Merge branch 'master' of prism.r:stockholm

28 files changed, 440 insertions, 155 deletions

diff --git a/makefu/0tests/data/secrets/nixos-community b/makefu/0tests/data/secrets/nixos-community
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/makefu/0tests/data/secrets/nixos-community
diff --git a/makefu/1systems/cake/config.nix b/makefu/1systems/cake/config.nix
index 1a617e52d..e40042b2d 100644
--- a/makefu/1systems/cake/config.nix
+++ b/makefu/1systems/cake/config.nix
@@ -2,6 +2,7 @@
 {
   imports = [
     <stockholm/makefu>
+    ./hardware-config.nix
     <stockholm/makefu/2configs/tools/core.nix>
 # configure your hw:
 # <stockholm/makefu/2configs/save-diskspace.nix>
@@ -11,43 +12,10 @@
     tinc.retiolum.enable = true;
     build.host = config.krebs.hosts.cake;
   };
-  boot.loader.grub.enable = false;
-  boot.loader.generic-extlinux-compatible.enable = true;
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-  boot.kernelParams = ["cma=32M" "console=ttyS0,115200n8" "console=tty0" ];
 
-  programs.info.enable = false;
-  programs.man.enable = false;
+  documentation.info.enable = false;
+  documentation.man.enable = false;
   services.nixosManual.enable = false;
-  boot.tmpOnTmpfs = lib.mkForce false;
   sound.enable = false;
 
-  hardware.enableRedistributableFirmware = true;
-  hardware.firmware = [
-    (pkgs.stdenv.mkDerivation {
-     name = "broadcom-rpi3-rest";
-     src = pkgs.fetchurl {
-     url = "https://raw.githubusercontent.com/RPi-Distro/firmware-nonfree/54bab3d/brcm80211/brcm/brcmfmac43430-sdio.txt";
-     sha256 = "19bmdd7w0xzybfassn7x4rb30l70vynnw3c80nlapna2k57xwbw7";
-     };
-     phases = [ "installPhase" ];
-     installPhase = ''
-     mkdir -p $out/lib/firmware/brcm
-     cp $src $out/lib/firmware/brcm/brcmfmac43430-sdio.txt
-     '';
-     })
-  ];
-  networking.wireless.enable = true;
-
-# File systems configuration for using the installer's partition layout
-  fileSystems = {
-    "/boot" = {
-      device = "/dev/disk/by-label/NIXOS_BOOT";
-      fsType = "vfat";
-    };
-    "/" = {
-      device = "/dev/disk/by-label/NIXOS_SD";
-      fsType = "ext4";
-    };
-  };
 }
diff --git a/makefu/1systems/cake/hardware-config.nix b/makefu/1systems/cake/hardware-config.nix
new file mode 100644
index 000000000..d021f9458
--- /dev/null
+++ b/makefu/1systems/cake/hardware-config.nix
@@ -0,0 +1,42 @@
+{ pkgs, lib, ... }:
+{
+  # raspi3
+  boot.kernelParams = ["cma=32M" "console=ttyS0,115200n8" "console=tty0" "console=ttyS1,115200n8" ];
+  boot.loader.grub.enable = false;
+  boot.loader.raspberryPi.enable = true;
+  boot.loader.raspberryPi.version = 3;
+  boot.loader.raspberryPi.uboot.enable = true;
+  boot.loader.raspberryPi.uboot.configurationLimit = 3;
+  boot.loader.raspberryPi.firmwareConfig = ''
+    gpu_mem=32
+    arm_freq=1350
+    core_freq=500
+    over_voltage=4
+    disable_splash=1
+    # bye bye warranty
+    force_turbo=1
+  '';
+  boot.loader.generationsDir.enable = lib.mkDefault false;
+
+  boot.tmpOnTmpfs = lib.mkForce false;
+  boot.cleanTmpDir = true;
+  hardware.enableRedistributableFirmware = true;
+
+  ## wifi not working, will be fixed with https://github.com/NixOS/nixpkgs/pull/53747
+  # boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  environment.systemPackages = [ pkgs.raspberrypi-tools ];
+  networking.wireless.enable = true;
+  # File systems configuration for using the installer's partition layout
+  swapDevices = [ { device = "/var/swap"; size = 2048; } ];
+  fileSystems = {
+    "/boot" = {
+      device = "/dev/disk/by-label/NIXOS_BOOT";
+      fsType = "vfat";
+    };
+    "/" = {
+      device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+    };
+  };
+}
diff --git a/makefu/1systems/gum/config.nix b/makefu/1systems/gum/config.nix
index 97b4555a5..e274b4bf8 100644
--- a/makefu/1systems/gum/config.nix
+++ b/makefu/1systems/gum/config.nix
@@ -22,6 +22,8 @@ in {
         };
       }
       <stockholm/makefu/2configs/support-nixos.nix>
+      <stockholm/makefu/2configs/home-manager>
+      <stockholm/makefu/2configs/home-manager/cli.nix>
       # <stockholm/makefu/2configs/stats/client.nix>
       <stockholm/makefu/2configs/stats/netdata-server.nix>
 
