositories.
+                  }
+
+                  if(dependency.from !== undefined) { // Adopt from property if one has been provided
+                      packageObj["_from"] = dependency.from;
+                  }
+
+                  fs.writeFileSync(packageJSONPath, JSON.stringify(packageObj, null, 2));
+              }
+
+              // Augment transitive dependencies
+              if(dependency.dependencies !== undefined) {
+                  augmentDependencies(packageJSONDir, dependency.dependencies);
+              }
+          }
+      }
+
+      if(fs.existsSync("./package-lock.json")) {
+          var packageLock = JSON.parse(fs.readFileSync("./package-lock.json"));
+
+          if(![1, 2].includes(packageLock.lockfileVersion)) {
+             process.stderr.write("Sorry, I only understand lock file versions 1 and 2!\n");
+             process.exit(1);
+          }
+
+          if(packageLock.dependencies !== undefined) {
+              augmentDependencies(".", packageLock.dependencies);
+          }
+      }
+    '';
+  };
+
+  # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
+  reconstructPackageLock = writeTextFile {
+    name = "addintegrityfields.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      var packageObj = JSON.parse(fs.readFileSync("package.json"));
+
+      var lockObj = {
+          name: packageObj.name,
+          version: packageObj.version,
+          lockfileVersion: 1,
+          requires: true,
+          dependencies: {}
+      };
+
+      function augmentPackageJSON(filePath, dependencies) {
+          var packageJSON = path.join(filePath, "package.json");
+          if(fs.existsSync(packageJSON)) {
+              var packageObj = JSON.parse(fs.readFileSync(packageJSON));
+              dependencies[packageObj.name] = {
+                  version: packageObj.version,
+                  integrity: "sha1-000000000000000000000000000=",
+                  dependencies: {}
+              };
+              processDependencies(path.join(filePath, "node_modules"), dependencies[packageObj.name].dependencies);
+          }
+      }
+
+      function processDependencies(dir, dependencies) {
+          if(fs.existsSync(dir)) {
+              var files = fs.readdirSync(dir);
+
+              files.forEach(function(entry) {
+                  var filePath = path.join(dir, entry);
+                  var stats = fs.statSync(filePath);
+
+                  if(stats.isDirectory()) {
+                      if(entry.substr(0, 1) == "@") {
+                          // When we encounter a namespace folder, augment all packages belonging to the scope
+                          var pkgFiles = fs.readdirSync(filePath);
+
+                          pkgFiles.forEach(function(entry) {
+                              if(stats.isDirectory()) {
+                                  var pkgFilePath = path.join(filePath, entry);
+                                  augmentPackageJSON(pkgFilePath, dependencies);
+                              }
+                          });
+                      } else {
+                          augmentPackageJSON(filePath, dependencies);
+                      }
+                  }
+              });
+          }
+      }
+
+      processDependencies("node_modules", lockObj.dependencies);
+
+      fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
+    '';
+  };
+
+  prepareAndInvokeNPM =
+    { packageName, bypassCache, reconstructLock, npmFlags, production }:
+    let
+      forceOfflineFlag = if bypassCache then
+        "--offline"
+      else
+        "--registry http://www.example.com";
+    in ''
+      # Pinpoint the versions of all dependencies to the ones that are actually being used
+      echo "pinpointing versions of dependencies..."
+      source $pinpointDependenciesScriptPath
+
+      # Patch the shebangs of the bundled modules to prevent them from
+      # calling executables outside the Nix store as much as possible
+      patchShebangs .
+
+      # Deploy the Node.js package by running npm install. Since the
+      # dependencies have been provided already by ourselves, it should not
+      # attempt to install them again, which is good, because we want to make
+      # it Nix's responsibility. If it needs to install any dependencies
+      # anyway (e.g. because the dependency parameters are
+      # incomplete/incorrect), it fails.
+      #
+      # The other responsibilities of NPM are kept -- version checks, build
+      # steps, postprocessing etc.
+
+      export HOME=$TMPDIR
+      cd "${packageName}"
+      runHook preRebuild
+
+      ${lib.optionalString bypassCache ''
+        ${lib.optionalString reconstructLock ''
+          if [ -f package-lock.json ]
+          then
+              echo "WARNING: Reconstruct lock option enabled, but a lock file already exists!"
+              echo "This will most likely result in version mismatches! We will remove the lock file and regenerate it!"
+              rm package-lock.json
+          else
+              echo "No package-lock.json file found, reconstructing..."
+          fi
+
+          node ${reconstructPackageLock}
+        ''}
+
+        node ${addIntegrityFieldsScript}
+      ''}
+
+      npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${
+        lib.optionalString production "--production"
+      } rebuild
+
+      if [ "''${dontNpmInstall-}" != "1" ]
+      then
+          # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
+          rm -f npm-shrinkwrap.json
+
+          npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${
+            lib.optionalString production "--production"
+          } install
+      fi
+    '';
+
+  # Builds and composes an NPM package including all its dependencies
+  buildNodePackage = { name, packageName, version, dependencies ? [ ]
+    , buildInputs ? [ ], production ? true, npmFlags ? ""
