diff --git a/.config/nvim/ftplugin/haskell.lua b/.config/nvim/ftplugin/haskell.lua
index ee1dba9a..ddc57c09 100644
--- a/.config/nvim/ftplugin/haskell.lua
+++ b/.config/nvim/ftplugin/haskell.lua
@@ -5,4 +5,4 @@ vim.bo.shiftwidth = 2
 vim.bo.expandtab = true
 
 -- useful for CPP extension
-vim.o.smartindent = true
+vim.bo.smartindent = true
diff --git a/.config/nvim/init.lua b/.config/nvim/init.lua
index 21b5f3e2..c927f47a 100644
--- a/.config/nvim/init.lua
+++ b/.config/nvim/init.lua
@@ -7,4 +7,4 @@ require("_lazy")
 require("lsp.haskell")
 require("lsp.rust")
 
-vim.cmd.colorscheme("curry")
+vim.cmd.colorscheme("milou")
diff --git a/.config/nvim/lazy-lock.json b/.config/nvim/lazy-lock.json
index 483f2ead..52f9c7f9 100644
--- a/.config/nvim/lazy-lock.json
+++ b/.config/nvim/lazy-lock.json
@@ -7,7 +7,6 @@
   "cmp-path": { "branch": "main", "commit": "c642487086dbd9a93160e1679a1327be111cbc25" },
   "cmp-spell": { "branch": "master", "commit": "694a4e50809d6d645c1ea29015dad0c293f019d6" },
   "cmp_luasnip": { "branch": "master", "commit": "98d9cb5c2c38532bd9bdb481067b20fea8f32e90" },
-  "curry.nvim": { "branch": "mistress", "commit": "2c20e5dd43af134a6e18e21ba53f1c0830abe4fc" },
   "fidget.nvim": { "branch": "main", "commit": "3f5475949679953af6d78654db29b944fa826e6a" },
   "friendly-snippets": { "branch": "main", "commit": "572f5660cf05f8cd8834e096d7b4c921ba18e175" },
   "gitsigns.nvim": { "branch": "main", "commit": "1ee5c1fd068c81f9dd06483e639c2aa4587dc197" },
@@ -16,6 +15,7 @@
   "lazy.nvim": { "branch": "main", "commit": "59334064f8604ca073791c25dcc5c9698865406e" },
   "lazydev.nvim": { "branch": "main", "commit": "258d2a5ef4a3e3d6d9ba9da72c9725c53e9afcbd" },
   "leap.nvim": { "branch": "main", "commit": "07304103f6bd923004fdef9262d9a4d7925fb70a" },
+  "milou": { "branch": "haddock", "commit": "ae95eb2ebdbc4228931ceefa64f86b877213dc62" },
   "no-neck-pain.nvim": { "branch": "main", "commit": "ecc584150f5c8a2a82f2e1d43201df0f65c63d0e" },
   "nvim-autopairs": { "branch": "master", "commit": "23320e75953ac82e559c610bec5a90d9c6dfa743" },
   "nvim-cmp": { "branch": "main", "commit": "b5311ab3ed9c846b585c0c15b7559be131ec4be9" },
@@ -38,5 +38,6 @@
   "vim-fugitive": { "branch": "master", "commit": "61b51c09b7c9ce04e821f6cf76ea4f6f903e3cf4" },
   "vim-repeat": { "branch": "master", "commit": "65846025c15494983dafe5e3b46c8f88ab2e9635" },
   "vim-sleuth": { "branch": "master", "commit": "be69bff86754b1aa5adcbb527d7fcd1635a84080" },
-  "vim-surround": { "branch": "master", "commit": "3d188ed2113431cf8dac77be61b842acb64433d9" }
+  "vim-surround": { "branch": "master", "commit": "3d188ed2113431cf8dac77be61b842acb64433d9" },
+  "vimtex": { "branch": "master", "commit": "2e1bbabeb2c34bb17d7bc8cfdf8f95b16dd0db0c" }
 }
diff --git a/.config/nvim/lua/_lazy.lua b/.config/nvim/lua/_lazy.lua
index 8cd2dd9d..9e228094 100644
--- a/.config/nvim/lua/_lazy.lua
+++ b/.config/nvim/lua/_lazy.lua
@@ -78,7 +78,8 @@ local plugins = {
     -- Highlight comments
     { "folke/todo-comments.nvim", dependencies = "nvim-lua/plenary.nvim" },
 
-    "leana8959/curry.nvim",
+    -- "leana8959/curry.nvim",
+    "https://git.confusedcompiler.org/leana8959/milou",
 
     --
     -- LSP / DAP
@@ -113,6 +114,12 @@ local plugins = {
     },
     -- The haskell lexer
     "vim-scripts/alex.vim",
+    {
+        -- https://github.com/lervag/vimtex#lazynvim
+        "lervag/vimtex",
+        lazy = false,
+        version = "^2",
+    },
     {
         "nvim-telescope/telescope.nvim",
         branch = "0.1.x",
diff --git a/.config/nvim/plugin/lsp.lua b/.config/nvim/plugin/lsp.lua
index d8cca152..7af2d20f 100644
--- a/.config/nvim/plugin/lsp.lua
+++ b/.config/nvim/plugin/lsp.lua
@@ -21,7 +21,7 @@ local servers = {
     tinymist = {},
     nil_ls = {
         settings = {
-            ["nil"] = { formatting = { command = { "alejandra" } } },
+            ["nil"] = { formatting = { command = { "nixfmt" } } },
         },
     },
 }
diff --git a/.config/nvim/plugin/luasnip.lua b/.config/nvim/plugin/luasnip.lua
index bd6ab457..65fe4532 100644
--- a/.config/nvim/plugin/luasnip.lua
+++ b/.config/nvim/plugin/luasnip.lua
@@ -5,8 +5,8 @@ local cr = function() return t { "", "" } end
 local i = luasnip.insert_node
 local f = luasnip.function_node
 
-local function datetime() return os.date('%Y-%m-%d %H:%M:%S') end
-local function date() return os.date('%Y-%m-%d') end
+local function datetime() return os.date("%Y-%m-%d %H:%M:%S") end
+local function date() return os.date("%Y-%m-%d") end
 local function quoted(s) return '"' .. s .. '"' end
 
 luasnip.add_snippets("typst", {
@@ -57,5 +57,9 @@ luasnip.add_snippets("ruler", {
     }),
 })
 
+luasnip.add_snippets("nix", {
+    s("system", { t("stdenv.hostPlatform.system") }),
+})
+
 local haskell_snippets = require("haskell-snippets").all
 luasnip.add_snippets("haskell", haskell_snippets, { key = "haskell" })
diff --git a/.config/nvim/syntax/ruler.vim b/.config/nvim/syntax/ruler.vim
index 73a21fab..c82ba8d6 100644
--- a/.config/nvim/syntax/ruler.vim
+++ b/.config/nvim/syntax/ruler.vim
@@ -10,6 +10,8 @@ syn match rulerLineComment        "--.*$"
 syn match rulerTripleDot          "\.\.\."
 syn match rulerDate               "\d\d\d\d\D\d\d\D\d\d \d\d\D\d\d\D\(\d\d\|__\)"
 syn match rulerTag                "\s\+[a-zA-Z]\+:[^\n]*"
+syn match rulerImport             "import"
+syn match rulerType               "type"
 
 syn region rulerBlockComment      start="{-"   end="-}"
 
@@ -17,6 +19,8 @@ hi def link rulerLineComment      Comment
 hi def link rulerBlockComment     Comment
 hi def link rulerTripleDot        Comment
 hi def link rulerDate             Macro
+hi def link rulerImport           Keyword
+hi def link rulerType             Keyword
 hi def link rulerTag              @property
 
 let b:current_syntax = "ruler"
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 249934f5..3b969a4c 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -7,3 +7,6 @@ e91471432f7b7e3e5cb6cdb245819998d6653b5e
 
 # Reformat with stylua
 94ab5d51f10e609cee0159636c29cd404e3a6570
+
+# Reformat with nixfmt
+ebf84688079b537b3a34a7f5decdf30e165b7933
diff --git a/Justfile b/Justfile
index 17d6a417..3c0318de 100644
--- a/Justfile
+++ b/Justfile
@@ -6,10 +6,10 @@ os host action:
         set -euo pipefail
 
         nixpkgs=$(nix-instantiate --eval -E "let sources = import ./npins; in sources.nixpkgs.outPath" | jq -r .)
-        sudo nixos-rebuild {{ action }} \
+        nixos-rebuild {{ action }} \
                 -I nixpkgs=${nixpkgs} \
                 -I nixos-config=./nix/configurations/{{ host }}.nix \
-                --fast \
+                --no-reexec \
                 --file ./default.nix \
                 --attr "nixosConfigurations.{{ host }}"
 
@@ -18,15 +18,18 @@ install host:
         set -euo pipefail
 
         nixpkgs=$(nix-instantiate --eval -E "let sources = import ./npins; in sources.nixpkgs.outPath" | jq -r .)
-        sudo nixos-install \
+        nixos-install \
                 -I nixpkgs=${nixpkgs} \
                 -I nixos-config=./nix/configurations/{{ host }}.nix \
                 --file ./default.nix \
                 --attr "nixosConfigurations.{{ host }}"
 
-cleanup:
-        sudo nix-env --delete-generations +10 -p /nix/var/nix/profiles/system
-        nix-env --delete-generations +10 -p ~/.local/state/nix/profiles/home-manager
+# Retain four weeks of generations so I don't fuck up
+clean-os:
+        nix-env --delete-generations 28d -p /nix/var/nix/profiles/system
+
+clean-hm:
+        nix-env --delete-generations 28d -p ~/.local/state/nix/profiles/home-manager
 
 update:
         npins update
diff --git a/README.md b/README.md
index 402fc97f..97076825 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@ This repo is managed with Nix + GNU stow
 - Generate image & boot
   We do this because the default one doesn't have all the utilities we want (e.g. disko).
   - generate image `nom-build --attr nixosConfigurations.installer.config.system.build.isoImage`
+  - wipe the disk's fs with `wipefs`
   - `dd` the image to a flash drive (remember to `sync`)
   - boot off that flash drive
 
@@ -29,13 +30,57 @@ This repo is managed with Nix + GNU stow
   disko -m disko ./disko.nix # format the drive
 
   # optional for unknown hard ware
-  nixos-generate-config --no-filesystems --root /mnt --dir . # disko will take care of the file system configuration
+  nixos-generate-config --no-filesystems --dir . # disko will take care of the file system configuration
   # put the generated config in the right path and import it
 