@@ -123,8 +125,7 @@ in {
       #<stockholm/makefu/2configs/nginx/update.connector.one.nix>
       <stockholm/makefu/2configs/nginx/misa-felix-hochzeit.ml.nix>
       # <stockholm/makefu/2configs/nginx/gold.krebsco.de.nix>
-      <stockholm/makefu/2configs/nginx/iso.euer.nix>
-      <stockholm/krebs/2configs/cache.nsupdate.info.nix>
+      # <stockholm/makefu/2configs/nginx/iso.euer.nix>
 
       <stockholm/makefu/2configs/deployment/photostore.krebsco.de.nix>
       <stockholm/makefu/2configs/deployment/graphs.nix>
diff --git a/makefu/1systems/gum/hardware-config.nix b/makefu/1systems/gum/hardware-config.nix
index e9670a5a4..542b79fe7 100644
--- a/makefu/1systems/gum/hardware-config.nix
+++ b/makefu/1systems/gum/hardware-config.nix
@@ -34,7 +34,7 @@ in {
         prefixLength = external-netmask6;
       }];
     };
-    defaultGateway6 = external-gw6;
+    defaultGateway6 = { address = external-gw6; interface = ext-if; };
     defaultGateway = external-gw;
   };
   boot.kernelParams = [ ];
diff --git a/makefu/1systems/gum/source.nix b/makefu/1systems/gum/source.nix
index 1e36c6e87..43586ede4 100644
--- a/makefu/1systems/gum/source.nix
+++ b/makefu/1systems/gum/source.nix
@@ -2,4 +2,5 @@
   name="gum";
   torrent = true;
   clever_kexec = true;
+  home-manager = true;
 }
diff --git a/makefu/1systems/x/config.nix b/makefu/1systems/x/config.nix
index 5a4eea2e4..138735d91 100644
--- a/makefu/1systems/x/config.nix
+++ b/makefu/1systems/x/config.nix
@@ -14,10 +14,12 @@
       <stockholm/makefu/2configs/main-laptop.nix>
       <stockholm/makefu/2configs/extra-fonts.nix>
       <stockholm/makefu/2configs/tools/all.nix>
+      <stockholm/makefu/2configs/dict.nix>
 
       <stockholm/makefu/2configs/backup/state.nix>
       # <stockholm/makefu/2configs/dnscrypt/client.nix>
       <stockholm/makefu/2configs/avahi.nix>
+      <stockholm/makefu/2configs/support-nixos.nix>
 