+    , dontNpmInstall ? false, bypassCache ? false, reconstructLock ? false
+    , preRebuild ? "", dontStrip ? true, unpackPhase ? "true"
+    , buildPhase ? "true", meta ? { }, ... }@args:
+
+    let
+      extraArgs = removeAttrs args [
+        "name"
+        "dependencies"
+        "buildInputs"
+        "dontStrip"
+        "dontNpmInstall"
+        "preRebuild"
+        "unpackPhase"
+        "buildPhase"
+        "meta"
+      ];
+    in stdenv.mkDerivation ({
+      name = "${name}-${version}";
+      buildInputs = [ tarWrapper python nodejs ]
+        ++ lib.optional (stdenv.isLinux) utillinux
+        ++ lib.optional (stdenv.isDarwin) libtool ++ buildInputs;
+
+      inherit nodejs;
+
+      inherit
+        dontStrip; # Stripping may fail a build for some package deployments
+      inherit dontNpmInstall preRebuild unpackPhase buildPhase;
+
+      compositionScript = composePackage args;
+      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+      passAsFile = [ "compositionScript" "pinpointDependenciesScript" ];
+
+      installPhase = ''
+        # Create and enter a root node_modules/ folder
+        mkdir -p $out/lib/node_modules
+        cd $out/lib/node_modules
+
+        # Compose the package and all its dependencies
+        source $compositionScriptPath
+
+        ${prepareAndInvokeNPM {
+          inherit packageName bypassCache reconstructLock npmFlags production;
+        }}
+
+        # Create symlink to the deployed executable folder, if applicable
+        if [ -d "$out/lib/node_modules/.bin" ]
+        then
+            ln -s $out/lib/node_modules/.bin $out/bin
+        fi
+
+        # Create symlinks to the deployed manual page folders, if applicable
+        if [ -d "$out/lib/node_modules/${packageName}/man" ]
+        then
+            mkdir -p $out/share
+            for dir in "$out/lib/node_modules/${packageName}/man/"*
+            do
+                mkdir -p $out/share/man/$(basename "$dir")
+                for page in "$dir"/*
+                do
+                    ln -s $page $out/share/man/$(basename "$dir")
+                done
+            done
+        fi
+
+        # Run post install hook, if provided
+        runHook postInstall
+      '';
+
+      meta = {
+        # default to Node.js' platforms
+        platforms = nodejs.meta.platforms;
+      } // meta;
+    } // extraArgs);
+
+  # Builds a node environment (a node_modules folder and a set of binaries)
+  buildNodeDependencies = { name, packageName, version, src, dependencies ? [ ]
+    , buildInputs ? [ ], production ? true, npmFlags ? ""
+    , dontNpmInstall ? false, bypassCache ? false, reconstructLock ? false
+    , dontStrip ? true, unpackPhase ? "true", buildPhase ? "true", ... }@args:
+
+    let extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
+    in stdenv.mkDerivation ({
+      name = "node-dependencies-${name}-${version}";
+
+      buildInputs = [ tarWrapper python nodejs ]
+        ++ lib.optional (stdenv.isLinux) utillinux
+        ++ lib.optional (stdenv.isDarwin) libtool ++ buildInputs;
+
+      inherit
+        dontStrip; # Stripping may fail a build for some package deployments
+      inherit dontNpmInstall unpackPhase buildPhase;
+
+      includeScript = includeDependencies { inherit dependencies; };
+      pinpointDependenciesScript = pinpointDependenciesOfPackage args;
+
+      passAsFile = [ "includeScript" "pinpointDependenciesScript" ];
+
+      installPhase = ''
+        mkdir -p $out/${packageName}
+        cd $out/${packageName}
+
+        source $includeScriptPath
+
+        # Create fake package.json to make the npm commands work properly
+        cp ${src}/package.json .
+        chmod 644 package.json
+        ${lib.optionalString bypassCache ''
+          if [ -f ${src}/package-lock.json ]
+          then
+              cp ${src}/package-lock.json .
+          fi
+        ''}
+
+        # Go to the parent folder to make sure that all packages are pinpointed
+        cd ..
+        ${lib.optionalString (builtins.substring 0 1 packageName == "@")
+        "cd .."}
+
+        ${prepareAndInvokeNPM {
+          inherit packageName bypassCache reconstructLock npmFlags production;
+        }}
+
+        # Expose the executables that were installed
+        cd ..
+        ${lib.optionalString (builtins.substring 0 1 packageName == "@")
+        "cd .."}
+
+        mv ${packageName} lib
+        ln -s $out/lib/node_modules/.bin $out/bin
+      '';
+    } // extraArgs);
+
+  # Builds a development shell
+  buildNodeShell = { name, packageName, version, src, dependencies ? [ ]
+    , buildInputs ? [ ], production ? true, npmFlags ? ""
+    , dontNpmInstall ? false, bypassCache ? false, reconstructLock ? false
+    , dontStrip ? true, unpackPhase ? "true", buildPhase ? "true", ... }@args:
+
+    let nodeDependencies = buildNodeDependencies args;
+    in stdenv.mkDerivation {
+      name = "node-shell-${name}-${version}";
+
+      buildInputs = [ python nodejs ] ++ lib.optional (stdenv.isLinux) utillinux
+        ++ buildInputs;
+      buildCommand = ''
+        mkdir -p $out/bin
+        cat > $out/bin/shell <<EOF
+        #! ${stdenv.shell} -e
+        $shellHook
+        exec ${stdenv.shell}
+        EOF
+        chmod +x $out/bin/shell
+      '';
+
+      # Provide the dependencies in a development shell through the NODE_PATH environment variable
+      inherit nodeDependencies;
+      shellHook = lib.optionalString (dependencies != [ ]) ''
+        export NODE_PATH=${nodeDependencies}/lib/node_modules
+        export PATH="${nodeDependencies}/bin:$PATH"
+      '';
+    };
+in {
+  buildNodeSourceDist = lib.makeOverridable buildNodeSourceDist;
+  buildNodePackage = lib.makeOverridable buildNodePackage;
+  buildNodeDependencies = lib.makeOverridable buildNodeDependencies;
+  buildNodeShell = lib.makeOverridable buildNodeShell;
+}