-  nixos-install --flake .dotfiles#<hostname>
+  # We do -j 1 because otherwise the kernel or the fonts might use too much
+  # memory at the same time and the system will kaput
+  nixos-install --flake .dotfiles#<hostname> -j 1
+
   # profit
   ```
 
+## Installation for Raspberry Pi
+Raspberry Pi uses the same configuration as the installer.
+The `(modulesPath + "/installer/sd-card/sd-image-aarch64.nix")` allows this.
+
+- Build the image `nixosConfigurations.<name>.config.system.build.sdImage`.
+  Disable stuff like Lix to build this.
+  You might want to use raw password once so you don't have agenix decryption
+  problem while trying to have wpa_supplicant have the right passwords.
+
+- Burn the image to the sd card.
+  ```bash
+  zstdcat result/sd-image/nixos-image-sd-card-<hash>-aarch64-linux.img.zst |
+        doas dd of=/dev/sdb status=progress
+  ```
+
+- profit
+
+## Hetzner, nixos-anywhere
+References:
+- <https://github.com/nix-community/nixos-anywhere/blob/main/docs/quickstart.md>
+- <https://wiki.nixos.org/wiki/Install_NixOS_on_Hetzner_Cloud>
+
+I haven't figured out how to use raid on this machine, as it failed half-way
+through the installer when I used the raid configuration.
+
+### Pitfalls
+- nixos-anywhere will wipe the disk, even if you use the flag `--generate-hardware-config`.
+
+- The command is quite long and isn't non-flake friendly.
+  Note that the diskoScript has to come before toplevel derivation.
+  Read more on the order <https://github.com/nix-community/nixos-anywhere/issues/597>.
+  ```fish
+  nixos-anywhere \
+      --generate-hardware-config nixos-generate-config ./hardware-configuration.nix \
+      -i <ssh_identity> \
+      --store-paths $(nix-build --no-out-link \
+          -A nixosConfigurations.hetzner_benchmark.config.system.build.diskoScript \
+          -A nixosConfigurations.hetzner_benchmark.config.system.build.toplevel) \
+      <user>@<host>
+  ```
+
 # Pitfalls
 ## `users.mutableUsers`
 NEVER set this to true without declaratively setting the passwords.
diff --git a/default.nix b/default.nix
index 7deece54..54690d9e 100644
--- a/default.nix
+++ b/default.nix
@@ -1,18 +1,48 @@
-{sources ? import ./npins}: {
+{
+  sources ? import ./npins,
+}:
+{
   # for repl sessions
   inherit sources;
   lib = import (sources.nixpkgs + "/lib");
 
-  nixosConfigurations = builtins.mapAttrs (_: import (sources.nixpkgs + "/nixos/lib/eval-config.nix")) {
-    vanadium = {
-      system = "x86_64-linux";
-      modules = [./nix/configurations/vanadium.nix];
-    };
-    installer = {
-      system = "x86_64-linux";
-      modules = [./nix/configurations/installer.nix];
-    };
-  };
+  nixosConfigurations =
+    builtins.mapAttrs (_: import (sources.nixpkgs + "/nixos/lib/eval-config.nix"))
+      {
+        vanadium = {
+          system = "x86_64-linux";
+          modules = [ ./nix/configurations/vanadium.nix ];
+        };
+        hydrogen = {
+          system = "aarch64-linux";
+          modules = [ ./nix/configurations/hydrogen.nix ];
+        };
+        iron = {
+          system = "x86_64-linux";
+          modules = [ ./nix/configurations/iron.nix ];
+        };
+        installer = {
+          system = "x86_64-linux";
+          modules = [ ./nix/configurations/installer.nix ];
+        };
+        # Specialized with patches for the GPU
+        installer-macbook-pro-2009 = {
+          system = "x86_64-linux";
+          modules = [
+            ./nix/configurations/installer.nix
+            ./nix/nixosModules/extra/macbook-pro-radeon.nix
+            ./nix/nixosModules/extra/macbook-swap-cmd-opt.nix
+            ./nix/nixosModules/extra/macbook-swap-fn-ctrl.nix
+            ./nix/nixosModules/extra/macbook-broacom-b43.nix
+          ];
+        };
 
-  packages = import ./nix/packages {inherit sources;};
+        # Not mine, rented on hetzner
+        hetzner_benchmark = {
+          system = "x86_64-linux";
+          modules = [ ./nix/configurations/hetzner_benchmark.nix ];
+        };
+      };
+
+  packages = import ./nix/packages { inherit sources; };
 }
diff --git a/nix/configurations/hetzner_benchmark.nix b/nix/configurations/hetzner_benchmark.nix
new file mode 100644
index 00000000..6201e6f1
--- /dev/null
+++ b/nix/configurations/hetzner_benchmark.nix
@@ -0,0 +1,118 @@
+# The hetzner machine rented to benchmark the cabal comment parser
+let
+  sources = import ../../npins;
+
+  hostname = "hetzner_benchmark";
+  username = "leana";
+in
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib.modules) mkAliasOptionModule;
+in
+{
+  imports = [
+    #
+    # Shorthands
+    #
+    (mkAliasOptionModule [ "me" ] [ "users" "users" username ])
+    (mkAliasOptionModule [ "hm" ] [ "home-manager" "users" username ])
+
+    #
+    # hostname
+    #
+    { _module.args = { inherit hostname; }; }
+
+    #
+    # nixpkgs
+    #
+    {
+      # don't use `nixpkgs.flake.source`, it uses flake so it double fetches
+      nix.nixPath = [ "nixpkgs=${sources.nixpkgs}" ];
+
+      nixpkgs = {
+        overlays = map import [
+          ../packages/overlay.nix
+
+          # use lix everywhere and wrap it with nom
+          ../overlays/lix.nix
+          ../overlays/nix-monitored.nix
+        ];
+      };
+
+      nix.package = pkgs.nix-monitored;
+
+      system.nixos =
+        let
+          rev = lib.substring 0 8 sources.nixpkgs.revision;
+        in
+        {
+          versionSuffix = "-git:${rev}";
+          revision = rev;
+        };
+    }
+
+    ./hetzner_benchmark/nixos/hardware-configuration.nix
+    ./hetzner_benchmark/nixos/misc.nix
+    ./hetzner_benchmark/nixos/programs.nix
+
+    ../nixosModules/common/fish.nix
+    ../nixosModules/common/disable-command-not-found.nix
+    ../nixosModules/common/network.nix
+    ../nixosModules/common/sudo-conf.nix
+    ../nixosModules/common/system-nixconf.nix
+
+    ../nixosModules/extra/leana.nix
+
+    #
+    # Extern modules
+    #
+    (sources.disko + "/module.nix")
+    ../disko/hetzner_benchmark/ext4.nix
+
+    #
+    # home-manager
+    #
+    (sources.home-manager + "/nixos")
+    {
+      home-manager = {
+        useGlobalPkgs = true;
+        useUserPackages = true;
+        sharedModules = [ { home.stateVersion = lib.mkDefault config.system.stateVersion; } ];
+      };
+
+      hm.imports = [
+        #
+        # hostname
+        #
+        { _module.args = { inherit hostname; }; }
+
+        #
+        # home modules
+        #
+        ./hetzner_benchmark/home/programs.nix
+        ./hetzner_benchmark/home/dev.nix
+
+        ../homeModules/common/btop
+        ../homeModules/common/fish
+        ../homeModules/common/starship
+        ../homeModules/common/fzf.nix
+        ../homeModules/common/tmux
+        ../homeModules/common/vim
+        ../homeModules/common/direnv.nix
+        ../homeModules/common/git.nix
+        ../homeModules/common/gpg.nix
+        ../homeModules/common/leana.nix
+        ../homeModules/common/locale.nix
+        ../homeModules/common/packages.nix
+        ../homeModules/common/tealdeer.nix
+
+        ../homeModules/extra/tmux-fish-integration.nix
+      ];
+    }
+  ];
+}
diff --git a/nix/configurations/hetzner_benchmark/home/dev.nix b/nix/configurations/hetzner_benchmark/home/dev.nix
new file mode 100644
index 00000000..1a816999
--- /dev/null
+++ b/nix/configurations/hetzner_benchmark/home/dev.nix
@@ -0,0 +1,23 @@
+{
+  programs.git = {
+    enable = true;
+    signing.signByDefault = false; # no need to setup the key
+  };
+
+  programs.gpg.enable = true;
+
+  nix = {
+    settings = {
+      extra-substituters = [
+        "https://ghc-nix.cachix.org"
+        "https://haskell-language-server.cachix.org"
+        "https://cache.iog.io"
+      ];
+      extra-trusted-public-keys = [
+        "ghc-nix.cachix.org-1:ziC/I4BPqeA4VbtOFpFpu6D1t6ymFvRWke/lc2+qjcg="
+        "haskell-language-server.cachix.org-1:juFfHrwkOxqIOZShtC4YC1uT1bBcq2RSvC7OMKx0Nz8="
+        "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
+      ];
+    };
+  };
+}
diff --git a/nix/configurations/hetzner_benchmark/home/programs.nix b/nix/configurations/hetzner_benchmark/home/programs.nix
new file mode 100644
index 00000000..be1cbfc1
--- /dev/null
+++ b/nix/configurations/hetzner_benchmark/home/programs.nix
@@ -0,0 +1,54 @@
+# TODO: remove some packages for this machine
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  home.sessionVariables =
+    let
+      fishCfg = config.programs.fish;
+    in
+    {
+      "SHELL" = lib.mkIf fishCfg.enable (lib.getExe fishCfg.package);
+    };
+
+  home.packages = [
+    pkgs.stow
+    pkgs.zip
+    pkgs.unzip
+    pkgs.gnutar
+    pkgs.p7zip
+    pkgs.bc
+    pkgs.dig
+    pkgs.hutils
+
+    # pretty tui tools
+    pkgs.dust
+    pkgs.tokei
+    pkgs.hyperfine
+    pkgs.watchexec
+    pkgs.onefetch
+    pkgs.just
+  ];
+
+  programs = {
+    neovim = {
+      enable = true;
+      defaultEditor = true;
+    };
+    lazygit.enable = true;
+    fish.enable = true;
+    starship.enable = true;
+    tmux.enable = true;
+    direnv.enable = true;
+    ripgrep.enable = true;
+
+    btop.enable = true;
+  };
+
+  services = {
+    gpg-agent.enable = true;
+  };
+}
diff --git a/nix/configurations/hetzner_benchmark/nixos/hardware-configuration.nix b/nix/configurations/hetzner_benchmark/nixos/hardware-configuration.nix
new file mode 100644
index 00000000..2066ce8f
--- /dev/null
+++ b/nix/configurations/hetzner_benchmark/nixos/hardware-configuration.nix
@@ -0,0 +1,35 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp41s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/nix/configurations/hetzner_benchmark/nixos/misc.nix b/nix/configurations/hetzner_benchmark/nixos/misc.nix
new file mode 100644
index 00000000..d83a0e7b
--- /dev/null
+++ b/nix/configurations/hetzner_benchmark/nixos/misc.nix
@@ -0,0 +1,13 @@
+{
+  boot.loader.grub.enable = true;
+
+  services.openssh.enable = true;
+
+  users.users = {
+    "root".openssh.authorizedKeys.keys = import ../../../identities.nix ++ [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFza3UN1gWQqh//FkJBzmssQ4lxHdllQGfqPHzG4LQI8 benchmark-machine"
+    ];
+  };
+
+  system.stateVersion = "25.05";
+}
diff --git a/nix/configurations/hetzner_benchmark/nixos/programs.nix b/nix/configurations/hetzner_benchmark/nixos/programs.nix
new file mode 100644
index 00000000..58d07dc1
--- /dev/null
+++ b/nix/configurations/hetzner_benchmark/nixos/programs.nix
@@ -0,0 +1,4 @@
+{
+  # Helps with kitty when ssh from remote
+  environment.enableAllTerminfo = true;
+}
diff --git a/nix/configurations/hydrogen.nix b/nix/configurations/hydrogen.nix
new file mode 100644
index 00000000..5a303423
--- /dev/null
+++ b/nix/configurations/hydrogen.nix
@@ -0,0 +1,143 @@
+let
+  sources = import ../../npins;
+
+  hostname = "hydrogen";
+  username = "leana";
+in
+{
+  modulesPath,
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib.modules) mkAliasOptionModule;
+in
+{
+  imports = [
+    # The generator and hardware configuration
+    (modulesPath + "/installer/sd-card/sd-image-aarch64.nix")
+
+    #
+    # Shorthands
+    #
+    (mkAliasOptionModule [ "me" ] [ "users" "users" username ])
+    (mkAliasOptionModule [ "hm" ] [ "home-manager" "users" username ])
+
+    #
+    # hostname
+    #
+    { _module.args = { inherit hostname; }; }
+
+    #
+    # nixpkgs
+    #
+    {
+      # don't use `nixpkgs.flake.source`, it uses flake so it double fetches
+      nix.nixPath = [ "nixpkgs=${sources.nixpkgs}" ];
+
+      nixpkgs = {
+        overlays = map import [
+          ../overlays/agenix.nix
+          ../overlays/nur.nix
+          ../overlays/nix-tree.nix
+          ../packages/overlay.nix
+
+          # use lix everywhere and wrap it with nom
+          ../overlays/lix.nix
+          ../overlays/nix-monitored.nix
+        ];
+      };
+
+      nix.package = pkgs.nix-monitored;
+
+      system.nixos =
+        let
+          rev = lib.substring 0 8 sources.nixpkgs.revision;
+        in
+        {
+          versionSuffix = "-git:${rev}";
+          revision = rev;
+        };
+    }
+
+    ./hydrogen/nixos/misc.nix
+    ./hydrogen/nixos/programs.nix
+    ./hydrogen/nixos/connectivity.nix
+
+    ../nixosModules/common/fish.nix
+    ../nixosModules/common/disable-command-not-found.nix
+    ../nixosModules/common/network.nix
+    ../nixosModules/common/sudo-conf.nix
+    ../nixosModules/common/system-nixconf.nix
+
+    # QUIRK:
+    # Had issue when building the installer as it fails to bootstrap itself
+    # Might be useful to disable for the first build.
+    # ../nixosModules/extra/secure_dns.nix
+    ../nixosModules/extra/leana.nix
+
+    #
+    # Extern modules
+    #
+    (sources.agenix + "/modules/age.nix")
+
+    (sources.nixos-hardware + "/raspberry-pi/4")
+
+    #
+    # home-manager
+    #
+    (sources.home-manager + "/nixos")
+    {
+      home-manager = {
+        useGlobalPkgs = true;
+        useUserPackages = true;
+        sharedModules = [ { home.stateVersion = lib.mkDefault config.system.stateVersion; } ];
+      };
+
+      hm.imports = [
+        #
+        # hostname
+        #
+        { _module.args = { inherit hostname; }; }
+
+        #
+        # home modules
+        #
+        ./hydrogen/home/programs.nix
+        ./hydrogen/home/dev.nix
+
+        ../homeModules/common/btop
+        ../homeModules/common/fish
+        ../homeModules/common/starship
+        ../homeModules/common/fzf.nix
+        ../homeModules/common/tmux
+        ../homeModules/common/vim
+        ../homeModules/common/direnv.nix
+        ../homeModules/common/git.nix
+        ../homeModules/common/gpg.nix
+        ../homeModules/common/leana.nix
+        ../homeModules/common/locale.nix
+        ../homeModules/common/packages.nix
+        ../homeModules/common/tealdeer.nix
+
+        ../homeModules/extra/tmux-fish-integration.nix
+
+        #
+        # Extern modules
+        #
+        (sources.agenix + "/modules/age-home.nix")
+      ];
+    }
+
+    #
+    # Secrets
+    #
+    {
+      age.secrets = {
+        wpa_password.file = "${../secrets/wpa_password.age}";
+      };
+    }
+  ];
+}
diff --git a/nix/configurations/hydrogen/home/dev.nix b/nix/configurations/hydrogen/home/dev.nix
new file mode 100644
index 00000000..1d38b35c
--- /dev/null
+++ b/nix/configurations/hydrogen/home/dev.nix
@@ -0,0 +1,28 @@
+{ pkgs, ... }:
+{
+  home.packages = [
+    pkgs.pyright # python
+  ];
+
+  programs.git = {
+    enable = true;
+    signing.signByDefault = false; # no need to setup the key
+  };
+
+  programs.gpg.enable = true;
+
+  nix = {
+    settings = {
+      extra-substituters = [
+        "https://ghc-nix.cachix.org"
+        "https://haskell-language-server.cachix.org"
+        "https://cache.iog.io"
+      ];
+      extra-trusted-public-keys = [
+        "ghc-nix.cachix.org-1:ziC/I4BPqeA4VbtOFpFpu6D1t6ymFvRWke/lc2+qjcg="
+        "haskell-language-server.cachix.org-1:juFfHrwkOxqIOZShtC4YC1uT1bBcq2RSvC7OMKx0Nz8="
+        "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
+      ];
+    };
+  };
+}
diff --git a/nix/configurations/hydrogen/home/programs.nix b/nix/configurations/hydrogen/home/programs.nix
new file mode 100644
index 00000000..df6c010b
--- /dev/null
+++ b/nix/configurations/hydrogen/home/programs.nix
@@ -0,0 +1,56 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  home.sessionVariables =
+    let
+      fishCfg = config.programs.fish;
+    in
+    {
+      "SHELL" = lib.mkIf fishCfg.enable (lib.getExe fishCfg.package);
+    };
+
+  home.packages = [
+    pkgs.nmap
+    pkgs.stow
+    pkgs.zip
+    pkgs.unzip
+    pkgs.gnutar
+    pkgs.p7zip
+    pkgs.bc
+    pkgs.dig
+    pkgs.hutils
+    pkgs.miniserve
+    pkgs.nix-which
+
+    # # pretty tui tools
+    # pkgs.dust
+    # pkgs.tokei
+    # pkgs.hyperfine
+    # pkgs.watchexec
+    # pkgs.onefetch
+    # pkgs.just
+  ];
+
+  programs = {
+    neovim = {
+      enable = true;
+      defaultEditor = true;
+    };
+    lazygit.enable = true;
+    fish.enable = true;
+    starship.enable = true;
+    tmux.enable = true;
+    direnv.enable = true;
+    ripgrep.enable = true;
+
+    btop.enable = true;
+  };
+
+  services = {
+    gpg-agent.enable = true;
+  };
+}
diff --git a/nix/configurations/hydrogen/nixos/connectivity.nix b/nix/configurations/hydrogen/nixos/connectivity.nix
new file mode 100644
index 00000000..41c5a29f
--- /dev/null
+++ b/nix/configurations/hydrogen/nixos/connectivity.nix
@@ -0,0 +1,36 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+  users.users.root.openssh.authorizedKeys.keys = import ../../../identities.nix;
+
+  networking = {
+    networkmanager.enable = lib.mkForce false;
+
+    firewall.allowedTCPPorts = [
+      8080
+
+      # For 'localsend'
+      # https://github.com/localsend/localsend?tab=readme-ov-file#setup
+      53317
+    ];
+
+    # To enable roaming https://wiki.archlinux.org/title/Wpa_supplicant#Roaming
+    wireless = {
+      enable = true;
+      userControlled.enable = true;
+      secretsFile = config.age.secrets.wpa_password.path;
+      scanOnLowSignal = false;
+      networks =
+        let
+          fromList = import ../../../networks/wpa_supplicant-compat.nix;
+          networks = import ../../../networks/list.nix;
+        in
+        fromList (builtins.filter (x: x.ssid == "~") networks);
+    };
+  };
+
+  hardware.bluetooth.enable = true;
+}
diff --git a/nix/configurations/hydrogen/nixos/misc.nix b/nix/configurations/hydrogen/nixos/misc.nix
new file mode 100644
index 00000000..7dc4601c
--- /dev/null
+++ b/nix/configurations/hydrogen/nixos/misc.nix
@@ -0,0 +1,19 @@
+{
+  system.stateVersion = "25.05";
+
+  swapDevices = [
+    {
+      device = "/var/swapfile";
+      size = 1024; # MB
+    }
+  ];
+
+  # Related https://github.com/NixOS/nixpkgs/issues/154163#issuecomment-1350599022
+  #
+  # modprobe: FATAL: Module sun4i-drm not found in directory /nix/store/gvvwpdckzcr4iamp1iyrqw3nzb7bg6c4-linux-rpi-6.6.51-stable_20241008-modules/lib/modules/6.6.51
+  nixpkgs.overlays = [
+    (final: prev: {
+      makeModulesClosure = x: prev.makeModulesClosure (x // { allowMissing = true; });
+    })
+  ];
+}
diff --git a/nix/configurations/hydrogen/nixos/programs.nix b/nix/configurations/hydrogen/nixos/programs.nix
new file mode 100644
index 00000000..b77c0323
--- /dev/null
+++ b/nix/configurations/hydrogen/nixos/programs.nix
@@ -0,0 +1,20 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = [
+    pkgs.man-pages
+    pkgs.man-pages-posix
+  ];
+
+  #
+  # Programs
+  #
+  programs = {
+    vim.enable = true;
+    vim.defaultEditor = true;
+
+    git.enable = true;
+  };
+
+  # Helps with kitty when ssh from remote
+  environment.enableAllTerminfo = true;
+}
diff --git a/nix/configurations/installer.nix b/nix/configurations/installer.nix
index 44ae03b3..972409e9 100644
--- a/nix/configurations/installer.nix
+++ b/nix/configurations/installer.nix
@@ -4,23 +4,33 @@
 # figured out an elegant (enough) way to do it while keeping my secrets
 # encrypted.
 #
+let
+  sources = import ../../npins;
+in
 {
   pkgs,
   lib,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     ../nixosModules/common/system-nixconf.nix
+    ../nixosModules/common/sudo-conf.nix
 
     (modulesPath + "/installer/cd-dvd/installation-cd-minimal.nix")
   ];
 
   nix.settings = {
-    extra-substituters = ["https://leana8959.cachix.org"];
-    extra-trusted-substituters = ["https://leana8959.cachix.org"];
-    extra-trusted-public-keys = ["leana8959.cachix.org-1:CxQSAp8lcgMv8Me459of0jdXRW2tcyeYRKTiiUq8z0M="];
-    experimental-features = ["nix-command" "flakes"];
+    extra-substituters = [ "https://leana8959.cachix.org" ];
+    extra-trusted-substituters = [ "https://leana8959.cachix.org" ];
+    extra-trusted-public-keys = [
+      "leana8959.cachix.org-1:CxQSAp8lcgMv8Me459of0jdXRW2tcyeYRKTiiUq8z0M="
+    ];
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
   };
 
   nixpkgs = {
@@ -34,6 +44,15 @@
     ];
   };
 
+  system.nixos =
+    let
+      rev = lib.substring 0 8 sources.nixpkgs.revision;
+    in
+    {
+      versionSuffix = "-git:${rev}";
+      revision = rev;
+    };
+
   isoImage.squashfsCompression = "zstd -Xcompression-level 3";
 
   environment.systemPackages = [
@@ -44,7 +63,7 @@
     pkgs.btop
   ];
 
-  networking.firewall.allowedTCPPorts = [8080]; # in case you wanna nc
+  networking.firewall.allowedTCPPorts = [ 8080 ]; # in case you wanna nc
 
   programs.tmux.enable = true;
   users.users.nixos.shell = pkgs.fish;
@@ -63,4 +82,8 @@
   boot.extraModprobeConfig = ''
     options cfg80211 ieee80211_regdom="US"
   '';
+
+  # If we run out of memory during building, the machine would hang, and that sucks.
+  # Nothing worse than restarting the installation from scratch
+  services.earlyoom.enable = true;
 }
diff --git a/nix/configurations/iron.nix b/nix/configurations/iron.nix
new file mode 100644
index 00000000..6745f3a5
--- /dev/null
+++ b/nix/configurations/iron.nix
@@ -0,0 +1,166 @@
+# Entry point to cherry pick modules
+let
+  sources = import ../../npins;
+
+  hostname = "iron";
+  username = "leana";
+in
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib.modules) mkAliasOptionModule;
+in
+{
+  imports = [
+    #
+    # Shorthands
+    #
+    (mkAliasOptionModule [ "me" ] [ "users" "users" username ])
+    (mkAliasOptionModule [ "hm" ] [ "home-manager" "users" username ])
+
+    #
+    # hostname
+    #
+    { _module.args = { inherit hostname; }; }
+
+    #
+    # nixpkgs
+    #
+    {
+      # affect the generated nix.conf, doesn't need to be turned off during nixos-install
+      nix = {
+        distributedBuilds = true;
+        settings.builders-use-substitutes = true;
+
+        # don't use `nixpkgs.flake.source`, it uses flake so it double fetches
+        nixPath = [ "nixpkgs=${sources.nixpkgs}" ];
+      };
+
+      nixpkgs = {
+        overlays = map import [
+          ../overlays/agenix.nix
+          ../overlays/disko.nix
+          ../overlays/nur.nix
+          ../overlays/nix-tree.nix
+          ../overlays/nil.nix
+          ../overlays/dix.nix
+
+          ../packages/overlay.nix
+          # use lix everywhere and wrap it with nom
+          ../overlays/lix.nix
+          ../overlays/nix-monitored.nix
+        ];
+      };
+
+      nix.package = pkgs.nix-monitored;
+
+      system.nixos =
+        let
+          rev = lib.substring 0 8 sources.nixpkgs.revision;
+        in
+        {
+          versionSuffix = "-git:${rev}";
+          revision = rev;
+        };
+    }
+
+    #
+    # NixOS modules
+    #
+    ./iron/nixos/hardware-configuration.nix # generated
+    ./iron/nixos/fs.nix
+
+    ./iron/nixos/battery.nix
+
+    ./iron/nixos/connectivity.nix
+    ./iron/nixos/input.nix
+
+    ./iron/nixos/misc.nix
+
+    ./iron/nixos/display.nix
+
+    ./iron/nixos/locale.nix
+    ./iron/nixos/programs.nix
+
+    ../nixosModules/common/disable-command-not-found.nix
+    ../nixosModules/common/network.nix
+    ../nixosModules/common/sudo-conf.nix
+    ../nixosModules/common/system-nixconf.nix
+
+    ../nixosModules/extra/leana.nix
+
+    #
+    # Extern modules
+    #
+    (sources.disko + "/module.nix")
+    ../disko/iron/btrfs.nix
+
+    (sources.agenix + "/modules/age.nix")
+
+    ../nixosModules/extra/macbook-pro-radeon.nix
+    ../nixosModules/extra/macbook-swap-cmd-opt.nix
+    ../nixosModules/extra/macbook-swap-fn-ctrl.nix
+    ../nixosModules/extra/macbook-broacom-b43.nix
+
+    #
+    # home-manager
+    #
+    (sources.home-manager + "/nixos")
+    {
+      home-manager = {
+        useGlobalPkgs = true;
+        useUserPackages = true;
+        sharedModules = [ { home.stateVersion = lib.mkDefault config.system.stateVersion; } ];
+      };
+
+      hm.imports = [
+        #
+        # hostname
+        #
+        { _module.args = { inherit hostname; }; }
+
+        #
+        # home modules
+        #
+        ./iron/home/programs.nix
+
+        ../homeModules/common/btop
+        ../homeModules/common/fish
+        ../homeModules/common/starship
+        ../homeModules/common/tmux
+        ../homeModules/common/vim
+        ../homeModules/common/direnv.nix
+        ../homeModules/common/fzf.nix
+        ../homeModules/common/git.nix
+        ../homeModules/common/gpg.nix
+        ../homeModules/common/leana.nix
+        ../homeModules/common/locale.nix
+        ../homeModules/common/lazygit.nix
+        ../homeModules/common/packages.nix
+        ../homeModules/common/password-store.nix
+        ../homeModules/common/tealdeer.nix
+        ../homeModules/common/user-nixconf.nix
+
+        ../homeModules/extra/tmux-fish-integration.nix
+
+        #
+        # Extern modules
+        #
+        (sources.agenix + "/modules/age-home.nix")
+      ];
+    }
+
+    #
+    # Secrets
+    #
+    {
+      age.secrets = {
+        wpa_password.file = "${../secrets/wpa_password.age}";
+      };
+    }
+  ];
+}
diff --git a/nix/configurations/iron/home/programs.nix b/nix/configurations/iron/home/programs.nix
new file mode 100644
index 00000000..3368e909
--- /dev/null
+++ b/nix/configurations/iron/home/programs.nix
@@ -0,0 +1,78 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+{
+  home.sessionPath = [
+    "${config.home.homeDirectory}/.local/bin"
+  ];
+
+  home.sessionVariables =
+    let
+      fishCfg = config.programs.fish;
+    in
+    {
+      "SHELL" = lib.mkIf fishCfg.enable (lib.getExe fishCfg.package);
+    };
+
+  home.packages = [
+    pkgs.nmap
+    pkgs.stow
+    pkgs.zip
+    pkgs.unzip
+    pkgs.gnutar
+    pkgs.p7zip
+    pkgs.bc
+    pkgs.dig
+    pkgs.hutils
+    pkgs.miniserve
+    pkgs.agenix
+    pkgs.nix-which
+
+    # pretty tui tools
+    pkgs.dust
+    pkgs.tokei
+    pkgs.hyperfine
+    pkgs.watchexec
+    pkgs.onefetch
+    pkgs.just
+
+    # nix tools
+    pkgs.alejandra
+    pkgs.nurl
+    pkgs.dix
+    pkgs.niv
+    pkgs.npins
+    pkgs.nix-tree
+    pkgs.nh
+  ];
+
+  programs = {
+    neovim = {
+      enable = true;
+      defaultEditor = true;
+    };
+    lazygit.enable = true;
+    fish = {
+      enable = true;
+      shellAbbrs = {
+        "fdoc" = "find ~/Documents -name";
+      };
+    };
+    starship.enable = true;
+    tmux.enable = true;
+    direnv.enable = true;
+    ripgrep.enable = true;
+    password-store.enable = true;
+    tealdeer.enable = true;
+
+    btop.enable = true;
+    cmus.enable = true;
+  };
+
+  services = {
+    gpg-agent.enable = true;
+  };
+}
diff --git a/nix/configurations/iron/nixos/battery.nix b/nix/configurations/iron/nixos/battery.nix
new file mode 100644
index 00000000..54e4a0dd
--- /dev/null
+++ b/nix/configurations/iron/nixos/battery.nix
@@ -0,0 +1,7 @@
+{
+  services.logind.settings = {
+    # It's a server :sparkles:
+    Login.HandleLidSwitch = "ignore";
+    Login.HandleLidSwitchDocked = "ignore";
+  };
+}
diff --git a/nix/configurations/iron/nixos/connectivity.nix b/nix/configurations/iron/nixos/connectivity.nix
new file mode 100644
index 00000000..7cd0abd4
--- /dev/null
+++ b/nix/configurations/iron/nixos/connectivity.nix
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+  users.users.root.openssh.authorizedKeys.keys = import ../../../identities.nix;
+
+  networking = {
+    networkmanager.enable = lib.mkForce false;
+
+    firewall.allowedTCPPorts = [
+      8080
+
+      # For 'localsend'
+      # https://github.com/localsend/localsend?tab=readme-ov-file#setup
+      53317
+    ];
+
+    # To enable roaming https://wiki.archlinux.org/title/Wpa_supplicant#Roaming
+    wireless = {
+      enable = true;
+      userControlled.enable = true;
+      secretsFile = config.age.secrets.wpa_password.path;
+      scanOnLowSignal = false;
+      networks =
+        let
+          fromList = import ../../../networks/wpa_supplicant-compat.nix;
+          networks = import ../../../networks/list.nix;
+        in
+        fromList networks;
+    };
+  };
+
+  services.mullvad-vpn.enable = true;
+
+  hardware.bluetooth.enable = true;
+}
diff --git a/nix/configurations/iron/nixos/display.nix b/nix/configurations/iron/nixos/display.nix
new file mode 100644
index 00000000..9328481c
--- /dev/null
+++ b/nix/configurations/iron/nixos/display.nix
@@ -0,0 +1,4 @@
+{
+  me.extraGroups = [ "video" ];
+  programs.light.enable = true;
+}
diff --git a/nix/configurations/iron/nixos/fs.nix b/nix/configurations/iron/nixos/fs.nix
new file mode 100644
index 00000000..9a636a29
--- /dev/null
+++ b/nix/configurations/iron/nixos/fs.nix
@@ -0,0 +1,24 @@
+{ pkgs, ... }:
+{
+  services.btrfs.autoScrub = {
+    enable = true;
+    fileSystems = [
+      "/"
+      "/home"
+      "/nix"
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    # tmux-sessionizer directories
+    "d /home/leana/r  0700 leana leana -  -"
+    "d /home/leana/pg 0700 leana leana 4w -"
+    "d /home/leana/wt 0700 leana leana -  -"
+  ];
+
+  environment.systemPackages = [
+    pkgs.lsof
+    pkgs.smartmontools
+    pkgs.compsize
+  ];
+}
diff --git a/nix/configurations/iron/nixos/hardware-configuration.nix b/nix/configurations/iron/nixos/hardware-configuration.nix
new file mode 100644
index 00000000..92a104d9
--- /dev/null
+++ b/nix/configurations/iron/nixos/hardware-configuration.nix
@@ -0,0 +1,41 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "firewire_ohci"
+    "usbhid"
+    "uas"
+    "sd_mod"
+    "sr_mod"
+    "sdhci_pci"
+  ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0f0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp3s0b1.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/nix/configurations/iron/nixos/input.nix b/nix/configurations/iron/nixos/input.nix
new file mode 100644
index 00000000..6e8d794e
--- /dev/null
+++ b/nix/configurations/iron/nixos/input.nix
@@ -0,0 +1,11 @@
+{
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "dvorak";
+    options = builtins.concatStringsSep "," [
+      "caps:swapescape"
+      "compose:ralt"
+    ];
+  };
+  console.useXkbConfig = true;
+}
diff --git a/nix/configurations/iron/nixos/locale.nix b/nix/configurations/iron/nixos/locale.nix
new file mode 100644
index 00000000..666053d8
--- /dev/null
+++ b/nix/configurations/iron/nixos/locale.nix
@@ -0,0 +1,53 @@
+{ lib, ... }:
+{
+  # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+  # `timedatectl list-timezones`
+  time.timeZone = "Asia/Taipei";
+
+  i18n = {
+    defaultLocale = "en_US.UTF-8";
+    extraLocales = [
+      "en_US.UTF-8/UTF-8"
+      "fr_FR.UTF-8/UTF-8"
+      "zh_TW.UTF-8/UTF-8"
+    ];
+    extraLocaleSettings =
+      # A list of env variables you might want to set
+      #
+      # "LC_CTYPE"
+      # "LC_NUMERIC"
+      # "LC_TIME"
+      # "LC_COLLATE"
+      # "LC_MONETARY"
+      # "LC_MESSAGES"
+      # "LC_PAPER"
+      # "LC_NAME"
+      # "LC_ADDRESS"
+      # "LC_TELEPHONE"
+      # "LC_MEASUREMENT"
+      # "LC_IDENTIFICATION"
+      let
+        genLocale = locale: lib.flip lib.genAttrs (_: locale);
+      in
+      # - xscreensaver freaks out on the time display
+      # - evolution add event becomes hard to use
+      #   https://gitlab.gnome.org/GNOME/evolution/-/issues/3120
+      genLocale "fr_FR.UTF-8" [
+        "LC_TIME"
+      ]
+      // genLocale "zh_TW.UTF-8" [
+        "LC_MONETARY"
+        "LC_ADDRESS"
+      ];
+  };
+
+  # Wireless Regulatory Domain, uses ISO / IEC 3166 country code
+  #
+  # links:
+  # https://community.frame.work/t/framework-nixos-linux-users-self-help/31426/77
+  # https://wireless.docs.kernel.org/en/latest/en/developers/regulatory.html#the-ieee80211-regdom-module-parameter
+  hardware.wirelessRegulatoryDatabase = true;
+  boot.extraModprobeConfig = ''
+    options cfg80211 ieee80211_regdom="TW"
+  '';
+}
diff --git a/nix/configurations/iron/nixos/misc.nix b/nix/configurations/iron/nixos/misc.nix
new file mode 100644
index 00000000..7f389df2
--- /dev/null
+++ b/nix/configurations/iron/nixos/misc.nix
@@ -0,0 +1,11 @@
+{
+  system.stateVersion = "25.05";
+
+  boot.loader = {
+    systemd-boot = {
+      enable = true;
+      editor = false;
+    };
+    efi.canTouchEfiVariables = true;
+  };
+}
diff --git a/nix/configurations/iron/nixos/programs.nix b/nix/configurations/iron/nixos/programs.nix
new file mode 100644
index 00000000..bc9f95ae
--- /dev/null
+++ b/nix/configurations/iron/nixos/programs.nix
@@ -0,0 +1,17 @@
+{ pkgs, ... }:
+{
+  environment.systemPackages = [
+    pkgs.man-pages
+    pkgs.man-pages-posix
+  ];
+
+  #
+  # Programs
+  #
+  programs = {
+    vim.enable = true;
+    vim.defaultEditor = true;
+
+    git.enable = true;
+  };
+}
diff --git a/nix/configurations/vanadium.nix b/nix/configurations/vanadium.nix
index 208e712e..f881d389 100644
--- a/nix/configurations/vanadium.nix
+++ b/nix/configurations/vanadium.nix
@@ -5,223 +5,239 @@ let
   hostname = "vanadium";
   username = "leana";
 in
-  {
-    config,
-    lib,
-    pkgs,
-    ...
-  }: let
-    inherit (lib.modules) mkAliasOptionModule;
-  in {
-    imports = [
-      #
-      # Shorthands
-      #
-      (mkAliasOptionModule ["me"] ["users" "users" username])
-      (mkAliasOptionModule ["hm"] ["home-manager" "users" username])
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib.modules) mkAliasOptionModule;
+in
+{
+  imports = [
+    #
+    # Shorthands
+    #
+    (mkAliasOptionModule [ "me" ] [ "users" "users" username ])
+    (mkAliasOptionModule [ "hm" ] [ "home-manager" "users" username ])
 
-      #
-      # hostname
-      #
-      {_module.args = {inherit hostname;};}
+    #
+    # hostname
+    #
+    { _module.args = { inherit hostname; }; }
 
-      #
-      # nixpkgs
-      #
-      {
-        # affect the generated nix.conf, doesn't need to be turned off during nixos-install
-        nix = {
-          distributedBuilds = true;
-          settings.builders-use-substitutes = true;
+    #
+    # nixpkgs
+    #
+    {
+      # affect the generated nix.conf, doesn't need to be turned off during nixos-install
+      nix = {
+        distributedBuilds = true;
+        settings.builders-use-substitutes = true;
+
+        # don't use `nixpkgs.flake.source`, it uses flake so it double fetches
+        nixPath = [ "nixpkgs=${sources.nixpkgs}" ];
+      };
+
+      nixpkgs = {
+        config = {
+          # For btop, ROCm support is needed for AMD GPU
+          # https://github.com/aristocratos/btop?tab=readme-ov-file#gpu-compatibility
+          rocmSupport = true;
         };
 
-        nixpkgs = {
-          config = {
-            # For btop, ROCm support is needed for AMD GPU
-            # https://github.com/aristocratos/btop?tab=readme-ov-file#gpu-compatibility
-            rocmSupport = true;
-          };
+        overlays = map import [
+          ../overlays/agenix.nix
+          ../overlays/disko.nix
+          ../overlays/nur.nix
+          ../overlays/wired-notify.nix
+          ../overlays/nix-tree.nix
+          ../overlays/wallpapers.nix
+          ../overlays/nil.nix
+          ../overlays/dix.nix
+          ../overlays/eepy.nix
+          ../overlays/calibre-no-mime.nix
+          ../overlays/fcitx5-table-extra-taiwanese.nix
 
-          overlays =
-            map import
-            [
-              ../overlays/agenix.nix
-              ../overlays/disko.nix
-              ../overlays/nur.nix
-              ../overlays/wired-notify.nix
-              ../overlays/nix-tree.nix
-              ../overlays/wallpapers.nix
-              ../overlays/nil.nix
-              ../overlays/dix.nix
-              ../overlays/eepy.nix
-              ../overlays/calibre-no-mime.nix
-              ../overlays/fcitx5-table-extra-taiwanese.nix
+          ../overlays/iosevka.nix
+          ../packages/overlay.nix
 
-              ../overlays/iosevka.nix
-              ../packages/overlay.nix
+          ./vanadium/overlay.nix
+          ./vanadium/kernel-overlay.nix
 
-              ./vanadium/overlay.nix
+          # removed, but I need it for PLFA!
+          ../overlays/pin-emacs28.nix
 
-              # removed, but I need it for PLFA!
-              ../overlays/pin-emacs28.nix
-            ]
-            # use lix everywhere and wrap it with nom
-            ++ [
-              (import (sources.lix-module + "/overlay.nix") {inherit (sources) lix;})
-              (import ../overlays/nix-monitored.nix)
-            ];
-
-          # Set NIX_PATH and flake registry at the same time
-          # https://github.com/NixOS/nixpkgs/pull/254405
-          flake.source = sources.nixpkgs;
-        };
-
-        nix.package = pkgs.nix-monitored;
-
-        system.nixos.version = lib.substring 0 8 sources.nixpkgs.revision;
-      }
-
-      #
-      # NixOS modules
-      #
-      ./vanadium/nixos/hardware-configuration.nix # generated
-      ./vanadium/nixos/fs.nix
-      ./vanadium/nixos/restic.nix
-
-      ./vanadium/nixos/battery.nix
-
-      ./vanadium/nixos/audio.nix
-      ./vanadium/nixos/connectivity.nix
-      ./vanadium/nixos/secure_dns.nix
-      ./vanadium/nixos/input.nix
-
-      ./vanadium/nixos/misc.nix
-
-      ./vanadium/nixos/display.nix
-      ./vanadium/nixos/gui.nix
-
-      ./vanadium/nixos/locale.nix
-      ./vanadium/nixos/unfree-predicate.nix
-      ./vanadium/nixos/programs.nix
-
-      ../nixosModules/common/disable-command-not-found.nix
-      ../nixosModules/common/network.nix
-      ../nixosModules/common/sudo-conf.nix
-      ../nixosModules/common/system-nixconf.nix
-      ../nixosModules/common/xscreensaver.nix
-
-      ../nixosModules/extra/zram.nix
-      ../nixosModules/extra/leana.nix
-
-      #
-      # Extern modules
-      #
-      (sources.disko + "/module.nix")
-      ../disko/vanadium/btrfs.nix
-
-      (sources.agenix + "/modules/age.nix")
-
-      (import sources.url-eater).nixosModules.default
-
-      (sources.nixos-hardware + "/framework/13-inch/7040-amd")
-
-      #
-      # home-manager
-      #
-      (sources.home-manager + "/nixos")
-      {
-        home-manager = {
-          useGlobalPkgs = true;
-          useUserPackages = true;
-          sharedModules = [{home.stateVersion = lib.mkDefault config.system.stateVersion;}];
-        };
-
-        hm.imports = [
-          #
-          # hostname
-          #
-          {_module.args = {inherit hostname;};}
-
-          #
-          # home modules
-          #
-          ./vanadium/home/programs.nix
-          ./vanadium/home/misc.nix
-
-          ./vanadium/home/firefox.nix
-          ./vanadium/home/xmobar.nix
-
-          # Language server packages, etc
-          ./vanadium/home/dev.nix
-
-          ../homeModules/common/btop
-          ../homeModules/common/cmus
-          ../homeModules/common/fcitx5
-          ../homeModules/common/fish
-          ../homeModules/common/nushell.nix
-          ../homeModules/common/starship
-          ../homeModules/common/tmux
-          ../homeModules/common/vim
-          ../homeModules/common/wired
-          ../homeModules/common/atuin.nix