       # Debugging
       # <stockholm/makefu/2configs/disable_v6.nix>
@@ -64,11 +66,12 @@
       <stockholm/makefu/2configs/tor.nix>
       <stockholm/makefu/2configs/vpn/vpngate.nix>
       # <stockholm/makefu/2configs/buildbot-standalone.nix>
-      # <stockholm/makefu/2configs/remote-build/master.nix>
+      <stockholm/makefu/2configs/remote-build/aarch64-community.nix>
 
       # Hardware
       <stockholm/makefu/2configs/hw/tp-x230.nix>
       <stockholm/makefu/2configs/hw/mceusb.nix>
+      <stockholm/makefu/2configs/hw/malduino_elite.nix>
       # <stockholm/makefu/2configs/hw/tpm.nix>
       # <stockholm/makefu/2configs/hw/rtl8812au.nix>
       <stockholm/makefu/2configs/hw/network-manager.nix>
diff --git a/makefu/2configs/bgt/download.binaergewitter.de.nix b/makefu/2configs/bgt/download.binaergewitter.de.nix
index 6d64848f5..f223081e9 100644
--- a/makefu/2configs/bgt/download.binaergewitter.de.nix
+++ b/makefu/2configs/bgt/download.binaergewitter.de.nix
@@ -3,6 +3,8 @@
 with import <stockholm/lib>;
 let
   ident = (builtins.readFile ./auphonic.pub);
+  bgtaccess = "/var/spool/nginx/logs/binaergewitter.access.log";
+  bgterror = "/var/spool/nginx/logs/binaergewitter.error.log";
 in {
   services.openssh = {
     allowSFTP = true;
@@ -21,6 +23,19 @@ in {
     useDefaultShell = true;
     openssh.authorizedKeys.keys = [ ident config.krebs.users.makefu.pubkey ];
   };
+  services.logrotate = {
+    enable = true;
+    config = ''
+    ${bgtaccess} ${bgterror} {
+      rotate 5
+      weekly
+      create 600 nginx nginx
+      postrotate
+        ${pkgs.systemd}/bin/systemctl reload nginx
+      endscript
+    }
+    '';
+  };
   services.nginx = {
     enable = lib.mkDefault true;
     recommendedGzipSettings = true;
@@ -29,10 +44,21 @@ in {
         serverAliases = [ "dl2.binaergewitter.de" ];
         root = "/var/www/binaergewitter";
         extraConfig = ''
-          access_log /var/spool/nginx/logs/binaergewitter.access.log combined;
-          error_log /var/spool/nginx/logs/binaergewitter.error.log error;
+          access_log ${bgtaccess} combined;
+          error_log ${bgterror} error;
           autoindex on;
         '';
     };
   };
+  environment.etc."netdata/python.d/web_log.conf".text = ''
+    nginx_log3:
+      name: 'nginx'
+      path: '/var/spool/nginx/logs/access.log'
+    nginx_log4:
+      name: 'bgt'
+      path: '${bgtaccess}'
+  '';
+
+  users.users.netdata.extraGroups = [ "nginx" ];
+
 }
diff --git a/makefu/2configs/bureautomation/default.nix b/makefu/2configs/bureautomation/default.nix
index 3897537ea..917044d63 100644
--- a/makefu/2configs/bureautomation/default.nix
+++ b/makefu/2configs/bureautomation/default.nix
@@ -5,7 +5,7 @@ let
   port = 3001;
   runit = pkgs.writeDash "runit" ''
     set -xeuf
-    PATH=${pkgs.curl}/bin:${pkgs.coreutils}/bin
+    PATH=${pkgs.mosquitto}/bin:${pkgs.coreutils}/bin
     name=''${1?must provide name as first arg}
     state=''${2?must provide state as second arg}
     # val=''${3?must provide val as third arg}
@@ -14,9 +14,10 @@ let
     test $state = alerting || exit 0
 