packages/tuxedo-keyboard.nix

@@ -0,0 +1,39 @@
+{ stdenv, lib, linuxPackages, fetchurl }:
+
+let
+  kernel = linuxPackages.kernel;
+  kernelDir = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+
+in stdenv.mkDerivation rec {
+  name = "tuxedo-keyboard";
+  version = "v3.0.8";
+
+  src = builtins.fetchGit {
+    url = "git://github.com/tuxedocomputers/tuxedo-keyboard";
+    ref = "refs/tags/${version}";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  buildPhase = ''
+    make KDIR='${kernelDir}' all
+  '';
+
+  installPhase = ''
+    install -v -D -m 644 \
+      -t "$out/lib/modules/${kernel.modDirVersion}/extra/" \
+      ./src/tuxedo_keyboard.ko \
+      ./src/clevo_wmi.ko \
+      ./src/tuxedo_io/tuxedo_io.ko \
+      ./src/clevo_acpi.ko
+
+    find -name '*.ko'
+    echo ${kernel.modDirVersion}
+  '';
+
+  meta = {
+    homepage =
+      "https://github.com/tuxedocomputers/tuxedo-keyboard/blob/master/Makefile";
+  };
+
+}

packages/vaultsink.nix

@@ -0,0 +1,24 @@
+with import <nixpkgs> { };
+
+stdenv.mkDerivation rec {
+  name = "vaultsink";
+  version = "0.1.8";
+  src = fetchurl {
+    url =
+      "https://github.com/cookiefactory/vault-sink/releases/download/v${version}/vault-sink-linux-amd64";
+    sha256 = "057799e7f907186993b591e3b2f743b69d7a9fed";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  installPhase = ''
+    install -m 755 -D vault-sink-linux-amd64 $out/bin/sink
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/cookiefactory/vault-sink";
+    description = "Vault Secret helper for yaml files";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ foosinn ];
+  };
+}

roles/admin.nix

@@ -1,46 +1,52 @@
-{ pkgs, options, ...}:
+{ pkgs, options, ... }:
 