-          ../homeModules/common/direnv.nix
-          ../homeModules/common/feh.nix
-          ../homeModules/common/firefox.nix
-          ../homeModules/common/fzf.nix
-          ../homeModules/common/git.nix
-          ../homeModules/common/gpg.nix
-          ../homeModules/common/kitty.nix
-          ../homeModules/common/leana.nix
-          ../homeModules/common/locale.nix
-          ../homeModules/common/lazygit.nix
-          ../homeModules/common/packages.nix
-          ../homeModules/common/password-store.nix
-          ../homeModules/common/sioyek.nix
-          ../homeModules/common/tealdeer.nix
-          ../homeModules/common/user-nixconf.nix
-
-          ../homeModules/extra/tmux-fish-integration.nix
-
-          #
-          # Extern modules
-          #
-          (sources.agenix + "/modules/age-home.nix")
-          (import sources.wired-notify).homeManagerModules.default
+          # use lix everywhere and wrap it with nom
+          ../overlays/lix.nix
+          ../overlays/nix-monitored.nix
         ];
-      }
+      };
 
-      #
-      # Secrets
-      #
-      {
-        age.secrets = {
-          wpa_password.file = "${../secrets/wpa_password.age}";
+      nix.package = pkgs.nix-monitored;
 
-          restic_backblaze_pwd.file = "${../secrets/restic_backblaze_pwd.age}";
-          restic_backblaze_repo.file = "${../secrets/restic_backblaze_repo.age}";
-          restic_backblaze_env.file = "${../secrets/restic_backblaze_env.age}";
-
-          four_pwd.file = "${../secrets/four_pwd.age}";
-          restic_four_pwd.file = "${../secrets/restic_four_pwd.age}";
-
-          sgbk_pwd.file = "${../secrets/sgbk_pwd.age}";
-          restic_sgbk_pwd.file = "${../secrets/restic_sgbk_pwd.age}";
-
-          two_pwd.file = "${../secrets/two_pwd.age}";
+      system.nixos =
+        let
+          rev = lib.substring 0 8 sources.nixpkgs.revision;
+        in
+        {
+          versionSuffix = "-git:${rev}";
+          revision = rev;
         };
+    }
 
-        hm = {
-          age.secrets = {
-            sshconfig = {
-              file = "${../secrets/sshconfig.age}";
-              path = "/home/leana/.ssh/config";
-            };
-            iambconfig = {
-              file = "${../secrets/iambconfig.age}";
-              path = "/home/leana/.config/iamb/config.toml";
-            };
+    #
+    # NixOS modules
+    #
+    ./vanadium/nixos/hardware-configuration.nix # generated
+    ./vanadium/nixos/fs.nix
+    ./vanadium/nixos/restic.nix
+
+    ./vanadium/nixos/battery.nix
+
+    ./vanadium/nixos/audio.nix
+    ./vanadium/nixos/connectivity.nix
+    ./vanadium/nixos/input.nix
+
+    ./vanadium/nixos/misc.nix
+
+    ./vanadium/nixos/display.nix
+    ./vanadium/nixos/gui.nix
+
+    ./vanadium/nixos/locale.nix
+    ./vanadium/nixos/unfree-predicate.nix
+    ./vanadium/nixos/programs.nix
+
+    ../nixosModules/common/fish.nix
+    ../nixosModules/common/disable-command-not-found.nix
+    ../nixosModules/common/network.nix
+    ../nixosModules/common/sudo-conf.nix
+    ../nixosModules/common/system-nixconf.nix
+    ../nixosModules/common/xscreensaver.nix
+
+    # QUIRK:
+    # Had issue when building the installer as it fails to bootstrap itself
+    # Might be useful to disable for the first build.
+    # ../nixosModules/extra/secure_dns.nix
+    ../nixosModules/extra/zram.nix
+    ../nixosModules/extra/leana.nix
+
+    #
+    # Extern modules
+    #
+    (sources.disko + "/module.nix")
+    ../disko/vanadium/btrfs.nix
+
+    (sources.agenix + "/modules/age.nix")
+
+    sources.url-eater.asFlake.nixosModules.default
+
+    (sources.nixos-hardware + "/framework/13-inch/7040-amd")
+
+    #
+    # home-manager
+    #
+    (sources.home-manager + "/nixos")
+    {
+      home-manager = {
+        useGlobalPkgs = true;
+        useUserPackages = true;
+        sharedModules = [ { home.stateVersion = lib.mkDefault config.system.stateVersion; } ];
+      };
+
+      hm.imports = [
+        #
+        # hostname
+        #
+        { _module.args = { inherit hostname; }; }
+
+        #
+        # home modules
+        #
+        ./vanadium/home/programs.nix
+        ./vanadium/home/misc.nix
+        ./vanadium/home/gtk.nix
+
+        ./vanadium/home/zen-browser.nix
+        ./vanadium/home/firefox.nix
+        ./vanadium/home/xmobar.nix
+
+        # Language server packages, etc
+        ./vanadium/home/dev.nix
+
+        ../homeModules/common/btop
+        ../homeModules/common/cmus
+        ../homeModules/common/fcitx5
+        ../homeModules/common/fish
+        ../homeModules/common/nushell.nix
+        ../homeModules/common/starship
+        ../homeModules/common/tmux
+        ../homeModules/common/vim
+        ../homeModules/common/wired
+        ../homeModules/common/vlc.nix
+        ../homeModules/common/atuin.nix
+        ../homeModules/common/direnv.nix
+        ../homeModules/common/feh.nix
+        ../homeModules/common/zen-browser.nix
+        ../homeModules/common/firefox.nix
+        ../homeModules/common/fzf.nix
+        ../homeModules/common/git.nix
+        ../homeModules/common/gpg.nix
+        ../homeModules/common/kitty.nix
+        ../homeModules/common/leana.nix
+        ../homeModules/common/locale.nix
+        ../homeModules/common/lazygit.nix
+        ../homeModules/common/packages.nix
+        ../homeModules/common/password-store.nix
+        ../homeModules/common/sioyek.nix
+        ../homeModules/common/tealdeer.nix
+        ../homeModules/common/user-nixconf.nix
+
+        ../homeModules/extra/tmux-fish-integration.nix
+
+        #
+        # Extern modules
+        #
+        (sources.agenix + "/modules/age-home.nix")
+        sources.wired-notify.asFlake.homeManagerModules.default
+
+        sources.zen-browser.asFlake.homeModules.twilight
+      ];
+    }
+
+    #
+    # Secrets
+    #
+    {
+      age.secrets = {
+        wpa_password.file = "${../secrets/wpa_password.age}";
+
+        restic_backblaze_pwd.file = "${../secrets/restic_backblaze_pwd.age}";
+        restic_backblaze_repo.file = "${../secrets/restic_backblaze_repo.age}";
+        restic_backblaze_env.file = "${../secrets/restic_backblaze_env.age}";
+
+        four_pwd.file = "${../secrets/four_pwd.age}";
+        restic_four_pwd.file = "${../secrets/restic_four_pwd.age}";
+
+        sgbk_pwd.file = "${../secrets/sgbk_pwd.age}";
+        restic_sgbk_pwd.file = "${../secrets/restic_sgbk_pwd.age}";
+
+        two_pwd.file = "${../secrets/two_pwd.age}";
+      };
+
+      hm = {
+        age.secrets = {
+          sshconfig = {
+            file = "${../secrets/sshconfig.age}";
+            path = "/home/leana/.ssh/config";
+          };
+          iambconfig = {
+            file = "${../secrets/iambconfig.age}";
+            path = "/home/leana/.config/iamb/config.toml";
           };
         };
-      }
-    ];
-  }
+      };
+    }
+  ];
+}
diff --git a/nix/configurations/vanadium/home/dev.nix b/nix/configurations/vanadium/home/dev.nix
index 5d3b2068..a55be211 100644
--- a/nix/configurations/vanadium/home/dev.nix
+++ b/nix/configurations/vanadium/home/dev.nix
@@ -3,7 +3,8 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   home.packages = [
     # preview markdown
     pkgs.python3Packages.grip
@@ -35,74 +36,19 @@
     signing.signByDefault = true;
     maintenance = {
       enable = true;
-      repositories =
-        lib.map (path: config.home.homeDirectory + "/${path}")
-        [
-          "r/nixos/nixpkgs"
-        ];
+      # We don't deal with worktree folders anyway
+      repositories = lib.map (path: "${config.home.homeDirectory}/r/${path}") [
+        "nixos/nixpkgs"
+        "ghc/ghc"
+        "haskell/cabal"
+      ];
     };
-    includes = let
-      hasconfigRemoteCondition = cfg: let
-        cfg' = builtins.removeAttrs cfg ["url" "path"];
-        path = cfg.path or "*/**";
-      in [
-        (cfg' // {condition = "hasconfig:remote.*.url:git@${cfg.url}:${path}";})
-        (cfg' // {condition = "hasconfig:remote.*.url:https://${cfg.url}/${path}";})
-      ];
-
-      haskellIdentity = {
-        init.defaultBranch = "main";
-        user.name = "Léana Jiang";
-      };
-
-      universityIdentity = {
-        init.defaultBranch = "main";
-        user = {
-          name = "Léana CHIANG";
-          email = "leana.chiang@etudiant.univ-rennes1.fr";
-          signingKey = "0x32035DB97E777EEB";
-        };
-      };
-
-      blameIgnore = {
-        blame.ignoreRevsFile = ".git-blame-ignore-revs";
-      };
-    in
-      builtins.concatMap hasconfigRemoteCondition [
-        # Univ stuff
-        {
-          url = "gitlab.istic.univ-rennes1.fr";
-          contents = universityIdentity;
-        }
-        {
-          url = "gitlab2.istic.univ-rennes1.fr";
-          contents = universityIdentity;
-        }
-
-        # Haskell
-        {
-          url = "gitlab.haskell.org";
-          contents = haskellIdentity;
-        }
-
-        # Blame
-        # Turning this on globally will fail if the file doesn't exist
-        {
-          url = "github.com";
-          path = "nixos/nixpkgs.git";
-          contents = blameIgnore;
-        }
-        {
-          url = "gitlab.haskell.org";
-          path = "ghc/ghc.git";
-          contents = blameIgnore;
-        }
-        {
-          url = "github.com";
-          path = "haskell/cabal.git";
-          contents = blameIgnore;
-        }
-      ];
+    includes =
+      let
+        fromList = import ../../../git-identities/git-compat.nix;
+        identities = import ../../../git-identities/list.nix;
+      in
+      fromList identities;
   };
 
   programs.gpg.enable = true;
@@ -118,13 +64,15 @@
   nix = {
     settings = {
       extra-substituters = [
-        "https://ghc-nix.cachix.org"
+        "https://ghc-nix.cachix.org" # ghc nix-shell
+        "https://ghc.cachix.org" # ghcs
         "https://haskell-language-server.cachix.org"
         "https://helix.cachix.org"
         "https://cache.iog.io"
       ];
       extra-trusted-public-keys = [
         "ghc-nix.cachix.org-1:ziC/I4BPqeA4VbtOFpFpu6D1t6ymFvRWke/lc2+qjcg="
+        "ghc.cachix.org-1:a751hwq9ydeP3Nr6h84iA9zSjxg9Z3uznqi4YBGjsiw="
         "haskell-language-server.cachix.org-1:juFfHrwkOxqIOZShtC4YC1uT1bBcq2RSvC7OMKx0Nz8="
         "helix.cachix.org-1:ejp9KQpR1FBI2onstMQ34yogDm4OgU2ru6lIwPvuCVs="
         "hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
diff --git a/nix/configurations/vanadium/home/firefox.nix b/nix/configurations/vanadium/home/firefox.nix
index c91b2222..6edc85cb 100644
--- a/nix/configurations/vanadium/home/firefox.nix
+++ b/nix/configurations/vanadium/home/firefox.nix
@@ -2,109 +2,97 @@
   pkgs,
   config,
   ...
-}: let
+}:
+let
   inherit (pkgs) nur;
-in {
+in
+{
   programs.firefox = {
-    enable = true;
+    enable = false;
 
-    policies = {
-      SearchEngines = {
-        Default = "leta";
-        Remove = ["Google"];
-        Add = [
-          {
-            Name = "leta";
-            Alias = "@lt";
-            IconURL = "https://leta.mullvad.net/favicon.ico";
-            URLTemplate = "https://leta.mullvad.net/search?q={searchTerms}&engine=brave";
-            SuggestURLTemplate = "https://suggestqueries.google.com/complete/search?q={searchTerms}";
-          }
+    policies.SearchEngines.Add = [
+      # Forges
+      {
+        Name = "GitHub";
+        Alias = "@gh";
+        IconURL = "https://github.com/favicon.ico";
+        Description = "Your code yum yum";
+        URLTemplate = "https://github.com/search?q={searchTerms}&type=repositories";
+      }
+      {
+        Name = "GitHub (Code Search)";
+        Alias = "@ghc";
+        IconURL = "https://github.com/favicon.ico";
+        Description = "Your code yum yum";
+        URLTemplate = "https://github.com/search?q={searchTerms}&type=code";
+      }
+      {
+        Name = "Codeberg";
+        Alias = "@cb";
+        IconURL = "https://codeberg.org/favicon.ico";
+        Description = "Software development, but free!";
+        URLTemplate = "https://codeberg.org/explore/repos?q={searchTerms}";
+      }
+      {
+        Name = "?C";
+        Alias = "@cc";
+        IconURL = "https://git.confusedcompiler.org/favicon.ico";
+        URLTemplate = "https://git.confusedcompiler.org/explore/repos?q={searchTerms}";
+      }
 
-          # Forges
-          {
-            Name = "GitHub";
-            Alias = "@gh";
-            IconURL = "https://github.com/favicon.ico";
-            Description = "Your code yum yum";
-            URLTemplate = "https://github.com/search?q={searchTerms}&type=repositories";
-          }
-          {
-            Name = "GitHub (Code Search)";
-            Alias = "@ghc";
-            IconURL = "https://github.com/favicon.ico";
-            Description = "Your code yum yum";
-            URLTemplate = "https://github.com/search?q={searchTerms}&type=code";
-          }
-          {
-            Name = "Codeberg";
-            Alias = "@cb";
-            IconURL = "https://codeberg.org/favicon.ico";
-            Description = "Software development, but free!";
-            URLTemplate = "https://codeberg.org/explore/repos?q={searchTerms}";
-          }
-          {
-            Name = "?C";
-            Alias = "@cc";
-            IconURL = "https://git.confusedcompiler.org/favicon.ico";
-            URLTemplate = "https://git.confusedcompiler.org/explore/repos?q={searchTerms}";
-          }
+      # Nix{,OS,pkgs}
+      {
+        Name = "NixOS Search (Package)";
+        Alias = "@np";
+        IconURL = "https://nixos.org/favicon.ico";
+        Description = "Search in nixpkgs";
+        URLTemplate = "https://search.nixos.org/packages?query={searchTerms}";
+      }
+      {
+        Name = "NixOS Search (Options)";
+        Alias = "@no";
+        IconURL = "https://nixos.org/favicon.ico";
+        Description = "Search in NixOS options";
+        URLTemplate = "https://search.nixos.org/options?query={searchTerms}";
+      }
 
-          # Nix{,OS,pkgs}
-          {
-            Name = "NixOS Search (Package)";
-            Alias = "@np";
-            IconURL = "https://nixos.org/favicon.ico";
-            Description = "Search in nixpkgs";
-            URLTemplate = "https://search.nixos.org/packages?query={searchTerms}";
-          }
-          {
-            Name = "NixOS Search (Options)";
-            Alias = "@no";
-            IconURL = "https://nixos.org/favicon.ico";
-            Description = "Search in NixOS options";
-            URLTemplate = "https://search.nixos.org/options?query={searchTerms}";
-          }
+      # Haskell
+      {
+        Name = "Flora";
+        Alias = "@hs";
+        IconURL = "https://flora.pm/static/icons/favicon-32x32.png";
+        URLTemplate = "https://flora.pm/search?q={searchTerms}";
+      }
 
-          # Haskell
-          {
-            Name = "Flora";
-            Alias = "@hs";
-            IconURL = "https://flora.pm/static/icons/favicon-32x32.png";
-            URLTemplate = "https://flora.pm/search?q={searchTerms}";
-          }
+      # Discourse
+      {
+        Name = "NixOS Discourse";
+        Alias = "@nd";
+        IconURL = "https://nixos.org/favicon.ico";
+        URLTemplate = "https://discourse.nixos.org/search?q={searchTerms}";
+      }
+      {
+        Name = "Framework Discourse";
+        Alias = "@fd";
+        IconURL = "https://frame.work/favicon.ico";
+        URLTemplate = "https://community.frame.work/search?q={searchTerms}";
+      }
 
-          # Discourse
-          {
-            Name = "NixOS Discourse";
-            Alias = "@nd";
-            IconURL = "https://nixos.org/favicon.ico";
-            URLTemplate = "https://discourse.nixos.org/search?q={searchTerms}";
-          }
-          {
-            Name = "Framework Discourse";
-            Alias = "@fd";
-            IconURL = "https://frame.work/favicon.ico";
-            URLTemplate = "https://community.frame.work/search?q={searchTerms}";
-          }
-
-          # Misc
-          {
-            Name = "YouTube";
-            Alias = "@yt";
-            IconURL = "https://youtube.com/favicon.ico";
-            SuggestURLTemplate = "http://suggestqueries.google.com/complete/search?q={searchTerms}&ds=yt";
-            URLTemplate = "https://www.youtube.com/results?search_query={searchTerms}";
-          }
-          {
-            Name = "Genius";
-            Alias = "@geni";
-            IconURL = "https://genius.com/favicon.ico";
-            URLTemplate = "https://genius.com/search?q={searchTerms}";
-          }
-        ];
-      };
-    };
+      # Misc
+      {
+        Name = "YouTube";
+        Alias = "@yt";
+        IconURL = "https://youtube.com/favicon.ico";
+        SuggestURLTemplate = "http://suggestqueries.google.com/complete/search?q={searchTerms}&ds=yt";
+        URLTemplate = "https://www.youtube.com/results?search_query={searchTerms}";
+      }
+      {
+        Name = "Genius";
+        Alias = "@geni";
+        IconURL = "https://genius.com/favicon.ico";
+        URLTemplate = "https://genius.com/search?q={searchTerms}";
+      }
+    ];
 
     profiles = {
       default = {
@@ -120,26 +108,29 @@ in {
             font-family: monospace;
           }
         '';
-        extensions.packages = let
-          addons = nur.repos.rycee.firefox-addons;
-        in [
-          addons.sponsorblock
-          addons.return-youtube-dislikes
-          addons.consent-o-matic
-        ];
+        extensions.packages =
+          let
+            addons = nur.repos.rycee.firefox-addons;
+          in
+          [
+            addons.sponsorblock
+            addons.return-youtube-dislikes
+            addons.consent-o-matic
+          ];
       };
 
       junk = {
         id = 1;
-        inherit
-          (config.programs.firefox.profiles.default)
+        inherit (config.programs.firefox.profiles.default)
           settings
           userChrome
           ;
 
-        extensions.packages = let
-          addons = nur.repos.rycee.firefox-addons;
-        in [addons.multi-account-containers];
+        extensions.packages =
+          let
+            addons = nur.repos.rycee.firefox-addons;
+          in
+          [ addons.multi-account-containers ];
 
         containers = {
           raisin = {
@@ -158,15 +149,16 @@ in {
       # Isolate it because it's proprietary
       tampermonkey = {
         id = 2;
-        inherit
-          (config.programs.firefox.profiles.default)
+        inherit (config.programs.firefox.profiles.default)
           settings
           userChrome
           ;
 
-        extensions.packages = let
-          addons = nur.repos.rycee.firefox-addons;
-        in [addons.tampermonkey];
+        extensions.packages =
+          let
+            addons = nur.repos.rycee.firefox-addons;
+          in
+          [ addons.tampermonkey ];
       };
     };
   };
diff --git a/nix/configurations/vanadium/home/gtk.nix b/nix/configurations/vanadium/home/gtk.nix
new file mode 100644
index 00000000..f059868e
--- /dev/null
+++ b/nix/configurations/vanadium/home/gtk.nix
@@ -0,0 +1,38 @@
+{ pkgs, ... }:
+{
+  home.packages = [
+    pkgs.pantheon.elementary-sound-theme
+  ];
+
+  # Note: this would automatically recurse into gtk{2,3,4} settings
+  # In version prior to 25.11 it doesn't do this.
+  gtk.enable = true;
+  gtk = {
+    font = {
+      name = "Ubuntu";
+      package = pkgs.ubuntu-classic;
+    };
+    iconTheme = {
+      name = "Adwaita";
+      package = pkgs.gnome-themes-extra;
+    };
+    theme = {
+      name = "Adwaita";
+      package = pkgs.gnome-themes-extra;
+    };
+
+    # TODO: open an issue, why are the types inconsistent? ew.
+    gtk2.extraConfig = ''
+      gtk-sound-theme-name = "elementary"
+    '';
+    gtk3.extraConfig = {
+      gtk-sound-theme-name = "elementary";
+    };
+    gtk4.extraConfig = {
+      gtk-sound-theme-name = "elementary";
+    };
+  };
+  dconf.settings = {
+    "org/gnome/desktop/sound".theme-name = "elementary";
+  };
+}
diff --git a/nix/configurations/vanadium/home/misc.nix b/nix/configurations/vanadium/home/misc.nix
index 4cf015ee..ae41030e 100644
--- a/nix/configurations/vanadium/home/misc.nix
+++ b/nix/configurations/vanadium/home/misc.nix
@@ -1,19 +1,21 @@
 {
   pkgs,
-  lib,
-  nixosConfig ? {},
   ...
-}: {
+}:
+{
   #
   # fonts
   #
   fonts.fontconfig = {
     enable = true;
-    defaultFonts = lib.mapAttrsRecursive (_: v: v ++ ["Last Resort"]) {
-      sansSerif = ["Ubuntu" "Noto Sans CJK TC"];
-      serif = ["Noto Serif CJK TC"];
-      monospace = ["Iosevka"];
-      emoji = ["Noto Color Emoji"];
+    defaultFonts = {
+      sansSerif = [
+        "Ubuntu"
+        "Noto Sans CJK TC"
+      ];
+      serif = [ "Noto Serif CJK TC" ];
+      monospace = [ "Iosevka" ];
+      emoji = [ "Noto Color Emoji" ];
     };
   };
   home.packages = [
@@ -25,12 +27,11 @@
     pkgs.noto-fonts-emoji-blob-bin
     pkgs.ubuntu-classic
     pkgs.iosevka
-    pkgs.last-resort
   ];
 
   home.file = {
     ".xscreensaver".source = "${./xscreensaver/.xscreensaver}";
-    ".wallpaper".source = "${pkgs.wallpapers.y-combinator}/main.svg";
+    ".wallpaper".source = "${pkgs.wallpapers.packages.serial_experiments_lain.lain_red_bg}";
   };
   xdg.configFile = {
     "xmonad".source = "${./xmonad}";
@@ -38,13 +39,9 @@
   home.pointerCursor = {
     x11.enable = true;
     gtk.enable = true;
-
-    inherit
-      (nixosConfig.services.xserver.displayManager.lightdm.greeters.gtk.cursorTheme)
-      name
-      package
-      size
-      ;
+    name = "Posy_Cursor_Black";
+    package = pkgs.posy-cursors;
+    size = 72;
   };
   xresources.properties."Xft.dpi" = 150;
   i18n.inputMethod = {
@@ -52,10 +49,15 @@
     type = "fcitx5";
   };
 
-  xdg.mimeApps = {
-    enable = true;
-    defaultApplications = {
-      "x-scheme-handler/mailto" = ["org.gnome.Evolution.desktop"];
+  xdg.mimeApps =
+    let
+      associations = {
+        "x-scheme-handler/mailto" = [ "org.gnome.Evolution.desktop" ];
+      };
+    in
+    {
+      enable = true;
+      associations.added = associations;
+      defaultApplications = associations;
     };
-  };
 }
diff --git a/nix/configurations/vanadium/home/programs.nix b/nix/configurations/vanadium/home/programs.nix
index 597e550a..a2b44af7 100644
--- a/nix/configurations/vanadium/home/programs.nix
+++ b/nix/configurations/vanadium/home/programs.nix
@@ -3,16 +3,19 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   home.sessionPath = [
     "${config.home.homeDirectory}/.local/bin"
   ];
 
-  home.sessionVariables = let
-    fishCfg = config.programs.fish;
-  in {
-    "SHELL" = lib.mkIf fishCfg.enable (lib.getExe fishCfg.package);
-  };
+  home.sessionVariables =
+    let
+      fishCfg = config.programs.fish;
+    in
+    {
+      "SHELL" = lib.mkIf fishCfg.enable (lib.getExe fishCfg.package);
+    };
 
   home.packages = [
     pkgs.ghc # my favorite calculator
@@ -37,9 +40,7 @@
     # lol
     pkgs.macchanger
 
-    /*
-    The file picker is not ergonomic enough, sadly
-    */
+    # The file picker is not ergonomic enough, sadly
     # pkgs.helix
     # pkgs.nushell
 
@@ -49,7 +50,7 @@
     pkgs.zbar
 
     # pdf
-    pkgs.poppler_utils # pdfseparate, pdfunite
+    pkgs.poppler-utils # pdfseparate, pdfunite
     pkgs.easyscan
 
     # fun
@@ -61,7 +62,7 @@
     # pkgs.necrolib
 
     # pretty tui tools
-    pkgs.du-dust
+    pkgs.dust
     pkgs.tokei
     pkgs.hyperfine
     pkgs.watchexec
@@ -69,7 +70,10 @@
     pkgs.just
 
     # nix tools
-    pkgs.alejandra
+    # # Alejandra handles inline comments poorly
+    # # https://github.com/kamadorueda/alejandra/issues/429
+    # pkgs.alejandra
+    pkgs.nixfmt-rfc-style
     pkgs.nurl
     pkgs.dix
     pkgs.niv
@@ -98,6 +102,7 @@
     pkgs.mousai
     pkgs.localsend # file share with iOS
     pkgs.minder # mindmap tool
+    pkgs.mkvtoolnix
 
     # social
     pkgs.iamb
@@ -105,6 +110,7 @@
     pkgs.signal-desktop
     pkgs.tuba # mastodon GUI client
     pkgs.emoji-picker-rs
+    pkgs.telegram-desktop # for archlinux china
 
     # wm utilities
     pkgs.xbrightness
@@ -117,6 +123,8 @@
     # audio utilities
     pkgs.helvum
     pkgs.pavucontrol
+    pkgs.pulseaudio # pactl value control
+    pkgs.pantheon.elementary-sound-theme
   ];
 
   programs = {
@@ -156,7 +164,12 @@
     kitty = {
       enable = true;
       font.size = 12; # sweet spot for framework 13
-      settings.shell = lib.getExe config.programs.fish.package;
+      settings = {
+        shell = lib.getExe config.programs.fish.package;
+        # https://github.com/kovidgoyal/kitty/issues/1866
+        # https://sw.kovidgoyal.net/kitty/conf/#terminal-bell
+        linux_bell_theme = "elementary";
+      };
     };
 
     chromium.enable = true;
@@ -169,7 +182,7 @@
 
     gnome-keyring = {
       enable = true;
-      components = ["secrets"];
+      components = [ "secrets" ];
     };
   };
 }
diff --git a/nix/configurations/vanadium/home/xmobar.nix b/nix/configurations/vanadium/home/xmobar.nix
index 40476f66..0da89245 100644
--- a/nix/configurations/vanadium/home/xmobar.nix
+++ b/nix/configurations/vanadium/home/xmobar.nix
@@ -1,23 +1,32 @@
-{pkgs, ...}: {
-  home.packages = let
-    inherit (pkgs) lib;
+{ pkgs, ... }:
+{
+  home.packages =
+    let
+      inherit (pkgs) lib;
 
-    ghc = pkgs.haskellPackages.ghc.withPackages (haskellPackages: [
-      haskellPackages.xmobar
-    ]);
+      ghc = pkgs.haskellPackages.ghc.withPackages (haskellPackages: [
+        haskellPackages.xmobar
+      ]);
 
-    wrapped-xmobar = pkgs.symlinkJoin {
-      name = "xmobar";
-      paths = [pkgs.xmobar];
-      buildInputs = [pkgs.makeWrapper];
-      postBuild = ''
-        wrapProgram $out/bin/xmobar \
-          --prefix PATH : "${lib.makeBinPath [ghc pkgs.libnotify]}"
-      '';
-    };
-  in [
-    wrapped-xmobar
-  ];
+      wrapped-xmobar = pkgs.symlinkJoin {
+        name = "xmobar";
+        paths = [ pkgs.xmobar ];
+        buildInputs = [ pkgs.makeWrapper ];
+        postBuild = ''
+          wrapProgram $out/bin/xmobar \
+            --prefix PATH : "${
+              lib.makeBinPath [
+                ghc
+                pkgs.libnotify
+                pkgs.hrt-time
+              ]
+            }"
+        '';
+      };
+    in
+    [
+      wrapped-xmobar
+    ];
 
   xdg.configFile = {
     "xmobar" = {
diff --git a/nix/configurations/vanadium/home/xmobar/xmobar.hs b/nix/configurations/vanadium/home/xmobar/xmobar.hs
index 1117d7cd..314f4d50 100644
--- a/nix/configurations/vanadium/home/xmobar/xmobar.hs
+++ b/nix/configurations/vanadium/home/xmobar/xmobar.hs
@@ -61,12 +61,7 @@ config =
     , textOffset       = 2
 
     , commands =
-        [ Run $ DateZone "%a %d %H:%M:%S" "" ""                 "hereClock"    (1  &second)
-        , Run $ DateZone "%H:%M"          "" "America/Aruba"    "arubaClock"   (10 &second)
-        , Run $ DateZone "%H:%M"          "" "Europe/Dublin"    "dublinClock"  (10 &second)
-        , Run $ DateZone "%H:%M"          "" "America/New_York" "newYorkClock" (10 &second)
-        , Run $ DateZone "%H:%M"          "" "Europe/Paris"     "cetClock"     (10 &second)
-        , Run $ DateZone "%H:%M"          "" "Asia/Taipei"      "tstClock"     (10 &second)
+        [ Run $ DateZone "%a %d %H:%M:%S" "" "" "hereClock"    (1  &second)
         , Run $
             Com
               "tomorrow"
@@ -76,9 +71,13 @@ config =
               , "--target", "2025-09-16=snip snip"
               , "--target", "2025-10-13=no teef"
               , "--target", "2025-10-31=dragon book"
+              , "--target", "2025-11-19=scalpel"
               , "--target", "2025-11-29=à deux"
-              , "--target", "2025-12-16=dragon book²"
+              , "--target", "2025-12-16=dragon book"
               , "--target", "2025-12-30=seule"
+              , "--target", "2025-12-15=campus baguette"
+              , "--target", "2026-02-02=monmaster"
+              , "--target", "2026-02-22=dernier appel"
               ]
               ""
               (60 &minute)
@@ -102,6 +101,7 @@ config =
               ]
               (6 &second)
         , Run $ Com "powerprofilesctl" ["get"] "" (6 &second)
+        , Run $ Com "hrt-time" ["days"] "" (60 &minute)
         , Run XMonadLog
         , Run $
             Weather
@@ -122,17 +122,9 @@ config =
           " %XMonadLog% "
             <> alignSep config
             <> intercalate "|"
-              [ (unwords . map greyFg)
-                  [ "[AUA: %arubaClock%]"
-                  , "[DUB: %dublinClock%]"
-                  , "[JFK: %newYorkClock%]"
-                  , "[CDG: %cetClock%]"
-                  , "[TPE: %tstClock%]"
-                  ]
-                <> " "
-              , " %RCSS% "
+              [ " %RCSS% "
               , " %battery%, %powerprofilesctl%) "
-              , " %hereClock% (%tomorrow%) "
+              , " %hereClock% (%tomorrow%, %hrt-time%) "
               ]
     }
 
diff --git a/nix/configurations/vanadium/home/xmonad/leanamonad.cabal b/nix/configurations/vanadium/home/xmonad/leanamonad.cabal
index 63d6b030..bfe56163 100644
--- a/nix/configurations/vanadium/home/xmonad/leanamonad.cabal
+++ b/nix/configurations/vanadium/home/xmonad/leanamonad.cabal
@@ -18,14 +18,14 @@ common common
     , xmonad-contrib
     , containers
     , X11
-  default-language: GHC2021
+  default-language: Haskell2010
 
 library
   import: common
   hs-source-dirs: lib
   exposed-modules:
-    Leanamonad.Layouts.ReflectMsg
-    Leanamonad.GreekChar
+    XMonad.Layout.Reflect.Message
+    Data.Char.Greek
 
 executable leanamonad
   import: common
diff --git a/nix/configurations/vanadium/home/xmonad/lib/Leanamonad/GreekChar.hs b/nix/configurations/vanadium/home/xmonad/lib/Data/Char/Greek.hs
similarity index 95%
rename from nix/configurations/vanadium/home/xmonad/lib/Leanamonad/GreekChar.hs
rename to nix/configurations/vanadium/home/xmonad/lib/Data/Char/Greek.hs
index 844e05b5..43e8b23f 100644
--- a/nix/configurations/vanadium/home/xmonad/lib/Leanamonad/GreekChar.hs
+++ b/nix/configurations/vanadium/home/xmonad/lib/Data/Char/Greek.hs
@@ -1,4 +1,4 @@
-module Leanamonad.GreekChar where
+module Data.Char.Greek where
 
 import Data.List (find)
 
diff --git a/nix/configurations/vanadium/home/xmonad/lib/Leanamonad/Layouts/ReflectMsg.hs b/nix/configurations/vanadium/home/xmonad/lib/XMonad/Layout/Reflect/Message.hs
similarity index 86%
rename from nix/configurations/vanadium/home/xmonad/lib/Leanamonad/Layouts/ReflectMsg.hs
rename to nix/configurations/vanadium/home/xmonad/lib/XMonad/Layout/Reflect/Message.hs
index c8cbd263..61811072 100644
--- a/nix/configurations/vanadium/home/xmonad/lib/Leanamonad/Layouts/ReflectMsg.hs
+++ b/nix/configurations/vanadium/home/xmonad/lib/XMonad/Layout/Reflect/Message.hs
@@ -1,6 +1,7 @@
-{-# LANGUAGE NegativeLiterals #-}
+{-# LANGUAGE FlexibleInstances #-}
+{-# LANGUAGE MultiParamTypeClasses #-}
 
-module Leanamonad.Layouts.ReflectMsg where
+module XMonad.Layout.Reflect.Message where
 
 import XMonad (
   Resize (Expand, Shrink),
diff --git a/nix/configurations/vanadium/home/xmonad/xmonad.hs b/nix/configurations/vanadium/home/xmonad/xmonad.hs
index d4de3680..dd1c6ffc 100644
--- a/nix/configurations/vanadium/home/xmonad/xmonad.hs
+++ b/nix/configurations/vanadium/home/xmonad/xmonad.hs
@@ -1,45 +1,53 @@
 {-# LANGUAGE NegativeLiterals  #-}
-{-# LANGUAGE LambdaCase        #-}
+{-# OPTIONS_GHC -Wno-missing-signatures #-} -- my layout is getting crazy
 
 import XMonad
+import XMonad.Actions.CopyWindow
+import XMonad.Actions.PerWorkspaceKeys
 import XMonad.Actions.Submap
 import XMonad.Actions.SwapWorkspaces
 import XMonad.Hooks.DynamicLog
 import XMonad.Hooks.EwmhDesktops
-import XMonad.Hooks.FadeWindows
 import XMonad.Hooks.InsertPosition
 import XMonad.Hooks.ManageDocks
 import XMonad.Hooks.ManageHelpers
+import XMonad.Hooks.OnPropertyChange
 import XMonad.Hooks.RefocusLast
 import XMonad.Hooks.StatusBar
+import XMonad.Layout.Accordion
+import XMonad.Layout.Grid
+import XMonad.Layout.IfMax
+import XMonad.Layout.LimitWindows
+import XMonad.Layout.Maximize
 import XMonad.Layout.NoBorders
-import XMonad.Layout.Reflect
+import XMonad.Layout.PerWorkspace
 import XMonad.Layout.Renamed
 import XMonad.Layout.ResizableTile
 import XMonad.Layout.Spacing
-import XMonad.StackSet qualified as W
+import XMonad.Layout.ThreeColumns
+import XMonad.Layout.ToggleLayouts
+import qualified XMonad.StackSet as W
 import XMonad.Util.EZConfig
 import XMonad.Util.Hacks
 import XMonad.Util.NamedScratchpad
 import XMonad.Util.SpawnOnce
-import XMonad.Layout.Magnifier
 
-import Data.Map.Strict              qualified as M
-import Data.Monoid
+import Data.Char.Greek
+import Data.Ratio
+import Data.Semigroup
+import qualified Data.Map.Strict as M
 import System.Posix
 import Graphics.X11.ExtraTypes.XF86
 
-import Leanamonad.Layouts.ReflectMsg
-import Leanamonad.GreekChar
-
 main :: IO ()
 main =
   xmonad
   -- Fix all java things that don't scale with XMonad
   -- https://wiki.archlinux.org/title/java#Gray_window,_applications_not_resizing_with_WM,_menus_immediately_closing
-  . javaHack
-  . withSB xmobarConfig . docks
-  . ewmhFullscreen . ewmh
+  $ javaHack
+  $ withSB xmobarConfig . docks
+  $ setEwmhActivateHook myActivateHook
+  $ ewmhFullscreen . ewmh
   $ def
       { modMask            = superMask
       , borderWidth        = 5
@@ -48,208 +56,306 @@ main =
       , focusFollowsMouse  = True
       , terminal           = myTerm
       , workspaces         = myWorkspaces
-
-      , logHook =
-          let
-            fadeHook =
-              composeOne
-                [ -- easier to paint over stuff
-                  isFloating
-                      <&&> isFocused
-                      <&&> title ~? "Wplace"
-                    -?> transparency 0.5
-
-                  -- matches the second string of the WM_CLASS
-                , className `isOneOf`
-                      [ "firefox"
-                      , "Signal"
-                      , "steam"
-                      , "discord"
-                      ]
-                    -?> opaque
-
-                , isFloating  -?> ifM isFocused (transparency 0.04) (transparency 0.08)
-                , isUnfocused -?> transparency 0.02
-                ]
-           in
-            fadeWindowsLogHook fadeHook
-              <> refocusLastLogHook
-
-      , startupHook = do
-          spawnOnce "fcitx5 &"                                -- Input method
-
-          spawn "feh --no-fehbg --bg-fill ~/.wallpaper &" -- wallpaper
-
-          -- Needed to make gnome keyring work
-          -- https://wiki.archlinux.org/title/GNOME/Keyring#Using_gnome-keyring-daemon_outside_desktop_environments_(KDE,_GNOME,_XFCE,_...)
-          spawn "dbus-update-activation-environment DISPLAY XAUTHORITY WAYLAND_DISPLAY"
-
-          io $ do
-            -- This is done here because:
-            -- - setting `home.sessionVariable` (home-manager) would only effect shells, probably due to the order of launched processes blah blah
-            -- - setting `environment.sessionVariables` (NixOS) would make my set up less portable
-            putEnv "GLFW_IM_MODULE=ibus"  -- Make sure kitty knows how to talk to fcitx
-            putEnv "MOZ_USE_XINPUT2=1"    -- Force touchpad for firefox
-
-      , layoutHook =
-          let tallr = named "Normal"
-                      $ smartSpacingWithEdge 5
-                      $ reflectMsg . reflectHoriz
-                      $ ResizableTall 1 (1/10) (3/7) []
-              mag = magnifyxy 1.05 1.3 (NoMaster 3) False
-           in avoidStruts . smartBorders $
-                mag tallr ||| Full
-
-      , manageHook =
-          let
-            hasEvenWindows :: X Bool
-            hasEvenWindows = g <$> get
-              where g = even . length . W.integrate'
-                        . W.stack . W.workspace . W.current . windowset
-
-            -- When having a lot of windows this will converge into the middle of the stack
-            insertInMiddle :: Query (Endo WindowSet)
-            insertInMiddle =
-              ifM
-                (liftX hasEvenWindows)
-                (insertPosition Below Newer) -- New window is odd
-                (insertPosition Above Newer) -- New window is even
-          in
-            composeAll
-              [ className ~? "NautilusPreviewer"  --> customFloating centeredFloat
-              , className =? "feh"                --> customFloating buttomRightFloat
-              , className =? "Minder"
-                    <&&> not <$> title ~? "Pick a Color" -- ignore the color picker
-                  --> customFloating centeredFloat
-              , isFirefoxPIP                      --> doFloat
-
-              , namedScratchpadManageHook myScratchpads
-              ]
-
-            <>
-            composeOne
-              [ className =? "firefox" -?> insertPosition Master Newer
-              , className =? "kitty"   -?> insertPosition Below Newer
-              , className `isOneOf`
-                    [ "sioyek"
-                    , "Nautilus"
-                    ]
-                  -?> insertPosition End Older
-              , Just <$> insertInMiddle
-              ]
+      , logHook            = refocusLastLogHook
+      , startupHook        = myStartupHook
+      , layoutHook         = myLayout
+      , manageHook         = myManageHook
+      , handleEventHook    = myEventHandleHook
       }
 
-    -- Only remove mappings that needs pass through (it's a map).
-    `removeKeys`
-      [ (superMask, xK_h)
-      , (superMask, xK_l)
-      , (superMask, xK_p)
+    -- Only remove mappings that needs pass through
+    `removeKeys` removedKeybinds
+    `additionalKeys` keybinds
 
-        -- It has been more than once that I actidently killed xmonad >:(
-      , (superMask .|. shiftMask, xK_q)
-      ]
-      ++ [ (superMask              , n) | n <- [xK_1 .. xK_9] ]
-      ++ [ (superMask .|. shiftMask, n) | n <- [xK_1 .. xK_9] ]
+myLayout =
+    avoidStruts
+  $ smartBorders
+  $ onWorkspace chatWS       (ifMaxToggle 2 grid accordion)
+  $ onWorkspace multimediaWS (ifMaxToggle 2 grid accordion)
+  -- Magifier doesn't work well with threecol's slaves
+  -- Full has the property of "only maximizing the focused one"
+  -- Maximize can have a window maximized but not focused, might be useful when programming
+  $ maximizeWithPadding 0 threecol
+  where
+    ifMaxToggle n tog l = ifMax n l (toggleLayouts tog l)
+    threecol =
+      renamed [ Replace "3Col" ]
+       $ smartSpacingWithEdge 5
+       $ ThreeColMid 1 (3/100) (1/2)
 
-    `additionalKeys`
-      [
-      -- Display
-        ((0,         xF86XK_MonBrightnessDown), spawn "light -U 5")
-      , ((0,         xF86XK_MonBrightnessUp  ), spawn "light -A 5")