     echo $name - $state
-    curl 'http://bauarbeiterlampe/ay?o=1'
+    topic=plug
+    mosquitto_pub -t /bam/$topic/cmnd/POWER -m ON
     sleep 5
-    curl 'http://bauarbeiterlampe/ay?o=1'
+    mosquitto_pub -t /bam/$topic/cmnd/POWER -m OFF
   '';
 in {
   services.logstash = {
diff --git a/makefu/2configs/bureautomation/hass.nix b/makefu/2configs/bureautomation/hass.nix
index a89a4813f..b70c9b030 100644
--- a/makefu/2configs/bureautomation/hass.nix
+++ b/makefu/2configs/bureautomation/hass.nix
@@ -1,21 +1,51 @@
 { pkgs, lib, ... }:
 let
+  tasmota_rgb = name: topic:
+# LED WS2812b
+#      effect_state_topic: "stat/led/Scheme"
+#      effect_command_topic: "cmnd/led/Scheme"
+#      effect_value_template: "{{ value_json.Scheme }}"
+  { platform = "mqtt";
+    inherit name;
+    retain = false;
+    qos = 1;
+    optimistic = false;
+    # state
+    # TODO: currently broken, will not use the custom state topic
+    state_topic = "/bam/${topic}/stat/POWER";
+    command_topic = "/bam/${topic}/cmnd/POWER";
+    availability_topic = "/bam/${topic}/tele/LWT";
+    payload_on= "ON";
+    payload_off= "OFF";
+    payload_available= "Online";
+    payload_not_available= "Offline";
+    # brightness
+    brightness_state_topic = "/bam/${topic}/stat/Dimmer";
+    brightness_command_topic = "/bam/${topic}/cmnd/Dimmer";
+    brightness_value_template = "{{ value_json.Dimmer }}";
+    brightness_scale = 100;
+    # color
+    rgb_state_topic = "/bam/${topic}/stat/Color";
+    rgb_command_topic = "/bam/${topic}/cmnd/Color2";
+    rgb_command_mode = "hex";
+    rgb_command_template = "{{ '%02x%02x%02x' | format(red, green, blue)}}";
+    # effects
+    effect_state_topic = "/bam/${topic}/stat/Scheme";
+    effect_command_topic = "/bam/${topic}/cmnd/Scheme";
+    effect_value_template = "{{ value_json.Scheme }}";
+    effect_list = [ 0 1 2 3 4 5 6 7 8 9 10 11 12 ];
+};
   tasmota_plug = name: topic:
   { platform = "mqtt";
     inherit name;
-    state_topic = "/bam/${topic}/stat/POWER1";
-    command_topic = "/bam/${topic}/cmnd/POWER1";
+    state_topic = "/bam/${topic}/stat/POWER";
+    command_topic = "/bam/${topic}/cmnd/POWER";
     availability_topic = "/bam/${topic}/tele/LWT";
     payload_on= "ON";
     payload_off= "OFF";
     payload_available= "Online";
     payload_not_available= "Offline";
   };
-  tasmota_stecki = name: topic:
-    ( tasmota_plug name topic) //
-    { state_topic = "/bam/${topic}/stat/POWER";
-      command_topic = "/bam/${topic}/cmnd/POWER";
-  };
   espeasy_dht22 = name: [
   { platform = "mqtt";
     name = "${name} DHT22 Temperature";
@@ -77,8 +107,12 @@ in {
       switch = [
         (tasmota_plug "Bauarbeiterlampe" "plug")
         (tasmota_plug "Blitzdings" "plug2")
-        (tasmota_stecki "Fernseher" "fernseher")
-        (tasmota_plug "Pluggy" "plug4")
+        (tasmota_plug "Fernseher" "plug3")
+        (tasmota_plug "Feuer" "plug4")
+        (tasmota_plug "Nachtlicht" "plug5")
+      ];
+      light = [