-{
+let
+in {
   environment.systemPackages = with pkgs; [
+    cryptsetup
+    dnsutils
+    dogdns
+    k9s
+    kind
     kubectl
+    kubectx
+    kubeseal
+    nmap
+    pwgen
+    terraform
+    whois
+    ipcalc
 
-    # podman
-    conmon
+    argocd
+    kubernetes-helm
+    kustomize
+    pre-commit
+    terraform-ls
+    vault
+
+    docker-compose
     fuse-overlayfs
-    podman
-    podman-compose
-    runc
-    slirp4netns
+    qemu
+    virt-manager
+
+    (import ../packages/skaffold.nix)
+    (import ../packages/certmanager.nix)
   ];
 
-  users.users.stefan.subUidRanges = [{ startUid = 100000; count = 65536; }];
-  users.users.stefan.subGidRanges = [{ startGid = 100000; count = 65536; }];
-
-  environment.etc."containers/policy.json" = {
-    mode="0644";
-    text=''
-      {
-        "default": [
-          {
-            "type": "insecureAcceptAnything"
-          }
-        ],
-        "transports":
-          {
-            "docker-daemon":
-              {
-                "": [{"type":"insecureAcceptAnything"}]
-              }
-          }
-      }
-    '';
+  programs.bash.shellAliases = {
+    kx = "kubectx";
+    kns = "kubens";
   };
 
-  environment.etc."containers/registries.conf" = {
-    mode="0644";
-    text=''
-      [registries.search]
-      registries = ['docker.io', 'quay.io']
-    '';
+  virtualisation.docker = {
+    enable = true;
+    storageDriver = "zfs";
+  };
+  virtualisation.libvirtd = {
+    enable = true;
+    qemu = {
+      swtpm.enable = true;
+      ovmf.enable = true;
+    };
   };
 }

roles/base.nix

@@ -1,30 +1,55 @@
 { config, lib, pkgs, ... }:
 
-let
-  unstable = import <nixos-unstable> {};
+let unstable = import <nixos-unstable> { };
 in {
   environment.systemPackages = with pkgs; [
+    acpi
+    aspell
+    aspellDicts.de
+    aspellDicts.en
     bash
+    bash-completion
     bat
-    emacs-nox
-    fd 
+    borgbackup
+    curl
+    direnv
+    fd
+    file
     fzf
     git
     gnupg
     htop
     jq
+    mtr
     ncdu
+    nix-index
+    nload
+    nnn
+    ntfs3g
     openssl
+    patchelf
+    pv
+    restic
     ripgrep
+    starship
+    sysstat
+    tcpdump
     tmux
-    z-lua
-    unstable.starship
+    unzip
+    wget
+    zoxide
     (import ../packages/neovim.nix)
   ];
 
   environment = {
-    etc = {
-      "starship.toml".source = ../dotfiles/starship.toml;
+    etc = { "starship.toml".source = ../dotfiles/starship.toml; };
+
+    variables = {
+      BAT_THEME = "ansi";
+      EDITOR = "nvim";
+      STARSHIP_CONFIG = "/etc/starship.toml";
+      HISTCONTROL = "ignoreboth";
+      NIXOS_OZONE_WL = "y";
     };
   };
 
@@ -33,11 +58,18 @@ in {
       . <(starship init bash)
     '';
     interactiveShellInit = ''
-      export EDITOR=nvim
-      export STARSHIP_CONFIG=/etc/starship.toml
 
-      if [ -z "$SSH_AUTH_SOCK" ]; then
-          eval $(ssh-agent)
+      if [ -f ~/.ssh/agent.env ] ; then
+          . ~/.ssh/agent.env > /dev/null
+          if ! kill -0 "$SSH_AGENT_PID" > /dev/null 2>&1; then
+              echo "Stale agent file found. Spawning a new agent. "
+              eval `ssh-agent | tee ~/.ssh/agent.env`
+              ssh-add
+          fi
+      else
+          echo "Starting ssh-agent"
+          eval `ssh-agent | tee ~/.ssh/agent.env`
+          ssh-add
       fi
 
       set_win_title() {
@@ -45,25 +77,46 @@ in {
       }
       starship_precmd_user_func=set_win_title
 