-      , ((shiftMask, xF86XK_MonBrightnessDown), spawn "light -U 1")
-      , ((shiftMask, xF86XK_MonBrightnessUp  ), spawn "light -A 1")
-      , ((altMask,   xF86XK_MonBrightnessUp  ), spawn "autorandr --change --ignore-lid")
-      , ((altMask,   xF86XK_MonBrightnessDown), spawn "autorandr --change --ignore-lid")
+    grid =
+      renamed [ Replace "Grid" ]
+      $ smartSpacingWithEdge 5
+      $ Grid
 
-      -- Volume adjustments
-      -- Don't overload the mute button
-      -- In case of doubt, smashing the button becomes deterministic
-      , ((0,           xF86XK_AudioMute),        spawn "pactl -- set-sink-mute 0 1"    ) -- mute
-      , ((controlMask, xF86XK_AudioMute),        spawn "pactl -- set-sink-mute 0 0"    ) -- unmute
-      , ((0,           xF86XK_AudioLowerVolume), spawn "pactl -- set-sink-volume 0 -5%")
-      , ((0,           xF86XK_AudioRaiseVolume), spawn "pactl -- set-sink-volume 0 +5%")
-      , ((shiftMask,   xF86XK_AudioLowerVolume), spawn "pactl -- set-sink-volume 0 -1%")
-      , ((shiftMask,   xF86XK_AudioRaiseVolume), spawn "pactl -- set-sink-volume 0 +1%")
+    accordion =
+      renamed [ Replace "Accordion" ]
+      $ smartSpacingWithEdge 5
+      $ limitSlice 3
+      $ Accordion
 
-      -- Playback control
-      , ((0, xF86XK_AudioPrev), spawn "playerctl previous"  )
-      , ((0, xF86XK_AudioPlay), spawn "playerctl play-pause")
-      , ((0, xF86XK_AudioNext), spawn "playerctl next"      )
+isSioyek :: Query Bool
+isSioyek = className =? "sioyek"
 
-      -- Toggle fullscreen
-      , ((superMask, xK_Escape), sendMessage NextLayout)
+isDiscord :: Query Bool
+isDiscord =
+  let electronDiscord = className =? "discord"
+      firefoxDiscord = isFirefox <&&> title ~? "Discord"
+  in  electronDiscord <||> firefoxDiscord
 
-      -- Resize windows
-      , ((superMask, xK_equal               ), sendMessage $ IncMasterN  1)
-      , ((superMask, xK_minus               ), sendMessage $ IncMasterN -1)
-      , ((superMask, xK_comma               ), sendMessage Shrink         )
-      , ((superMask, xK_period              ), sendMessage Expand         )
-      , ((superMask .|. shiftMask, xK_comma ), sendMessage MirrorShrink   )
-      , ((superMask .|. shiftMask, xK_period), sendMessage MirrorExpand   )
-      , ((superMask              , xK_apostrophe), sendMessage Toggle     )
+isEvolution :: Query Bool
+isEvolution = className ~? "gnome.Evolution"
 
-      -- [D]o sink and lift
-      , ( (superMask, xK_d)
-        , submap $ M.fromList
-            [ ((0, xK_t), withFocused $ windows . W.sink)
-            , ((0, xK_l), withFocused $ windows . flip W.float centeredFloat)
-            ]
-        )
+isEvolutionComposer :: Query Bool
+isEvolutionComposer =
+  isEvolution <&&>
+    (fmap or . sequence)
+      [ title =? "Compose Message"
+      , title ^? "Re: "        -- reply message composer
+      , title ^? "Appointment" -- calendar event editor
+      , title ^? "Meeting"     -- calendar event editor
       ]
 
-      -- Screenshots
-      ++ (let
-          fullscreen = "maim -u | xclip -in -selection clipboard -t image/png"
+isFirefox :: Query Bool
+isFirefox = className =? "firefox" <||> className ^? "zen"
+
+isSpotify :: Query Bool
+isSpotify = isFirefox <&&> title ~? "Spotify"
+
+isYouTube :: Query Bool
+isYouTube = isFirefox <&&> title ~? "YouTube"
+
+isWhatsApp :: Query Bool
+isWhatsApp = isFirefox <&&> title ~? "WhatsApp"
+
+isSignal :: Query Bool
+isSignal = className =? "Signal"
+
+isElement :: Query Bool
+isElement = isFirefox <&&> title ~? "Element"
+
+isFirefoxPip :: Query Bool
+isFirefoxPip =
+  isFirefox
+    -- This changes depending on the locale of the browser :/
+    <&&> (title =? "Incrustation vidéo" <||> title =? "Picture-in-Picture")
+
+isPavucontrol :: Query Bool
+isPavucontrol = className =? "pavucontrol"
+
+isFeh :: Query Bool
+isFeh = className =? "feh"
+
+isNautilus :: Query Bool
+isNautilus = className $? "Nautilus"
+
+isNautilusPreviewer :: Query Bool
+isNautilusPreviewer = className $? "NautilusPreviewer"
+
+isMinder :: Query Bool
+isMinder = className =? "Minder" <&&> (not <$> title ~? "Pick a Color")
+
+isKitty :: Query Bool
+isKitty = className =? "kitty"
+
+isUtility :: Query Bool
+isUtility =
+  -- Useful to ignore stuff like digikam pop ups
+  isInProperty "_NET_WM_WINDOW_TYPE" "_NET_WM_WINDOW_TYPE_UTILITY"
+
+myActivateHook :: ManageHook
+myActivateHook =
+  -- Ignore activate request
+  composeOne
+    [ isDiscord   -?> mempty
+    , isEvolution -?> mempty
+    , isSignal    -?> mempty
+    , isSioyek    -?> mempty
+    , isFeh       -?> mempty
+    , return True -?> doFocus
+    ]
+
+myManageHook :: ManageHook
+myManageHook =
+  composeAll
+    [ isNautilusPreviewer      --> customFloating centeredFloat
+    , isPavucontrol            --> customFloating centeredFloat
+    , isFeh                    --> doF copyToAll <> customFloating buttomRightFloat
+    , isMinder                 --> customFloating centeredFloat
+    , isDiscord                --> doShift chatWS
+    , isEvolution              --> doShift chatWS
+    , isSignal                 --> doShift chatWS
+    , isFirefox                --> insertPosition Master Newer
+    , isKitty                  --> insertPosition Below Newer
+    , isNautilus <||> isSioyek --> insertPosition End Older
+    ]
+    -- Note: some rules here are overlapping, the first one will take the precedence (composeOne)
+    -- e.g. firefoxpip is a utility window
+    <> composeOne
+      [ isFirefoxPip             -?> doF copyToAll <> customFloating buttomRightFloat
+      , isUtility                -?> doIgnore
+      , isDialog                 -?> customFloating centeredFloat
+      , isEvolutionComposer      -?> customFloating centeredFloat
+      ]
+    <> namedScratchpadManageHook myScratchpads
+
+-- TODO: is there a way to always open certain sites in new windows in firefox?
+-- TODO: stop full screen when move happens
+myEventHandleHook :: Event -> X All
+myEventHandleHook =
+  -- If the title changes in the background, we don't want to greedy view that workspace.
+  -- Imagine Spotify playing in the background, a track change would focus that workspace.
+  -- We prevent this by checking if the window is in the current workspace
+  onTitleChange
+    $ (windowIsInCurrentWorkspace -->)
+    $ composeAll
+    [ isSpotify  --> doShiftAndGreedyView multimediaWS
+    , isYouTube  --> doShiftAndGreedyView multimediaWS
+    , isDiscord  --> doShiftAndGreedyView chatWS
+    , isWhatsApp --> doShiftAndGreedyView chatWS
+    , isElement  --> doShiftAndGreedyView chatWS
+    ]
+
+doShiftAndGreedyView :: WorkspaceId -> Query (Endo WindowSet)
+doShiftAndGreedyView n = doF . go =<< ask
+  where go :: Window -> WindowSet -> WindowSet
+        go w s = W.greedyView n $ W.shiftWin n w s
+
+queryWindowSet :: Query WindowSet
+queryWindowSet = liftX $ gets windowset
+
+windowIsInCurrentWorkspace :: Query Bool
+windowIsInCurrentWorkspace = do
+  w <- ask
+  s <- queryWindowSet
+  pure $ case W.findTag w s of
+    Just from | from == W.currentTag s -> True
+    _ -> False
+
+myStartupHook :: X ()
+myStartupHook = do
+  spawnOnce "fcitx5 &"                                -- Input method
+
+  spawn "feh --no-fehbg --bg-fill ~/.wallpaper &" -- wallpaper
+
+  -- Needed to make gnome keyring work
+  -- https://wiki.archlinux.org/title/GNOME/Keyring#Using_gnome-keyring-daemon_outside_desktop_environments_(KDE,_GNOME,_XFCE,_...)
+  spawn "dbus-update-activation-environment DISPLAY XAUTHORITY WAYLAND_DISPLAY"
+
+  io $ do
+    -- This is done here because:
+    -- - setting `home.sessionVariable` (home-manager) would only effect shells, probably due to the order of launched processes blah blah
+    -- - setting `environment.sessionVariables` (NixOS) would make my set up less portable
+    putEnv "GLFW_IM_MODULE=ibus"  -- Make sure kitty knows how to talk to fcitx
+    putEnv "MOZ_USE_XINPUT2=1"    -- Force touchpad for firefox
+
+removedKeybinds :: [(KeyMask, KeySym)]
+removedKeybinds =
+  [ (superMask, xK_h)
+  , (superMask, xK_l)
+  , (superMask, xK_p)
+
+    -- It has been more than once that I actidently killed xmonad >:(
+  , (superMask .|. shiftMask, xK_q)
+  ]
+  ++ [ (superMask              , n) | n <- [xK_1 .. xK_9] ]
+  ++ [ (superMask .|. shiftMask, n) | n <- [xK_1 .. xK_9] ]
+
+keybinds :: [((KeyMask, KeySym), X ())]
+keybinds =
+  [
+    -- Display
+    ((0,         xF86XK_MonBrightnessDown), spawn "light -U 5")
+  , ((0,         xF86XK_MonBrightnessUp  ), spawn "light -A 5")
+  , ((shiftMask, xF86XK_MonBrightnessDown), spawn "light -U 1")
+  , ((shiftMask, xF86XK_MonBrightnessUp  ), spawn "light -A 1")
+  , ((altMask,   xF86XK_MonBrightnessUp  ), spawn "autorandr --change --ignore-lid")
+  , ((altMask,   xF86XK_MonBrightnessDown), spawn "autorandr --change --ignore-lid")
+
+    -- Volume adjustments
+    -- Don't overload the mute button
+    -- In case of doubt, smashing the button becomes deterministic
+  , ((0,           xF86XK_AudioMute),        spawn "pactl -- set-sink-mute 0 1"    ) -- mute
+  , ((controlMask, xF86XK_AudioMute),        spawn "pactl -- set-sink-mute 0 0"    ) -- unmute
+  , ((0,           xF86XK_AudioLowerVolume), spawn "pactl -- set-sink-volume 0 -5%")
+  , ((0,           xF86XK_AudioRaiseVolume), spawn "pactl -- set-sink-volume 0 +5%")
+  , ((shiftMask,   xF86XK_AudioLowerVolume), spawn "pactl -- set-sink-volume 0 -1%")
+  , ((shiftMask,   xF86XK_AudioRaiseVolume), spawn "pactl -- set-sink-volume 0 +1%")
+
+    -- Playback control
+  , ((0, xF86XK_AudioPrev), spawn "playerctl previous"  )
+  , ((0, xF86XK_AudioPlay), spawn "playerctl play-pause")
+  , ((0, xF86XK_AudioNext), spawn "playerctl next"      )
+
+    -- Resize windows
+  , ((superMask, xK_equal               ), sendMessage $ IncMasterN  1)
+  , ((superMask, xK_minus               ), sendMessage $ IncMasterN -1)
+  , ((superMask, xK_comma               ), sendMessage Shrink         )
+  , ((superMask, xK_period              ), sendMessage Expand         )
+  , ((superMask .|. shiftMask, xK_comma ), sendMessage MirrorShrink   )
+  , ((superMask .|. shiftMask, xK_period), sendMessage MirrorExpand   )
+  , ((superMask              , xK_space ), chooseAction $ \ws ->
+           if ws == chatWS       then sendMessage ToggleLayout
+      else if ws == multimediaWS then sendMessage ToggleLayout
+      else withFocused (sendMessage . maximizeRestore)
+    )
+
+    -- [D]o sink and lift
+  , ( (superMask, xK_d)
+    , submap $ M.fromList
+        [ ((0, xK_t), withFocused $ windows . W.sink)
+        , ((0, xK_l), withFocused $ windows . flip W.float centeredFloat)
+        ]
+    )
+  ]
+
+    -- Screenshots
+  ++ (let fullscreen = "maim -u | xclip -in -selection clipboard -t image/png"
           withSelection = "maim -u -s -b 5 -o | xclip -in -selection clipboard -t image/png"
           toFloat = "maim -u -s -b 5 -o | feh --auto-zoom -"
-      in
-      [ ((0,                       xK_Print), spawn fullscreen   )
-      , ((superMask .|. shiftMask, xK_3    ), spawn fullscreen   )
-      , ((superMask .|. shiftMask, xK_4    ), spawn withSelection)
-      , ((superMask .|. shiftMask, xK_5    ), spawn toFloat      )
-      ])
+      in  [ ((0,                       xK_Print), spawn fullscreen   )
+          , ((superMask .|. shiftMask, xK_3    ), spawn fullscreen   )
+          , ((superMask .|. shiftMask, xK_4    ), spawn withSelection)
+          , ((superMask .|. shiftMask, xK_5    ), spawn toFloat      )
+          ]
+     )
 
-      -- Yeet
-      ++ (let
-          workspaceKeys = [xK_h, xK_t, xK_n, xK_s, xK_m, xK_w, xK_v, xK_z]
-      in
-      [ ((superMask, k), windows $ W.greedyView space)
-      | (k, space) <- zip workspaceKeys myWorkspaces
-      ]
-      ++
-      [ ((superMask .|. altMask, k), windows $ W.greedyView space . W.shift space)
-      | (k, space) <- zip workspaceKeys myWorkspaces
-      ]
-      ++
-      [ ((superMask .|. controlMask, k), windows $ swapWithCurrent space)
-      | (k, space) <- zip workspaceKeys myWorkspaces
-      ])
+  -- Yeet
+  ++ (let workspaceKeys = [xK_h, xK_t, xK_n, xK_s, xK_m, xK_w, xK_v, xK_z]
+      in  [ ((superMask, k), windows $ W.greedyView space)
+          | (k, space) <- zip workspaceKeys myWorkspaces
+          ]
+          ++ [ ((superMask .|. altMask, k), windows $ W.greedyView space . W.shift space)
+             | (k, space) <- zip workspaceKeys myWorkspaces
+             ]
+          ++ [ ((superMask .|. controlMask, k), windows $ swapWithCurrent space)
+             | (k, space) <- zip workspaceKeys myWorkspaces
+             ]
+     )
 
-      -- Launcher
-      ++ (let
-          launchFirefox = "if type firefox; then firefox; else firefox-esr; fi"
+  -- Launcher
+  ++ (let launchFirefox = "zen"
           launchDmenu = "dmenu_run -i -fn \"Iosevka-14\" -nb \"#36363a\" -nf \"#e2e2e4\" -sb \"#f7f7f8\" -sf \"#36363a\" -l 10"
           lock = "xscreensaver-command -lock"
-      in
-      [ ((controlMask .|. altMask, xK_m), namedScratchpadAction myScratchpads "cmus"  )
-      , ((controlMask .|. altMask, xK_t), namedScratchpadAction myScratchpads "btop"  )
-      , ((controlMask .|. altMask, xK_p), namedScratchpadAction myScratchpads "pass"  )
-      , ((controlMask .|. altMask, xK_e), namedScratchpadAction myScratchpads "emoji-picker")
-      , ((controlMask .|. altMask, xK_b), spawn launchFirefox                         )
-      , ((superMask,               xK_o), spawn launchDmenu                           )
-      , ((superMask,               xK_l), spawn lock                                  )
-      ])
+      in  [ ((controlMask .|. altMask, xK_m), namedScratchpadAction myScratchpads "cmus"  )
+          , ((controlMask .|. altMask, xK_t), namedScratchpadAction myScratchpads "btop"  )
+          , ((controlMask .|. altMask, xK_p), namedScratchpadAction myScratchpads "pass"  )
+          , ((controlMask .|. altMask, xK_e), namedScratchpadAction myScratchpads "emoji-picker")
+          , ((controlMask .|. altMask, xK_b), spawn launchFirefox                         )
+          , ((superMask,               xK_o), spawn launchDmenu                           )
+          , ((superMask,               xK_l), spawn lock                                  )
+          ]
+     )
 
-      ++ (let
-          powerprofile p = (p, spawn $ "powerprofilesctl set " ++ p)
-      in
-      [ ( (superMask, xK_p), visualSubmap def $ M.fromList
-            [ ((0, xK_1), powerprofile "power-saver")
-            , ((0, xK_2), powerprofile "balanced"   )
-            , ((0, xK_3), powerprofile "performance")
-            ]
-        )
-      ])
+  ++ (let powerprofile p = (p, spawn $ "powerprofilesctl set " ++ p)
+      in  [ ( (superMask, xK_p), visualSubmap def $ M.fromList
+                [ ((0, xK_1), powerprofile "power-saver")
+                , ((0, xK_2), powerprofile "balanced"   )
+                , ((0, xK_3), powerprofile "performance")
+                ]
+            )
+          ]
+     )
 
 myTerm :: String
 myTerm = "kitty"
@@ -258,53 +364,53 @@ superMask, altMask :: KeyMask
 superMask = mod4Mask
 altMask = mod1Mask
 
-myWorkspaces :: [String]
-myWorkspaces = take 8 . fmap (:[]) $ greekLower
+myWorkspaces :: [WorkspaceId]
+myWorkspaces = map (:[]) $ take 8 greekLower
+
+chatWS :: WorkspaceId
+chatWS = myWorkspaces !! 3
+
+multimediaWS :: WorkspaceId
+multimediaWS = myWorkspaces !! 6
 
 centeredFloat, smallFloat, fullFloat, buttomRightFloat :: W.RationalRect
-centeredFloat = W.RationalRect (1/9) (1/9) (7/9) (7/9)
-smallFloat    = W.RationalRect (3/5) (3/5) (2/7) (2/7)
-fullFloat     = W.RationalRect     0     0     1     1
-buttomRightFloat = W.RationalRect  (1/2) (1/2) (1/2) (1/2)
+centeredFloat    = W.RationalRect (1%9) (1%9) (7%9) (7%9)
+smallFloat       = W.RationalRect (3%5) (3%5) (2%7) (2%7)
+fullFloat        = W.RationalRect     0     0     1     1
+buttomRightFloat = W.RationalRect (1%2) (1%2) (1%2) (1%2)
 
 xmobarConfig :: StatusBarConfig
 xmobarConfig = statusBarProp "xmobar -x 0" (pure myPrettyPrinter)
   where
+    myPrettyPrinter :: PP
     myPrettyPrinter =
       filterOutWsPP [scratchpadWorkspaceTag]
       $ def
-        { ppCurrent         = xmobarColor "#000000" "#ffffff" . wrap " " " " . fmap toUpper
+        { ppCurrent         = xmobarColor "#000000" "#ffffff" . wrap " " " "
         , ppHiddenNoWindows = xmobarColor "#9c9c9c" "" . const "⋅"
+        , ppHidden          = xmobarColor "#ffffff" ""
         , ppSep             = " | "
         }
 
-
-isOneOf :: Eq a => Query a -> [a] -> Query Bool
-isOneOf q = fmap or . traverse (q =?)
-
-isFocused :: Query Bool
-isFocused = fmap not isUnfocused
-
-isFirefoxPIP :: Query Bool
-isFirefoxPIP =
-  className =? "firefox"
-    <&&> title =? "Picture-in-Picture"
-
 myScratchpads :: [NamedScratchpad]
 myScratchpads =
-  [ NS "cmus"
+  [ NS
+      "cmus"
       (myTerm ++ " -T 'cmus' cmus")
       (title =? "cmus")
       (customFloating centeredFloat)
-  , NS "btop"
+  , NS
+      "btop"
       (myTerm ++ " -T 'btop' btop")
       (title =? "btop")
       (customFloating fullFloat)
-  , NS "pass"
+  , NS
+      "pass"
       (myTerm ++ " -T 'pass' -- fish -i -c 'while :; fzf-pass; end'")
       (title =? "pass")
       (customFloating smallFloat)
-  , NS "emoji-picker"
+  , NS
+      "emoji-picker"
       (myTerm ++ " -T 'emoji-picker' -- fish -i -c 'while :; emoji-picker; end'")
       (title =? "emoji-picker")
       (customFloating smallFloat)
diff --git a/nix/configurations/vanadium/home/zen-browser.nix b/nix/configurations/vanadium/home/zen-browser.nix
new file mode 100644
index 00000000..beee8d6a
--- /dev/null
+++ b/nix/configurations/vanadium/home/zen-browser.nix
@@ -0,0 +1,165 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+let
+  inherit (pkgs) nur;
+in
+{
+  programs.zen-browser = {
+    enable = true;
+
+    policies.SearchEngines.Add = [
+      # Forges
+      {
+        Name = "GitHub";
+        Alias = "@gh";
+        IconURL = "https://github.com/favicon.ico";
+        Description = "Your code yum yum";
+        URLTemplate = "https://github.com/search?q={searchTerms}&type=repositories";
+      }
+      {
+        Name = "GitHub (Code Search)";
+        Alias = "@ghc";
+        IconURL = "https://github.com/favicon.ico";
+        Description = "Your code yum yum";
+        URLTemplate = "https://github.com/search?q={searchTerms}&type=code";
+      }
+      {
+        Name = "Codeberg";
+        Alias = "@cb";
+        IconURL = "https://codeberg.org/favicon.ico";
+        Description = "Software development, but free!";
+        URLTemplate = "https://codeberg.org/explore/repos?q={searchTerms}";
+      }
+      {
+        Name = "?C";
+        Alias = "@cc";
+        IconURL = "https://git.confusedcompiler.org/favicon.ico";
+        URLTemplate = "https://git.confusedcompiler.org/explore/repos?q={searchTerms}";
+      }
+
+      # Nix{,OS,pkgs}
+      {
+        Name = "NixOS Search (Package)";
+        Alias = "@np";
+        IconURL = "https://nixos.org/favicon.ico";
+        Description = "Search in nixpkgs";
+        URLTemplate = "https://search.nixos.org/packages?query={searchTerms}";
+      }
+      {
+        Name = "NixOS Search (Options)";
+        Alias = "@no";
+        IconURL = "https://nixos.org/favicon.ico";
+        Description = "Search in NixOS options";
+        URLTemplate = "https://search.nixos.org/options?query={searchTerms}";
+      }
+
+      # Haskell
+      {
+        Name = "Flora";
+        Alias = "@hs";
+        IconURL = "https://flora.pm/static/icons/favicon-32x32.png";
+        URLTemplate = "https://flora.pm/search?q={searchTerms}";
+      }
+
+      # Discourse
+      {
+        Name = "NixOS Discourse";
+        Alias = "@nd";
+        IconURL = "https://nixos.org/favicon.ico";
+        URLTemplate = "https://discourse.nixos.org/search?q={searchTerms}";
+      }
+      {
+        Name = "Framework Discourse";
+        Alias = "@fd";
+        IconURL = "https://frame.work/favicon.ico";
+        URLTemplate = "https://community.frame.work/search?q={searchTerms}";
+      }
+
+      # Misc
+      {
+        Name = "YouTube";
+        Alias = "@yt";
+        IconURL = "https://youtube.com/favicon.ico";
+        SuggestURLTemplate = "http://suggestqueries.google.com/complete/search?q={searchTerms}&ds=yt";
+        URLTemplate = "https://www.youtube.com/results?search_query={searchTerms}";
+      }
+      {
+        Name = "Genius";
+        Alias = "@geni";
+        IconURL = "https://genius.com/favicon.ico";
+        URLTemplate = "https://genius.com/search?q={searchTerms}";
+      }
+    ];
+
+    profiles = {
+      default = {
+        settings = {
+          # "full-screen-api.ignore-widgets" = true; # limit fullscreen mode to window
+        };
+        userChrome = ''
+          /* monofont tweak */
+          #statuspanel-label {
+            font-family: monospace;
+          }
+          .urlbar-input-box {
+            font-family: monospace;
+          }
+        '';
+        extensions.packages =
+          let
+            addons = nur.repos.rycee.firefox-addons;
+          in
+          [
+            addons.sponsorblock
+            addons.return-youtube-dislikes
+            addons.consent-o-matic
+          ];
+      };
+
+      junk = {
+        id = 1;
+        inherit (config.programs.zen-browser.profiles.default)
+          settings
+          userChrome
+          ;
+
+        extensions.packages =
+          let
+            addons = nur.repos.rycee.firefox-addons;
+          in
+          [ addons.multi-account-containers ];
+
+        containers = {
+          raisin = {
+            color = "purple";
+            icon = "fruit";
+            id = 1;
+          };
+          pomme = {
+            color = "red";
+            icon = "fruit";
+            id = 2;
+          };
+        };
+      };
+
+      # Isolate it because it's proprietary
+      tampermonkey = {
+        id = 2;
+        inherit (config.programs.zen-browser.profiles.default)
+          settings
+          userChrome
+          ;
+
+        extensions.packages =
+          let
+            addons = nur.repos.rycee.firefox-addons;
+          in
+          [ addons.tampermonkey ];
+      };
+    };
+  };
+}
diff --git a/nix/configurations/vanadium/kernel-overlay.nix b/nix/configurations/vanadium/kernel-overlay.nix
index 1af875e2..795a480a 100644
--- a/nix/configurations/vanadium/kernel-overlay.nix
+++ b/nix/configurations/vanadium/kernel-overlay.nix
@@ -1,6 +1,8 @@
-final: prev: let
+final: prev:
+let
   inherit (final) lib;
-in {
+in
+{
   linuxPackages = final.linuxPackagesFor (
     prev.linuxPackages.kernel.override {
       # TODO: The error message is quite unintuitive, maybe improve it?
@@ -30,18 +32,19 @@ in {
         SCHED_MC = yes;
         X86_MCE = yes;
         X86_MCE_AMD = yes;
+        X86_MCE_INTEL = no;
         PERF_EVENTS_INTEL_RAPL = yes;
         X86_AMD_PSTATE = yes;
         X86_POWERNOW_K8 = no;
 
+        # Processor type and features > Performance monitoring
+        PERF_EVENTS_AMD_POWER = yes;
+        PERF_EVENTS_AMD_UNCORE = yes;
+
         # With amd_pstate=active ondemand won't be available anyway.
         # Without more testing, we should accept the claim that its more power efficient and stick to it
         CPU_FREQ = yes;
         X86_INTEL_PSTATE = lib.mkForce no;
-        CPU_FREQ_DEFAULT_GOV_SCHEDUTIL = lib.mkForce no;
-        CPU_FREQ_DEFAULT_GOV_ONDEMAND = yes;
-        # ERROR: could not insert 'amd_freq_sensitivity': No such device
-        X86_AMD_FREQ_SENSITIVITY = module;
 
         # skipping firmware loading section since it's handled by other parts of nixos options
         SENSORS_K10TEMP = yes;
@@ -69,6 +72,7 @@ in {
 
         # Disable hypervisor guest
         HYPERVISOR_GUEST = lib.mkForce no;
+        HYPERV = lib.mkForce unset;
         DRM_HYPERV = lib.mkForce unset;
         FB_HYPERV = lib.mkForce unset;
         HVC_XEN = lib.mkForce unset;
@@ -92,6 +96,10 @@ in {
         XEN_PVHVM = lib.mkForce unset;
         XEN_SAVE_RESTORE = lib.mkForce unset;
         XEN_SYS_HYPERVISOR = lib.mkForce unset;
+
+        # Device Driver
+        MACINTOSH_DRIVERS = no; # hmm
+        SURFACE_PLATFORMS = no; # ew
       };
     }
   );
diff --git a/nix/configurations/vanadium/nixos/audio.nix b/nix/configurations/vanadium/nixos/audio.nix
index f5ef99f5..f4c036de 100644
--- a/nix/configurations/vanadium/nixos/audio.nix
+++ b/nix/configurations/vanadium/nixos/audio.nix
@@ -5,5 +5,5 @@
     jack.enable = true;
   };
 
-  me.extraGroups = ["audio"];
+  me.extraGroups = [ "audio" ];
 }
diff --git a/nix/configurations/vanadium/nixos/battery.nix b/nix/configurations/vanadium/nixos/battery.nix
index 57ca236a..8ac3479a 100644
--- a/nix/configurations/vanadium/nixos/battery.nix
+++ b/nix/configurations/vanadium/nixos/battery.nix
@@ -1,11 +1,7 @@
 {
-  systemd.sleep.extraConfig = ''
-    HibernateDelaySec=1d
-  '';
-
-  services.logind = {
-    powerKey = "hibernate";
-    lidSwitch = "suspend-then-hibernate";
-    lidSwitchDocked = "ignore";
+  services.logind.settings = {
+    # Note: vanadium's btrfs disk layout has been changed and the swap has been reduced. It will not work with hibernate anymore.
+    Login.HandleLidSwitch = "suspend";
+    Login.HandleLidSwitchDocked = "ignore";
   };
 }
diff --git a/nix/configurations/vanadium/nixos/connectivity.nix b/nix/configurations/vanadium/nixos/connectivity.nix
index 5a0891fc..c484540f 100644
--- a/nix/configurations/vanadium/nixos/connectivity.nix
+++ b/nix/configurations/vanadium/nixos/connectivity.nix
@@ -3,22 +3,23 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   # For nautilius and iOS
   services.gvfs.enable = true;
   # iOS
   services.usbmuxd.enable = true;
-  environment.systemPackages = with pkgs; [libimobiledevice idevicerestore];
+  environment.systemPackages = with pkgs; [
+    libimobiledevice
+    idevicerestore
+  ];
 
   # https://unix.stackexchange.com/questions/592775/how-can-i-enable-apple-ios-fast-charge-support
   services.udev.extraRules = ''
     SUBSYSTEM=="usb", ACTION=="add", DRIVER=="apple-mfi-fastcharge", RUN+="/bin/sh -c 'echo Fast > /sys/class/power_supply/apple_mfi_fastcharge/charge_type'"
   '';
 
-  users.users.root.openssh.authorizedKeys.keys = let
-    ids = import ../../../identities.nix;
-  in
-    builtins.concatMap builtins.attrValues (builtins.attrValues ids);
+  users.users.root.openssh.authorizedKeys.keys = import ../../../identities.nix;
 
   networking = {
     networkmanager.enable = lib.mkForce false;
@@ -37,43 +38,45 @@
       userControlled.enable = true;
       secretsFile = config.age.secrets.wpa_password.path;
       scanOnLowSignal = false;
-      networks = let
-        # wpa_supplicant uses `strchr` to seek to the first `=`, so the only forbidden character is `=`.
-        escapePwdKey = lib.replaceStrings ["="] ["_"];
-
-        fromList = ns: let
-          go = networkArgs @ {
-            ssid,
-            # Custom fields wrapping nixpkgs module options
-            hasPassword ? false,
-            scanOnLowSignal ? false,
-            randomizeMac ? false,
-            ...
-          }: {
-            ${ssid} = lib.mkMerge [
-              (builtins.removeAttrs networkArgs ["ssid" "hasPassword" "scanOnLowSignal" "randomizeMac"])
-              (lib.optionalAttrs hasPassword {
-                pskRaw = "ext:${escapePwdKey ssid}";
-              })
-              (lib.optionalAttrs scanOnLowSignal {
-                extraConfig = ''
-                  bgscan="simple:30:-70:3600"
-                '';
-              })
-              (lib.optionalAttrs randomizeMac {
-                extraConfig = ''
-                  mac_addr=1
-                '';
-              })
-            ];
-          };
+      networks =
+        let
+          fromList = import ../../../networks/wpa_supplicant-compat.nix;
+          networks = import ../../../networks/list.nix;
         in
-          lib.mkMerge (map go ns);
-      in
-        fromList (import ./connectivity/networks.nix);
+        fromList networks;
     };
   };
 
+  networking = {
+    hostFiles = [
+      # Prevent building up reliance on chatbots
+      # Gotta preserve that thinking ability of my smoof bwain
+      "${pkgs.ai_blocklist}/share/hosts.txt"
+      "${pkgs.hategroup_blocklist}/share/hosts.txt"
+    ];
+
+    extraHosts = ''
+      #
+      # Generated from nixos configuartion
+      #
+
+      # This is the fascist one, just block it because I can't tell
+      0.0.0.0 nixos.wiki
+
+      # Gotta purify my smoos brain for a while
+      0.0.0.0 instagram.com
+      0.0.0.0 www.instagram.com
+
+      # The "people who you viewed can see you" thing is weird af
+      0.0.0.0 linkedin.com
+      0.0.0.0 www.linkedin.com
+    '';
+  };
+
+  # LAN CONNECTION
+  # ~~~~~~~~~~~~~~
+  # Note that when you're corrected to mullvad, you can't ssh into your local machines.
+  # I wonder if there's an option to turn this off.
   services.mullvad-vpn.enable = true;
 
   hardware.bluetooth.enable = true;
diff --git a/nix/configurations/vanadium/nixos/display.nix b/nix/configurations/vanadium/nixos/display.nix
index 94d31e1c..43e9f953 100644
--- a/nix/configurations/vanadium/nixos/display.nix
+++ b/nix/configurations/vanadium/nixos/display.nix
@@ -2,13 +2,14 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   imports = [
     #
     # builtin screen
     #
     {
-      me.extraGroups = ["video"];
+      me.extraGroups = [ "video" ];
       programs.light.enable = true;
     }
 
@@ -16,10 +17,10 @@
     # external screen
     #
     {
-      me.extraGroups = ["i2c"];
+      me.extraGroups = [ "i2c" ];
       hardware.i2c.enable = true;
-      environment.systemPackages = [pkgs.ddcutil];
-      boot.kernelModules = ["i2c-dev"];
+      environment.systemPackages = [ pkgs.ddcutil ];
+      boot.kernelModules = [ "i2c-dev" ];
     }
   ];
 
@@ -33,149 +34,160 @@
       "20_xmonad" = "${lib.getExe pkgs.haskellPackages.xmonad} --restart"; # make sure feh keeps up
     };
 
-    profiles = let
-      singleton = k: v: {${k} = v;};
+    profiles =
+      let
+        singleton = k: v: { ${k} = v; };
 
-      fingerprints = {
-        built-in = singleton "eDP-1" "00ffffffffffff0009e5ca0b000000002f200104a51c137803de50a3544c99260f505400000001010101010101010101010101010101115cd01881e02d50302036001dbe1000001aa749d01881e02d50302036001dbe1000001a000000fe00424f452043510a202020202020000000fe004e4531333546424d2d4e34310a0073";
-        amethyst = device: singleton device "00ffffffffffff0006b35b27010101012c210103803c22782a29d5ad4f44a7240f5054bfef00714f81809500d1c0d1e8d1fc01010101565e00a0a0a029503020350055502100001a000000fd0030901edf3c000a202020202020000000fc005647323741514c33410a202020000000ff0052414c4d51533139373533370a0111020347f14a90030204014061603f1f230907078301000067030c002000384468d85dc401788003026d1a000002013090f00069096909e305ff01e6060701696900e2006ae20fc0eae70070a0a067500820980455502100001a6fc200a0a0a055503020350055502100001a5aa000a0a0a046503020350055502100001a0000bc";
-        orchid = device: singleton device "00ffffffffffff0004699a24642900002416010380341d782a2ac5a4564f9e280f5054b7ef00714f814081809500b300d1c081c08100023a801871382d40582c450009252100001e000000ff0043394c4d54463031303539360a000000fd00324b185311000a202020202020000000fc00415355532056533234370a20200173020322714f0102031112130414050e0f1d1e1f10230917078301000065030c0010008c0ad08a20e02d10103e9600092521000018011d007251d01e206e28550009252100001e011d00bc52d01e20b828554009252100001e8c0ad090204031200c4055000925210000180000000000000000000000000000000000000000005d";
-      };
+        fingerprints = {
+          built-in = singleton "eDP-1" "00ffffffffffff0009e5ca0b000000002f200104a51c137803de50a3544c99260f505400000001010101010101010101010101010101115cd01881e02d50302036001dbe1000001aa749d01881e02d50302036001dbe1000001a000000fe00424f452043510a202020202020000000fe004e4531333546424d2d4e34310a0073";
+          amethyst =
+            device:
+            singleton device "00ffffffffffff0006b35b27010101012c210103803c22782a29d5ad4f44a7240f5054bfef00714f81809500d1c0d1e8d1fc01010101565e00a0a0a029503020350055502100001a000000fd0030901edf3c000a202020202020000000fc005647323741514c33410a202020000000ff0052414c4d51533139373533370a0111020347f14a90030204014061603f1f230907078301000067030c002000384468d85dc401788003026d1a000002013090f00069096909e305ff01e6060701696900e2006ae20fc0eae70070a0a067500820980455502100001a6fc200a0a0a055503020350055502100001a5aa000a0a0a046503020350055502100001a0000bc";
+          orchid =
+            device:
+            singleton device "00ffffffffffff0004699a24642900002416010380341d782a2ac5a4564f9e280f5054b7ef00714f814081809500b300d1c081c08100023a801871382d40582c450009252100001e000000ff0043394c4d54463031303539360a000000fd00324b185311000a202020202020000000fc00415355532056533234370a20200173020322714f0102031112130414050e0f1d1e1f10230917078301000065030c0010008c0ad08a20e02d10103e9600092521000018011d007251d01e206e28550009252100001e011d00bc52d01e20b828554009252100001e8c0ad090204031200c4055000925210000180000000000000000000000000000000000000000005d";
+        };
 
-      devices = rec {
-        built-in = "eDP-1";
-        # Run `xrandr` to see the max number
-        extern = map (portNumber: "DP-${toString portNumber}") (lib.range 1 8);
-        all = [built-in] ++ extern;
-      };
+        devices = rec {
+          built-in = "eDP-1";
+          # Run `xrandr` to see the max number
+          extern = map (portNumber: "DP-${toString portNumber}") (lib.range 1 8);
+          all = [ built-in ] ++ extern;
+        };
 
-      switches = {
-        setDPI = {dpi}:
-          singleton "10_xrdb-dpi" "${lib.getExe pkgs.xorg.xrdb} -merge ${pkgs.writeText "xrdb-dpi-config" ''
-            Xcursor.size: 64
-            Xft.dpi:   ${toString dpi}
-          ''}";
+        switches = {
+          setDPI =
+            { dpi }:
+            singleton "10_xrdb-dpi" "${lib.getExe pkgs.xorg.xrdb} -merge ${pkgs.writeText "xrdb-dpi-config" ''
+              Xcursor.size: 64
+              Xft.dpi:   ${toString dpi}
+            ''}";
 
-        # Is scoped to an output device, no need to be called on built-in display
-        setSoftwareBrightness = {
-          device, # obtain with `xrandr`
-          brightness, # [0..1]
-        }:
-        # Hack:
-        # xrandr would consider the display being connected before we can change its brightness
-        # For that reason, we can't base our delay on its output, sadly.
-          singleton "10_xrandr_brightness" ''
-            sleep 10
-            ${lib.getExe pkgs.xorg.xrandr} --output ${device} --brightness ${toString brightness}
-          '';
+          # Is scoped to an output device, no need to be called on built-in display
+          setSoftwareBrightness =
+            {
+              device, # obtain with `xrandr`
+              brightness, # [0..1]
+            }:
+            singleton "10_xrandr_brightness" /* bash */ ''
+              ${lib.getExe pkgs.xorg.xrandr} --output ${device} --brightness ${toString brightness}
+            '';
 
-        # Is scoped to an output device, no need to be called on built-in display
-        setDDCBrightness = {
-          modelName, # obtain with `ddcutil detect`
-          brightness, # [0..1]
-        }:
-          singleton "10_ddc_brightness" ''
-            ${lib.getExe pkgs.ddcutil} --model ${modelName} setvcp 10 ${toString (builtins.floor (brightness * 100))}
-          '';
+          # Is scoped to an output device, no need to be called on built-in display
+          setDDCBrightness =
+            {
+              modelName, # obtain with `ddcutil detect`
+              brightness, # [0..1]
+            }:
+            singleton "10_ddc_brightness" /* bash */ ''
+              ${lib.getExe pkgs.ddcutil} --model ${modelName} setvcp 10 ${
+                toString (builtins.floor (brightness * 100))
+              }
+            '';
 
-        setDDCContrast = {
-          modelName, # obtain with `ddcutil detect`
-          contrast, # [0..1]
-        }:
-          singleton "10_ddc_contrast" ''
-            ${lib.getExe pkgs.ddcutil} --model ${modelName} setvcp 12 ${toString (builtins.floor (contrast * 100))}
-          '';
-      };
+          setDDCContrast =
+            {
+              modelName, # obtain with `ddcutil detect`
+              contrast, # [0..1]
+            }:
+            singleton "10_ddc_contrast" /* bash */ ''
+              ${lib.getExe pkgs.ddcutil} --model ${modelName} setvcp 12 ${
+                toString (builtins.floor (contrast * 100))
+              }
+            '';
+        };
 
-      # Note: the "position" field corresponds to the "pos" field outputted by autorandr
-      # To get the current config, run `xrandr --auto` and then `autorandr --config`
-      configs = {
-        allOff = lib.genAttrs devices.all (_: {enable = lib.mkDefault false;});
-        enableBuiltin = {
-          eDP-1 = {
-            enable = true;
-            crtc = 0;
-            mode = "2256x1504";
-            rate = "60.00";
-            primary = true;
+        # Note: the "position" field corresponds to the "pos" field outputted by autorandr
+        # To get the current config, run `xrandr --auto` and then `autorandr --config`
+        configs = {
+          allOff = lib.genAttrs devices.all (_: {
+            enable = lib.mkDefault false;
+          });
+          enableBuiltin = {
+            eDP-1 = {
+              enable = true;
+              crtc = 0;
+              mode = "2256x1504";
+              rate = "60.00";
+              primary = true;
+            };
+          };
+          enableAmethyst = name: {
+            ${name} = {
+              enable = true;
+              primary = true;
+              crtc = 1;
+              mode = "2560x1440";
+              rate = "59.95";
+            };
+          };
+          enableOrchid = name: {
+            ${name} = {
+              enable = true;
+              primary = true;
+              crtc = 1;
+              mode = "1920x1080";
+              rate = "60.00";
+            };
           };
         };
-        enableAmethyst = name: {
-          ${name} = {
-            enable = true;
-            primary = true;
-            crtc = 1;
-            mode = "2560x1440";
-            rate = "59.95";
-          };
+
+        frameworkBuiltin = {
+          fingerprint = fingerprints.built-in;
+          config = lib.mkMerge [
+            configs.allOff
+            configs.enableBuiltin
+          ];
+          hooks.postswitch = switches.setDPI { dpi = 150; };
         };
-        enableOrchid = name: {
-          ${name} = {
-            enable = true;
-            primary = true;
-            crtc = 1;