+        (tasmota_rgb "Status Felix" "status1")
       ];
       binary_sensor = [
         { platform = "mqtt";
@@ -174,12 +208,16 @@ in {
           };
         automation = [
           "automation.turn_off_fernseher_10_minutes_after_last_movement"
+          "automation.turn_off_nachtlicht_on_sunrise"
+          "automation.turn_on_nachtlicht_on_motion_and_dusk"
         ];
         switches = [
           "switch.bauarbeiterlampe"
           "switch.blitzdings"
           "switch.fernseher"
-          "switch.pluggy"
+          "switch.feuer"
+          "switch.nachtlicht"
+          "light.status_felix"
         ];
         camera = [
           "camera.Baumarkt"
@@ -212,11 +250,55 @@ in {
           };
           action = {
             service = "homeassistant.turn_on";
-            entity_id =  [ "switch.fernseher" "switch.blitzdings" ];
+            entity_id =  [
+              "switch.fernseher"
+              "switch.feuer"
+              "light.status_felix"
+            ];
+          };
+        }
+        {
+          alias = "Turn off Nachtlicht on sunrise";
+          trigger =
+          {
+            platform = "sun";
+            event = "sunrise";
+          };
+          action =
+          {
+            service = "homeassistant.turn_off";
+            entity_id =  [ "switch.nachtlicht" ];
+          };
+        }
+        {
+          alias = "Turn on Nachtlicht on motion and dusk";
+          trigger =
+          {
+            platform = "state";
+            entity_id = "binary_sensor.motion";
+            to = "on";
+          };
+          condition = # 'when dark'
+          {
+            condition = "or";
+            conditions = [
+              { condition = "sun";
+                after = "sunset";
+                after_offset = "-00:45:00"; # on dusk
+              }
+              { condition = "sun";
+                before = "sunrise";
+              }
+            ];
+          };
+          action =
+          {
+            service = "homeassistant.turn_on";
+            entity_id =  [ "switch.nachtlicht" ];
           };
         }
         { alias = "Turn off Fernseher 10 minutes after last movement";
-          trigger = [ 
+          trigger = [
           { # trigger when movement was detected at the time
             platform = "state";
             entity_id = "binary_sensor.motion";
@@ -231,7 +313,11 @@ in {
         ];
           action = {
             service = "homeassistant.turn_off";
-            entity_id =  [ "switch.fernseher" "switch.blitzdings" ];
+            entity_id =  [
+              "switch.fernseher"
+              "switch.feuer"
+              "light.status_felix"
+            ];
           };
           condition =
           { condition = "and";
diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix
index 61cba86d9..177114a49 100644
--- a/makefu/2configs/default.nix
+++ b/makefu/2configs/default.nix
@@ -36,7 +36,6 @@ with import <stockholm/lib>;
     enable = true;
 