-      pw() {
-          len=''${1:-$(( $RANDOM % 24 + 8 ))}
-          tr -dc a-zA-Z0-9 < /dev/urandom | head -c $len
-          echo
-      }
-      cdg() {
-          gitroot=$(until [ -d .git ]; do [ "$PWD" == "/" ] && exit 1; cd ..; done; echo $PWD)
-          if [ $? == 0 ]; then
-precmd_user_func = "title"
-              cd $gitroot
-          else
-              echo "gitroot not found."
-              return 1
-          fi
-      }
-      
       . "$(fzf-share)/key-bindings.bash"
       . "$(fzf-share)/completion.bash"
-      . <(z --init bash)
+      . <(zoxide init bash)
+      . <(direnv hook bash)
+      . ${pkgs.bash-completion}/etc/profile.d/bash_completion.sh
+
+      alias cat="bat -pp"
+      alias docker="sudo -g docker docker"
+      alias docker-compose="sudo -g docker docker-compose"
+      alias less="bat -p"
+      alias ls="ls --color=auto"
+      alias vim="nvim"
+      alias k="kubectl"
+      alias n="nix-shell -p"
+      alias nu="nix-shell -I nixpkgs=/nix/var/nix/profiles/per-user/root/channels/nixos-unstable -p"
+
+      sink() {
+        VAULT_TOKEN=$(vault token lookup -format=json | jq -r .data.id) \
+        ENVIRONMENTS=staging \
+        ~/git/bitsbeats/vault-sink/sink
+      }
+      vsink() {
+        if ! grep -q /values.yaml .gitignore; then
+          echo refusing to sink with missing gitignore
+          return 1
+        fi
+        sink < ./helm/*/values.yaml > ./values.yaml
+      }
+
+      for script in "$HOME"/dotfiles/bashrc/*.sh; do
+          . "$script"
+      done
+
+      if [[ -z $DISPLAY ]] \
+          && [[ $(tty) = /dev/tty1 ]] \
+          && [[ "$USER" = "stefan" ]] \
+          && [[ -x /run/current-system/sw/bin/startsway ]]
+      then
+        exec startsway
+      fi
     '';
 
     shellAliases = {
@@ -75,7 +128,7 @@ precmd_user_func = "title"
   };
 
   users.users.stefan = {
-    extraGroups = [ "wheel" ];
+    extraGroups = [ "wheel" "dialout" "libvirtd" "input" ];
     home = "/home/stefan";
     isNormalUser = true;
     uid = 1000;
@@ -86,5 +139,47 @@ precmd_user_func = "title"
     Defaults env_keep+=SSH_AUTH_SOCK
   '';
 
+  services.fwupd.enable = true;
   services.resolved.enable = true;
+
+  services.lorri.enable = true;
+  systemd.user.services.lorri.serviceConfig = {
+    ProtectSystem = pkgs.lib.mkForce "full";
+    ProtectHome = pkgs.lib.mkForce false;
+  };
+
+  security.wrappers.gvfsd-nfs = {
+    source = "${pkgs.gnome.gvfs}/libexec/gvfsd-nfs";
+    owner = "nobody";
+    group = "nogroup";
+    capabilities = "cap_net_bind_service+ep";
+  };
+  services.gvfs = {
+    enable = true;
+    package = lib.mkForce (pkgs.gnome.gvfs.overrideAttrs (oldAttrs: {
+      postInstall = ''
+        ln -sf /run/wrappers/bin/gvfsd-nfs $out/libexec/gvfsd-nfs
+      '';
+    }));
+  };
+
+  services.zfs.autoSnapshot = {
+    enable = true;
+    frequent = 8;
+    monthly = 6;
+  };
+
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    extraLocaleSettings = {
+      LC_TIME = "de_DE.UTF-8";
+      LC_NUMERIC = "de_DE.UTF-8";
+      LC_PAPER = "de_DE.UTF-8";
+      LC_MONETARY = "de_DE.UTF-8";
+      LC_MEASUREMENT = "de_DE.UTF-8";
+      LC_NAME = "de_DE.UTF-8";
+      LC_TELEPHONE = "de_DE.UTF-8";
+      LC_IDENTIFICATION = "de_DE.UTF-8";
+    };
+  };
 }

roles/desktop.nix

@@ -1,80 +1,238 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
+#g Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, ... }:
 