-            mode = "1920x1080";
-            rate = "60.00";
-          };
+
+        mkAmethyst = name: {
+          fingerprint = lib.mkMerge [
+            fingerprints.built-in
+            (fingerprints.amethyst name)
+          ];
+          config = lib.mkMerge [
+            configs.allOff
+            (configs.enableAmethyst name)
+          ];
+          hooks.postswitch = lib.mkMerge [
+            (switches.setDPI { dpi = 110; })
+            (switches.setSoftwareBrightness {
+              device = name;
+              brightness = 1;
+            })
+            (switches.setDDCBrightness {
+              modelName = "VG27AQL3A";
+              brightness = 0;
+            })
+            (switches.setDDCContrast {
+              modelName = "VG27AQL3A";
+              contrast = 0.5;
+            })
+          ];
         };
-      };
 
-      frameworkBuiltin = {
-        fingerprint = fingerprints.built-in;
-        config = lib.mkMerge [
-          configs.allOff
-          configs.enableBuiltin
-        ];
-        hooks.postswitch = switches.setDPI {dpi = 150;};
-      };
-
-      mkAmethyst = name: {
-        fingerprint = lib.mkMerge [
-          fingerprints.built-in
-          (fingerprints.amethyst name)
-        ];
-        config = lib.mkMerge [
-          configs.allOff
-          (configs.enableAmethyst name)
-        ];
-        hooks.postswitch = lib.mkMerge [
-          (switches.setDPI {dpi = 110;})
-          (switches.setSoftwareBrightness {
-            device = name;
-            brightness = 1;
-          })
-          (switches.setDDCBrightness {
-            modelName = "VG27AQL3A";
-            brightness = 0;
-          })
-          (switches.setDDCContrast {
-            modelName = "VG27AQL3A";
-            contrast = 0.5;
-          })
-        ];
-      };
-
-      mkOrchid = name: {
-        fingerprint = lib.mkMerge [
-          fingerprints.built-in
-          (fingerprints.orchid name)
-        ];
-        config = lib.mkMerge [
-          configs.allOff
-          (configs.enableOrchid name)
-        ];
-        # seems like this display doesn't support DDC
-        hooks.postswitch = lib.mkMerge [
-          (switches.setDPI {dpi = 100;})
-          (switches.setSoftwareBrightness {
-            device = name;
-            brightness = 0.7;
-          })
-        ];
-      };
-    in
+        mkOrchid = name: {
+          fingerprint = lib.mkMerge [
+            fingerprints.built-in
+            (fingerprints.orchid name)
+          ];
+          config = lib.mkMerge [
+            configs.allOff
+            (configs.enableOrchid name)
+          ];
+          # seems like this display doesn't support DDC
+          hooks.postswitch = lib.mkMerge [
+            (switches.setDPI { dpi = 100; })
+            (switches.setSoftwareBrightness {
+              device = name;
+              brightness = 0.5;
+            })
+          ];
+        };
+      in
       lib.mkMerge [
-        {default = frameworkBuiltin;}
+        { default = frameworkBuiltin; }
         (lib.genAttrs' devices.extern (name: lib.nameValuePair "amethyst-${name}" (mkAmethyst name)))
         (lib.genAttrs' devices.extern (name: lib.nameValuePair "orchid-${name}" (mkOrchid name)))
       ];
diff --git a/nix/configurations/vanadium/nixos/fs.nix b/nix/configurations/vanadium/nixos/fs.nix
index 93c4d2c4..bfe64d4a 100644
--- a/nix/configurations/vanadium/nixos/fs.nix
+++ b/nix/configurations/vanadium/nixos/fs.nix
@@ -2,7 +2,8 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   services.btrfs.autoScrub = {
     enable = true;
     fileSystems = [
@@ -21,9 +22,9 @@
 
   fileSystems = {
     /*
-    WARNING:
-    Use "noauto" if you want to mount the drive at a later time and not all the time
-    Otherwise the mount would fail and cascade into the graphical session being stopped
+      WARNING:
+      Use "noauto" if you want to mount the drive at a later time and not all the time
+      Otherwise the mount would fail and cascade into the graphical session being stopped
     */
 
     "/home/leana/mnt/tdk32" = {
@@ -53,21 +54,23 @@
     sgbk /dev/disk/by-uuid/21b5207e-c3cf-49da-b944-fb405ae1eee2 ${config.age.secrets.sgbk_pwd.path} noauto
   '';
 
-  systemd.mounts = let
-    bindToCryptDev = dev: {
-      what = "/dev/mapper/${dev}";
-      where = "/mnt/${dev}";
-      unitConfig = {
-        Requires = ["systemd-cryptsetup@${dev}.service"];
-        After = ["systemd-cryptsetup@${dev}.service"];
-        PropagatesStopTo = ["systemd-cryptsetup@${dev}.service"];
+  systemd.mounts =
+    let
+      bindToCryptDev = dev: {
+        what = "/dev/mapper/${dev}";
+        where = "/mnt/${dev}";
+        unitConfig = {
+          Requires = [ "systemd-cryptsetup@${dev}.service" ];
+          After = [ "systemd-cryptsetup@${dev}.service" ];
+          PropagatesStopTo = [ "systemd-cryptsetup@${dev}.service" ];
+        };
       };
-    };
-  in [
-    (bindToCryptDev "four")
-    (bindToCryptDev "two")
-    (bindToCryptDev "sgbk")
-  ];
+    in
+    [
+      (bindToCryptDev "four")
+      (bindToCryptDev "two")
+      (bindToCryptDev "sgbk")
+    ];
 
   environment.systemPackages = [
     pkgs.lsof
diff --git a/nix/configurations/vanadium/nixos/gui.nix b/nix/configurations/vanadium/nixos/gui.nix
index b96b9a65..b9b1f6b4 100644
--- a/nix/configurations/vanadium/nixos/gui.nix
+++ b/nix/configurations/vanadium/nixos/gui.nix
@@ -2,7 +2,8 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   services.xserver.windowManager.xmonad = {
     enable = true;
     enableContribAndExtras = true;
@@ -14,13 +15,29 @@
     autoRepeatInterval = 40;
   };
 
+  environment.systemPackages = [
+    pkgs.pantheon.elementary-sound-theme
+  ];
   services.xserver.displayManager.lightdm = {
     enable = true;
     background = "#000000";
-    greeters.gtk.cursorTheme = {
-      name = "Posy_Cursor_Black";
-      package = pkgs.posy-cursors;
-      size = 72;
+    greeters.gtk = {
+      iconTheme = {
+        name = "Adwaita";
+        package = pkgs.gnome-themes-extra;
+      };
+      theme = {
+        name = "Adwaita";
+        package = pkgs.gnome-themes-extra;
+      };
+      cursorTheme = {
+        name = "Posy_Cursor_Black";
+        package = pkgs.posy-cursors;
+        size = 72;
+      };
+      extraConfig = ''
+        gtk-sound-theme-name = elementary
+      '';
     };
   };
 
@@ -28,7 +45,7 @@
     enable = true;
     hooks = {
       # Reset display setting on login
-      "UNBLANK" = ''
+      "RUN" = ''
         ${lib.getExe pkgs.autorandr} --change --ignore-lid
       '';
     };
@@ -36,8 +53,10 @@
 
   services.picom = {
     enable = true;
-    backend = "glx";
+    # avoid tearing
     vSync = true;
+
+    # buttery smooth
     fade = true;
     fadeDelta = 3;
     settings = {
diff --git a/nix/configurations/vanadium/nixos/hardware-configuration.nix b/nix/configurations/vanadium/nixos/hardware-configuration.nix
index 32be11fa..9b75a244 100644
--- a/nix/configurations/vanadium/nixos/hardware-configuration.nix
+++ b/nix/configurations/vanadium/nixos/hardware-configuration.nix
@@ -7,15 +7,20 @@
   pkgs,
   modulesPath,
   ...
-}: {
+}:
+{
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "thunderbolt"];
-  boot.initrd.kernelModules = ["dm-snapshot"];
-  boot.kernelModules = ["kvm-amd"];
-  boot.extraModulePackages = [];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "thunderbolt"
+  ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/nix/configurations/vanadium/nixos/input.nix b/nix/configurations/vanadium/nixos/input.nix
index 246d07f6..452c5678 100644
--- a/nix/configurations/vanadium/nixos/input.nix
+++ b/nix/configurations/vanadium/nixos/input.nix
@@ -13,7 +13,7 @@
     };
   };
 
-  me.extraGroups = ["scanner"];
+  me.extraGroups = [ "scanner" ];
   hardware.sane = {
     enable = true;
     brscan5.enable = true;
diff --git a/nix/configurations/vanadium/nixos/locale.nix b/nix/configurations/vanadium/nixos/locale.nix
index de1bd43f..666053d8 100644
--- a/nix/configurations/vanadium/nixos/locale.nix
+++ b/nix/configurations/vanadium/nixos/locale.nix
@@ -1,4 +1,5 @@
-{lib, ...}: {
+{ lib, ... }:
+{
   # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
   # `timedatectl list-timezones`
   time.timeZone = "Asia/Taipei";
@@ -28,16 +29,16 @@
       let
         genLocale = locale: lib.flip lib.genAttrs (_: locale);
       in
-        # - xscreensaver freaks out on the time display
-        # - evolution add event becomes hard to use
-        #   https://gitlab.gnome.org/GNOME/evolution/-/issues/3120
-        genLocale "fr_FR.UTF-8" [
-          "LC_TIME"
-        ]
-        // genLocale "zh_TW.UTF-8" [
-          "LC_MONETARY"
-          "LC_ADDRESS"
-        ];
+      # - xscreensaver freaks out on the time display
+      # - evolution add event becomes hard to use
+      #   https://gitlab.gnome.org/GNOME/evolution/-/issues/3120
+      genLocale "fr_FR.UTF-8" [
+        "LC_TIME"
+      ]
+      // genLocale "zh_TW.UTF-8" [
+        "LC_MONETARY"
+        "LC_ADDRESS"
+      ];
   };
 
   # Wireless Regulatory Domain, uses ISO / IEC 3166 country code
diff --git a/nix/configurations/vanadium/nixos/misc.nix b/nix/configurations/vanadium/nixos/misc.nix
index db83b159..4d512a82 100644
--- a/nix/configurations/vanadium/nixos/misc.nix
+++ b/nix/configurations/vanadium/nixos/misc.nix
@@ -1,3 +1,4 @@
+{ config, ... }:
 {
   system.stateVersion = "24.11";
 
@@ -13,4 +14,9 @@
     # https://community.frame.work/t/stability-issues-random-crashes-reboots-and-boot-freezes/62675/4
     "pcie_aspm=off"
   ];
+
+  # Cross building
+  # https://discourse.nixos.org/t/how-do-i-get-my-aarch64-linux-machine-to-build-x86-64-linux-extra-platforms-doesnt-seem-to-work/38106/2?u=leana8959
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+  nix.settings.extra-platforms = config.boot.binfmt.emulatedSystems;
 }
diff --git a/nix/configurations/vanadium/nixos/programs.nix b/nix/configurations/vanadium/nixos/programs.nix
index f66aed03..74d4be3e 100644
--- a/nix/configurations/vanadium/nixos/programs.nix
+++ b/nix/configurations/vanadium/nixos/programs.nix
@@ -2,14 +2,15 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   imports = [
     #
     # Docker
     #
     {
       virtualisation.docker.enable = true;
-      me.extraGroups = ["docker"];
+      me.extraGroups = [ "docker" ];
     }
 
     # #
@@ -48,6 +49,9 @@
   services.gnome.gnome-keyring.enable = true;
 
   services = {
+    # Since we don't have a lot of swap, we make sure we kill the processes and not halt the machine
+    earlyoom.enable = true;
+
     postgresql = {
       enable = true;
       authentication = lib.mkOverride 10 ''
@@ -63,10 +67,10 @@
       enable = true;
       filters = ''
         category "Spotify" {
-          params "context@open.spotify.com" "si@open.spotify.com"
+          params "context@*spotify.com" "si@*spotify.com"
         }
         category "YouTube" {
-          params "si@youtu.be" "pp@youtu.be" "si@youtube.com" "pp@youtube.com"
+          params "si@youtu.be" "pp@youtu.be" "si@*youtube.com" "pp@*youtube.com"
         }
         category "WTF" {
           params "utm_*"
diff --git a/nix/configurations/vanadium/nixos/restic.nix b/nix/configurations/vanadium/nixos/restic.nix
index 7e9eeefd..b90a92bc 100644
--- a/nix/configurations/vanadium/nixos/restic.nix
+++ b/nix/configurations/vanadium/nixos/restic.nix
@@ -1,91 +1,94 @@
-{config, ...}: {
-  services.restic.backups = let
-    pruneOpts = [
-      "--keep-daily 7"
-      "--keep-weekly 4"
-      "--keep-monthly 12"
-      "--keep-yearly 10"
-    ];
-  in {
-    "backblaze" = {
-      paths = [
-        "/home/leana/Documents"
-        "/home/leana/Calibre"
+{ config, ... }:
+{
+  services.restic.backups =
+    let
+      pruneOpts = [
+        "--keep-daily 7"
+        "--keep-weekly 4"
+        "--keep-monthly 12"
+        "--keep-yearly 10"
       ];
+    in
+    {
+      "backblaze" = {
+        paths = [
+          "/home/leana/Documents"
+          "/home/leana/Calibre"
+        ];
 
-      passwordFile = config.age.secrets.restic_backblaze_pwd.path;
-      repositoryFile = config.age.secrets.restic_backblaze_repo.path;
-      environmentFile = config.age.secrets.restic_backblaze_env.path;
+        passwordFile = config.age.secrets.restic_backblaze_pwd.path;
+        repositoryFile = config.age.secrets.restic_backblaze_repo.path;
+        environmentFile = config.age.secrets.restic_backblaze_env.path;
 
-      timerConfig = {
-        OnCalendar = "daily";
-        Persistent = true;
-        RandomizedDelaySec = "1h";
+        timerConfig = {
+          OnCalendar = "daily";
+          Persistent = true;
+          RandomizedDelaySec = "1h";
+        };
+
+        inherit pruneOpts;
       };
 
-      inherit pruneOpts;
+      "four" = {
+        paths = [
+          "/home/leana/Music"
+          "/home/leana/Documents"
+          "/home/leana/Calibre"
+          "/home/leana/Images"
+        ];
+
+        repository = "/mnt/four/restic";
+        passwordFile = config.age.secrets.restic_four_pwd.path;
+
+        timerConfig = null;
+
+        inherit pruneOpts;
+      };
+
+      "sgbk" = {
+        paths = [
+          "/home/leana/Music"
+          "/home/leana/Documents"
+          "/home/leana/Calibre"
+          "/home/leana/Images"
+        ];
+
+        timerConfig = null;
+
+        repository = "/mnt/sgbk/restic";
+        passwordFile = config.age.secrets.restic_sgbk_pwd.path;
+
+        inherit pruneOpts;
+      };
+
+      "two-to-four" = {
+        paths = [ "/mnt/two" ];
+
+        timerConfig = null;
+
+        repository = "/mnt/four/restic";
+        passwordFile = config.age.secrets.restic_four_pwd.path;
+
+        exclude = [ "lost+found" ];
+
+        inherit pruneOpts;
+      };
     };
 
-    "four" = {
-      paths = [
-        "/home/leana/Music"
-        "/home/leana/Documents"
-        "/home/leana/Calibre"
-        "/home/leana/Images"
-      ];
-
-      repository = "/mnt/four/restic";
-      passwordFile = config.age.secrets.restic_four_pwd.path;
-
-      timerConfig = null;
-
-      inherit pruneOpts;
-    };
-
-    "sgbk" = {
-      paths = [
-        "/home/leana/Music"
-        "/home/leana/Documents"
-        "/home/leana/Calibre"
-        "/home/leana/Images"
-      ];
-
-      timerConfig = null;
-
-      repository = "/mnt/sgbk/restic";
-      passwordFile = config.age.secrets.restic_sgbk_pwd.path;
-
-      inherit pruneOpts;
-    };
-
-    "two-to-four" = {
-      paths = ["/mnt/two"];
-
-      timerConfig = null;
-
-      repository = "/mnt/four/restic";
-      passwordFile = config.age.secrets.restic_four_pwd.path;
-
-      exclude = ["lost+found"];
-
-      inherit pruneOpts;
-    };
-  };
-
   systemd.services = {
     # TODO:
     # Wait for upstream to introduce direct access to unitConfig
     # c.f. https://github.com/NixOS/nixpkgs/pull/368234
     "restic-backups-four" = {
-      requires = ["mnt-four.mount"];
-      after = ["mnt-four.mount"];
-      unitConfig.PropagatesStopTo = ["mnt-four.mount"];
+      requires = [ "mnt-four.mount" ];
+      after = [ "mnt-four.mount" ];
+      unitConfig.PropagatesStopTo = [ "mnt-four.mount" ];
     };
 
     "restic-backups-sgbk" = {
-      requires = ["mnt-sgbk.mount"];
-      after = ["mnt-sgbk.mount"];
-      unitConfig.PropagatesStopTo = ["mnt-sgbk.mount"];
+      requires = [ "mnt-sgbk.mount" ];
+      after = [ "mnt-sgbk.mount" ];
+      unitConfig.PropagatesStopTo = [ "mnt-sgbk.mount" ];
     };
 
     "restic-backups-two-to-four" = {
diff --git a/nix/configurations/vanadium/nixos/secure_dns.nix b/nix/configurations/vanadium/nixos/secure_dns.nix
deleted file mode 100644
index eebd747a..00000000
--- a/nix/configurations/vanadium/nixos/secure_dns.nix
+++ /dev/null
@@ -1,80 +0,0 @@
-# https://nixos.wiki/wiki/Encrypted_DNS
-{
-  lib,
-  pkgs,
-  ...
-}: {
-  networking = {
-    nameservers = ["127.0.0.1" "::1"];
-    dhcpcd.extraConfig = "nohook resolv.conf";
-    # networkmanager.dns = "none";
-  };
-
-  services.resolved.enable = false;
-
-  services.dnscrypt-proxy2 = {
-    enable = true;
-    # Settings reference:
-    # https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml
-    settings = {
-      listen_addresses = ["127.0.0.1:53"];
-      ipv4_servers = true;
-
-      require_dnssec = true;
-      require_nolog = true;
-      require_nofilter = true;
-
-      lb_strategy = "p2";
-      lb_estimator = true;
-
-      # Blocklists are made of one pattern per line.
-      # https://github.com/DNSCrypt/dnscrypt-proxy/blob/fa59f990431a49b6485f63f96601bc7e64017bf8/dnscrypt-proxy/example-dnscrypt-proxy.toml#L583C4-L583C75
-      blocked_names.blocked_names_file = let
-        # Prevent building up reliance on chatbots
-        # Gotta preserve that thinking ability of my smoof bwain
-        ai_list = let
-          src = pkgs.fetchFromGitHub {
-            owner = "laylavish";
-            repo = "uBlockOrigin-HUGE-AI-Blocklist";
-            rev = "9bb188e2701138e03f73bacebd6b19b181ca0012";
-            hash = "sha256-p3wfR28DH6V8BHn9DT10d09Yq3mdbBecWwlR1CdDYUA=";
-          };
-        in
-          lib.pipe (builtins.readFile "${src}/noai_hosts.txt") [
-            (lib.replaceStrings ["\r\n"] ["\n"]) # convert to unix ending just in case
-            (lib.splitString "\n")
-            (builtins.filter (x: ! (x == "" || lib.hasPrefix "#" x)))
-            (builtins.map (x: builtins.elemAt (lib.splitString " " x) 1)) # remove 0.0.0.0
-          ];
-
-        hategroup_list = let
-          src = pkgs.fetchFromGitHub {
-            owner = "chigh";
-            repo = "hategroup-dnsbl";
-            rev = "cc19c050997d5f54014bb20c764b131e003dfb17";
-            hash = "sha256-SZBrjIBUw687MdrbOV7WrP5IhAAtKvPL2GqdcICHNvQ=";
-          };
-        in
-          lib.pipe (builtins.readFile "${src}/blocklist.txt") [
-            (lib.replaceStrings ["\r\n"] ["\n"]) # convert to unix ending just in case
-            (lib.splitString "\n")
-            (builtins.filter (x: ! (x == "" || lib.hasPrefix "#" x)))
-          ];
-
-        combined_lists = ai_list ++ hategroup_list;
-      in
-        pkgs.writeText "dnsblocklist" (builtins.concatStringsSep "\n" combined_lists);
-
-      # Add this to test if dnscrypt-proxy is actually used to resolve DNS requests
-      # query_log.file = "/var/log/dnscrypt-proxy/query.log";
-      sources.public-resolvers = {
-        urls = [
-          "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
-          "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
-        ];
-        cache_file = "/var/cache/dnscrypt-proxy/public-resolvers.md";
-        minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
-      };
-    };
-  };
-}
diff --git a/nix/configurations/vanadium/nixos/unfree-predicate.nix b/nix/configurations/vanadium/nixos/unfree-predicate.nix
index 97456b73..d880c61f 100644
--- a/nix/configurations/vanadium/nixos/unfree-predicate.nix
+++ b/nix/configurations/vanadium/nixos/unfree-predicate.nix
@@ -1,27 +1,29 @@
-{lib, ...}: {
+{ lib, ... }:
+{
   nixpkgs.config.allowUnfreePredicate = lib.mkDefault (
-    pkg: let
+    pkg:
+    let
       name = lib.getName pkg;
     in
-      builtins.elem name [
-        "languagetool"
+    builtins.elem name [
+      "languagetool"
 
-        "vscode"
-        "code"
+      "vscode"
+      "code"
 
-        "tampermonkey"
+      "tampermonkey"
 
-        "aseprite"
+      "aseprite"
 
-        "posy-cursors"
+      "posy-cursors"
 
-        "discord"
-      ]
-      || builtins.any (lib.flip lib.hasInfix name) [
-        # Scanner
-        "brscan5"
+      "discord"
+    ]
+    || builtins.any (lib.flip lib.hasInfix name) [
+      # Scanner
+      "brscan5"
 
-        "steam"
-      ]
+      "steam"
+    ]
   );
 }
diff --git a/nix/configurations/vanadium/overlay.nix b/nix/configurations/vanadium/overlay.nix
index 7f973f21..8414c6e9 100644
--- a/nix/configurations/vanadium/overlay.nix
+++ b/nix/configurations/vanadium/overlay.nix
@@ -9,57 +9,63 @@ let
 
   infuse = lib.flip infuse-lib.v1.infuse;
 in
-  # Why shouldn't I go crazy with overlays?
-  final:
-    infuse {
-      cmus.__input.alsaSupport = _: false;
+# Why shouldn't I go crazy with overlays?
+final:
+infuse {
+  cmus.__input.alsaSupport = _: false;
 
-      fish.__input.usePython = _: false;
+  fish.__input.usePython = _: false;
 
-      tmux.__input.withSixel = _: false;
+  tmux.__input.withSixel = _: false;
 
-      vlc.__input.chromecastSupport = _: false;
-      vlc.__input.waylandSupport = _: false;
+  vlc.__input.chromecastSupport = _: false;
+  vlc.__input.waylandSupport = _: false;
 
-      # I don't really use helix, but it's nice to have the W alias just in case
-      helix.__output.patches.__append = [
-        ./patches/helix/W-as-write.patch
-      ];
+  # I don't really use helix, but it's nice to have the W alias just in case
+  helix.__output.patches.__append = [
+    ./patches/helix/W-as-write.patch
+  ];
 
-      # Too loud
-      alejandra.__output.patches.__append = [
-        ./patches/alejandra/no-ads.patch
-      ];
-      alejandra.__output.doCheck = _: false;
+  # Too loud
+  alejandra.__output.patches.__append = [
+    ./patches/alejandra/no-ads.patch
+  ];
+  alejandra.__output.doCheck = _: false;
 
-      # TODO:
-      # pinned branch of https://github.com/astrand/xclip/tree/xerror
-      # use this until #43 gets resolved properly
-      xclip.__output.src = _:
-        final.fetchFromGitHub {
-          owner = "astrand";
-          repo = "xclip";
-          rev = "2c3b811002b35d3be7f39cc1145dd06bdb32e31c";
-          hash = "sha256-hHbq97GTKiRw8LZa/LY4LUOFOd/5H4+S+NR0BJfcu6M=";
-        };
+  # TODO:
+  # pinned branch of https://github.com/astrand/xclip/tree/xerror
+  # use this until #43 gets resolved properly
+  xclip.__output.src =
+    _:
+    final.fetchFromGitHub {
+      owner = "astrand";
+      repo = "xclip";
+      rev = "2c3b811002b35d3be7f39cc1145dd06bdb32e31c";
+      hash = "sha256-hHbq97GTKiRw8LZa/LY4LUOFOd/5H4+S+NR0BJfcu6M=";
+    };
 
-      fcitx5.__output.cmakeFlags.__append = [
-        (lib.cmakeFeature "ENABLE_EMOJI" "Off")
-        (lib.cmakeFeature "ENABLE_WAYLAND" "Off")
-      ];
-      fcitx5.__output.patches.__append = [
-        ./patches/fcitx5/disable-clipboard.patch
-        ./patches/fcitx5/disable-quickphrase.patch
-        ./patches/fcitx5/disable-unicode.patch
-      ];
-      fcitx5-chinese-addons.__output.cmakeFlags.__append = [
-        (lib.cmakeFeature "ENABLE_BROWSER" "Off")
-        (lib.cmakeFeature "ENABLE_CLOUDPINYIN" "Off")
-        (lib.cmakeFeature "ENABLE_DATA" "Off")
-      ];
-      fcitx5-chinese-addons.__output.patches.__append = [
-        ./patches/fcitx5-chinese-addons/disable-chttrans.patch
-        ./patches/fcitx5-chinese-addons/disable-fullwidth.patch
-        # Note: disabling pinyin helper breaks canjie
-      ];
-    }
+  fcitx5.__output.cmakeFlags.__append = [
+    (lib.cmakeFeature "ENABLE_EMOJI" "Off")
+    (lib.cmakeFeature "ENABLE_WAYLAND" "Off")
+  ];
+  fcitx5.__output.patches.__append = [
+    ./patches/fcitx5/disable-clipboard.patch
+    ./patches/fcitx5/disable-quickphrase.patch
+    ./patches/fcitx5/disable-unicode.patch
+  ];
+  qt6Packages.fcitx5-chinese-addons.__output.cmakeFlags.__append = [
+    (lib.cmakeFeature "ENABLE_BROWSER" "Off")
+    (lib.cmakeFeature "ENABLE_CLOUDPINYIN" "Off") # c.f. patch below
+    (lib.cmakeFeature "ENABLE_DATA" "Off")
+  ];
+  qt6Packages.fcitx5-chinese-addons.__output.patches.__append = [
+    ./patches/fcitx5-chinese-addons/disable-chttrans.patch
+    ./patches/fcitx5-chinese-addons/disable-fullwidth.patch
+    (final.fetchpatch {
+      name = "cloudpinyin-disable-build"; # without this the option would fail
+      url = "https://github.com/fcitx/fcitx5-chinese-addons/commit/92ffd494273a5573347c1fe2667fb8d67a5303db.patch";
+      hash = "sha256-Mo5l8tsn1JQxTFHxOZfQRmbCeWZHLyxfn2Qwv/gQXGA=";
+    })
+    # Note: disabling pinyin helper breaks canjie
+  ];
+}
diff --git a/nix/configurations/vanadium/patches/fcitx5-chinese-addons/disable-chttrans.patch b/nix/configurations/vanadium/patches/fcitx5-chinese-addons/disable-chttrans.patch
index f18c0d76..ea5ce501 100644
--- a/nix/configurations/vanadium/patches/fcitx5-chinese-addons/disable-chttrans.patch
+++ b/nix/configurations/vanadium/patches/fcitx5-chinese-addons/disable-chttrans.patch
@@ -1,5 +1,5 @@
 diff --git a/modules/chttrans/CMakeLists.txt b/modules/chttrans/CMakeLists.txt
-index 6c73ea8..8ed5660 100644
+index e2f5f43..61c6590 100644
 --- a/modules/chttrans/CMakeLists.txt
 +++ b/modules/chttrans/CMakeLists.txt
 @@ -1,20 +1,20 @@
@@ -10,7 +10,7 @@ index 6c73ea8..8ed5660 100644
 -    set(CHTTRANS_SOURCES ${CHTTRANS_SOURCES} chttrans-opencc.cpp)
 -endif()
 -add_fcitx5_addon(chttrans ${CHTTRANS_SOURCES})
--target_link_libraries(chttrans Fcitx5::Core Fcitx5::Config Fcitx5::Module::Notifications Boost::iostreams ${FMT_TARGET})
+-target_link_libraries(chttrans Fcitx5::Core Fcitx5::Config Fcitx5::Module::Notifications)
 -if (ENABLE_OPENCC)
 -    target_link_libraries(chttrans OpenCC::OpenCC)
 -    if (TARGET Boost::json)
@@ -25,7 +25,7 @@ index 6c73ea8..8ed5660 100644
 +#     set(CHTTRANS_SOURCES ${CHTTRANS_SOURCES} chttrans-opencc.cpp)
 +# endif()
 +# add_fcitx5_addon(chttrans ${CHTTRANS_SOURCES})
-+# target_link_libraries(chttrans Fcitx5::Core Fcitx5::Config Fcitx5::Module::Notifications Boost::iostreams ${FMT_TARGET})
++# target_link_libraries(chttrans Fcitx5::Core Fcitx5::Config Fcitx5::Module::Notifications)
 +# if (ENABLE_OPENCC)
 +#     target_link_libraries(chttrans OpenCC::OpenCC)
 +#     if (TARGET Boost::json)
@@ -42,7 +42,7 @@ index 6c73ea8..8ed5660 100644
 +#         COMPONENT config)
 +# install(FILES gbks2t.tab DESTINATION "${CMAKE_INSTALL_DATADIR}/fcitx5/chttrans" COMPONENT config)
 diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 994a4d1..9322834 100644
+index 5a8c94c..2feccd0 100644
 --- a/test/CMakeLists.txt
 +++ b/test/CMakeLists.txt
 @@ -23,10 +23,10 @@ add_dependencies(testfullwidth fullwidth fullwidth.conf.in-fmt)
@@ -50,14 +50,13 @@ index 994a4d1..9322834 100644
  
  add_subdirectory(inputmethod)
 -add_executable(testchttrans testchttrans.cpp)
--target_link_libraries(testchttrans Fcitx5::Core Fcitx5::Module::TestFrontend Fcitx5::Module::TestIM Pthread::Pthread)
+-target_link_libraries(testchttrans Fcitx5::Core Fcitx5::Module::TestFrontend Fcitx5::Module::TestIM)
 -add_dependencies(testchttrans chttrans chttrans.conf.in-fmt copy-addon copy-testim)
 -add_test(NAME testchttrans COMMAND testchttrans)
 +# add_executable(testchttrans testchttrans.cpp)
-+# target_link_libraries(testchttrans Fcitx5::Core Fcitx5::Module::TestFrontend Fcitx5::Module::TestIM Pthread::Pthread)
++# target_link_libraries(testchttrans Fcitx5::Core Fcitx5::Module::TestFrontend Fcitx5::Module::TestIM)
 +# add_dependencies(testchttrans chttrans chttrans.conf.in-fmt copy-addon copy-testim)
 +# add_test(NAME testchttrans COMMAND testchttrans)
  
  add_subdirectory(addon)
  add_executable(testpinyin testpinyin.cpp)
-
diff --git a/nix/configurations/vanadium/patches/fcitx5-chinese-addons/disable-fullwidth.patch b/nix/configurations/vanadium/patches/fcitx5-chinese-addons/disable-fullwidth.patch
index 16626dc4..b079fafe 100644
--- a/nix/configurations/vanadium/patches/fcitx5-chinese-addons/disable-fullwidth.patch
+++ b/nix/configurations/vanadium/patches/fcitx5-chinese-addons/disable-fullwidth.patch
@@ -22,7 +22,7 @@ index 6e275bd..2dabd86 100644
 +# install(FILES "${CMAKE_CURRENT_BINARY_DIR}/fullwidth.conf" DESTINATION "${FCITX_INSTALL_PKGDATADIR}/addon"
 +#         COMPONENT config)
 diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 994a4d1..f354bfd 100644
+index 5a8c94c..0f0b130 100644
 --- a/test/CMakeLists.txt
 +++ b/test/CMakeLists.txt
 @@ -17,10 +17,10 @@ target_link_libraries(testpinyinhelper Fcitx5::Core Fcitx5::Module::PinyinHelper
@@ -30,14 +30,13 @@ index 994a4d1..f354bfd 100644
  add_test(NAME testpinyinhelper COMMAND testpinyinhelper)
  
 -add_executable(testfullwidth testfullwidth.cpp)
--target_link_libraries(testfullwidth Fcitx5::Core Fcitx5::Module::TestFrontend Fcitx5::Module::TestIM Pthread::Pthread)
+-target_link_libraries(testfullwidth Fcitx5::Core Fcitx5::Module::TestFrontend Fcitx5::Module::TestIM)
 -add_dependencies(testfullwidth fullwidth fullwidth.conf.in-fmt)
 -add_test(NAME testfullwidth COMMAND testfullwidth)
 +# add_executable(testfullwidth testfullwidth.cpp)
-+# target_link_libraries(testfullwidth Fcitx5::Core Fcitx5::Module::TestFrontend Fcitx5::Module::TestIM Pthread::Pthread)
++# target_link_libraries(testfullwidth Fcitx5::Core Fcitx5::Module::TestFrontend Fcitx5::Module::TestIM)
 +# add_dependencies(testfullwidth fullwidth fullwidth.conf.in-fmt)
 +# add_test(NAME testfullwidth COMMAND testfullwidth)
  
  add_subdirectory(inputmethod)
  add_executable(testchttrans testchttrans.cpp)
-
diff --git a/nix/configurations/vanadium/patches/fcitx5/disable-clipboard.patch b/nix/configurations/vanadium/patches/fcitx5/disable-clipboard.patch
index 4ad25570..fa526161 100644
--- a/nix/configurations/vanadium/patches/fcitx5/disable-clipboard.patch
+++ b/nix/configurations/vanadium/patches/fcitx5/disable-clipboard.patch
@@ -1,8 +1,8 @@
 diff --git a/src/modules/clipboard/CMakeLists.txt b/src/modules/clipboard/CMakeLists.txt
-index 997c4e3e..4163cada 100644
+index afeaa6d3..ad4e77e0 100644
 --- a/src/modules/clipboard/CMakeLists.txt
 +++ b/src/modules/clipboard/CMakeLists.txt
-@@ -1,21 +1,21 @@
+@@ -1,25 +1,25 @@
 -add_fcitx5_addon(clipboard)
 -
 -target_sources(clipboard PRIVATE clipboard.cpp)
@@ -15,7 +15,11 @@ index 997c4e3e..4163cada 100644
 -
 -if (WAYLAND_FOUND)
 -    target_sources(clipboard PRIVATE waylandclipboard.cpp)
--    target_link_libraries(clipboard Fcitx5::Module::Wayland Fcitx5::Wayland::WLRDataControl Pthread::Pthread)
+-    target_link_libraries(clipboard
+-        Fcitx5::Module::Wayland
+-        Fcitx5::Wayland::WLRDataControl
+-        Fcitx5::Wayland::ExtDataControl
+-        Pthread::Pthread)
 -endif()
 -
 -install(TARGETS clipboard DESTINATION "${FCITX_INSTALL_ADDONDIR}")
@@ -33,7 +37,11 @@ index 997c4e3e..4163cada 100644
 +#
 +# if (WAYLAND_FOUND)
 +#     target_sources(clipboard PRIVATE waylandclipboard.cpp)
-+#     target_link_libraries(clipboard Fcitx5::Module::Wayland Fcitx5::Wayland::WLRDataControl Pthread::Pthread)
++#     target_link_libraries(clipboard
++#         Fcitx5::Module::Wayland
++#         Fcitx5::Wayland::WLRDataControl
++#         Fcitx5::Wayland::ExtDataControl
++#         Pthread::Pthread)
 +# endif()
 +#
 +# install(TARGETS clipboard DESTINATION "${FCITX_INSTALL_ADDONDIR}")
@@ -42,4 +50,3 @@ index 997c4e3e..4163cada 100644
  configure_file(clipboard.conf.in.in clipboard.conf.in @ONLY)
  fcitx5_translate_desktop_file(${CMAKE_CURRENT_BINARY_DIR}/clipboard.conf.in clipboard.conf)
  fcitx5_export_module(Clipboard TARGET clipboard BUILD_INCLUDE_DIRECTORIES "${CMAKE_CURRENT_SOURCE_DIR}" HEADERS clipboard_public.h INSTALL)
-
diff --git a/nix/configurations/vanadium/patches/fcitx5/disable-quickphrase.patch b/nix/configurations/vanadium/patches/fcitx5/disable-quickphrase.patch
index 37afa2fd..41df9ece 100644
--- a/nix/configurations/vanadium/patches/fcitx5/disable-quickphrase.patch
+++ b/nix/configurations/vanadium/patches/fcitx5/disable-quickphrase.patch
@@ -25,10 +25,10 @@ index b5bc37ac..04f4da59 100644
 +#         FILES_MATCHING PATTERN "*.mb")
  
 diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 97eed1f3..53e09977 100644
+index 643d96f4..0916c732 100644
 --- a/test/CMakeLists.txt
 +++ b/test/CMakeLists.txt
-@@ -147,10 +147,10 @@ if (ENABLE_KEYBOARD)
+@@ -162,10 +162,10 @@ if (ENABLE_KEYBOARD)
      add_test(NAME testspell COMMAND testspell)
  endif()
  
@@ -43,4 +43,3 @@ index 97eed1f3..53e09977 100644
  
  if (ENABLE_X11)
  add_executable(testxim testxim.cpp)
-
diff --git a/nix/configurations/vanadium/patches/fcitx5/disable-unicode.patch b/nix/configurations/vanadium/patches/fcitx5/disable-unicode.patch
index 8b49d39e..7de1dedd 100644
--- a/nix/configurations/vanadium/patches/fcitx5/disable-unicode.patch
+++ b/nix/configurations/vanadium/patches/fcitx5/disable-unicode.patch
@@ -1,13 +1,13 @@
 diff --git a/src/modules/unicode/CMakeLists.txt b/src/modules/unicode/CMakeLists.txt
-index 73f7e064..afddabee 100644
+index 11512ecf..9efde8ac 100644
 --- a/src/modules/unicode/CMakeLists.txt
 +++ b/src/modules/unicode/CMakeLists.txt
 @@ -1,11 +1,11 @@
 -add_fcitx5_addon(unicode unicode.cpp charselectdata.cpp)
--target_link_libraries(unicode Fcitx5::Core Fcitx5::Module::Clipboard ${FMT_TARGET})
+-target_link_libraries(unicode Fcitx5::Core Fcitx5::Module::Clipboard)
 -install(TARGETS unicode DESTINATION "${FCITX_INSTALL_ADDONDIR}")
 +# add_fcitx5_addon(unicode unicode.cpp charselectdata.cpp)
-+# target_link_libraries(unicode Fcitx5::Core Fcitx5::Module::Clipboard ${FMT_TARGET})
++# target_link_libraries(unicode Fcitx5::Core Fcitx5::Module::Clipboard)
 +# install(TARGETS unicode DESTINATION "${FCITX_INSTALL_ADDONDIR}")
  configure_file(unicode.conf.in.in unicode.conf.in @ONLY)
  fcitx5_translate_desktop_file(${CMAKE_CURRENT_BINARY_DIR}/unicode.conf.in unicode.conf)
@@ -21,10 +21,10 @@ index 73f7e064..afddabee 100644
 +# install(FILES charselectdata DESTINATION "${FCITX_INSTALL_PKGDATADIR}/unicode" COMPONENT config)
  
 diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 97eed1f3..ff902c88 100644
+index 643d96f4..d008183a 100644
 --- a/test/CMakeLists.txt
 +++ b/test/CMakeLists.txt
-@@ -134,10 +134,10 @@ add_dependencies(testemoji emoji emoji.conf.in-fmt)
+@@ -149,10 +149,10 @@ add_dependencies(testemoji emoji emoji.conf.in-fmt)
  add_test(NAME testemoji COMMAND testemoji)
  endif()
  
diff --git a/nix/devShells/flora.nix b/nix/devShells/flora.nix
index 21c35fb8..1b94c3ee 100644
--- a/nix/devShells/flora.nix
+++ b/nix/devShells/flora.nix
@@ -4,56 +4,65 @@
 let
   sources = import ../../npins;
 in
-  {pkgs ? import sources.pin-florashell {}}:
-    pkgs.mkShell (let
-      libs = with pkgs; [
-        zlib
-        libpq
-        libsodium
-      ];
+{
+  pkgs ? import sources.pin-florashell { },
+}:
+pkgs.mkShell (
+  let
+    libs = with pkgs; [
+      zlib
+      libpq
+      libsodium
+    ];
 
-      hlib = pkgs.haskell.lib;
+    hlib = pkgs.haskell.lib;
 
-      callHackage = {
+    callHackage =
+      {
         name,
         version,
-      }: let
-        pkg = pkgs.haskell.packages.ghc910.callHackage name version {};
+      }:
+      let
+        pkg = pkgs.haskell.packages.ghc910.callHackage name version { };
       in
-        hlib.dontCheck (hlib.doJailbreak pkg);
-    in {
-      name = "flora";
-      packages = with pkgs; let
+      hlib.dontCheck (hlib.doJailbreak pkg);
+  in
+  {
+    name = "flora";
+    packages =
+      with pkgs;
+      let
         haskellPackages = haskell.packages.ghc910;
       in
-        # These don't build directly and need to be pinned
-        map callHackage [
-          {
-            name = "fourmolu";
-            version = "0.17.0.0";
-          }
-          {
-            name = "postgresql-migration";
-            version = "0.2.1.8";
-          }
-        ]
-        ++ [
-          haskellPackages.ghcid
-          haskellPackages.cabal-fmt
-          haskellPackages.cabal-install
-          haskellPackages.ghc
-          haskellPackages.haskell-language-server
+      # These don't build directly and need to be pinned
+      map callHackage [
+        {
+          name = "fourmolu";
+          version = "0.17.0.0";
+        }
+        {
+          name = "postgresql-migration";
+          version = "0.2.1.8";
+        }
+      ]
+      ++ [
+        haskellPackages.ghcid
+        haskellPackages.cabal-fmt
+        haskellPackages.cabal-install
+        haskellPackages.ghc
+        haskellPackages.haskell-language-server
 
-          postgresql_14
-          postgresqlTestHook
+        postgresql_14
+        postgresqlTestHook
 
-          yarn
+        yarn
 
-          pkg-config
-          esbuild
-          changelog-d
-        ]
-        ++ libs;
+        pkg-config
+        esbuild
+        changelog-d
+      ]
+      ++ libs;
 
-      LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath libs;
-    })
+    LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath libs;
+  }
+)
diff --git a/nix/devShells/forgejo.nix b/nix/devShells/forgejo.nix
index 103ae074..ed8eba15 100644
--- a/nix/devShells/forgejo.nix
+++ b/nix/devShells/forgejo.nix
@@ -1,20 +1,26 @@
-{pkgs ? import <nixpkgs> {}}: let
+{
+  pkgs ? import <nixpkgs> { },
+}:
+let
   inherit (pkgs) lib;
 in
-  pkgs.mkShell {
-    name = "forgejo";
-    packages = with pkgs; [
-      gnumake
+pkgs.mkShell {
+  name = "forgejo";
+  packages = with pkgs; [
+    gnumake
 
-      go
-      golangci-lint
-      gofumpt
+    go
+    golangci-lint
+    gofumpt
 
-      nodejs
-      nodePackages.npm
-    ];
+    nodejs
+    nodePackages.npm
+  ];
 
-    LD_LIBRARY_PATH = lib.makeLibraryPath (with pkgs; [
+  LD_LIBRARY_PATH = lib.makeLibraryPath (
+    with pkgs;
+    [
       libuuid
-    ]);
-  }
+    ]
+  );
+}
diff --git a/nix/devShells/haddock2.nix b/nix/devShells/haddock2.nix
index 47c4d064..447cc726 100644
--- a/nix/devShells/haddock2.nix
+++ b/nix/devShells/haddock2.nix
@@ -1,4 +1,6 @@
-{pkgs ? import <nixpkgs> {}}:
+{
+  pkgs ? import <nixpkgs> { },
+}:
 pkgs.mkShell rec {
   name = "haddock2";
 
diff --git a/nix/devShells/masna3.nix b/nix/devShells/masna3.nix
index 89da2ccb..60c9a391 100644
--- a/nix/devShells/masna3.nix
+++ b/nix/devShells/masna3.nix
@@ -1,53 +1,59 @@
 let
   sources = import ../../npins;
 in
-  {pkgs ? import sources.pin-masna3shell {}}:
-    pkgs.mkShell (let
-      libs = with pkgs; [
-        zlib
-        libpq
-        libsodium
-      ];
+{
+  pkgs ? import sources.pin-masna3shell { },
+}:
+pkgs.mkShell (
+  let
+    libs = with pkgs; [
+      zlib
+      libpq
+      libsodium
+    ];
 
-      hlib = pkgs.haskell.lib;
+    hlib = pkgs.haskell.lib;
 
-      callHackage = {
+    callHackage =
+      {
         name,
         version,
         haskellPackages ? pkgs.haskellPackages,
-      }: let
-        pkg = haskellPackages.callHackage name version {};
+      }:
+      let
+        pkg = haskellPackages.callHackage name version { };
       in
-        hlib.dontCheck (hlib.doJailbreak pkg);
+      hlib.dontCheck (hlib.doJailbreak pkg);
 
-      haskellPackages = pkgs.haskell.packages.ghc910;
-    in {
-      name = "masna3";
-      packages =
-        [
-          pkgs.haskell.packages.ghc9102.ghc
-          pkgs.haskell.packages.ghc9102.haskell-language-server
+    haskellPackages = pkgs.haskell.packages.ghc910;
+  in
+  {
+    name = "masna3";
+    packages = [