     dns.providers.lan  = "hosts";
-    search-domain = "r";
     build.user = config.krebs.users.makefu;
   };
 
@@ -85,5 +84,5 @@ with import <stockholm/lib>;
     SystemMaxUse=1G
     RuntimeMaxUse=128M
     '';
-
+  environment.pathsToLink = [ "/share" ];
 }
diff --git a/makefu/2configs/deployment/owncloud.nix b/makefu/2configs/deployment/owncloud.nix
index cfde0aba8..d7c082662 100644
--- a/makefu/2configs/deployment/owncloud.nix
+++ b/makefu/2configs/deployment/owncloud.nix
@@ -169,6 +169,7 @@ in  {
     ( serveCloud [ "o.euer.krebsco.de" ] )
   ];
 
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
   services.redis.enable = true;
   services.mysql = {
     enable = false;
diff --git a/makefu/2configs/dict.nix b/makefu/2configs/dict.nix
new file mode 100644
index 000000000..6db9102ba
--- /dev/null
+++ b/makefu/2configs/dict.nix
@@ -0,0 +1,5 @@
+{ pkgs, ... }:
+{
+  services.dictd.enable = true;
+  services.dictd.DBs = with pkgs.dictdDBs; [ wiktionary wordnet deu2eng eng2deu ];
+}
diff --git a/makefu/2configs/gui/base.nix b/makefu/2configs/gui/base.nix
index 6bcd09826..63ce6201a 100644
--- a/makefu/2configs/gui/base.nix
+++ b/makefu/2configs/gui/base.nix
@@ -28,6 +28,7 @@ in
 
     windowManager = {
       awesome.enable = true;
+      awesome.noArgb = true;
       awesome.luaModules = [ pkgs.luaPackages.vicious ];
       default = "awesome";
     };
diff --git a/makefu/2configs/home-manager/cli.nix b/makefu/2configs/home-manager/cli.nix
index 64aa03bd7..6b5d26111 100644
--- a/makefu/2configs/home-manager/cli.nix
+++ b/makefu/2configs/home-manager/cli.nix
@@ -1,4 +1,5 @@
 {pkgs, ... }: {
+  imports = [ ./zsh.nix ];
   home-manager.users.makefu = {
     services.gpg-agent = {
       enable = true;
@@ -9,7 +10,34 @@
       enableSshSupport = true;
       enableScDaemon = true;
     };
-    programs.fzf.enable = true; # alt-c
+    programs.direnv = {
+      stdlib = ''
+use_nix() {
+  local cache=".direnv.$(nixos-version --hash)"
+
+  if [[ ! -e "$cache" ]] || \
+    [[ "$HOME/.direnvrc" -nt "$cache" ]] || \
+    [[ ".envrc" -nt "$cache" ]] || \
+    [[ "default.nix" -nt "$cache" ]] || \
+    [[ "shell.nix" -nt "$cache" ]];
+  then
+    local tmp="$(mktemp "$${cache}.tmp-XXXXXXXX")"
+    trap "rm -rf '$tmp' >/dev/null" EXIT
+    nix-shell --show-trace "$@" --run 'direnv dump' > "$tmp" && \
+    mv "$tmp" "$cache"
+  fi
+
+  direnv_load cat "$cache"
+
+  if [[ $# = 0 ]]; then
+    watch_file default.nix
+    watch_file shell.nix
+    rm direnv.* 2>/dev/null
+  fi
+}
+'';
+      enableZshIntegration = true;
+    };
   };
   services.udev.packages = [
     pkgs.libu2f-host
diff --git a/makefu/2configs/home-manager/desktop.nix b/makefu/2configs/home-manager/desktop.nix
index ce98e651a..3be020faa 100644
--- a/makefu/2configs/home-manager/desktop.nix
+++ b/makefu/2configs/home-manager/desktop.nix
@@ -1,11 +1,14 @@
-{ pkgs, lib, ... }: 
+{ pkgs, lib, ... }:
 
 {
+  users.users.makefu.packages = with pkgs;[ bat direnv clipit ];
   home-manager.users.makefu = {
+    systemd.user.services.network-manager-applet.Service.Environment = ''XDG_DATA_DIRS=/run/current-system/sw/share:${pkgs.networkmanagerapplet}/share GDK_PIXBUF_MODULE_FILE=${pkgs.librsvg.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache'';
     programs.browserpass = { browsers = [ "firefox" ] ; enable = true; };
     programs.firefox.enable = true;
+    programs.obs-studio.enable = true;
+    xdg.enable = true;
     services.network-manager-applet.enable = true;
-    systemd.user.services.network-manager-applet.Service.Environment = ''XDG_DATA_DIRS=/etc/profiles/per-user/makefu/share GDK_PIXBUF_MODULE_FILE=${pkgs.librsvg.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache'';
     services.blueman-applet.enable = true;
     services.pasystray.enable = true;
     systemd.user.services.pasystray.Service.Environment = "PATH=" + (lib.makeBinPath (with pkgs;[ pavucontrol paprefs /* pavumeter  */  /* paman */ ]) );
@@ -34,7 +37,7 @@
       };
 