 let
-  unstable = import <nixos-unstable> {};
-in {
+  colors = config.colors;
+  schema = pkgs.gsettings-desktop-schemas;
+  datadir = "${schema}/share/gsettings-schemas/${schema.name}";
+in
+{
+  programs.droidcam.enable = true;
   programs.sway = {
     enable = true;
+    wrapperFeatures.gtk = true;
     extraPackages = with pkgs; [
       bemenu
+      brightnessctl
+      gammastep
       grim
       i3status-rust
       kanshi
       mako
+      picom
       slurp
       swayidle
       swaylock
+      swaynotificationcenter
+      swayr
+      wf-recorder
+      wofi
     ];
+    extraSessionCommands = "";
+  };
+  xdg.portal.enable = true;
+
+  boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
+
+  colors = {
+    background = "#282a36";
+    foreground = "#f8f8f2";
+    black = "#1E2029";
+    red = "#ff5555";
+    green = "#50fa7b";
+    yellow = "#f1fa8c";
+    cyan = "#8be9fd";
+    magenta = "#bd93f9";
+    blue = "#61bfff";
+    white = "#ffffff";
   };
 
   environment = {
     etc = {
       "sway/config".source = ../dotfiles/sway/config;
       "sway/status.toml".source = ../dotfiles/sway/status.toml;
-      "xdg/alacritty/alacritty.yml".source = ../dotfiles/alacritty.yml;
+      "xdg/alacritty/alacritty.yml".text = ''
+        font:
+          normal:
+            family: CaskaydiaCove Nerd Font
+          size: 12
+
+        draw_bold_text_with_bright_colors: true
+
+        colors:
+          primary:
+            background: "${colors.background}"
+            foreground: "${colors.foreground}"
+
+          normal:
+            black: "${colors.black}"
+            red: "${colors.red}"
+            green: "${colors.green}"
+            yellow: "${colors.yellow}"
+            cyan: "${colors.cyan}"
+            magenta: "${colors.magenta}"
+            blue: "${colors.blue}"
+            white: "${colors.white}"
+
+        window:
+          dynamic_title: true
+          opacity: 0.98
+
+        env:
+          TERM: xterm-256color
+
+        key_bindings:
+          - { key: Escape, mods: Control, action: ToggleViMode }
+      '';
+      "wezterm.lua".source = ../dotfiles/wezterm.lua;
     };
   };
 
-  sound.enable = true;
-  hardware.pulseaudio.enable = true;
+  qt.platformTheme = "qt5ct";
 
-  fonts.enableDefaultFonts = true;
+  hardware.pulseaudio.enable = false;
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
+  services.udev.packages = [
+    (pkgs.writeTextFile {
+      name = "uinput.rules";
+      text = ''
+        KERNEL=="uinput", GROUP="users", MODE="0660", OPTIONS+="static_node=uinput"
+      '';
+      destination = "/etc/udev/rules.d/80-uinput.rules";
+    })
+  ];
+  services.ratbagd.enable = true;
+
+  fonts.enableDefaultPackages = true;
   fonts.fontconfig.antialias = true;
-  fonts.fonts = with pkgs; [
-    cascadia-code
-    font-awesome
+  fonts.packages = with pkgs; [
+    corefonts
+    emacs-all-the-icons-fonts
+    fira-code
     noto-fonts
     noto-fonts-emoji
+    (nerdfonts.override { fonts = [ "CascadiaCode" "Meslo" ]; })
   ];
 