+      pkgs.haskell.packages.ghc9102.ghc
+      pkgs.haskell.packages.ghc9102.haskell-language-server
 
-          haskellPackages.cabal-install
-          haskellPackages.postgresql-migration
-          (callHackage {
-            name = "fourmolu";
-            version = "0.18.0.0";
-            haskellPackages = pkgs.haskell.packages.ghc912;
-          })
-          (callHackage {
-            name = "hlint";
-            version = "3.10";
-            haskellPackages = pkgs.haskell.packages.ghc912;
-          })
-          pkgs.haskell.packages.ghc98.apply-refact
-          haskellPackages.ghc-tags
-          haskellPackages.cabal-gild
+      haskellPackages.cabal-install
+      haskellPackages.postgresql-migration
+      (callHackage {
+        name = "fourmolu";
+        version = "0.18.0.0";
+        haskellPackages = pkgs.haskell.packages.ghc912;
+      })
+      (callHackage {
+        name = "hlint";
+        version = "3.10";
+        haskellPackages = pkgs.haskell.packages.ghc912;
+      })
+      pkgs.haskell.packages.ghc98.apply-refact
+      haskellPackages.ghc-tags
+      haskellPackages.cabal-gild
 
-          pkgs.gnumake
-          pkgs.pkg-config
-        ]
-        ++ libs;
+      pkgs.gnumake
+      pkgs.pkg-config
+    ]
+    ++ libs;
 
-      LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath libs;
-    })
+    LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath libs;
+  }
+)
diff --git a/nix/devShells/necro-man.nix b/nix/devShells/necro-man.nix
index 098e0cdc..6039be67 100644
--- a/nix/devShells/necro-man.nix
+++ b/nix/devShells/necro-man.nix
@@ -1,37 +1,40 @@
 let
   sources = import ../../npins;
 in
-  {pkgs ? import sources.pin-necro-man-nixpkgs {}}: let
-    shell = {
+{
+  pkgs ? import sources.pin-necro-man-nixpkgs { },
+}:
+let
+  shell =
+    {
       mkShell,
       #
       pkgs,
       python310Packages,
       texlive,
     }:
-      mkShell {
-        name = "necro-manual";
-        packages = [
-          pkgs.emacs
-          python310Packages.pygments
+    mkShell {
+      name = "necro-manual";
+      packages = [
+        pkgs.emacs
+        python310Packages.pygments
 
-          (texlive.combine {
-            inherit
-              (texlive)
-              scheme-medium
-              #
-              wrapfig
-              capt-of
-              minted
-              upquote
-              todonotes
-              fvextra
-              catchfile
-              xstring
-              framed
-              ;
-          })
-        ];
-      };
-  in
-    pkgs.callPackage shell {}
+        (texlive.combine {
+          inherit (texlive)
+            scheme-medium
+            #
+            wrapfig
+            capt-of
+            minted
+            upquote
+            todonotes
+            fvextra
+            catchfile
+            xstring
+            framed
+            ;
+        })
+      ];
+    };
+in
+pkgs.callPackage shell { }
diff --git a/nix/devShells/vim-tw.nix b/nix/devShells/vim-tw.nix
index 58c6678c..1e5595b1 100644
--- a/nix/devShells/vim-tw.nix
+++ b/nix/devShells/vim-tw.nix
@@ -1,14 +1,16 @@
 let
   sources = import ../../npins;
 in
-  {pkgs ? import sources.pin-vim-tw {}}:
-    pkgs.mkShell {
-      name = "vim-tw";
-      packages = with pkgs; [
-        haskellPackages.cabal-fmt
-        haskellPackages.cabal-install
-        haskellPackages.ghc
-        haskellPackages.haskell-language-server
-        haskellPackages.retrie
-      ];
-    }
+{
+  pkgs ? import sources.pin-vim-tw { },
+}:
+pkgs.mkShell {
+  name = "vim-tw";
+  packages = with pkgs; [
+    haskellPackages.cabal-fmt
+    haskellPackages.cabal-install
+    haskellPackages.ghc
+    haskellPackages.haskell-language-server
+    haskellPackages.retrie
+  ];
+}
diff --git a/nix/disko/hetzner_benchmark/ext4.nix b/nix/disko/hetzner_benchmark/ext4.nix
new file mode 100644
index 00000000..1bd10ef0
--- /dev/null
+++ b/nix/disko/hetzner_benchmark/ext4.nix
@@ -0,0 +1,37 @@
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/nvme1n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1M";
+              type = "EF02";
+              priority = 1;
+            };
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/nix/disko/hetzner_benchmark/raid.nix b/nix/disko/hetzner_benchmark/raid.nix
new file mode 100644
index 00000000..c6ed68d5
--- /dev/null
+++ b/nix/disko/hetzner_benchmark/raid.nix
@@ -0,0 +1,93 @@
+# I can't get this working for now :(
+# Only nvme1n1 is detected in the installer environment
+{
+  disko.devices = {
+    disk = {
+      one = {
+        type = "disk";
+        device = "/dev/nvme0n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            BOOT = {
+              size = "1M";
+              type = "EF02"; # for grub MBR
+            };
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+      two = {
+        type = "disk";
+        device = "/dev/nvme1n1";
+        content = {
+          type = "gpt";
+          partitions = {
+            boot = {
+              size = "1M";
+              type = "EF02"; # for grub MBR
+            };
+            ESP = {
+              size = "500M";
+              type = "EF00";
+              content = {
+                type = "mdraid";
+                name = "boot";
+              };
+            };
+            mdadm = {
+              size = "100%";
+              content = {
+                type = "mdraid";
+                name = "raid1";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    mdadm = {
+      boot = {
+        type = "mdadm";
+        level = 1;
+        metadata = "1.0";
+        content = {
+          type = "filesystem";
+          format = "vfat";
+          mountpoint = "/boot";
+          mountOptions = [ "umask=0077" ];
+        };
+      };
+      raid1 = {
+        type = "mdadm";
+        level = 1;
+        content = {
+          type = "gpt";
+          partitions.primary = {
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+            };
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/nix/disko/tungsten/btrfs.nix b/nix/disko/iron/btrfs.nix
similarity index 88%
rename from nix/disko/tungsten/btrfs.nix
rename to nix/disko/iron/btrfs.nix
index 88f5a492..66201153 100644
--- a/nix/disko/tungsten/btrfs.nix
+++ b/nix/disko/iron/btrfs.nix
@@ -14,7 +14,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = ["umask=0077"];
+                mountOptions = [ "umask=0077" ];
               };
             };
 
@@ -24,7 +24,7 @@
               content = {
                 type = "luks";
                 name = "crypted";
-                extraOpenArgs = [];
+                extraOpenArgs = [ ];
                 settings.allowDiscards = true;
                 content = {
                   type = "lvm_pv";
@@ -74,12 +74,15 @@
                 };
 
                 "/home" = {
-                  mountOptions = ["compress=zstd"];
+                  mountOptions = [ "compress=zstd" ];
                   mountpoint = "/home";
                 };
 
                 "/nix" = {
-                  mountOptions = ["compress=zstd" "noatime"];
+                  mountOptions = [
+                    "compress=zstd"
+                    "noatime"
+                  ];
                   mountpoint = "/nix";
                 };
               };
diff --git a/nix/disko/tungsten/default.nix b/nix/disko/iron/default.nix
similarity index 91%
rename from nix/disko/tungsten/default.nix
rename to nix/disko/iron/default.nix
index 172e29f5..0df2006c 100644
--- a/nix/disko/tungsten/default.nix
+++ b/nix/disko/iron/default.nix
@@ -18,7 +18,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = ["umask=0077"];
+                mountOptions = [ "umask=0077" ];
               };
             };
             luks = {
@@ -26,7 +26,7 @@
               content = {
                 type = "luks";
                 name = "crypted";
-                extraOpenArgs = [];
+                extraOpenArgs = [ ];
                 settings = {
                   allowDiscards = true;
                 };
@@ -50,7 +50,7 @@
               type = "filesystem";
               format = "ext4";
               mountpoint = "/";
-              mountOptions = ["defaults"];
+              mountOptions = [ "defaults" ];
             };
           };
           nix = {
@@ -59,7 +59,7 @@
               type = "filesystem";
               format = "ext4";
               mountpoint = "/nix";
-              mountOptions = ["noatime"];
+              mountOptions = [ "noatime" ];
             };
           };
           swap = {
diff --git a/nix/disko/vanadium/btrfs.nix b/nix/disko/vanadium/btrfs.nix
index 7ee68251..439c16a8 100644
--- a/nix/disko/vanadium/btrfs.nix
+++ b/nix/disko/vanadium/btrfs.nix
@@ -8,13 +8,13 @@
           type = "gpt";
           partitions = {
             ESP = {
-              size = "500M";
+              size = "512M";
               type = "EF00";
               content = {
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = ["umask=0077"];
+                mountOptions = [ "umask=0077" ];
               };
             };
 
@@ -24,64 +24,40 @@
               content = {
                 type = "luks";
                 name = "crypted";
-                extraOpenArgs = [];
+                extraOpenArgs = [ ];
                 settings.allowDiscards = true;
                 content = {
-                  type = "lvm_pv";
-                  vg = "pool";
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-
-    # Use LVM to create a partition for swap
-    lvm_vg = {
-      pool = {
-        type = "lvm_vg";
-        lvs = {
-          # Set swap device as resume device
-          swap = {
-            size = "48G"; # > 32G for hibernation
-            content = {
-              type = "swap";
-              discardPolicy = "both";
-              resumeDevice = true;
-            };
-          };
-
-          # Use btrfs over ext4 for:
-          # - compression
-          #   nix store can be shrinked using this feature
-          # - more transparent partitions (subvolumes)
-          #   no more "I need more space here and not there"
-          btrfs = {
-            size = "100%";
-            content = {
-              type = "btrfs";
-
-              mountpoint = "/btrfs-root";
-
-              # # DANGER:
-              # # Override existing partition at partition creation
-              # extraArgs = ["-f"];
-
-              subvolumes = {
-                "/root" = {
-                  mountOptions = ["noatime"];
-                  mountpoint = "/";
-                };
-
-                "/home" = {
-                  mountOptions = ["noatime"];
-                  mountpoint = "/home";
-                };
-
-                "/nix" = {
-                  mountOptions = ["compress=zstd" "noatime"];
-                  mountpoint = "/nix";
+                  type = "btrfs";
+                  # # DANGER:
+                  # # Override existing partition at partition creation
+                  # extraArgs = ["-f"];
+                  subvolumes = {
+                    "/root" = {
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                      ];
+                      mountpoint = "/";
+                    };
+                    "/home" = {
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                      ];
+                      mountpoint = "/home";
+                    };
+                    "/nix" = {
+                      mountOptions = [
+                        "compress=zstd"
+                        "noatime"
+                      ];
+                      mountpoint = "/nix";
+                    };
+                    "/swap" = {
+                      mountpoint = "/.swapvol";
+                      swap.swapfile.size = "1G";
+                    };
+                  };
                 };
               };
             };
diff --git a/nix/disko/vanadium/default.nix b/nix/disko/vanadium/default.nix
index 2590fceb..22941fd0 100644
--- a/nix/disko/vanadium/default.nix
+++ b/nix/disko/vanadium/default.nix
@@ -15,7 +15,7 @@
                 type = "filesystem";
                 format = "vfat";
                 mountpoint = "/boot";
-                mountOptions = ["umask=0077"];
+                mountOptions = [ "umask=0077" ];
               };
             };
             luks = {
@@ -23,7 +23,7 @@
               content = {
                 type = "luks";
                 name = "crypted";
-                extraOpenArgs = [];
+                extraOpenArgs = [ ];
                 settings = {
                   allowDiscards = true;
                 };
@@ -47,7 +47,7 @@
               type = "filesystem";
               format = "ext4";
               mountpoint = "/";
-              mountOptions = ["defaults"];
+              mountOptions = [ "defaults" ];
             };
           };
           nix = {
@@ -56,7 +56,7 @@
               type = "filesystem";
               format = "ext4";
               mountpoint = "/nix";
-              mountOptions = ["noatime"];
+              mountOptions = [ "noatime" ];
             };
           };
           swap = {
diff --git a/nix/git-identities/git-compat.nix b/nix/git-identities/git-compat.nix
new file mode 100644
index 00000000..d9806d98
--- /dev/null
+++ b/nix/git-identities/git-compat.nix
@@ -0,0 +1,20 @@
+let
+  hasconfigRemoteCondition =
+    {
+      # Custom arguments
+      url,
+      path ? "*/**",
+      ...
+    }@cfg:
+    let
+      cfg' = builtins.removeAttrs cfg [
+        "url"
+        "path"
+      ];
+    in
+    [
+      (cfg' // { condition = "hasconfig:remote.*.url:git@${url}:${path}"; })
+      (cfg' // { condition = "hasconfig:remote.*.url:https://${url}/${path}"; })
+    ];
+in
+builtins.concatMap hasconfigRemoteCondition
diff --git a/nix/git-identities/hooks/cabal/pre-commit b/nix/git-identities/hooks/cabal/pre-commit
new file mode 100755
index 00000000..51217183
--- /dev/null
+++ b/nix/git-identities/hooks/cabal/pre-commit
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+make style
+make doctest
+make lint
diff --git a/nix/git-identities/list.nix b/nix/git-identities/list.nix
new file mode 100644
index 00000000..245ac78c
--- /dev/null
+++ b/nix/git-identities/list.nix
@@ -0,0 +1,57 @@
+let
+  sources = import ../../npins;
+  lib = import (sources.nixpkgs + "/lib");
+
+  haskellIdentity = {
+    init.defaultBranch = "main";
+    user.name = "Léana Jiang";
+  };
+
+  universityIdentity = {
+    init.defaultBranch = "main";
+    user = {
+      name = "Léana CHIANG";
+      email = "leana.chiang@etudiant.univ-rennes1.fr";
+      signingKey = "0x32035DB97E777EEB";
+    };
+  };
+
+  blameIgnore = {
+    blame.ignoreRevsFile = ".git-blame-ignore-revs";
+  };
+in
+[
+  # Univ stuff
+  {
+    url = "gitlab.istic.univ-rennes1.fr";
+    contents = universityIdentity;
+  }
+  {
+    url = "gitlab2.istic.univ-rennes1.fr";
+    contents = universityIdentity;
+  }
+
+  # Haskell
+  {
+    url = "gitlab.haskell.org";
+    contents = haskellIdentity;
+  }
+
+  # Blame
+  # Turning this on globally will fail if the file doesn't exist
+  {
+    url = "github.com";
+    path = "nixos/nixpkgs.git";
+    contents = blameIgnore;
+  }
+  {
+    url = "gitlab.haskell.org";
+    path = "ghc/ghc.git";
+    contents = blameIgnore;
+  }
+  {
+    url = "github.com";
+    path = "haskell/cabal.git";
+    contents = blameIgnore;
+  }
+]
diff --git a/nix/homeModules/common/atuin.nix b/nix/homeModules/common/atuin.nix
index 940d0e02..86c5b17a 100644
--- a/nix/homeModules/common/atuin.nix
+++ b/nix/homeModules/common/atuin.nix
@@ -1,6 +1,6 @@
 {
   programs.atuin = {
-    flags = ["--disable-up-arrow"];
+    flags = [ "--disable-up-arrow" ];
     settings = {
       history_filter = [
         # privacy
diff --git a/nix/homeModules/common/btop/btop.conf b/nix/homeModules/common/btop/btop.conf
index 26e23814..c1973464 100644
--- a/nix/homeModules/common/btop/btop.conf
+++ b/nix/homeModules/common/btop/btop.conf
@@ -145,9 +145,10 @@ background_update = True
 #* Custom cpu model name, empty string to disable.
 custom_cpu_name = ""
 
+# TODO: maybe move this to vanadium because it's host based
 #* Optional filter for shown disks, should be full path of a mountpoint, separate multiple values with whitespace " ".
 #* Begin line with "exclude=" to change to exclude filter, otherwise defaults to "most include" filter. Example: disks_filter="exclude=/boot /home/user".
-disks_filter = "exclude=/btrfs-root /nix /home /boot"
+disks_filter = "exclude=/nix /home /boot /.swapvol"
 
 #* Show graphs instead of meters for memory values.
 mem_graphs = True
diff --git a/nix/homeModules/common/btop/default.nix b/nix/homeModules/common/btop/default.nix
index b5344c6c..3a3c2389 100644
--- a/nix/homeModules/common/btop/default.nix
+++ b/nix/homeModules/common/btop/default.nix
@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
+{
   programs.btop = {
     settings.color_theme = "${config.programs.btop.package}/share/btop/themes/onedark.theme";
     extraConfig = builtins.readFile ./btop.conf;
diff --git a/nix/homeModules/common/cmus/default.nix b/nix/homeModules/common/cmus/default.nix
index 07c185db..7ebf12b9 100644
--- a/nix/homeModules/common/cmus/default.nix
+++ b/nix/homeModules/common/cmus/default.nix
@@ -2,49 +2,51 @@
   pkgs,
   lib,
   ...
-}: {
-  programs.cmus.extraConfig = let
-    # dispatch to multiple callbacks
-    callback-script = pkgs.writeShellApplication {
-      name = "cmus-callback-script";
-      runtimeInputs = [
-        pkgs.cmusfm
-        pkgs.libnotify
-      ];
-      text = ''
-        # All keys contain only chars a-z. Values are UTF-8 strings.
-        #
-        # Keys: status file url artist album discnumber tracknumber title date
-        #   - status (stopped, playing, paused) is always given
-        #   - file or url is given only if track is 'loaded' in cmus
-        #   - other keys/values are given only if they are available
+}:
+{
+  programs.cmus.extraConfig =
+    let
+      # dispatch to multiple callbacks
+      callback-script = pkgs.writeShellApplication {
+        name = "cmus-callback-script";
+        runtimeInputs = [
+          pkgs.cmusfm
+          pkgs.libnotify
+        ];
+        text = ''
+          # All keys contain only chars a-z. Values are UTF-8 strings.
+          #
+          # Keys: status file url artist album discnumber tracknumber title date
+          #   - status (stopped, playing, paused) is always given
+          #   - file or url is given only if track is 'loaded' in cmus
+          #   - other keys/values are given only if they are available
 
-        # Use a map so that we can redirect all the args to cmusfm
-        argv=("$@")
-        declare -A map
-        while [ $# -gt 0 ]; do
-          map["$1"]="$2"
-          shift
-          shift
-        done
+          # Use a map so that we can redirect all the args to cmusfm
+          argv=("$@")
+          declare -A map
+          while [ $# -gt 0 ]; do
+            map["$1"]="$2"
+            shift
+            shift
+          done
 
-        # Setup pretty symbols
-        case ''${map[status]} in
-          paused)
-            SYMB="⏸"
-            ;;
-          playing)
-            SYMB="⏵"
-            ;;
-        esac
+          # Setup pretty symbols
+          case ''${map[status]} in
+            paused)
+              SYMB="⏸"
+              ;;
+            playing)
+              SYMB="⏵"
+              ;;
+          esac
 
-        notify-send \
-          "$SYMB ''${map[title]}"  \
-          "''${map[artist]} / ''${map[album]}"
-        cmusfm "''${argv[@]}"
-      '';
-    };
-  in
+          notify-send \
+            "$SYMB ''${map[title]}"  \
+            "''${map[artist]} / ''${map[album]}"
+          cmusfm "''${argv[@]}"
+        '';
+      };
+    in
     builtins.readFile ./rc
     + lib.optionalString pkgs.stdenv.isLinux ''
       set status_display_program=${lib.getExe callback-script}
diff --git a/nix/homeModules/common/direnv.nix b/nix/homeModules/common/direnv.nix
index aa4f2673..6ea2fc3d 100644
--- a/nix/homeModules/common/direnv.nix
+++ b/nix/homeModules/common/direnv.nix
@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
+{
   programs.direnv = {
     nix-direnv.enable = true;
     config = {
diff --git a/nix/homeModules/common/fcitx5/default.nix b/nix/homeModules/common/fcitx5/default.nix
index d0e86339..40fadff1 100644
--- a/nix/homeModules/common/fcitx5/default.nix
+++ b/nix/homeModules/common/fcitx5/default.nix
@@ -3,12 +3,14 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   cfg = config.i18n.inputMethod;
-in {
+in
+{
   i18n.inputMethod = {
     fcitx5.addons = [
-      pkgs.fcitx5-chinese-addons
+      pkgs.qt6Packages.fcitx5-chinese-addons
       pkgs.fcitx5-table-extra
     ];
   };
diff --git a/nix/homeModules/common/fcitx5/fcitx/config b/nix/homeModules/common/fcitx5/fcitx/config
index 3c6a8023..53fcbc42 100644
--- a/nix/homeModules/common/fcitx5/fcitx/config
+++ b/nix/homeModules/common/fcitx5/fcitx/config
@@ -27,12 +27,6 @@ EnumerateWithTriggerKeys=true
 [Hotkey/AltTriggerKeys]
 0=Shift_L
 
-[Hotkey/EnumerateGroupBackwardKeys]
-0=Control+Shift+space
-
-[Hotkey/EnumerateGroupForwardKeys]
-0=Control+space
-
 [Hotkey/NextCandidate]
 0=Tab
 
@@ -46,3 +40,4 @@ EnumerateWithTriggerKeys=true
 0=Up
 
 [Hotkey/TriggerKeys]
+0=Control+space
diff --git a/nix/homeModules/common/fcitx5/fcitx/profile b/nix/homeModules/common/fcitx5/fcitx/profile
index 9f258564..cbb6da73 100644
--- a/nix/homeModules/common/fcitx5/fcitx/profile
+++ b/nix/homeModules/common/fcitx5/fcitx/profile
@@ -1,23 +1,16 @@
 # vim:ft=ini
-
 [GroupOrder]
-0=gDvorak
-1=gCangjie
+0="Group 1"
 
 [Groups/0]
+Name="Group 1"
 Default Layout=us-dvorak
 DefaultIM=keyboard-us-dvorak
-Name=gDvorak
 
 [Groups/0/Items/0]
-Layout=
 Name=keyboard-us-dvorak
+Layout=us-dvorak
 
-[Groups/1]
-Default Layout=us
-DefaultIM=cangjie3
-Name=gCangjie
-
-[Groups/1/Items/0]
-Layout=
+[Groups/0/Items/1]
 Name=cangjie3
+Layout=us
diff --git a/nix/homeModules/common/fcitx5/fcitx/table/cangjie3.conf b/nix/homeModules/common/fcitx5/fcitx/table/cangjie3.conf
index 072933e0..75639c18 100644
--- a/nix/homeModules/common/fcitx5/fcitx/table/cangjie3.conf
+++ b/nix/homeModules/common/fcitx5/fcitx/table/cangjie3.conf
@@ -3,7 +3,7 @@
 SecondCandidate=
 # Select Third Candidate
 ThirdCandidate=
-# Page size
+# Candidates Per Page
 PageSize=10
 # Commit after auto select candidates
 CommitAfterSelect=True
diff --git a/nix/homeModules/common/firefox.nix b/nix/homeModules/common/firefox.nix
index d15d0246..194206bf 100644
--- a/nix/homeModules/common/firefox.nix
+++ b/nix/homeModules/common/firefox.nix
@@ -3,11 +3,13 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   inherit (pkgs) nur;
 
   cfg = config.programs.firefox;
-in {
+in
+{
   programs.firefox = {
     # https://mozilla.github.io/policy-templates
     # The following have more complex logic, keep them as policies and not profiles
@@ -19,7 +21,21 @@ in {
       ];
 
       SearchEngines = {
-        Remove = ["Bing" "DuckDuckGo" "Qwant" "eBay"];
+        Remove = [
+          "Google"
+          "Bing"
+          "DuckDuckGo"
+          "Qwant"
+          "eBay"
+          "Perplexity"
+        ];
+        Default = "DuckDuckGo Lite";
+        Add = [
+          {
+            Name = "DuckDuckGo Lite";
+            URLTemplate = "https://lite.duckduckgo.com/lite/search?q={searchTerms}";
+          }
+        ];
       };
       NoDefaultBookmarks = true;
       DisplayMenuBar = "never";
@@ -38,6 +54,10 @@ in {
         "browser.ctrlTab.sortByRecentlyUsed" = false;
         "layout.css.devPixelsPerPx" = 1.1;
 
+        # open links in new window
+        # this works a lot better with xmonad where I have a bunch of windows
+        "browser.link.open_newwindow" = 2;
+
         # Sponsored crap
         # Yes
         "browser.newtabpage.activity-stream.showSearch" = true;
@@ -85,35 +105,42 @@ in {
         "media.peerconnection.enabled" = false;
       };
 
-      extensions.packages = let
-        addons = nur.repos.rycee.firefox-addons;
-      in [
-        addons.ublock-origin
-        addons.privacy-badger
-        addons.user-agent-string-switcher
+      extensions.packages =
+        let
+          addons = nur.repos.rycee.firefox-addons;
+        in
+        [
+          addons.ublock-origin
+          addons.privacy-badger
+          addons.user-agent-string-switcher
 
-        /*
-        Here's to you who want to remove news feed eradicator because you find it annoying:
-        It is here to annoy you so it is less likely for you to be on the agency inversion path.
-        DO NOT REMOVE IT. I repeat, DO NOT REMOVE IT.
+          /*
+            Here's to you who want to remove news feed eradicator because you find it annoying:
+            It is here to annoy you so it is less likely for you to be on the agency inversion path.
+            DO NOT REMOVE IT. I repeat, DO NOT REMOVE IT.
 
-        If you think it's annoying, go do some jump rope, sing, live.
-        */
-        addons.news-feed-eradicator # did you read the comment above?
-        addons.multi-account-containers
-      ];
+            If you think it's annoying, go do some jump rope, sing, live.
+          */
+          addons.news-feed-eradicator # did you read the comment above?
+          addons.multi-account-containers
+        ];
     };
   };
 
-  xdg.mimeApps = lib.mkIf cfg.enable {
-    enable = true;
-    # source: https://unix.stackexchange.com/a/684582
-    defaultApplications = {
-      "text/html" = "firefox.desktop";
-      "x-scheme-handler/http" = "firefox.desktop";
-      "x-scheme-handler/https" = "firefox.desktop";
-      "x-scheme-handler/about" = "firefox.desktop";
-      "x-scheme-handler/unknown" = "firefox.desktop";
+  xdg.mimeApps =
+    let
+      # source: https://unix.stackexchange.com/a/684582
+      associations = {
+        "text/html" = "firefox.desktop";
+        "x-scheme-handler/http" = "firefox.desktop";
+        "x-scheme-handler/https" = "firefox.desktop";
+        "x-scheme-handler/about" = "firefox.desktop";
+        "x-scheme-handler/unknown" = "firefox.desktop";
+      };
+    in
+    lib.mkIf (cfg.enable && !config.programs.zen-browser.enable) {
+      enable = true;
+      associations.added = associations;
+      defaultApplications = associations;
     };
-  };
 }
diff --git a/nix/homeModules/common/fish/aliasesAbbrs.nix b/nix/homeModules/common/fish/aliasesAbbrs.nix
index 253dae7f..330a0159 100644
--- a/nix/homeModules/common/fish/aliasesAbbrs.nix
+++ b/nix/homeModules/common/fish/aliasesAbbrs.nix
@@ -2,7 +2,8 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   programs.fish = {
     shellAbbrs = lib.mkMerge [
       (lib.mkIf pkgs.stdenv.isLinux {
diff --git a/nix/homeModules/common/fish/default.nix b/nix/homeModules/common/fish/default.nix
index 240a6c29..6a866084 100644
--- a/nix/homeModules/common/fish/default.nix
+++ b/nix/homeModules/common/fish/default.nix
@@ -2,7 +2,8 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   imports = [
     ./aliasesAbbrs.nix
   ];
@@ -10,7 +11,7 @@
   #
   # Script dependencies
   #
-  home.packages = [pkgs.vivid];
+  home.packages = [ pkgs.vivid ];
   programs = {
     fd.enable = true;
     fzf.enable = true;
@@ -24,11 +25,9 @@
   #
   # Scripts and functions
   #
-  xdg.configFile =
-    lib.mapAttrs'
-    (path: _:
-      lib.nameValuePair "fish/functions/${path}" {source = "${./functions}/${path}";})
-    (builtins.readDir ./functions);
+  xdg.configFile = lib.mapAttrs' (
+    path: _: lib.nameValuePair "fish/functions/${path}" { source = "${./functions}/${path}"; }
+  ) (builtins.readDir ./functions);
 
   programs.fish = {
     interactiveShellInit = builtins.readFile ./shellInit.fish;
diff --git a/nix/homeModules/common/fish/shellInit.fish b/nix/homeModules/common/fish/shellInit.fish
index 05793966..0a1cfd24 100644
--- a/nix/homeModules/common/fish/shellInit.fish
+++ b/nix/homeModules/common/fish/shellInit.fish
@@ -18,34 +18,33 @@ set fish_cursor_visual block
                                 ###############
 # Learn more: https://fishshell.com/docs/current/interactive.html
 begin # scope this in a block to not leak variables everywhere
-    set -l black  \#000000
-    set -l grey   \#a0a1a7
-    set -l cyan   \#0184bc
-    set -l blue   \#4078f2
-    set -l purple \#a626a4
-    set -l green  \#50a14f
-    set -l orange \#e45649
-    set -l red    \#ca1243
-    set -l brown  \#986801
-    set -l gold   \#c18401
-    set -l accent \#645199
-    set -l visual \#d0d0d0
+    set -l black   "#073642" # .hs-identifier
+    set -l grey    "#a0a1a7"
+    set -l cyan    "#2aa198" # .hs-pragma
+    set -l blue    "#268bd2" # .hs-number
+    set -l magenta "#d33682" # .hs-operator
+    set -l green   "#859900" # .hs-cpp
+    set -l orange  "#cb4b16" # .hs-char
+    set -l red     "#af005f" # .hs-special
+    set -l purple  "#5f5faf" # .hs-type
+    set -l visual  "#dbcba3"
+    set -l cursor  "#f0e5c9"
 
     # General
     set fish_color_normal $black                     # default color
-    set fish_color_command $blue                     # commands like echo
-    set fish_color_keyword $purple                   # keywords like if - this falls back on the command color if unset
-    set fish_color_quote $green                      # quoted text like "abc"
-    set fish_color_redirection $gold                 # IO redirections like >/dev/null
-    set fish_color_end $black --bold                 # process separators like ; and &
-    set fish_color_error $black                      # syntax errors
-    set fish_color_param $red                        # ordinary command parameters
+    set fish_color_command                           # commands like echo
+    set fish_color_keyword $red                      # keywords like if - this falls back on the command color if unset
+    set fish_color_quote $orange                     # quoted text like "abc"
+    set fish_color_redirection $magenta              # IO redirections like >/dev/null
+    set fish_color_end $magenta --bold               # process separators like ; and &
+    set fish_color_error $grey                       # syntax errors
+    set fish_color_param $black                      # ordinary command parameters
     set fish_color_valid_path --italics              # parameters that are filenames (if the file exists)
-    set fish_color_option $cyan                      # options starting with “-”, up to the first “--” parameter
+    set fish_color_option                            # options starting with “-”, up to the first “--” parameter
     set fish_color_comment $grey                     # comments like ‘# important’
     set fish_color_selection --background=$visual    # selected text in vi visual mode
-    set fish_color_operator $orange                  # parameter expansion operators like * and ~
-    set fish_color_escape $purple                    # character escapes like \n and \x70
+    set fish_color_operator $magenta                 # parameter expansion operators like * and ~
+    set fish_color_escape $orange                    # character escapes like \n and \x70
     set fish_color_autosuggestion $grey              # autosuggestions (the proposed rest of a command)
     set fish_color_cwd $black                        # The current working directory in the default prompt
     set fish_color_cwd_root $red                     # The current working directory in the default prompt for the root user
@@ -53,19 +52,19 @@ begin # scope this in a block to not leak variables everywhere
     set fish_color_host $black                       # The hostname in the default prompt
     set fish_color_host_remote $red                  # the hostname in the default prompt for remote sessions (like ssh)
     set fish_color_status $red                       # the last command’s nonzero exit code in the default prompt
-    set fish_color_cancel $accent --reverse          # the ‘^C’ indicator on a canceled command
-    set fish_color_search_match --background $visual # history search matches and selected pager items (background only)
+    set fish_color_cancel $cyan --reverse            # the ‘^C’ indicator on a canceled command
+    set fish_color_search_match --background=$cursor # history search matches and selected pager items (background only)
 
     # Pager
-    set fish_pager_color_progress --reverse $cyan   # the progress bar at the bottom left corner
-    set fish_pager_color_background $black          # the background color of a line
-    set fish_pager_color_prefix $black              # the prefix string, i.e. the string that is to be completed
-    set fish_pager_color_completion $grey           # the completion itself, i.e. the proposed rest of the string
-    set fish_pager_color_description $grey          # the completion description
-    set fish_pager_color_selected_background $black # background of the selected completion
-    set fish_pager_color_selected_prefix            # prefix of the selected completion
-    set fish_pager_color_selected_completion $red   # suffix of the selected completion
-    set fish_pager_color_selected_description $gold # description of the selected completion
+    set fish_pager_color_progress --reverse                        # the progress bar at the bottom left corner
+    set fish_pager_color_background                                # the background color of a line
+    set fish_pager_color_prefix $black                             # the prefix string, i.e. the string that is to be completed
+    set fish_pager_color_completion $grey                          # the completion itself, i.e. the proposed rest of the string
+    set fish_pager_color_description $grey                         # the completion description
+    set fish_pager_color_selected_background --background=$cursor  # background of the selected completion
+    set fish_pager_color_selected_prefix $black                    # prefix of the selected completion
+    set fish_pager_color_selected_completion $black                # suffix of the selected completion
+    set fish_pager_color_selected_description $black               # description of the selected completion
 
     # # Alternating colors
     # set fish_pager_color_secondary_background --background=$tinted_bg # background of every second unselected completion
@@ -81,8 +80,10 @@ end
 set -x fzf_preview_file_cmd 'cat -n'
 # fzf-fish search hidden files
 set -x fzf_fd_opts --hidden --exclude=.git
+# fzf-fish using patdiff would show incomplete diff, it is a bug
+# don't do it
 
 # fd uses LS_COLORS
-set -x LS_COLORS (vivid -m 24-bit generate one-light)
+set -x LS_COLORS (vivid -m 24-bit generate solarized-light) # similar to milou
 
 set -g sponge_purge_only_on_exit true
diff --git a/nix/homeModules/common/fzf.nix b/nix/homeModules/common/fzf.nix
index d26f3c4e..70e94458 100644
--- a/nix/homeModules/common/fzf.nix
+++ b/nix/homeModules/common/fzf.nix
@@ -3,10 +3,10 @@
     "--cycle"
     "--border=none"
     "--preview-window=wrap"
-    "--color=fg:#000000,bg:#eeeeee,hl:#ca1243"
-    "--color=fg+:#000000,bg+:#d0d0d0,hl+:#ca1243"
-    "--color=info:#0184bc,prompt:#645199,pointer:#645199"
-    "--color=marker:#0184bc,spinner:#645199,header:#645199"
-    "--color=gutter:#eeeeee"
+    "--color=fg:#073642,bg:#fdf6e3,hl:#af005f"
+    "--color=fg+:#073642,bg+:#f0e5c9,hl+:#af005f"
+    "--color=info:#268bd2,prompt:#5f5faf,pointer:#073642"
+    "--color=marker:#268bd2,spinner:#5f5faf,header:#073642"
+    "--color=gutter:#eeeadd"
   ];
 }
diff --git a/nix/homeModules/common/git.nix b/nix/homeModules/common/git.nix
index a50ba2a5..9074ce48 100644
--- a/nix/homeModules/common/git.nix
+++ b/nix/homeModules/common/git.nix
@@ -2,17 +2,19 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   # git plugins
-  programs.git = {
-    lfs.enable = true;
-    patdiff.enable = true;
+  programs.patdiff = {
+    enable = lib.mkDefault true;
+    enableGitIntegration = lib.mkDefault true;
   };
 
   # 懶惰鬼賴皮
-  programs.lazygit = let
-    patdiffCfg = config.programs.git.patdiff;
-  in
+  programs.lazygit =
+    let
+      patdiffCfg = config.programs.patdiff;
+    in
     lib.mkIf patdiffCfg.enable {
       settings = {
         git.paging.externalDiffCommand = "${lib.getExe' patdiffCfg.package "patdiff-git-wrapper"}";
@@ -21,7 +23,7 @@
 
   # git itself
   programs.git = {
-    extraConfig = {
+    settings = {
       init.defaultBranch = "trunk"; # I like trees
       push.autoSetupRemote = true;
       pull.ff = "only";
@@ -49,9 +51,9 @@
   };
 
   # identity
-  programs.git = {
-    userEmail = "leana.jiang+git@icloud.com";
-    userName = "Léana 江";
+  programs.git.settings = {
+    user.email = "leana.jiang+git@icloud.com";
+    user.name = "Léana 江";
     signing = {
       key = "0x4E887A4CA9714ADA";
       signByDefault = lib.mkDefault false;
diff --git a/nix/homeModules/common/gpg.nix b/nix/homeModules/common/gpg.nix
index 02df7fa6..916db466 100644
--- a/nix/homeModules/common/gpg.nix
+++ b/nix/homeModules/common/gpg.nix
@@ -1,25 +1,27 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   services = {
     gpg-agent.defaultCacheTtl = 1209600;
     gpg-agent.pinentry.package = pkgs.pinentry-tty;
   };
 
-  programs.gpg.publicKeys = let
-    fromUrl = {
-      url,
-      hash,
-      trust ? 5,
-    }: {
-      source = pkgs.fetchurl {inherit url hash;};
-      inherit trust;
-    };
+  programs.gpg.publicKeys =
+    let
+      fromUrl =
+        {
+          url,
+          hash,
+          trust ? 5,
+        }:
+        {
+          source = pkgs.fetchurl { inherit url hash; };
+          inherit trust;
+        };
 
-    github = {user, ...} @ args:
-      fromUrl (
-        builtins.removeAttrs args ["user"]
-        // {url = "https://github.com/${user}.gpg";}
-      );
-  in
+      github =
+        { user, ... }@args:
+        fromUrl (builtins.removeAttrs args [ "user" ] // { url = "https://github.com/${user}.gpg"; });
+    in
     map github [
       # Do not depend on my own forgejo instance / self-host server to avoid a single point of failure
       {
@@ -42,6 +44,10 @@
         user = "confusedkernel";
         hash = "sha256-9DdtDAcv+2Z0jJMSLAXbp5ne8uHYj5V/lNGi0kKSdv4=";
       }
+      {
+        user = "gautaz";
+        hash = "sha256-j0I9l8uKfzKNrc2qveFi5mkRppxL36+BUEqvFPs6vqA=";
+      }
     ]
     ++ map fromUrl [
       {
diff --git a/nix/homeModules/common/kitty.nix b/nix/homeModules/common/kitty.nix
index 56872961..afe1a9c5 100644
--- a/nix/homeModules/common/kitty.nix
+++ b/nix/homeModules/common/kitty.nix
@@ -3,9 +3,11 @@
   lib,
   config,
   ...
-}: let
+}:
+let
   cfg = config.programs.kitty;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     home.packages = [