       Service = {
-        Environment = ''XDG_DATA_DIRS=/etc/profiles/per-user/makefu/share GDK_PIXBUF_MODULE_FILE=${pkgs.librsvg.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache'';
+        Environment = ''XDG_DATA_DIRS=/run/current-system/sw/share:${pkgs.clipit}/share GDK_PIXBUF_MODULE_FILE=${pkgs.librsvg.out}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache'';
         ExecStart = "${pkgs.clipit}/bin/clipit";
         Restart = "on-abort";
       };
diff --git a/makefu/2configs/home-manager/zsh.nix b/makefu/2configs/home-manager/zsh.nix
new file mode 100644
index 000000000..59658e667
--- /dev/null
+++ b/makefu/2configs/home-manager/zsh.nix
@@ -0,0 +1,126 @@
+{ pkgs, ... }:
+{
+  imports = [
+    { #direnv
+      home-manager.users.makefu.home.packages = [ pkgs.direnv ];
+      home-manager.users.makefu.home.file.".direnvrc".text = ''
+      use_nix() {
+        local path="$(nix-instantiate --find-file nixpkgs)"
+
+        if [ -f "$${path}/.version-suffix" ]; then
+          local version="$(< $path/.version-suffix)"
+        elif [ -f "$path/.version" ]; then
+          local version="$(< $path/.version)"
+        else
+          local version="$(< $(< $path/.git/HEAD))"
+        fi
+
+        local cache=".direnv/cache-''${version:-unknown}"
+
+        if [[ ! -e "$cache" ]] || \
+          [[ "$HOME/.direnvrc" -nt "$cache" ]] || \
+          [[ .envrc -nt "$cache" ]] || \
+          [[ default.nix -nt "$cache" ]] || \
+          [[ shell.nix -nt "$cache" ]];
+        then
+          [ -d .direnv ] || mkdir .direnv
+          local tmp=$(nix-shell --show-trace "$@" \
+            --run "\"$direnv\" dump bash")
+          echo "$tmp" > "$cache"
+        fi
+
+        local path_backup=$PATH term_backup=$TERM
+        direnv_load cat "$cache"
+
+        export PATH=$PATH:$path_backup TERM=$term_backup
+
+        if [[ $# = 0 ]]; then
+          watch_file default.nix
+          watch_file shell.nix
+        fi
+      }
+      '';
+      home-manager.users.makefu.programs.zsh.initExtra = ''
+      nixify() {
+        if [ ! -e ./.envrc ]; then
+          echo "use nix" > .envrc
+          direnv allow
+        fi
+        if [ ! -e default.nix ]; then
+          cat > default.nix <<'EOF'
+      with import <nixpkgs> {};
+      stdenv.mkDerivation {
+        name = "env";
+        buildInputs = [
+          bashInteractive
+        ];
+      }
+      EOF
+          ''${EDITOR:-vim} default.nix
+        fi
+      }
+      eval "$(direnv hook zsh)"
+      '';
+    }
+    { # bat
+    home-manager.users.makefu.home.packages = [ pkgs.bat ];
+      home-manager.users.makefu.programs.zsh.shellAliases = {
+        cat = "bat";
+        catn = "${pkgs.coreutils}/bin/cat";
+      };
+    }
+  ];
+  environment.pathsToLink = [ "/share/zsh" ];
+  home-manager.users.makefu = {
+    programs.fzf.enable = false; # alt-c
+    programs.zsh = {
+      enable = true;
+      enableAutosuggestions = false;
+      enableCompletion = true;
+      oh-my-zsh.enable = false;
+      history = {
+        size = 900001;
+        save = 900001;
+        ignoreDups = true;