+  nixpkgs.config.allowUnfree = true;
+  environment.pathsToLink = [ "/libexec" ];
   environment.systemPackages = with pkgs; [
+    polkit_gnome
+
+    # firefox also needs:
+    #
+    # gfx.webrenderer.enabled = true
+    # widget.wayland-dmabuf-vaapi.enabled = true
+    #
+    # check in `about:support` that
+    #  * Composing -> Webrenderer
+    firefox-wayland
+    libva
+    libva-utils
+    mesa
+
+    librsvg
+    mypaint
+    mypaint-brushes
+
+    arc-theme
+    capitaine-cursors
+    dracula-theme
+    elementary-xfce-icon-theme
+    glib
+    gsettings-desktop-schemas
+    gtk-engine-murrine
+    gtk_engines
+    hicolor-icon-theme
+    libsForQt5.qtstyleplugins
+    lxappearance
+    numix-icon-theme
+    numix-cursor-theme
+
     alacritty
-    firefox
+    gimp
+    imv
+    inkscape
+    keepassxc
+    libreoffice
+    libsecret
+    mpv
     mumble
     neofetch
-    pulseaudio
-    pulsemixer
+    nodePackages.insect
+    pavucontrol
+    pcmanfm
+    qrencode
+    remmina
+    wezterm
+    uxplay
+
+    solaar
+    gdk-pixbuf
+
+    clipman
+    wdisplays
     wl-clipboard
-    unstable.keepassxc
-    (
-      pkgs.writeTextFile {
-        name = "startsway";
-        destination = "/bin/startsway";
-        executable = true;
-        text = ''
-          #! ${pkgs.bash}/bin/bash
-          
-	  export MOZ_ENABLE_WAYLAND=1
-	  export QT_QPA_PLATFORM=wayland-egl
-	  export QT_WAYLAND_FORCE_DPI=physical
-	  export SDL_VIDEODRIVER=wayland
-	  export _JAVA_AWT_WM_NOREPARENTING=1
-          exec ${pkgs.dbus}/bin/dbus-run-session ${pkgs.sway}/bin/sway
-        '';
-      }
-    )
+    xdg-utils
+    xfce.thunar
+    xfce.thunar-volman
+    wtype
+    (pkgs.writeTextFile {
+      name = "startsway";
+      destination = "/bin/startsway";
+      executable = true;
+      text = ''
+        #! ${pkgs.bash}/bin/bash
+
+        export GTK_ICON_THEME=Dracula
+        export GTK_THEME=Dracula
+        export _JAVA_AWT_WM_NOREPARENTING=1
+        export MOZ_DBUS_REMOTE=1
+        export MOZ_ENABLE_WAYLAND=1
+        export MOZ_USE_XINPUT2=1
+        export QT_AUTO_SCREEN_SCALE_FACTOR=0
+        export QT_QPA_PLATFORM=wayland-egl
+        export QT_WAYLAND_FORCE_DPI=96
+        export SDL_VIDEODRIVER=wayland
+        export WEZTERM_CONFIG_FILE=/etc/wezterm.lua
+        export XDG_CURRENT_DESKTOP=sway
+        export XDG_DATA_DIRS=${datadir}:$XDG_DATA_DIRS
+        export XDG_SESSION_TYPE=wayland
+
+        ${pkgs.dbus}/bin/dbus-run-session ${pkgs.sway}/bin/sway
+      '';
+    })
   ];
 
+  hardware.bluetooth.enable = true;
+  services.blueman.enable = true;
+
   services.syncthing = {
     enable = true;
+    dataDir = "/home/stefan";
     openDefaultPorts = true;
     user = "stefan";
     group = "users";
-    dataDir = "/home/stefan";
   };
 
   services.printing.enable = true;
+  services.printing.drivers = [ pkgs.gutenprint ];
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    publish = {
+      enable = true;
+      addresses = true;
+      workstation = true;
+      userServices = true;
+    };
+  };
 }

roles/dev.nix

@@ -1,23 +1,49 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, ... }:
+{ config, lib, buildPythonPackage, pkgs, fetchPypi,... }:
 
 let
-  unstable = import <nixos-unstable> {};
-  mozilla = import <mozilla> {};
-
+  unstable = import <nixos-unstable> { };
 in {
+
+  services.emacs.package = pkgs.emacs29-pgtk;
+
   environment.systemPackages = with pkgs; [
+    gnumake
     go
-    python37
-    python37Packages.pyls-black
-    python37Packages.pyls-isort
-    python37Packages.pyls-mypy
     rustup
-    sops
-    tig
+    shellcheck
+    unstable.golangci-lint
     unstable.gopls
     unstable.rust-analyzer
+
+    (python311.withPackages
+      (python-packages: with python-packages; [
+        black
+        diagrams
+        pymemcache
+        pyyaml
+        requests
+        ruff-lsp
+      ])
+    )
+
+    mariadb-client
+    musl
+
+    dbeaver-bin
+    emacs29-pgtk
+    gitAndTools.delta
+    lazygit
+    ltrace
+    parallel
+    sops
+    tig
+
+    openssl
+    pkg-config
+    nasm
+    cmake
+    zlib
+    gcc
+    binutils-unwrapped
   ];
 }

roles/mail.nix

@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+
+let
+  notcoal = pkgs.callPackage ../packages/notcoal { };
+in {
+  environment.systemPackages = with pkgs; [
+    isync
+    khal
+    msmtp
+    notmuch
+    notcoal
+    thunderbird
+    astroid
+    vdirsyncer
+  ];
+}

roles/network.nix

@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+let
+in {
+
+  networking.networkmanager.enable = true;
+  users.users.stefan.extraGroups = [ "networkmanager" ];
+
+  environment.systemPackages = with pkgs; [
+    networkmanagerapplet
+    networkmanager-vpnc
+    openconnect_openssl
+  ];
+}