       pkgs.nerd-fonts.iosevka
@@ -14,7 +16,7 @@ in {
     programs.kitty = lib.mkIf cfg.enable {
       font.name = "family=\"Iosevka NFM\"";
 
-      settings = {
+      settings = rec {
         # Make text thicker
         text_composition_strategy = lib.mkIf pkgs.stdenv.isLinux "2.8 0";
 
@@ -32,28 +34,28 @@ in {
         cursor_stop_blinking_after = 15; # always blink
 
         # theme
-        background = "#ffffff";
-        foreground = "#000000";
+        background = "#fdf6e3";
+        foreground = "#073642";
         cursor = "#000000";
         cursor_text_color = "#ffffff";
-        selection_background = "#bbbbbb";
-        color0 = "#000000";
+        selection_foreground = foreground;
+        selection_background = "#dbcba3";
+        color0 = "#073642";
         color8 = "#4d4d4d";
-        color1 = "#ca1243";
-        color9 = "#e61955";
-        color2 = "#50a14f";
-        color10 = "#67c761";
-        color3 = "#e5bf6d";
-        color11 = "#ffdf84";
-        color4 = "#4078f2";
-        color12 = "#6296ff";
-        color5 = "#950095";
-        color13 = "#b000b0";
-        color6 = "#0184bc";
-        color14 = "#00a6e6";
-        color7 = "#bbbbbb";
-        color15 = "#ffffff";
-        selection_foreground = "#f8f8f8";
+        color1 = "#af005f";
+        color9 = "#d33682";
+        color2 = "#859900";
+        color10 = "#29a350";
+        color3 = "#ba9b23";
+        color11 = "#d6b429";
+        color4 = "#268bd2";
+        color12 = "#469edd";
+        color5 = "#5f5faf";
+        color13 = "#6060d1";
+        color6 = "#2aa198";
+        color14 = "#4bccc1"; # a platupus? perry the platupus?
+        color7 = "#a0a1a7";
+        color15 = "#eeeadd";
       };
     };
   };
diff --git a/nix/homeModules/common/lazygit.nix b/nix/homeModules/common/lazygit.nix
index be6c2aef..f6a56eb6 100644
--- a/nix/homeModules/common/lazygit.nix
+++ b/nix/homeModules/common/lazygit.nix
@@ -2,9 +2,11 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   cfg = config.programs.lazygit;
-in {
+in
+{
   programs.tmux.extraConfig = lib.mkIf cfg.enable ''
     bind g run-shell "tmux new-window ${lib.getExe cfg.package}"
   '';
diff --git a/nix/homeModules/common/leana.nix b/nix/homeModules/common/leana.nix
index 760a6549..ae64efef 100644
--- a/nix/homeModules/common/leana.nix
+++ b/nix/homeModules/common/leana.nix
@@ -3,12 +3,14 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   home = {
     username = lib.mkDefault "leana";
-    homeDirectory = let
-      inherit (config.home) username;
-    in
+    homeDirectory =
+      let
+        inherit (config.home) username;
+      in
       lib.mkMerge [
         (lib.mkIf pkgs.stdenv.isLinux ("/home/" + username))
         (lib.mkIf pkgs.stdenv.isDarwin ("/Users/" + username))
diff --git a/nix/homeModules/common/locale.nix b/nix/homeModules/common/locale.nix
index 21e96dc5..e8949aef 100644
--- a/nix/homeModules/common/locale.nix
+++ b/nix/homeModules/common/locale.nix
@@ -2,7 +2,8 @@
   nixosConfig ? null,
   lib,
   ...
-}: {
+}:
+{
   home.language = {
     base = lib.mkDefault nixosConfig.i18n.defaultLocale or "en_US.UTF-8";
   };
diff --git a/nix/homeModules/common/packages.nix b/nix/homeModules/common/packages.nix
index 470c527d..fac0711a 100644
--- a/nix/homeModules/common/packages.nix
+++ b/nix/homeModules/common/packages.nix
@@ -2,21 +2,21 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   programs = {
     vim.enable = true;
   };
 
-  home.packages =
-    [
-      pkgs.file
-      pkgs.gnused
-      pkgs.tree
-      pkgs.findutils # xargs and more
-      pkgs.rsync
-      pkgs.parallel
-      pkgs.jq
-    ]
-    # coreutils for darwin
-    ++ lib.optional pkgs.stdenv.isDarwin pkgs.uutils-coreutils-noprefix;
+  home.packages = [
+    pkgs.file
+    pkgs.gnused
+    pkgs.tree
+    pkgs.findutils # xargs and more
+    pkgs.rsync
+    pkgs.parallel
+    pkgs.jq
+  ]
+  # coreutils for darwin
+  ++ lib.optional pkgs.stdenv.isDarwin pkgs.uutils-coreutils-noprefix;
 }
diff --git a/nix/homeModules/common/password-store.nix b/nix/homeModules/common/password-store.nix
index 159152e0..04d8c5f9 100644
--- a/nix/homeModules/common/password-store.nix
+++ b/nix/homeModules/common/password-store.nix
@@ -3,9 +3,11 @@
   pkgs,
   lib,
   ...
-}: let
+}:
+let
   cfg = config.programs.password-store;
-in {
+in
+{
   home.packages = lib.mkIf cfg.enable [
     pkgs.pwgen
     pkgs.diceware
diff --git a/nix/homeModules/common/sioyek.nix b/nix/homeModules/common/sioyek.nix
index 9c018fc8..93ee594d 100644
--- a/nix/homeModules/common/sioyek.nix
+++ b/nix/homeModules/common/sioyek.nix
@@ -2,7 +2,11 @@
   config,
   lib,
   ...
-}: {
+}:
+let
+  cfg = config.programs.sioyek;
+in
+{
   programs.sioyek = {
     bindings = {
       "move_up" = "k";
@@ -17,17 +21,25 @@
         "u"
         "<C-u>"
       ];
-      "toggle_two_page_mode" = ["T"];
-      "goto_mark" = ["`" "'"];
+      "toggle_two_page_mode" = [ "T" ];
+      "goto_mark" = [
+        "`"
+        "'"
+      ];
     };
 
     config.should_launch_new_window = "1";
   };
 
-  xdg.mimeApps = lib.mkIf config.programs.sioyek.enable {
-    enable = true;
-    defaultApplications = {
-      "application/pdf" = ["sioyek.desktop"];
+  xdg.mimeApps =
+    let
+      associations = {
+        "application/pdf" = [ "sioyek.desktop" ];
+      };
+    in
+    lib.mkIf cfg.enable {
+      enable = true;
+      associations.added = associations;
+      defaultApplications = associations;
     };
-  };
 }
diff --git a/nix/homeModules/common/starship/default.nix b/nix/homeModules/common/starship/default.nix
index 664103c0..e61b90b0 100644
--- a/nix/homeModules/common/starship/default.nix
+++ b/nix/homeModules/common/starship/default.nix
@@ -2,9 +2,11 @@
   lib,
   config,
   ...
-}: let
+}:
+let
   cfg = config.programs.starship;
-in {
+in
+{
   xdg.configFile = lib.mkIf cfg.enable {
     "starship.toml".source = "${./starship.toml}";
   };
diff --git a/nix/homeModules/common/starship/starship.toml b/nix/homeModules/common/starship/starship.toml
index 9c462e71..88a7587d 100644
--- a/nix/homeModules/common/starship/starship.toml
+++ b/nix/homeModules/common/starship/starship.toml
@@ -14,32 +14,29 @@ $git_state$git_branch$git_commit$git_status
 
 
 #################### Theme ####################
-palette = 'curry'
+palette = 'milou'
 
-[palettes.curry]
-accent = '#645199'       # Haskell purple
-accent_trans = '#efebfc'
-black = '#24292f'
+[palettes.milou]
+black = "#073642" # .hs-identifier
 grey = '#a0a1a7'
-cyan = '#1b7c83'
-blue = '#0969da'
-purple = '#8250df'
-green = '#116329'
-orange = '#e45649'
-red = '#ca1243'
-brown = '#986801'
-gold = '#c18401'
-tinted_bg = '#eeeeee'
+cyan = "#2aa198" # .hs-pragma
+blue = "#268bd2" # .hs-number
+magenta = "#d33682" # .hs-operator
+green = "#859900" # .hs-cpp
+orange = "#cb4b16" # .hs-char
+red = "#af005f" # .hs-special
+purple = "#5f5faf" # .hs-type
+cursor = "#f0e5c9"
 #################### Theme ####################
 
 
 [hostname]
 ssh_only = true
-style = 'bold orange'
+style = 'bold'
 format = '[$hostname]($style):'
 
 [username]
-style_root = 'bold orange'
+style_root = 'bold'
 style_user = 'grey'
 format = '( [\($user\)]($style))'
 
@@ -54,7 +51,7 @@ vimcmd_visual_symbol = '[V](grey)'      # Visual
 [directory]
 truncation_length = 4
 truncate_to_repo = false
-style = 'fg:black bg:accent_trans'
+style = 'fg:black bg:cursor'
 format = '[$path]($style)( [$read_only]($read_only_style))'
 read_only = ''
 read_only_style = 'red'
@@ -100,20 +97,20 @@ style = "bold #239dad"
 # style = 'bold #b07219'
 
 [haskell]
-format = '[ $version]($style)'
+format = '[ $ghc_version]($style)'
 style = "bold #5e5086"
 #################### Language modules ####################
 
 [time]
 disabled = false
 format = '[$time]($style) '
-style = "brown"
+style = "blue"
 
 #################### Right hand side ####################
 [cmd_duration]
 min_time = 60_000
 show_milliseconds = true
-style = 'brown'
+style = 'blue'
 format = '([$duration]($style) )'
 
 [git_state]
@@ -122,17 +119,17 @@ format = '\([$state( $progress_current/$progress_total)]($style)\) '
 
 [git_branch]
 symbol = ''
-style = 'grey'
+style = 'black'
 format = '[$symbol$branch(:$remote_branch)]($style)'
 
 [git_commit]
-style = 'accent'
-format = '[\(](grey)[$hash$tag]($style)[\)](grey)'
+style = 'cyan'
+format = '[\(](black)[$hash$tag]($style)[\)](black)'
 
 [git_status]
 ahead = '⇡$count'
 behind = '⇣$count'
 diverged = '⇕⇡$ahead_count⇣$behind_count'
-style = 'bold accent'
-format = '([\[](grey)[$all_status$ahead_behind]($style)[\]](grey))'
+style = 'bold cyan'
+format = '([\[](black)[$all_status$ahead_behind]($style)[\]](black))'
 #################### Right hand side ####################
diff --git a/nix/homeModules/common/tmux/default.nix b/nix/homeModules/common/tmux/default.nix
index 7efa8f11..47ecb2a2 100644
--- a/nix/homeModules/common/tmux/default.nix
+++ b/nix/homeModules/common/tmux/default.nix
@@ -2,7 +2,8 @@
   pkgs,
   lib,
   ...
-}: {
+}:
+{
   programs.tmux.extraConfig =
     builtins.readFile ./tmux.conf
     + lib.optionalString pkgs.stdenv.isDarwin ''
diff --git a/nix/homeModules/common/user-nixconf.nix b/nix/homeModules/common/user-nixconf.nix
index 574a939e..9ca3a09e 100644
--- a/nix/homeModules/common/user-nixconf.nix
+++ b/nix/homeModules/common/user-nixconf.nix
@@ -3,7 +3,8 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   nix = {
     package = lib.mkDefault (nixosConfig.nix.package or pkgs.nix);
 
diff --git a/nix/homeModules/common/vim/default.nix b/nix/homeModules/common/vim/default.nix
index ee264962..81944c7f 100644
--- a/nix/homeModules/common/vim/default.nix
+++ b/nix/homeModules/common/vim/default.nix
@@ -1,27 +1,30 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
+{
   programs.vim = {
     extraConfig = builtins.readFile ./vimrc;
-    plugins = let
-      vpkgs = pkgs.vimPlugins;
+    plugins =
+      let
+        vpkgs = pkgs.vimPlugins;
 
-      paramount = pkgs.vimUtils.buildVimPlugin {
-        name = "paramount";
-        src = pkgs.fetchFromGitHub {
-          owner = "owickstrom";
-          repo = "vim-colors-paramount";
-          rev = "a5601d36fb6932e8d1a6f8b37b179a99b1456798";
-          hash = "sha256-j9nMjKYK7bqrGHprYp0ddLEWs1CNMudxXD13sOROVmY=";
+        paramount = pkgs.vimUtils.buildVimPlugin {
+          name = "paramount";
+          src = pkgs.fetchFromGitHub {
+            owner = "owickstrom";
+            repo = "vim-colors-paramount";
+            rev = "a5601d36fb6932e8d1a6f8b37b179a99b1456798";
+            hash = "sha256-j9nMjKYK7bqrGHprYp0ddLEWs1CNMudxXD13sOROVmY=";
+          };
         };
-      };
-    in [
-      vpkgs.vim-sleuth
-      vpkgs.vim-surround
-      vpkgs.vim-fugitive
-      vpkgs.vim-commentary
-      vpkgs.undotree
-      vpkgs.tabular
-      vpkgs.vim-caddyfile
-      paramount
-    ];
+      in
+      [
+        vpkgs.vim-sleuth
+        vpkgs.vim-surround
+        vpkgs.vim-fugitive
+        vpkgs.vim-commentary
+        vpkgs.undotree
+        vpkgs.tabular
+        vpkgs.vim-caddyfile
+        paramount
+      ];
   };
 }
diff --git a/nix/homeModules/common/vlc.nix b/nix/homeModules/common/vlc.nix
new file mode 100644
index 00000000..3d324ca4
--- /dev/null
+++ b/nix/homeModules/common/vlc.nix
@@ -0,0 +1,142 @@
+{ lib, config, ... }:
+let
+  # Kinda slow but there's no option defined and I'm lazy
+  vlcInstalled = lib.any (x: lib.getName x == "vlc") config.home.packages;
+in
+{
+  xdg = lib.mkIf vlcInstalled {
+    enable = true;
+    mimeApps =
+      let
+        associations = lib.genAttrs vlcTypes (_: "vlc.desktop");
+        # credit: https://github.com/tiredofit/home
+        vlcTypes = [
+          "application/mxf"
+          "application/ogg"
+          "application/sdp"
+          "application/smil"
+          "application/streamingmedia"
+          "application/vnd.apple.mpegurl"
+          "application/vnd.ms-asf"
+          "application/vnd.rn-realmedia"
+          "application/vnd.rn-realmedia-vbr"
+          "application/x-cue"
+          "application/x-extension-m4a"
+          "application/x-extension-mp4"
+          "application/x-matroska"
+          "application/x-mpegurl"
+          "application/x-ogg"
+          "application/x-ogm"
+          "application/x-ogm-audio"
+          "application/x-ogm-video"
+          "application/x-shorten"
+          "application/x-smil"
+          "application/x-streamingmedia"
+          "audio/3gpp"
+          "audio/3gpp2"
+          "audio/AMR"
+          "audio/aac"
+          "audio/ac3"
+          "audio/aiff"
+          "audio/amr-wb"
+          "audio/dv"
+          "audio/eac3"
+          "audio/flac"
+          "audio/m3u"
+          "audio/m4a"
+          "audio/mp1"
+          "audio/mp2"
+          "audio/mp3"
+          "audio/mp4"
+          "audio/mpeg"
+          "audio/mpeg2"
+          "audio/mpeg3"
+          "audio/mpegurl"
+          "audio/mpg"
+          "audio/musepack"
+          "audio/ogg"
+          "audio/opus"
+          "audio/rn-mpeg"
+          "audio/scpls"
+          "audio/vnd.dolby.heaac.1"
+          "audio/vnd.dolby.heaac.2"
+          "audio/vnd.dts"
+          "audio/vnd.dts.hd"
+          "audio/vnd.rn-realaudio"
+          "audio/vorbis"
+          "audio/wav"
+          "audio/webm"
+          "audio/x-aac"
+          "audio/x-adpcm"
+          "audio/x-aiff"
+          "audio/x-ape"
+          "audio/x-m4a"
+          "audio/x-matroska"
+          "audio/x-mp1"
+          "audio/x-mp2"
+          "audio/x-mp3"
+          "audio/x-mpegurl"
+          "audio/x-mpg"
+          "audio/x-ms-asf"
+          "audio/x-ms-wma"
+          "audio/x-musepack"
+          "audio/x-pls"
+          "audio/x-pn-au"
+          "audio/x-pn-realaudio"
+          "audio/x-pn-wav"
+          "audio/x-pn-windows-pcm"
+          "audio/x-realaudio"
+          "audio/x-scpls"
+          "audio/x-shorten"
+          "audio/x-tta"
+          "audio/x-vorbis"
+          "audio/x-vorbis+ogg"
+          "audio/x-wav"
+          "audio/x-wavpack"
+          "video/3gp"
+          "video/3gpp"
+          "video/3gpp2"
+          "video/avi"
+          "video/divx"
+          "video/dv"
+          "video/fli"
+          "video/flv"
+          "video/mkv"
+          "video/mp2t"
+          "video/mp4"
+          "video/mp4v-es"
+          "video/mpeg"
+          "video/msvideo"
+          "video/ogg"
+          "video/quicktime"
+          "video/vnd.divx"
+          "video/vnd.mpegurl"
+          "video/vnd.rn-realvideo"
+          "video/webm"
+          "video/x-avi"
+          "video/x-flc"
+          "video/x-flic"
+          "video/x-flv"
+          "video/x-m4v"
+          "video/x-matroska"
+          "video/x-mpeg2"
+          "video/x-mpeg3"
+          "video/x-ms-afs"
+          "video/x-ms-asf"
+          "video/x-ms-wmv"
+          "video/x-ms-wmx"
+          "video/x-ms-wvxvideo"
+          "video/x-msvideo"
+          "video/x-ogm"
+          "video/x-ogm+ogg"
+          "video/x-theora"
+          "video/x-theora+ogg"
+        ];
+      in
+      {
+        enable = true;
+        associations.added = associations;
+        defaultApplications = associations;
+      };
+  };
+}
diff --git a/nix/homeModules/common/wired/default.nix b/nix/homeModules/common/wired/default.nix
index bc522eaa..2b3a7d2f 100644
--- a/nix/homeModules/common/wired/default.nix
+++ b/nix/homeModules/common/wired/default.nix
@@ -1,5 +1,6 @@
-{pkgs, ...}: {
-  home.packages = [pkgs.iosevka];
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.iosevka ];
   services.wired = {
     config = "${./wired.ron}";
   };
diff --git a/nix/homeModules/common/zen-browser.nix b/nix/homeModules/common/zen-browser.nix
new file mode 100644
index 00000000..be5ded5b
--- /dev/null
+++ b/nix/homeModules/common/zen-browser.nix
@@ -0,0 +1,168 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (pkgs) nur;
+
+  cfg = config.programs.zen-browser;
+in
+{
+  programs.zen-browser = {
+    # https://mozilla.github.io/policy-templates
+    # The following have more complex logic, keep them as policies and not profiles
+    policies = {
+      RequestedLocales = [
+        "fr-FR" # for fuck sake stop showing me translated version of French gov sites
+        "zh-TW"
+        "en-US"
+      ];
+
+      SearchEngines = {
+        Remove = [
+          "Google"
+          "Bing"
+          "DuckDuckGo"
+          "Qwant"
+          "eBay"
+          "Perplexity"
+        ];
+        Default = "DuckDuckGo Lite";
+        Add = [
+          {
+            Name = "DuckDuckGo Lite";
+            URLTemplate = "https://lite.duckduckgo.com/lite/search?q={searchTerms}";
+          }
+        ];
+      };
+      NoDefaultBookmarks = true;
+      DisplayMenuBar = "never";
+      DisplayBookmarksToolbar = "never";
+      DNSOverHTTPS = {
+        Enabled = false;
+      };
+    };
+
+    # https://searchfox.org/mozilla-central/source/browser/components/enterprisepolicies/Policies.sys.mjs
+    # Some policies can be rewritten to profiles configuration
+    #
+    # "locked" semantic from zen (doesn't seem to be doing anything, attempted for zen-twilight 1.18t)
+    # https://github.com/0xc000022070/zen-browser-flake/tree/main#preferences
+    #
+    # To check which option is mapped to which about:config
+    # - back preference file
+    #   cp .zen/default/prefs.js{,.bk}
+    # - click the buttons
+    # - diff it
+    #   diff .zen/default/prefs.js{.bk,}
+    profiles.default = {
+      settings = {
+        "toolkit.legacyUserProfileCustomizations.stylesheets" = true;
+        "browser.tabs.loadInBackground" = true;
+        "browser.ctrlTab.sortByRecentlyUsed" = false;
+        "layout.css.devPixelsPerPx" = 1.1;
+        "browser.startup.page" = 1;
+        "browser.translations.automaticallyPopup" = false;
+        "browser.tabs.closeWindowWithLastTab" = true;
+        "general.smoothScroll" = false;
+
+        # open links in new window
+        # this works a lot better with xmonad where I have a bunch of windows
+        "browser.link.open_newwindow" = 2;
+
+        # Sponsored crap
+        # Yes
+        "browser.newtabpage.activity-stream.showSearch" = true;
+        "browser.newtabpage.activity-stream.feeds.topsites" = true;
+        # No
+        "browser.newtabpage.activity-stream.showSponsoredTopSites" = false;
+        "browser.newtabpage.activity-stream.feeds.section.highlights" = false;
+        "browser.newtabpage.activity-stream.feeds.system.topstories" = false;
+        "browser.newtabpage.activity-stream.feeds.section.topstories" = false;
+        "browser.newtabpage.activity-stream.showSponsored" = false;
+
+        # URL
+        # Yes
+        "browser.urlbar.suggest.quicksuggest.nonsponsored" = true;
+        # No
+        "browser.urlbar.suggest.quicksuggest.sponsored" = false;
+
+        # Pasword manager
+        "signon.rememberSignons" = false;
+        "services.passwordSavingEnabled" = false;
+        "pref.privacy.disable_button.view_passwords" = false;
+
+        # Hardware acceleration
+        "layers.acceleration.disabled" = false;
+
+        # Screenshot
+        "screenshots.browser.component.enabled" = true;
+
+        # Recommendations
+        "browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons" = false;
+        "browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features" = false;
+        "extensions.htmlaboutaddons.recommendations.enabled" = false; # Addons
+
+        # Onboarding
+        "browser.aboutwelcome.enabled" = false;
+
+        # AI crap
+        "browser.ml.chat.enabled" = false;
+        "browser.ml.chat.page" = false;
+        "browser.ml.chat.shortcuts" = false;
+        "browser.ml.chat.sidebar" = false;
+
+        # Prevent WebRTC leak
+        # https://mullvad.net/en/help/webrtc
+        "media.peerconnection.enabled" = false;
+      };
+
+      extensions.packages =
+        let
+          addons = nur.repos.rycee.firefox-addons;
+        in
+        [
+          addons.ublock-origin
+          addons.privacy-badger
+          addons.user-agent-string-switcher
+
+          /*
+            Here's to you who want to remove news feed eradicator because you find it annoying:
+            It is here to annoy you so it is less likely for you to be on the agency inversion path.
+            DO NOT REMOVE IT. I repeat, DO NOT REMOVE IT.
+
+            If you think it's annoying, go do some jump rope, sing, live.
+          */
+          addons.news-feed-eradicator # did you read the comment above?
+          addons.multi-account-containers
+        ];
+    };
+  };
+
+  xdg.mimeApps =
+    let
+      associations = lib.genAttrs [
+        "application/x-extension-shtml"
+        "application/x-extension-xhtml"
+        "application/x-extension-html"
+        "application/x-extension-xht"
+        "application/x-extension-htm"
+        # "x-scheme-handler/unknown"
+        # "x-scheme-handler/mailto"
+        "x-scheme-handler/chrome"
+        "x-scheme-handler/about"
+        "x-scheme-handler/https"
+        "x-scheme-handler/http"
+        "application/xhtml+xml"
+        # "application/json"
+        # "text/plain"
+        "text/html"
+      ] (_: cfg.package.meta.desktopFileName);
+    in
+    lib.mkIf cfg.enable {
+      associations.added = associations;
+      defaultApplications = associations;
+    };
+}
diff --git a/nix/homeModules/extra/tmux-fish-integration.nix b/nix/homeModules/extra/tmux-fish-integration.nix
index 37061609..4480f567 100644
--- a/nix/homeModules/extra/tmux-fish-integration.nix
+++ b/nix/homeModules/extra/tmux-fish-integration.nix
@@ -4,7 +4,8 @@
   lib,
   config,
   ...
-}: {
+}:
+{
   assertions = [
     {
       assertion = config.programs.fish.enable;
@@ -22,7 +23,9 @@
     WORKTREE_PATH = "wt";
   };
 
-  programs.direnv.config.whitelist.prefix = [(config.home.sessionVariables.REPO_PATH + "/leana8959")];
+  programs.direnv.config.whitelist.prefix = [
+    (config.home.sessionVariables.REPO_PATH + "/leana8959")
+  ];
   programs.tmux.extraConfig = lib.mkBefore ''
     # sessionizer binds
     bind -n C-f run-shell "tmux new-window tmux-sessionizer"
diff --git a/nix/identities.nix b/nix/identities.nix
index 649c1ca8..1859f241 100644
--- a/nix/identities.nix
+++ b/nix/identities.nix
@@ -1,6 +1,7 @@
-{
-  vanadium = {
-    leana = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGPq2o9pbmLRGrOpAP76eYCAscmfakDC7wPm9fmsCCQM leana@vanadium";
-    root = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDc55vENX+13c4s2w7zjTb8T/AnBnTi96yRC5+fy7Z2A root@vanadium";
-  };
-}
+[
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGPq2o9pbmLRGrOpAP76eYCAscmfakDC7wPm9fmsCCQM leana@vanadium"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF5OgvihLpGaenFmZpbflF+UFsyYTZDwBZqTmSYdquC3 root@vanadium"
+
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEXzNdCA0zZ+WmeKZnhQSQtUcxnQhhDl59E3BPQfLj7Q leana@hydrogen"
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMVDmEt/12u9U4QGDZBx/Sx8itzqfQ4zWJvcC3pRZqP root@hydrogen"
+]
diff --git a/nix/lib/mkNerdFont.nix b/nix/lib/mkNerdFont.nix
index 1c9e72a2..9753577a 100644
--- a/nix/lib/mkNerdFont.nix
+++ b/nix/lib/mkNerdFont.nix
@@ -3,19 +3,20 @@
   nerd-font-patcher,
   parallel,
   stdenvNoCC,
-}: {
+}:
+{
   font,
-  extraArgs ? [],
+  extraArgs ? [ ],
   useDefaultsArgs ? true,
 }:
 stdenvNoCC.mkDerivation {
   /*
-  Credits:
-  https://github.com/NixOS/nixpkgs/issues/44329#issuecomment-1231189572
-  https://github.com/NixOS/nixpkgs/issues/44329#issuecomment-1544597422
+    Credits:
+    https://github.com/NixOS/nixpkgs/issues/44329#issuecomment-1231189572
+    https://github.com/NixOS/nixpkgs/issues/44329#issuecomment-1544597422
 
-  long font names is not problematic:
-  https://github.com/ryanoasis/nerd-fonts/issues/1018#issuecomment-1953555781
+    long font names is not problematic:
+    https://github.com/ryanoasis/nerd-fonts/issues/1018#issuecomment-1953555781
   */
   name = "${font.name}-NerdFont";
   src = font;
@@ -24,20 +25,22 @@ stdenvNoCC.mkDerivation {
     parallel
   ];
 
-  buildPhase = let
-    args =
-      lib.optionals useDefaultsArgs [
-        "--careful"
-        "--complete"
-        "--quiet"
-        "--no-progressbars"
-      ]
-      ++ extraArgs;
-  in ''
-    mkdir -p nerd-font
-    find \( -name \*.ttf -o -name \*.otf \) | parallel --jobs=$NIX_BUILD_CORES nerd-font-patcher {} \
-        --outputdir nerd-font ${builtins.concatStringsSep " " args}
-  '';
+  buildPhase =
+    let
+      args =
+        lib.optionals useDefaultsArgs [
+          "--careful"
+          "--complete"
+          "--quiet"
+          "--no-progressbars"
+        ]
+        ++ extraArgs;
+    in
+    ''
+      mkdir -p nerd-font
+      find \( -name \*.ttf -o -name \*.otf \) | parallel --jobs=$NIX_BUILD_CORES nerd-font-patcher {} \
+          --outputdir nerd-font ${builtins.concatStringsSep " " args}
+    '';
 
   installPhase = ''
     exists() { [ -e "$1" ]; }
diff --git a/nix/configurations/vanadium/nixos/connectivity/networks.nix b/nix/networks/list.nix
similarity index 72%
rename from nix/configurations/vanadium/nixos/connectivity/networks.nix
rename to nix/networks/list.nix
index e603f0e2..aaeb1560 100644
--- a/nix/configurations/vanadium/nixos/connectivity/networks.nix
+++ b/nix/networks/list.nix
@@ -1,10 +1,13 @@
 let
+  preferredPriority = 20;
   privatePriority = 10;
   limitedPriority = -10;
-in [
+in
+[
   {
     ssid = "~";
-    priority = privatePriority;
+    bssid = "de:ad:de:ad:d0:d0"; # dead dead dodo
+    priority = preferredPriority;
     hasPassword = true;
   }
   {
@@ -12,6 +15,11 @@ in [
     priority = privatePriority;
     hasPassword = true;
   }
+  {
+    ssid ="Kuo";
+    priority = privatePriority;
+    hasPassword = true;
+  }
   {
     ssid = "girlypop-net";
     priority = privatePriority;
@@ -28,7 +36,6 @@ in [
     ssid = "5526-1"; # TODO: set bssid preference ?
     priority = privatePriority;
     hasPassword = true;
-    scanOnLowSignal = true;
   }
 
   {
@@ -36,7 +43,7 @@ in [
     priority = privatePriority;
     scanOnLowSignal = true;
 
-    authProtocols = ["WPA-EAP"];
+    authProtocols = [ "WPA-EAP" ];
     auth = ''
       pairwise=CCMP
       group=CCMP TKIP
@@ -80,14 +87,31 @@ in [
     hasPassword = true;
     randomizeMac = true;
   }
+  {
+    ssid = "R802";
+    randomizeMac = true;
+  }
+  {
+    ssid = "R1108";
+    randomizeMac = true;
+  }
+  {
+    ssid = "NTUH_guest";
+    randomizeMac = true;
+  }
+  {
+    ssid = "i_Tzuchi_WiFi";
+    randomizeMac = true;
+  }
 
-  {ssid = "_SNCF_WIFI_INOUI";}
-  {ssid = "_WIFI_LYRIA";}
-  {ssid = "EurostarTrainsWiFi";}
-  {ssid = "SBB-FREE";}
-  {ssid = "AOT Airport Free Wi-Fi by NT";}
-  {ssid = "NewTaipei";}
-  {ssid = "Fami-WiFi";}
+  { ssid = "_SNCF_WIFI_INOUI"; }
+  { ssid = "_WIFI_LYRIA"; }
+  { ssid = "EurostarTrainsWiFi"; }
+  { ssid = "SBB-FREE"; }
+  { ssid = "AOT Airport Free Wi-Fi by NT"; }
+  { ssid = "NewTaipei"; }
+  { ssid = "Fami-WiFi"; }
+  { ssid = "THSR_freeWIFI_ALL"; }
 
   {
     ssid = "iPhone de Léana 江";
diff --git a/nix/configurations/vanadium/nixos/connectivity/universite_de_rennes.pem b/nix/networks/universite_de_rennes.pem
similarity index 100%
rename from nix/configurations/vanadium/nixos/connectivity/universite_de_rennes.pem
rename to nix/networks/universite_de_rennes.pem
diff --git a/nix/networks/wpa_supplicant-compat.nix b/nix/networks/wpa_supplicant-compat.nix
new file mode 100644
index 00000000..84f59504
--- /dev/null
+++ b/nix/networks/wpa_supplicant-compat.nix
@@ -0,0 +1,47 @@
+#
+# This loads the list of networks as a NixOS wpa_supplicant compatible attrset
+#
+# View the example config
+# less $(nix-build --no-out-link -E '(import <nixpkgs> {}).wpa_supplicant')/share/doc/wpa_supplicant/wpa_supplicant.conf.example
+let
+  sources = import ../../npins;
+  lib = import (sources.nixpkgs + "/lib");
+
+  # wpa_supplicant uses `strchr` to seek to the first `=`, so the only forbidden character is `=`.
+  escapePwdKey = lib.replaceStrings [ "=" ] [ "_" ];
+
+  go =
+    networkArgs@{
+      ssid,
+      bssid ? null,
+      # Custom fields wrapping nixpkgs module options
+      hasPassword ? false,
+      scanOnLowSignal ? false,
+      randomizeMac ? false,
+      ...
+    }:
+    let
+      uniqueKey = "${ssid}${lib.optionalString (bssid != null) bssid}";
+    in
+    {
+      ${uniqueKey} # we use a unique key here to make sure no "same ssid different bssid" networks collide in key.
+        =
+          lib.mkMerge [
+            (builtins.removeAttrs networkArgs [
+              "hasPassword"
+              "scanOnLowSignal"
+              "randomizeMac"
+            ])
+            (lib.optionalAttrs hasPassword {
+              pskRaw = "ext:${escapePwdKey uniqueKey}"; # this implies changing the external password key if you set a bssid!
+            })
+            {
+              extraConfig = ''
+                ${lib.optionalString scanOnLowSignal "bgscan=\"simple:30:-70:3600\""}
+                ${lib.optionalString randomizeMac "mac_addr=1"}
+              '';
+            }
+          ];
+    };
+in
+ns: lib.mkMerge (map go ns)
diff --git a/nix/nixosModules/common/disable-command-not-found.nix b/nix/nixosModules/common/disable-command-not-found.nix
index f81c9a8b..89d6638a 100644
--- a/nix/nixosModules/common/disable-command-not-found.nix
+++ b/nix/nixosModules/common/disable-command-not-found.nix
@@ -1 +1 @@
-{programs.command-not-found.enable = false;}
+{ programs.command-not-found.enable = false; }
diff --git a/nix/nixosModules/common/fish.nix b/nix/nixosModules/common/fish.nix
new file mode 100644
index 00000000..be194799
--- /dev/null
+++ b/nix/nixosModules/common/fish.nix
@@ -0,0 +1,25 @@
+#
+# This module links fish vendor completions, otherwise tab completion would be broken.
+#
+{
+  config,
+  lib,
+  ...
+}:
+let
+  fishNixOSEnabled = config.programs.fish.enable;
+  fishHMEnabled =
+    if config ? home-manager then
+      lib.any (userConfig: userConfig.programs.fish.enable) (lib.attrValues config.home-manager.users)
+    else
+      false;
+
+  fishEnabled = fishNixOSEnabled || fishHMEnabled;
+in
+{
+  environment.pathsToLink = lib.mkIf fishEnabled [
+    "/share/fish/vendor_conf.d"
+    "/share/fish/vendor_completions.d"
+    "/share/fish/vendor_functions.d"
+  ];
+}
diff --git a/nix/nixosModules/common/network.nix b/nix/nixosModules/common/network.nix
index 0a52670b..6d36fbfb 100644
--- a/nix/nixosModules/common/network.nix
+++ b/nix/nixosModules/common/network.nix
@@ -1,4 +1,5 @@
-{hostname, ...}: {
+{ hostname, ... }:
+{
   networking.hostName = hostname;
 
   services.openssh = {
diff --git a/nix/nixosModules/common/sudo-conf.nix b/nix/nixosModules/common/sudo-conf.nix
index b31388f4..35494b1b 100644
--- a/nix/nixosModules/common/sudo-conf.nix
+++ b/nix/nixosModules/common/sudo-conf.nix
@@ -1,5 +1,27 @@
+{ pkgs, ... }:
 {
-  security.sudo.extraConfig = ''
-    Defaults        lecture = always
-  '';
+  security.sudo.enable = false;
+
+  environment.systemPackages = [
+    pkgs.doas-sudo-shim
+  ];
+  security.doas = {
+    enable = true;
+    extraRules = [
+      {
+        # Invoke just with doas directly as a nixos-rebuild helper
+        #
+        # Specifiying just here is impractical, because
+        # - Use absolute path?
+        #   Works only for a specific version of just binary.
+        #   Also, for some reason, the rule won't match.
+        # - Use relative path?
+        #   doas's docs says it searches in a "limited subset of PATH" if it's relative.
+        #   I suspect that it doesn't search the PATH added ad-hoc by the nix-shell, also not a good solution.
+        #   Also, for some reason, the rule won't match.
+        users = [ ":wheel" ];
+        setEnv = [ "PATH" ];
+      }
+    ];
+  };
 }
diff --git a/nix/nixosModules/common/system-nixconf.nix b/nix/nixosModules/common/system-nixconf.nix
index 637e7d71..9a0d8783 100644
--- a/nix/nixosModules/common/system-nixconf.nix
+++ b/nix/nixosModules/common/system-nixconf.nix
@@ -2,7 +2,8 @@
   lib,
   pkgs,
   ...
-}: {
+}:
+{
   nix = {
     package = lib.mkDefault pkgs.nix;
 
diff --git a/nix/nixosModules/common/xscreensaver.nix b/nix/nixosModules/common/xscreensaver.nix
index 2d18a6a1..49aebbd0 100644
--- a/nix/nixosModules/common/xscreensaver.nix
+++ b/nix/nixosModules/common/xscreensaver.nix
@@ -5,14 +5,16 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   cfg = config.services.xscreensaver;
-in {
+in
+{
   options = {
     services.xscreensaver.hooks = lib.mkOption {
       type = with lib.types; attrsOf str;
       description = "An attrset of events mapped a block of shell command to be run";
-      default = {};
+      default = { };
     };
   };
 
@@ -20,26 +22,29 @@ in {
     systemd.user.services = {
       "xscreensaver-hooks" = {
         description = "Run commands on xscreensaver events";
-        after = ["graphical-session.target" "xscreensaver.service"];
-        partOf = ["graphical-session.target"];
-        wantedBy = ["graphical-session.target"];
-        script = let
-          handlers =
-            lib.concatMapAttrsStringSep "\n" (event: action: ''
+        after = [
+          "graphical-session.target"
+          "xscreensaver.service"
+        ];
+        partOf = [ "graphical-session.target" ];
+        wantedBy = [ "graphical-session.target" ];
+        script =
+          let
+            handlers = lib.concatMapAttrsStringSep "\n" (event: action: ''
               "${event}")
                       ( ${action}
                       )
                       ;;
-            '')
-            cfg.hooks;
-        in ''
-          xscreensaver-command -watch | while read event rest; do
-            echo "The handler script got \"$event\""
-            case $event in
-              ${handlers}
-            esac
-          done
-        '';
+            '') cfg.hooks;
+          in
+          ''
+            xscreensaver-command -watch | while read event rest; do
+              echo "The handler script got \"$event\""
+              case $event in
+                ${handlers}
+              esac
+            done
+          '';
         path = [
           cfg.package # contains xscreensaver-command
         ];
diff --git a/nix/nixosModules/extra/leana.nix b/nix/nixosModules/extra/leana.nix
index 0f884580..1412fd3d 100644
--- a/nix/nixosModules/extra/leana.nix
+++ b/nix/nixosModules/extra/leana.nix
@@ -2,27 +2,22 @@
   config,
   pkgs,
   ...
-}: {
+}:
+{
   #
   # My user
   #
-  nix.settings.trusted-users = ["leana"];
+  nix.settings.trusted-users = [ "leana" ];
   users.users."leana" = {
     isNormalUser = true;
     home = "/home/leana";
     description = "Leana";
     group = "leana";
-    extraGroups = ["wheel"];
+    extraGroups = [ "wheel" ];
     shell = pkgs.bash;
     openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys;
   };
-  users.groups.leana = {};
-
-  environment.pathsToLink = [
-    "/share/fish/vendor_conf.d"
-    "/share/fish/vendor_completions.d"
-    "/share/fish/vendor_functions.d"
-  ];
+  users.groups.leana = { };
 
   #
   # My nix binary cache
diff --git a/nix/nixosModules/extra/macbook-broacom-b43.nix b/nix/nixosModules/extra/macbook-broacom-b43.nix
new file mode 100644
index 00000000..705b04aa
--- /dev/null
+++ b/nix/nixosModules/extra/macbook-broacom-b43.nix
@@ -0,0 +1,4 @@
+{
+  nixpkgs.config.allowUnfree = true;
+  networking.enableB43Firmware = true;
+}
diff --git a/nix/nixosModules/extra/macbook-pro-radeon.nix b/nix/nixosModules/extra/macbook-pro-radeon.nix
index 0c664321..34de14fa 100644
--- a/nix/nixosModules/extra/macbook-pro-radeon.nix
+++ b/nix/nixosModules/extra/macbook-pro-radeon.nix
@@ -1,5 +1,5 @@
 {
   # This will temporarily disable the dedicated graphics and boot into the system.
   # If your computer suffers from the GPU's death it won't boot unless you do this.
-  boot.kernelParams = ["radeon.modeset=0"];
+  boot.kernelParams = [ "radeon.modeset=0" ];
 }
diff --git a/nix/nixosModules/extra/parrot.nix b/nix/nixosModules/extra/parrot.nix
index c1ead149..0d491ddb 100644
--- a/nix/nixosModules/extra/parrot.nix
+++ b/nix/nixosModules/extra/parrot.nix
@@ -3,10 +3,12 @@
   lib,
   config,
   ...
-}: let
+}:
+let
   cfg = config.services.parrot;
   t = lib.types;
-in {
+in
+{
   options = {
     services.parrot = {
       enable = lib.mkEnableOption "parrot";
@@ -23,12 +25,12 @@ in {
       group = "parrot";
       isSystemUser = true;
     };
-    users.groups."parrot" = {};
+    users.groups."parrot" = { };
 
     systemd.services."parrot" = {
       description = " A hassle-free, highly performant, self-hosted Discord music bot with YouTube and Spotify support. Powered by yt-dlp.";
-      after = ["network.target"];
-      wantedBy = ["multi-user.target"];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
         User = "parrot";
diff --git a/nix/nixosModules/extra/secure_dns.nix b/nix/nixosModules/extra/secure_dns.nix
new file mode 100644
index 00000000..321d8455
--- /dev/null
+++ b/nix/nixosModules/extra/secure_dns.nix
@@ -0,0 +1,60 @@
+# https://nixos.wiki/wiki/Encrypted_DNS
+{ pkgs, ... }:
+{
+  networking = {
+    nameservers = [
+      "127.0.0.1"
+      "::1"
+    ];
+    dhcpcd.extraConfig = "nohook resolv.conf";
+    # networkmanager.dns = "none";
+  };
+
+  services.resolved.enable = false;
+
+  services.dnscrypt-proxy2 = {
+    enable = true;
+    # Settings reference:
+    # https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml
+    settings = {
+      listen_addresses = [ "127.0.0.1:53" ];
+      ipv4_servers = true;
+
+      require_dnssec = true;
+      require_nolog = true;
+      require_nofilter = true;
+
+      lb_strategy = "p2";
+      lb_estimator = true;
+
+      # Blocklists are made of one pattern per line.
+      # https://github.com/DNSCrypt/dnscrypt-proxy/blob/fa59f990431a49b6485f63f96601bc7e64017bf8/dnscrypt-proxy/example-dnscrypt-proxy.toml#L583C4-L583C75
+      blocked_names.blocked_names_file = pkgs.concatText "dnsblocklist_combined" [
+        # Prevent building up reliance on chatbots
+        # Gotta preserve that thinking ability of my smoof bwain
+        "${pkgs.ai_blocklist}/share/hosts.txt"
+        "${pkgs.hategroup_blocklist}/share/hosts.txt"
+
+        (pkgs.writeText "extra_dns_blocklist" ''
+          # This is the fascist one, just block it because I can't tell
+          nixos.wiki
+
+          # Gotta purify my smoos brain for a while
+          instagram.com
+          youtube.com
+        '')
+      ];
+
+      # Add this to test if dnscrypt-proxy is actually used to resolve DNS requests
+      # query_log.file = "/var/log/dnscrypt-proxy/query.log";
+      sources.public-resolvers = {
+        urls = [