+        extended = true;
+        share = true;
+      };
+      sessionVariables = {
+        TERM = "rxvt-unicode-256color";
+        LANG = "en_US.UTF8";
+        LS_COLORS = ":di=1;31:";
+        EDITOR = "vim";
+      };
+      shellAliases = {
+        lsl = "ls -lAtr";
+        t = "task";
+        xo = "mimeopen";
+        nmap = "nmap -oN $HOME/loot/scan-`date +\%s`.nmap -oX $HOME/loot/scan-`date +%s`.xml";
+      };
+      initExtra = ''
+        bindkey -e
+        # shift-tab
+        bindkey '^[[Z' reverse-menu-complete
+        bindkey "\e[3~" delete-char
+        zstyle ':completion:*' menu select
+
+        setopt HIST_IGNORE_ALL_DUPS
+        setopt HIST_IGNORE_SPACE
+        setopt HIST_FIND_NO_DUPS
+
+        unset SSH_AGENT_PID
+        export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
+        compdef _pass brain
+        zstyle ':completion::complete:brain::' prefix "$HOME/brain"
+        compdef _pass secrets
+        zstyle ':completion::complete:secrets::' prefix "$HOME/.secrets-pass/"
+
+        # ctrl-x ctrl-e
+        autoload -U edit-command-line
+        zle -N edit-command-line
+        bindkey '^xe' edit-command-line
+        bindkey '^x^e' edit-command-line
+      '';
+    };
+  };
+}
diff --git a/makefu/2configs/hw/malduino_elite.nix b/makefu/2configs/hw/malduino_elite.nix
new file mode 100644
index 000000000..1af85493f
--- /dev/null
+++ b/makefu/2configs/hw/malduino_elite.nix
@@ -0,0 +1,15 @@
+{ config, lib, pkgs, ... }:
+
+{
+
+  services.udev.extraRules = ''
+    ACTION!="add|change", GOTO="mm_usb_device_blacklist_local_end"
+    SUBSYSTEM!="usb", GOTO="mm_usb_device_blacklist_local_end"
+    ENV{DEVTYPE}!="usb_device", GOTO="mm_usb_device_blacklist_local_end"
+
+    ATTRS{idVendor}=="1b4f" ATTRS{idProduct}=="9204", ENV{ID_MM_DEVICE_IGNORE}="1"
+    ATTRS{idVendor}=="1b4f" ATTRS{idProduct}=="9203", ENV{ID_MM_DEVICE_IGNORE}="1"
+
+    LABEL="mm_usb_device_blacklist_local_end"
+  '';
+}
diff --git a/makefu/2configs/printer.nix b/makefu/2configs/printer.nix
index fb1a67358..0889ebbc1 100644
--- a/makefu/2configs/printer.nix
+++ b/makefu/2configs/printer.nix
@@ -6,7 +6,8 @@ in {
   services.printing = {
     enable = true;
     drivers = with pkgs; [
-      samsungUnifiedLinuxDriver
+      # samsungUnifiedLinuxDriver
+      splix # scx 3200
       cups-dymo # dymo labelwriter
       foo2zjs # magicolor 1690mf
       cups-zj-58
diff --git a/makefu/2configs/remote-build/aarch64-community.nix b/makefu/2configs/remote-build/aarch64-community.nix
new file mode 100644
index 000000000..d57eacd68
--- /dev/null
+++ b/makefu/2configs/remote-build/aarch64-community.nix
@@ -0,0 +1,15 @@
+{
+  nix = {
+    distributedBuilds = true;
+    buildMachines = [
+      {
+        hostName = "aarch64.nixos.community";
+        maxJobs = 64;
+        sshKey = toString <secrets/nixos-community>;
+        sshUser = "makefu";
+        system = "aarch64-linux";
+        supportedFeatures = [ "big-parallel" ];
+      }
+    ];
+  };
+}
diff --git a/makefu/2configs/tools/android-pentest.nix b/makefu/2configs/tools/android-pentest.nix
index 9dedafdd2..05560db90 100644
--- a/