roles/nix.nix

@@ -0,0 +1,11 @@
+{ config, lib, pkgs, ... }:
+
+{
+
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 30d";
+  };
+
+}

roles/private.nix

@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }:
+
+let
+  openscad-ls = pkgs.callPackage ../packages/openscad-language-server.nix { };
+in
+{
+  environment.systemPackages = with pkgs;
+    [
+      openscad
+      openscad-ls
+    ];
+
+  # stm32 debugger
+  users.extraGroups.plugdev = { };
+  users.extraUsers.stefan.extraGroups = [ "plugdev" "dialout" ];
+  services.udev.packages = [ pkgs.openocd ];
+
+  fileSystems."/mnt/nfs" = {
+    device = "10.1.20.29:/srv/nfs";
+    fsType = "nfs";
+    options = [ "x-systemd.automount" "noauto" "x-systemd.idle-timeout=120" ];
+  };
+
+  networking.extraHosts = ''
+    162.55.40.34 mail.f2o.io
+  '';
+}

roles/vpn.nix

@@ -2,7 +2,5 @@
 
 {
   networking.wireguard.enable = true;
-  environment.systemPackages = with pkgs; [
-    wireguard
-  ];
+  environment.systemPackages = with pkgs; [ wireguard-tools ];
 }

roles/work.nix

@@ -0,0 +1,89 @@
+{ config, lib, pkgs, ... }:
+
+let
+  unstable = import <nixos-unstable> { config.allowUnfree = true; };
+  cloudstation = pkgs.callPackage (import ../packages/cloudstation.nix) { };
+  nagstamon = pkgs.libsForQt5.callPackage (import ../packages/nagstamon.nix) { };
+  myslack = pkgs.slack.overrideAttrs (oldAttrs: rec {
+    fixupPhase = ''
+      sed -i -e 's/,"WebRTCPipeWireCapturer"/,"LebRTCPipeWireCapturer"/' $out/lib/slack/resources/app.asar
+
+      rm $out/bin/slack
+      makeWrapper $out/lib/slack/slack $out/bin/slack \
+        --prefix XDG_DATA_DIRS : $GSETTINGS_SCHEMAS_PATH \
+        --suffix PATH : ${lib.makeBinPath [ pkgs.xdg-utils ]} \
+        --add-flags "--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations,WebRTCPipeWireCapturer"
+    '';
+  });
+in {
+
+  environment.variables = {
+    USE_GKE_GCLOUD_AUTH_PLUGIN = "True";
+  };
+
+  services.tailscale = {
+    enable = true;
+    package = unstable.tailscale;
+  };
+
+  security.pki.certificateFiles = [
+    ../dotfiles/certs/NetzmarktCA.crt
+    ../dotfiles/certs/vcenter.netzmarkt.lan.crt
+  ];
+
+  networking.extraHosts = ''
+    10.100.7.11 mon.netzmarkt.de
+    85.10.233.162 live.bonedo.de
+
+    172.20.0.2 hubble.kind
+    172.20.0.2 dashboard.kind
+    172.20.0.2 grafana.kind
+    172.20.0.2 alert.kind
+
+    #192.168.2.111 hass.home.f2o.io
+    #192.168.2.111 sync.home.f2o.io
+    192.168.2.111 pl.home.f2o.io
+
+    #127.0.0.1 auth-dev.thobits.com
+    127.0.0.1 database
+    127.0.0.1 youtube.com
+    127.0.0.1 www.youtube.com
+
+    34.49.192.42 www.tbone.audio
+    34.49.192.42 jobs.thomann.de
+
+  '';
+
+  environment.systemPackages = with pkgs; [
+    (import ../packages/oc311.nix)
+    (import ../packages/oc46.nix)
+    (import ../packages/openshift-install-4.5.nix)
+    # (import ../packages/vaultsink.nix) needs opensource verson
+    cloudstation
+    nagstamon
+    yubikey-manager
+    anydesk
+    chromium
+    nodejs
+    vscodium
+
+    drone-cli
+    govc
+    ttyd
+    discord
+    (google-cloud-sdk.withExtraComponents [
+      google-cloud-sdk.components.gke-gcloud-auth-plugin
+    ])
+    myslack
+    velero
+
+    obs-studio
+    obs-studio-plugins.wlrobs
+
+    prusa-slicer
+  ];
+
+  # yubikey support
+  services.udev.packages = [ pkgs.yubikey-personalization ];
+  services.pcscd.enable = true;
+}