+          "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md"
+          "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md"
+        ];
+        cache_file = "/var/cache/dnscrypt-proxy/public-resolvers.md";
+        minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+      };
+    };
+  };
+}
diff --git a/nix/nixosModules/extra/typst-bot.nix b/nix/nixosModules/extra/typst-bot.nix
index dbadaea3..153fea31 100644
--- a/nix/nixosModules/extra/typst-bot.nix
+++ b/nix/nixosModules/extra/typst-bot.nix
@@ -3,10 +3,12 @@
   config,
   lib,
   ...
-}: let
+}:
+let
   cfg = config.services.typst-bot;
   t = lib.types;
-in {
+in
+{
   options = {
     services.typst-bot = {
       enable = lib.mkEnableOption "typst-bot";
@@ -30,7 +32,7 @@ in {
       isSystemUser = true;
       home = cfg.dataDir;
     };
-    users.groups."typst-bot" = {};
+    users.groups."typst-bot" = { };
 
     systemd.tmpfiles.rules = [
       "d ${cfg.dataDir}/cache  700 typst-bot typst-bot - -"
@@ -39,15 +41,15 @@ in {
 
     systemd.services."typst-bot" = {
       description = "A discord bot to render Typst code";
-      after = ["network.target"];
-      wantedBy = ["multi-user.target"];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
 
       preStart = ''
         : >${cfg.dataDir}/sqlite/db.sqlite
       '';
 
       # Don't pollute the global path
-      path = [pkgs.typst-bot];
+      path = [ pkgs.typst-bot ];
       script = "typst-bot";
 
       serviceConfig = {
diff --git a/nix/nixosModules/extra/zram.nix b/nix/nixosModules/extra/zram.nix
index 0f13d841..bcf848ba 100644
--- a/nix/nixosModules/extra/zram.nix
+++ b/nix/nixosModules/extra/zram.nix
@@ -1 +1 @@
-{zramSwap.enable = true;}
+{ zramSwap.enable = true; }
diff --git a/nix/overlays/agenix.nix b/nix/overlays/agenix.nix
index eded6cc7..262d465a 100644
--- a/nix/overlays/agenix.nix
+++ b/nix/overlays/agenix.nix
@@ -1,7 +1,7 @@
 let
   sources = import ../../npins;
 in
-  final: _: {
-    # Use flake so the package inputs is pinned
-    agenix = sources.agenix.asFlake.packages.${final.system}.default;
-  }
+final: _: {
+  # Use flake so the package inputs is pinned
+  agenix = sources.agenix.asFlake.packages.${final.stdenv.hostPlatform.system}.default;
+}
diff --git a/nix/overlays/calibre-no-mime.nix b/nix/overlays/calibre-no-mime.nix
index f6436085..bfc2d604 100644
--- a/nix/overlays/calibre-no-mime.nix
+++ b/nix/overlays/calibre-no-mime.nix
@@ -2,8 +2,8 @@
 final: prev: {
   calibre = final.symlinkJoin {
     name = "calibre";
-    paths = [prev.calibre];
-    buildInputs = [final.makeWrapper];
+    paths = [ prev.calibre ];
+    buildInputs = [ final.makeWrapper ];
     postBuild = ''
       rm -r $out/share/mime
     '';
diff --git a/nix/overlays/disko.nix b/nix/overlays/disko.nix
index 038ae26d..c0243b78 100644
--- a/nix/overlays/disko.nix
+++ b/nix/overlays/disko.nix
@@ -1,6 +1,6 @@
 let
   sources = import ../../npins;
 in
-  final: _: {
-    disko = sources.disko.asFlake.packages.${final.system}.default;
-  }
+final: _: {
+  disko = sources.disko.asFlake.packages.${final.stdenv.hostPlatform.system}.default;
+}
diff --git a/nix/overlays/dix.nix b/nix/overlays/dix.nix
index ada5e33a..ad644e49 100644
--- a/nix/overlays/dix.nix
+++ b/nix/overlays/dix.nix
@@ -1,6 +1,6 @@
 let
   sources = import ../../npins;
 in
-  final: _: {
-    dix = sources.dix.asFlake.packages.${final.system}.default;
-  }
+final: _: {
+  dix = sources.dix.asFlake.packages.${final.stdenv.hostPlatform.system}.default;
+}
diff --git a/nix/overlays/eepy.nix b/nix/overlays/eepy.nix
index 1c821d2b..38bc8053 100644
--- a/nix/overlays/eepy.nix
+++ b/nix/overlays/eepy.nix
@@ -1,6 +1,6 @@
 let
   sources = import ../../npins;
 in
-  final: _: {
-    eepy = sources.eepy.asFlake.packages.${final.system}.default;
-  }
+final: _: {
+  eepy = sources.eepy.asFlake.packages.${final.stdenv.hostPlatform.system}.default;
+}
diff --git a/nix/overlays/fcitx5-table-extra-taiwanese.nix b/nix/overlays/fcitx5-table-extra-taiwanese.nix
index b24003f8..af7e17df 100644
--- a/nix/overlays/fcitx5-table-extra-taiwanese.nix
+++ b/nix/overlays/fcitx5-table-extra-taiwanese.nix
@@ -1,18 +1,14 @@
 let
   sources = import ../../npins;
 in
-  final: prev: {
-    fcitx5-table-extra = prev.fcitx5-table-extra.overrideAttrs (oldAttrs: {
-      src = sources.fcitx5-table-extra;
-      nativeBuildInputs =
-        oldAttrs.nativeBuildInputs or []
-        ++ [
-          final.python3
-        ];
-      preConfigure =
-        oldAttrs.preConfigure or ""
-        + ''
-          python3 ./generate.py
-        '';
-    });
-  }
+final: prev: {
+  fcitx5-table-extra = prev.fcitx5-table-extra.overrideAttrs (oldAttrs: {
+    src = sources.fcitx5-table-extra;
+    nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [
+      final.python3
+    ];
+    preConfigure = oldAttrs.preConfigure or "" + ''
+      python3 ./generate.py
+    '';
+  });
+}
diff --git a/nix/overlays/iosevka.nix b/nix/overlays/iosevka.nix
index e5760ec1..2239f2ae 100644
--- a/nix/overlays/iosevka.nix
+++ b/nix/overlays/iosevka.nix
@@ -1,7 +1,8 @@
 final: prev: rec {
-  nerd-fonts = let
-    mkNerdFont = final.callPackage ../lib/mkNerdFont.nix {};
-  in
+  nerd-fonts =
+    let
+      mkNerdFont = final.callPackage ../lib/mkNerdFont.nix { };
+    in
     prev.nerd-fonts
     // {
       iosevka = mkNerdFont {
diff --git a/nix/overlays/lix.nix b/nix/overlays/lix.nix
new file mode 100644
index 00000000..6be56324
--- /dev/null
+++ b/nix/overlays/lix.nix
@@ -0,0 +1,3 @@
+final: _: {
+  nix = final.lixPackageSets.stable.lix;
+}
diff --git a/nix/overlays/nil.nix b/nix/overlays/nil.nix
index ab05b204..9ba6b75b 100644
--- a/nix/overlays/nil.nix
+++ b/nix/overlays/nil.nix
@@ -2,21 +2,18 @@
 let
   sources = import ../../npins;
 in
-  final: _: {
-    nil = let
-      pkg = sources.nil.asFlake.packages.${final.system}.default;
+final: _: {
+  nil =
+    let
+      pkg = sources.nil.asFlake.packages.${final.stdenv.hostPlatform.system}.default;
     in
-      pkg.overrideAttrs (
-        oldAttrs: {
-          patches =
-            oldAttrs.patches or []
-            ++ [
-              (final.fetchpatch {
-                name = "fix-handling-inherit-and-patfield-in-inline-assist";
-                url = "https://github.com/oxalica/nil/pull/178.patch";
-                hash = "sha256-4f7DeWJtt63IyOjqlwzz0f05rv1NBYZO4JWEkFeDimk=";
-              })
-            ];
-        }
-      );
-  }
+    pkg.overrideAttrs (oldAttrs: {
+      patches = oldAttrs.patches or [ ] ++ [
+        (final.fetchpatch {
+          name = "fix-handling-inherit-and-patfield-in-inline-assist";
+          url = "https://github.com/oxalica/nil/pull/178.patch";
+          hash = "sha256-YeVshmMadgYnFWA8S+nA+MwWKjVrzn71fqhfn6oL8Uk=";
+        })
+      ];
+    });
+}
diff --git a/nix/overlays/nix-monitored.nix b/nix/overlays/nix-monitored.nix
index 91aa2cfd..28f696bb 100644
--- a/nix/overlays/nix-monitored.nix
+++ b/nix/overlays/nix-monitored.nix
@@ -1,12 +1,10 @@
 let
   sources = import ../../npins;
 in
-  # The final nix is lix in this case
-  final: prev: {
-    nix-monitored =
-      sources.nix-monitored.asFlake.packages.${final.system}.default
-    .override {
-        inherit (final) nix;
-        withNotify = false; # noisy, spams "command completed" even for nix shells
-      };
-  }
+# The final nix is lix in this case
+final: prev: {
+  nix-monitored = sources.nix-monitored.asFlake.packages.${final.stdenv.hostPlatform.system}.default.override {
+    inherit (final) nix;
+    withNotify = false; # noisy, spams "command completed" even for nix shells
+  };
+}
diff --git a/nix/overlays/nix-tree.nix b/nix/overlays/nix-tree.nix
index 36c30bfe..ec23e3c2 100644
--- a/nix/overlays/nix-tree.nix
+++ b/nix/overlays/nix-tree.nix
@@ -3,6 +3,6 @@
 let
   sources = import ../../npins;
 in
-  final: _: {
-    nix-tree = (import sources.nix-tree).packages.${final.system}.default;
-  }
+final: _: {
+  nix-tree = (import sources.nix-tree).packages.${final.stdenv.hostPlatform.system}.default;
+}
diff --git a/nix/overlays/nur.nix b/nix/overlays/nur.nix
index f0ff694f..e78d54fb 100644
--- a/nix/overlays/nur.nix
+++ b/nix/overlays/nur.nix
@@ -1,4 +1,4 @@
 let
   sources = import ../../npins;
 in
-  sources.nur.asFlake.overlays.default
+sources.nur.asFlake.overlays.default
diff --git a/nix/overlays/pin-emacs28.nix b/nix/overlays/pin-emacs28.nix
index f37787d7..11f1ed50 100644
--- a/nix/overlays/pin-emacs28.nix
+++ b/nix/overlays/pin-emacs28.nix
@@ -1,6 +1,6 @@
 let
   sources = import ../../npins;
 in
-  _: _: {
-    unsafe-emacs28 = (import sources.pin-emacs28 {}).emacs;
-  }
+_: _: {
+  unsafe-emacs28 = (import sources.pin-emacs28 { }).emacs;
+}
diff --git a/nix/overlays/pin-isabelle-2023.nix b/nix/overlays/pin-isabelle-2023.nix
index 38a100c5..c5cbab6f 100644
--- a/nix/overlays/pin-isabelle-2023.nix
+++ b/nix/overlays/pin-isabelle-2023.nix
@@ -1,7 +1,7 @@
 let
   sources = import ../../npins;
 in
-  _: _: {
-    # Isabelle version 2023
-    isabelle-2023 = (import sources.pin-isabelle {}).isabelle;
-  }
+_: _: {
+  # Isabelle version 2023
+  isabelle-2023 = (import sources.pin-isabelle { }).isabelle;
+}
diff --git a/nix/overlays/pin-wireshark.nix b/nix/overlays/pin-wireshark.nix
index dd9c800a..e1708117 100644
--- a/nix/overlays/pin-wireshark.nix
+++ b/nix/overlays/pin-wireshark.nix
@@ -1,8 +1,8 @@
 let
   sources = import ../../npins;
 in
-  _: _: {
-    # Wireshark bug
-    # https://gitlab.com/wireshark/wireshark/-/issues/19574
-    inherit (import sources.pin-wireshark {}) wireshark;
-  }
+_: _: {
+  # Wireshark bug
+  # https://gitlab.com/wireshark/wireshark/-/issues/19574
+  inherit (import sources.pin-wireshark { }) wireshark;
+}
diff --git a/nix/overlays/wallpapers.nix b/nix/overlays/wallpapers.nix
index 0545f74e..759b93ff 100644
--- a/nix/overlays/wallpapers.nix
+++ b/nix/overlays/wallpapers.nix
@@ -1,6 +1,7 @@
 let
   sources = import ../../npins;
 in
-  _: _: {
-    wallpapers = import sources.wallpapers {};
-  }
+_: _: rec {
+  wallpapers_source = sources.wallpapers;
+  wallpapers = import wallpapers_source { };
+}
diff --git a/nix/overlays/wired-notify.nix b/nix/overlays/wired-notify.nix
index 2e158aa5..05831369 100644
--- a/nix/overlays/wired-notify.nix
+++ b/nix/overlays/wired-notify.nix
@@ -1,4 +1,4 @@
 let
   sources = import ../../npins;
 in
-  (import sources.wired-notify).overlays.default
+(import sources.wired-notify).overlays.default
diff --git a/nix/packages/by-name/ai_blocklist/package.nix b/nix/packages/by-name/ai_blocklist/package.nix
new file mode 100644
index 00000000..ecfd0db0
--- /dev/null
+++ b/nix/packages/by-name/ai_blocklist/package.nix
@@ -0,0 +1,28 @@
+{
+  fetchFromGitHub,
+  stdenvNoCC,
+  lib,
+}:
+let
+  rev = "9bb188e2701138e03f73bacebd6b19b181ca0012";
+in
+stdenvNoCC.mkDerivation {
+  pname = "ai_blocklist";
+  version = "unstable-" + lib.substring 0 8 rev;
+
+  src = fetchFromGitHub {
+    owner = "laylavish";
+    repo = "uBlockOrigin-HUGE-AI-Blocklist";
+    inherit rev;
+    hash = "sha256-p3wfR28DH6V8BHn9DT10d09Yq3mdbBecWwlR1CdDYUA=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share
+    cp noai_hosts.txt $out/share/hosts.txt
+
+    # drop domain names
+    cat $out/share/hosts.txt |
+      sed 's/^0.0.0.0 //' > $out/share/domains.txt
+  '';
+}
diff --git a/nix/packages/by-name/audio-lint/package.nix b/nix/packages/by-name/audio-lint/package.nix
index 5f95c4aa..e4aacdf6 100644
--- a/nix/packages/by-name/audio-lint/package.nix
+++ b/nix/packages/by-name/audio-lint/package.nix
@@ -2,20 +2,24 @@
   rustPlatform,
   fetchFromGitea,
 }:
-rustPlatform.buildRustPackage (finalAttrs: let
-  cargoToml = fromTOML (builtins.readFile (finalAttrs.src + "/Cargo.toml"));
-  cargoLock = finalAttrs.src + "/Cargo.lock";
-in {
-  pname = "audio-lint";
-  version = cargoToml.package.version;
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    cargoToml = fromTOML (builtins.readFile (finalAttrs.src + "/Cargo.toml"));
+    cargoLock = finalAttrs.src + "/Cargo.lock";
+  in
+  {
+    pname = "audio-lint";
+    version = cargoToml.package.version;
 
-  src = fetchFromGitea {
-    domain = "git.confusedcompiler.org";
-    owner = "leana8959";
-    repo = "audio-lint";
-    rev = "3ea38c85c5f6135958e51ad4ff13a96ccd68a21c";
-    hash = "sha256-h1SnWAh3FPL5GweOXVXXtp+swZApgecYaWjy7rM/J+w=";
-  };
+    src = fetchFromGitea {
+      domain = "git.confusedcompiler.org";
+      owner = "leana8959";
+      repo = "audio-lint";
+      rev = "3ea38c85c5f6135958e51ad4ff13a96ccd68a21c";
+      hash = "sha256-h1SnWAh3FPL5GweOXVXXtp+swZApgecYaWjy7rM/J+w=";
+    };
 
-  cargoLock.lockFile = cargoLock;
-})
+    cargoLock.lockFile = cargoLock;
+  }
+)
diff --git a/nix/packages/by-name/easyscan/package.nix b/nix/packages/by-name/easyscan/package.nix
index 258e7fd3..3cd88e89 100644
--- a/nix/packages/by-name/easyscan/package.nix
+++ b/nix/packages/by-name/easyscan/package.nix
@@ -1,7 +1,7 @@
 {
   writeShellApplication,
   sane-backends,
-  poppler_utils,
+  poppler-utils,
   fzf,
   ghostscript,
 }:
@@ -10,7 +10,7 @@ writeShellApplication {
 
   runtimeInputs = [
     sane-backends
-    poppler_utils
+    poppler-utils
     fzf
     ghostscript
   ];
diff --git a/nix/packages/by-name/emoji-picker-rs/package.nix b/nix/packages/by-name/emoji-picker-rs/package.nix
index 11d2d75c..3e96dc06 100644
--- a/nix/packages/by-name/emoji-picker-rs/package.nix
+++ b/nix/packages/by-name/emoji-picker-rs/package.nix
@@ -6,29 +6,33 @@
   libxcb,
   fetchFromGitHub,
 }:
-rustPlatform.buildRustPackage (finalAttrs: let
-  cargoToml = fromTOML (builtins.readFile (finalAttrs.src + "/Cargo.toml"));
-  cargoLock = finalAttrs.src + "/Cargo.lock";
-in {
-  pname = "emoji-picker";
-  version = cargoToml.package.version;
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    cargoToml = fromTOML (builtins.readFile (finalAttrs.src + "/Cargo.toml"));
+    cargoLock = finalAttrs.src + "/Cargo.lock";
+  in
+  {
+    pname = "emoji-picker";
+    version = cargoToml.package.version;
 
-  src = fetchFromGitHub {
-    owner = "leana8959";
-    repo = "emoji-picker";
-    rev = "d77c086bb3ed1ba55560c5027cc58e2c033c9ca7";
-    hash = "sha256-gLsBhtSnrOdU/qH9WR3UnsclfptRAP0Wv+MJjY+wYGc=";
-  };
+    src = fetchFromGitHub {
+      owner = "leana8959";
+      repo = "emoji-picker";
+      rev = "d77c086bb3ed1ba55560c5027cc58e2c033c9ca7";
+      hash = "sha256-gLsBhtSnrOdU/qH9WR3UnsclfptRAP0Wv+MJjY+wYGc=";
+    };
 
-  cargoLock.lockFile = cargoLock;
+    cargoLock.lockFile = cargoLock;
 
-  nativeBuildInputs = [
-    python3
-    pkg-config
-  ];
+    nativeBuildInputs = [
+      python3
+      pkg-config
+    ];
 
-  buildInputs = [
-    openssl.dev
-    libxcb
-  ];
-})
+    buildInputs = [
+      openssl.dev
+      libxcb
+    ];
+  }
+)
diff --git a/nix/packages/by-name/hategroup_blocklist/package.nix b/nix/packages/by-name/hategroup_blocklist/package.nix
new file mode 100644
index 00000000..d7fb0e86
--- /dev/null
+++ b/nix/packages/by-name/hategroup_blocklist/package.nix
@@ -0,0 +1,27 @@
+{
+  fetchFromGitHub,
+  stdenvNoCC,
+  lib,
+}:
+let
+  rev = "cc19c050997d5f54014bb20c764b131e003dfb17";
+in
+stdenvNoCC.mkDerivation {
+  pname = "hategroup_blocklist";
+  version = "unstable-" + lib.substring 0 8 rev;
+
+  src = fetchFromGitHub {
+    owner = "chigh";
+    repo = "hategroup-dnsbl";
+    inherit rev;
+    hash = "sha256-SZBrjIBUw687MdrbOV7WrP5IhAAtKvPL2GqdcICHNvQ=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share
+    cp blocklist.txt $out/share/domains.txt
+
+    cat $out/share/domains.txt |
+      sed 's/^\([^#].*\)$/0.0.0.0 \1/' > $out/share/hosts.txt
+  '';
+}
diff --git a/nix/packages/by-name/hbrainfuck/package.nix b/nix/packages/by-name/hbrainfuck/package.nix
index 2236c773..cf4859d3 100644
--- a/nix/packages/by-name/hbrainfuck/package.nix
+++ b/nix/packages/by-name/hbrainfuck/package.nix
@@ -3,31 +3,26 @@
   haskell,
   fetchFromGitea,
   installShellFiles,
-}: let
+}:
+let
   inherit (haskell.lib.compose) justStaticExecutables overrideCabal;
 
-  drv =
-    haskellPackages.callCabal2nix "hbrainfuck"
-    (fetchFromGitea {
-      domain = "git.confusedcompiler.org";
-      owner = "leana8959";
-      repo = "hbrainfuck";
-      rev = "5eea5ff0d7efc0bd866a2273686032ba9cab5baa";
-      hash = "sha256-/htXOULUJN8+PsAYaG281Ge/9ULZoWip63IUxuVbTSg=";
-    })
-    {};
+  drv = haskellPackages.callCabal2nix "hbrainfuck" (fetchFromGitea {
+    domain = "git.confusedcompiler.org";
+    owner = "leana8959";
+    repo = "hbrainfuck";
+    rev = "5eea5ff0d7efc0bd866a2273686032ba9cab5baa";
+    hash = "sha256-/htXOULUJN8+PsAYaG281Ge/9ULZoWip63IUxuVbTSg=";
+  }) { };
 
   cabalOverrides = o: {
-    buildTools = o.buildTools or [] ++ [installShellFiles];
-    postInstall =
-      o.postInstall or ""
-      + ''
-        installShellCompletion --cmd hbrainfuck \
-        --bash <("$out/bin/hbf" --bash-completion-script "$out/bin/hbf") \
-        --fish <("$out/bin/hbf" --fish-completion-script "$out/bin/hbf") \
-        --zsh  <("$out/bin/hbf" --zsh-completion-script  "$out/bin/hbf")
-      '';
+    buildTools = o.buildTools or [ ] ++ [ installShellFiles ];
+    postInstall = o.postInstall or "" + ''
+      installShellCompletion --cmd hbrainfuck \
+      --bash <("$out/bin/hbf" --bash-completion-script "$out/bin/hbf") \
+      --fish <("$out/bin/hbf" --fish-completion-script "$out/bin/hbf") \
+      --zsh  <("$out/bin/hbf" --zsh-completion-script  "$out/bin/hbf")
+    '';
   };
 in
-  justStaticExecutables
-  (overrideCabal cabalOverrides drv)
+justStaticExecutables (overrideCabal cabalOverrides drv)
diff --git a/nix/packages/by-name/hrt-time/my-day.patch b/nix/packages/by-name/hrt-time/my-day.patch
new file mode 100644
index 00000000..0b951de0
--- /dev/null
+++ b/nix/packages/by-name/hrt-time/my-day.patch
@@ -0,0 +1,11 @@
+diff --git a/hrt-time.sh b/hrt-time.sh
+index d9811dd..f37aa6f 100755
+--- a/hrt-time.sh
++++ b/hrt-time.sh
+@@ -1,7 +1,7 @@
+ #!/bin/bash
+ 
+ secondsNow=$(date +%s)
+-secondsThen=$(date -d "october 17 2024 19:00" +%s)
++secondsThen=$(date -d "november 12 2021" +%s)
+ seconds=$((secondsNow - secondsThen))
diff --git a/nix/packages/by-name/hrt-time/package.nix b/nix/packages/by-name/hrt-time/package.nix
new file mode 100644
index 00000000..713bb8f1
--- /dev/null
+++ b/nix/packages/by-name/hrt-time/package.nix
@@ -0,0 +1,30 @@
+{
+  fetchFromGitHub,
+  stdenvNoCC,
+  lib,
+}:
+let
+  rev = "b344ab770e4c08d0bb13c38ea61979b282e24db7";
+in
+stdenvNoCC.mkDerivation {
+  pname = "hrt-time";
+  version = "unstable-" + lib.substring 0 8 rev;
+
+  src = fetchFromGitHub {
+    owner = "ariannelafraise";
+    repo = "hrt-time";
+    inherit rev;
+    hash = "sha256-+AhLkcCETVnF6S+ov1oKxhs3M9F6ghyyERoLN3aMMxw=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp hrt-time.sh $out/bin/hrt-time
+  '';
+
+  patches = [
+    ./my-day.patch
+  ];
+
+  meta.mainProgram = "hrt-time";
+}
diff --git a/nix/packages/by-name/hutils/package.nix b/nix/packages/by-name/hutils/package.nix
index f068bd8c..d5423044 100644
--- a/nix/packages/by-name/hutils/package.nix
+++ b/nix/packages/by-name/hutils/package.nix
@@ -2,18 +2,16 @@
   haskellPackages,
   haskell,
   fetchFromGitea,
-}: let
+}:
+let
   inherit (haskell.lib.compose) justStaticExecutables;
 
-  drv =
-    haskellPackages.callCabal2nix "hutils"
-    (fetchFromGitea {
-      domain = "git.confusedcompiler.org";
-      owner = "leana8959";
-      repo = "hutils";
-      rev = "30b503bec011f8908e26c0e1e961936d56da74cc";
-      hash = "sha256-lPwqxsz7WXdDMonjdWvTziR5HuE5HY2GyU2rQkwn0VU=";
-    })
-    {};
+  drv = haskellPackages.callCabal2nix "hutils" (fetchFromGitea {
+    domain = "git.confusedcompiler.org";
+    owner = "leana8959";
+    repo = "hutils";
+    rev = "30b503bec011f8908e26c0e1e961936d56da74cc";
+    hash = "sha256-lPwqxsz7WXdDMonjdWvTziR5HuE5HY2GyU2rQkwn0VU=";
+  }) { };
 in
-  justStaticExecutables drv
+justStaticExecutables drv
diff --git a/nix/packages/by-name/maeel/package.nix b/nix/packages/by-name/maeel/package.nix
index 54234d04..0d987aa5 100644
--- a/nix/packages/by-name/maeel/package.nix
+++ b/nix/packages/by-name/maeel/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
     hash = "sha256-Ee4/N2Q90xsbyGVtpE/yUFWC/ELt8nBAICkR/FlZQOo=";
   };
 
-  nativeBuildInputs = [rustc];
+  nativeBuildInputs = [ rustc ];
   installPhase = ''
     mkdir -p "$out/bin"
     cp --reflink=auto ./maeel "$out/bin"
diff --git a/nix/packages/by-name/necrolib/package.nix b/nix/packages/by-name/necrolib/package.nix
index 3c85c9a5..9b8ac1c2 100644
--- a/nix/packages/by-name/necrolib/package.nix
+++ b/nix/packages/by-name/necrolib/package.nix
@@ -2,27 +2,28 @@
   fetchFromGitLab,
   ocaml-ng,
   ocamlPackages ? ocaml-ng.ocamlPackages_5_1,
-}: let
+}:
+let
   version = "v0.16.2";
 in
-  ocamlPackages.buildDunePackage {
-    pname = "necrolib";
-    inherit version;
+ocamlPackages.buildDunePackage {
+  pname = "necrolib";
+  inherit version;
 
-    minimalOCamlVersion = "5.1.1";
+  minimalOCamlVersion = "5.1.1";
 
-    src = fetchFromGitLab {
-      domain = "gitlab.inria.fr";
-      owner = "skeletons";
-      repo = "necro";
-      rev = version;
-      hash = "sha256-KoSKJD5jy+GY5QKKMUTW5gc0V/5l/klHrJMdC8aPnj8=";
-    };
+  src = fetchFromGitLab {
+    domain = "gitlab.inria.fr";
+    owner = "skeletons";
+    repo = "necro";
+    rev = version;
+    hash = "sha256-KoSKJD5jy+GY5QKKMUTW5gc0V/5l/klHrJMdC8aPnj8=";
+  };
 
-    duneVersion = "3";
-    nativeBuildInputs = [ocamlPackages.menhir];
-    buildInputs = [
-      ocamlPackages.ocamlgraph
-      ocamlPackages.dune-build-info
-    ];
-  }
+  duneVersion = "3";
+  nativeBuildInputs = [ ocamlPackages.menhir ];
+  buildInputs = [
+    ocamlPackages.ocamlgraph
+    ocamlPackages.dune-build-info
+  ];
+}
diff --git a/nix/packages/by-name/nix-which/package.nix b/nix/packages/by-name/nix-which/package.nix
index 896ab411..a33f12b2 100644
--- a/nix/packages/by-name/nix-which/package.nix
+++ b/nix/packages/by-name/nix-which/package.nix
@@ -2,26 +2,27 @@
   writeShellApplication,
   which,
   lib,
-}: let
+}:
+let
   # Use this to not pollute the PATH inside
   # Otherwise nix-which which will be an edge case
   whichExe = "${lib.getExe which}";
 in
-  writeShellApplication {
-    name = "nix-which";
-    text = ''
-      if [ "$#" -ne 1 ]; then
-          echo "Must provide exactly one argument, the package to be dereferenced"
-          exit 1
-      fi
-      target="$1"
+writeShellApplication {
+  name = "nix-which";
+  text = ''
+    if [ "$#" -ne 1 ]; then
+        echo "Must provide exactly one argument, the package to be dereferenced"
+        exit 1
+    fi
+    target="$1"
 
-      target="$(${whichExe} "$target")"
-      echo "==> $target"
+    target="$(${whichExe} "$target")"
+    echo "==> $target"
 
-      while [ -L "$target" ]; do
-          target="$(readlink "$target")"
-          echo "==> $target"
-      done
-    '';
-  }
+    while [ -L "$target" ]; do
+        target="$(readlink "$target")"
+        echo "==> $target"
+    done
+  '';
+}
diff --git a/nix/packages/by-name/prop-solveur/package.nix b/nix/packages/by-name/prop-solveur/package.nix
index c9200357..19ec5af4 100644
--- a/nix/packages/by-name/prop-solveur/package.nix
+++ b/nix/packages/by-name/prop-solveur/package.nix
@@ -3,31 +3,26 @@
   haskell,
   fetchFromGitea,
   installShellFiles,
-}: let
+}:
+let
   inherit (haskell.lib.compose) justStaticExecutables overrideCabal;
 
-  drv =
-    haskellPackages.callCabal2nix "prop-solveur"
-    (fetchFromGitea {
-      domain = "git.confusedcompiler.org";
-      owner = "leana8959";
-      repo = "prop_solveur";
-      rev = "cc2430dc5a396b01d02bd925070ce5d009d05bc4";
-      hash = "sha256-jwNfRBytf/w0d2CWczXp+rVRXYNzptkuFE3OKSdOhLc=";
-    })
-    {};
+  drv = haskellPackages.callCabal2nix "prop-solveur" (fetchFromGitea {
+    domain = "git.confusedcompiler.org";
+    owner = "leana8959";
+    repo = "prop_solveur";
+    rev = "cc2430dc5a396b01d02bd925070ce5d009d05bc4";
+    hash = "sha256-jwNfRBytf/w0d2CWczXp+rVRXYNzptkuFE3OKSdOhLc=";
+  }) { };
 
   cabalOverrides = o: {
-    buildTools = o.buildTools or [] ++ [installShellFiles];
-    postInstall =
-      o.postInstall or ""
-      + ''
-        installShellCompletion --cmd prop-solveur \
-            --bash <("$out/bin/prop-solveur" --bash-completion-script "$out/bin/prop-solveur") \
-            --fish <("$out/bin/prop-solveur" --fish-completion-script "$out/bin/prop-solveur") \
-            --zsh  <("$out/bin/prop-solveur" --zsh-completion-script  "$out/bin/prop-solveur")
-      '';
+    buildTools = o.buildTools or [ ] ++ [ installShellFiles ];
+    postInstall = o.postInstall or "" + ''
+      installShellCompletion --cmd prop-solveur \
+          --bash <("$out/bin/prop-solveur" --bash-completion-script "$out/bin/prop-solveur") \
+          --fish <("$out/bin/prop-solveur" --fish-completion-script "$out/bin/prop-solveur") \
+          --zsh  <("$out/bin/prop-solveur" --zsh-completion-script  "$out/bin/prop-solveur")
+    '';
   };
 in
-  justStaticExecutables
-  (overrideCabal cabalOverrides drv)
+justStaticExecutables (overrideCabal cabalOverrides drv)
diff --git a/nix/packages/by-name/ruler/package.nix b/nix/packages/by-name/ruler/package.nix
index 68c59d45..0e7d8aa9 100644
--- a/nix/packages/by-name/ruler/package.nix
+++ b/nix/packages/by-name/ruler/package.nix
@@ -3,31 +3,26 @@
   haskell,
   fetchFromGitea,
   installShellFiles,
-}: let
+}:
+let
   inherit (haskell.lib.compose) justStaticExecutables overrideCabal;
 
-  drv =
-    haskellPackages.callCabal2nix "ruler"
-    (fetchFromGitea {
-      domain = "git.confusedcompiler.org";
-      owner = "leana8959";
-      repo = "ruler";
-      rev = "adf8f711b014cba4b73da0132c2be944ba20ba0b";
-      hash = "sha256-sHJEgwEAMERhOCPY16Lsirj1bSUfEUpwNnPmHfg+/8Q=";
-    })
-    {};
+  drv = haskellPackages.callCabal2nix "ruler" (fetchFromGitea {
+    domain = "git.confusedcompiler.org";
+    owner = "leana8959";
+    repo = "ruler";
+    rev = "2556b4985065d093b1db3a14a2c5c37115871c78";
+    hash = "sha256-OvNhDpyAbZp+d0rSXLE55BvM5jT3OI8q79D6aVaA2FI=";
+  }) { };
 
   cabalOverrides = o: {
-    buildTools = o.buildTools or [] ++ [installShellFiles];
-    postInstall =
-      o.postInstall or ""
-      + ''
-        installShellCompletion --cmd ruler \
-            --bash <("$out/bin/ruler" --bash-completion-script "$out/bin/ruler") \
-            --fish <("$out/bin/ruler" --fish-completion-script "$out/bin/ruler") \
-            --zsh  <("$out/bin/ruler" --zsh-completion-script "$out/bin/ruler")
-      '';
+    buildTools = o.buildTools or [ ] ++ [ installShellFiles ];
+    postInstall = o.postInstall or "" + ''
+      installShellCompletion --cmd ruler \
+          --bash <("$out/bin/ruler" --bash-completion-script "$out/bin/ruler") \
+          --fish <("$out/bin/ruler" --fish-completion-script "$out/bin/ruler") \
+          --zsh  <("$out/bin/ruler" --zsh-completion-script "$out/bin/ruler")
+    '';
   };
 in
-  justStaticExecutables
-  (overrideCabal cabalOverrides drv)
+justStaticExecutables (overrideCabal cabalOverrides drv)
diff --git a/nix/packages/by-name/tmux-sessionizer/package.nix b/nix/packages/by-name/tmux-sessionizer/package.nix
index e60e8a45..63c7cbc1 100644
--- a/nix/packages/by-name/tmux-sessionizer/package.nix
+++ b/nix/packages/by-name/tmux-sessionizer/package.nix
@@ -6,28 +6,14 @@
   gnused,
   lib,
   symlinkJoin,
-}: let
-  tmux-register-session = writeShellApplication {
-    name = "__tmux-register-session";
-    runtimeInputs = [tmux];
-    text = ''
-      last=/tmp/TMUX_LAST
-
-      # bail if tmux not running
-      if ! pgrep tmux >/dev/null 2>&1; then
-        exit 1
-      fi
-
-      this="$(tmux display-message -p '#S')"
-      if [ ! -f "$last" ] || [ "$(cat "$last")" != "$this" ]; then
-          echo "$this" >"$last"
-      fi
-    '';
-  };
-
+}:
+let
   tmux-maybe-create = writeShellApplication {
     name = "__tmux-maybe-create";
-    runtimeInputs = [procps tmux];
+    runtimeInputs = [
+      procps
+      tmux
+    ];
     text = ''
       session_name="$1"
       session_dir="$2"
@@ -40,7 +26,7 @@
 
   tmux-attach-or-switch = writeShellApplication {
     name = "__tmux-attach-or-switch";
-    runtimeInputs = [tmux];
+    runtimeInputs = [ tmux ];
     text = ''
       session_name="$1"
       TMUX=''${TMUX:-}
@@ -55,7 +41,10 @@
 
   tmux-sessionizer = writeShellApplication {
     name = "tmux-sessionizer";
-    runtimeInputs = [fzf gnused];
+    runtimeInputs = [
+      fzf
+      gnused
+    ];
     text = ''
       selected=$(
         {
@@ -87,18 +76,16 @@
       esac
 
       # effects
-      ${lib.getExe tmux-register-session} || :
       ${lib.getExe tmux-maybe-create} "$session_name" "$selected"
       ${lib.getExe tmux-attach-or-switch} "$session_name"
     '';
   };
 in
-  symlinkJoin {
-    name = "tmux-sessionizer";
-    paths = [
-      tmux-register-session
-      tmux-maybe-create
-      tmux-attach-or-switch
-      tmux-sessionizer
-    ];
-  }
+symlinkJoin {
+  name = "tmux-sessionizer";
+  paths = [
+    tmux-maybe-create
+    tmux-attach-or-switch
+    tmux-sessionizer
+  ];
+}
diff --git a/nix/packages/by-name/tokei/package.nix b/nix/packages/by-name/tokei/package.nix
index fbaee2fc..77399046 100644
--- a/nix/packages/by-name/tokei/package.nix
+++ b/nix/packages/by-name/tokei/package.nix
@@ -7,29 +7,33 @@
   darwin,
   zlib,
 }:
-rustPlatform.buildRustPackage (finalAttrs: let
-  cargoToml = fromTOML (builtins.readFile (finalAttrs.src + "/Cargo.toml"));
-  cargoLock = finalAttrs.src + "/Cargo.lock";
-in {
-  pname = "tokei";
-  version = cargoToml.package.version;
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    cargoToml = fromTOML (builtins.readFile (finalAttrs.src + "/Cargo.toml"));
+    cargoLock = finalAttrs.src + "/Cargo.lock";
+  in
+  {
+    pname = "tokei";
+    version = cargoToml.package.version;
 
-  src = fetchFromGitHub {
-    owner = "XAMPPRocky";
-    repo = "tokei";
-    rev = "v13.0.0-alpha.9";
-    hash = "sha256-OSIJYSUwc8SvszEOMgt+d/ljCW2jtBkPw6buof4JpUc=";
-  };
+    src = fetchFromGitHub {
+      owner = "XAMPPRocky";
+      repo = "tokei";
+      rev = "v13.0.0-alpha.9";
+      hash = "sha256-OSIJYSUwc8SvszEOMgt+d/ljCW2jtBkPw6buof4JpUc=";
+    };
 
-  cargoLock.lockFile = cargoLock;
+    cargoLock.lockFile = cargoLock;
 
-  buildInputs = lib.optionals stdenv.isDarwin [
-    libiconv
-    darwin.Security
-  ];
+    buildInputs = lib.optionals stdenv.isDarwin [
+      libiconv
+      darwin.Security
+    ];
 
-  checkInputs = lib.optionals stdenv.isDarwin [zlib];
+    checkInputs = lib.optionals stdenv.isDarwin [ zlib ];
 
-  # enable all output formats
-  buildFeatures = ["all"];
-})
+    # enable all output formats
+    buildFeatures = [ "all" ];
+  }
+)
diff --git a/nix/packages/by-name/typst-bot/package.nix b/nix/packages/by-name/typst-bot/package.nix
index 184ac9ab..f7a50b00 100644
--- a/nix/packages/by-name/typst-bot/package.nix
+++ b/nix/packages/by-name/typst-bot/package.nix
@@ -2,36 +2,37 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-}: let
+}:
+let
   rev = "c9d4b164ff5dc2567bb0de3876460e51da62ba94";
 in
-  rustPlatform.buildRustPackage (finalAttrs: {
-    pname = "typst-bot";
-    version = lib.substring 0 8 rev;
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "typst-bot";
+  version = lib.substring 0 8 rev;
 
-    src = fetchFromGitHub {
-      owner = "mattfbacon";
-      repo = "typst-bot";
-      inherit rev;
-      hash = "sha256-tB+zrE5p7zOloOgoP2fmFsajd4IBf94ET1v/0W3aNcM=";
+  src = fetchFromGitHub {
+    owner = "mattfbacon";
+    repo = "typst-bot";
+    inherit rev;
+    hash = "sha256-tB+zrE5p7zOloOgoP2fmFsajd4IBf94ET1v/0W3aNcM=";
+  };
+
+  preBuild = ''
+    # Don't use the upstream way of embedding the git rev
+    echo 'fn main() { println!("cargo:rustc-env=BUILD_SHA=${rev}"); }' > crates/bot/build.rs
+
+    # Patch the command calling the worker by name.
+    substituteInPlace crates/bot/src/worker.rs --replace-fail \
+      '"./worker"' \
+      '"${placeholder "out"}/bin/worker"'
+  '';
+
+  cargoBuildFlags = [ "--workspace" ];
+
+  cargoLock = {
+    lockFile = "${finalAttrs.src}/Cargo.lock";
+    outputHashes = {
+      "poise-0.6.1" = "sha256-iXyp9sR/vzPsexGPdRjfuKyFcGqvDdqiBAXnuw/HFo8=";
     };
-
-    preBuild = ''
-      # Don't use the upstream way of embedding the git rev
-      echo 'fn main() { println!("cargo:rustc-env=BUILD_SHA=${rev}"); }' > crates/bot/build.rs
-
-      # Patch the command calling the worker by name.
-      substituteInPlace crates/bot/src/worker.rs --replace-fail \
-        '"./worker"' \
-        '"${placeholder "out"}/bin/worker"'
-    '';
-
-    cargoBuildFlags = ["--workspace"];
-
-    cargoLock = {
-      lockFile = "${finalAttrs.src}/Cargo.lock";
-      outputHashes = {
-        "poise-0.6.1" = "sha256-iXyp9sR/vzPsexGPdRjfuKyFcGqvDdqiBAXnuw/HFo8=";
-      };
-    };
-  })
+  };
+})
diff --git a/nix/packages/by-name/typst-mutilate/package.nix b/nix/packages/by-name/typst-mutilate/package.nix
index 1b11b08e..cad4762b 100644
--- a/nix/packages/by-name/typst-mutilate/package.nix
+++ b/nix/packages/by-name/typst-mutilate/package.nix
@@ -3,27 +3,31 @@
   fetchFromGitHub,
   fetchpatch,
 }:
-rustPlatform.buildRustPackage (finalAttrs: let
-  cargoToml = fromTOML (builtins.readFile (finalAttrs.src + "/Cargo.toml"));
-  cargoLock = finalAttrs.src + "/Cargo.lock";
-in {
-  pname = "typst-mutilate";
-  version = cargoToml.package.version;
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    cargoToml = fromTOML (builtins.readFile (finalAttrs.src + "/Cargo.toml"));
+    cargoLock = finalAttrs.src + "/Cargo.lock";
+  in
+  {
+    pname = "typst-mutilate";
+    version = cargoToml.package.version;
 
-  src = fetchFromGitHub {
-    owner = "frozolotl";
-    repo = "typst-mutilate";
-    rev = "9bf5ed1f8a2f91055a91077f0a8545ff1f229933";
-    hash = "sha256-r4fkFv1np8xhff3m8yev1rU1vfKRz8zQMIKIc+fOjew=";
-  };
+    src = fetchFromGitHub {
+      owner = "frozolotl";
+      repo = "typst-mutilate";
+      rev = "9bf5ed1f8a2f91055a91077f0a8545ff1f229933";
+      hash = "sha256-r4fkFv1np8xhff3m8yev1rU1vfKRz8zQMIKIc+fOjew=";
+    };
 
-  cargoLock.lockFile = cargoLock;
+    cargoLock.lockFile = cargoLock;
 
-  patches = [
-    (fetchpatch {
-      name = "raw-block-fix";
-      url = "https://github.com/frozolotl/typst-mutilate/pull/2/commits/223bc31abb2d5fef4e743a1582bb126a2ef47a45.patch";
-      hash = "sha256-+6DMQo4cjVASgkX4gcYrEkwQ/uxttV/61fDnXBqbNcg=";
-    })
-  ];
-})
+    patches = [
+      (fetchpatch {
+        name = "raw-block-fix";
+        url = "https://github.com/frozolotl/typst-mutilate/pull/2/commits/223bc31abb2d5fef4e743a1582bb126a2ef47a45.patch";
+        hash = "sha256-+6DMQo4cjVASgkX4gcYrEkwQ/uxttV/61fDnXBqbNcg=";
+      })
+    ];
+  }
+)
diff --git a/nix/packages/by-name/webtoon_downloader/package.nix b/nix/packages/by-name/webtoon_downloader/package.nix
index 3ee408c1..c625ab1a 100644
--- a/nix/packages/by-name/webtoon_downloader/package.nix
+++ b/nix/packages/by-name/webtoon_downloader/package.nix
@@ -44,7 +44,7 @@ python3.pkgs.buildPythonApplication {
     "rich"
   ];
 
-  pythonImportsCheck = ["webtoon_downloader"];
+  pythonImportsCheck = [ "webtoon_downloader" ];
 
   nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
diff --git a/nix/packages/by-name/xbrightness/package.nix b/nix/packages/by-name/xbrightness/package.nix
index c2efe449..1977b4fb 100644
--- a/nix/packages/by-name/xbrightness/package.nix
+++ b/nix/packages/by-name/xbrightness/package.nix
@@ -4,7 +4,7 @@
 }:
 writeShellApplication {
   name = "xbrightness";
-  runtimeInputs = [bc];
+  runtimeInputs = [ bc ];
   text = ''
     device=$1
     rel=$2
diff --git a/nix/packages/default.nix b/nix/packages/default.nix
index 62311f0f..b72b05c0 100644
--- a/nix/packages/default.nix
+++ b/nix/packages/default.nix
@@ -1,11 +1,12 @@
-{sources ? import ../../npins}: let
-  scopeOverlay = overlay: final: prev: {export = prev.export or {} // overlay final prev;};
+{
+  sources ? import ../../npins,
+}:
+let
+  scopeOverlay = overlay: final: prev: { export = prev.export or { } // overlay final prev; };
 in
-  (
-    import sources.nixpkgs {
-      overlays = map scopeOverlay [
-        (import ./overlay.nix)
-        (import ../overlays/iosevka.nix)
-      ];
-    }
-  ).export
+(import sources.nixpkgs {
+  overlays = map scopeOverlay [
+    (import ./overlay.nix)
+    (import ../overlays/iosevka.nix)
+  ];
+}).export
diff --git a/nix/packages/overlay.nix b/nix/packages/overlay.nix
index 2b635dc2..5ab57ec9 100644
--- a/nix/packages/overlay.nix
+++ b/nix/packages/overlay.nix
@@ -1,7 +1,7 @@
-final: prev: let
+final: prev:
+let
   inherit (prev) lib;
 in
-  lib.mapAttrs (name: _: final.callPackage (./by-name + "/${name}/package.nix") {})
-  (
-    lib.filterAttrs (_: type: type == "directory") (builtins.readDir ./by-name)
-  )
+lib.mapAttrs (name: _: final.callPackage (./by-name + "/${name}/package.nix") { }) (
+  lib.filterAttrs (_: type: type == "directory") (builtins.readDir ./by-name)
+)
diff --git a/nix/secrets/four_pwd.age b/nix/secrets/four_pwd.age
index 2ca25498..f1a634e6 100644
Binary files a/nix/secrets/four_pwd.age and b/nix/secrets/four_pwd.age differ
diff --git a/nix/secrets/hoot_token.age b/nix/secrets/hoot_token.age
index 76995e5c..d2b68b7a 100644
Binary files a/nix/secrets/hoot_token.age and b/nix/secrets/hoot_token.age differ
diff --git a/nix/secrets/iambconfig.age b/nix/secrets/iambconfig.age
index c98a06d7..f26a387d 100644
Binary files a/nix/secrets/iambconfig.age and b/nix/secrets/iambconfig.age differ
diff --git a/nix/secrets/parrot_token.age b/nix/secrets/parrot_token.age
index 2e4eb685..b2570c93 100644
Binary files a/nix/secrets/parrot_token.age and b/nix/secrets/parrot_token.age differ
diff --git a/nix/secrets/restic_backblaze_env.age b/nix/secrets/restic_backblaze_env.age
index 1c5a33d1..fd2de494 100644
Binary files a/nix/secrets/restic_backblaze_env.age and b/nix/secrets/restic_backblaze_env.age differ
diff --git a/nix/secrets/restic_backblaze_pwd.age b/nix/secrets/restic_backblaze_pwd.age
index 65206714..6f4ca518 100644
Binary files a/nix/secrets/restic_backblaze_pwd.age and b/nix/secrets/restic_backblaze_pwd.age differ
diff --git a/nix/secrets/restic_backblaze_repo.age b/nix/secrets/restic_backblaze_repo.age
index 167e78cd..853c30c1 100644
Binary files a/nix/secrets/restic_backblaze_repo.age and b/nix/secrets/restic_backblaze_repo.age differ
diff --git a/nix/secrets/restic_four_pwd.age b/nix/secrets/restic_four_pwd.age
index 46b980de..1a6bc73b 100644
--- a/nix/secrets/restic_four_pwd.age
+++ b/nix/secrets/restic_four_pwd.age
@@ -1,10 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ /LOUFKCJMDbwGmRbKmtA5YibEwXaC+bn3qzr2G5PNjU
-8sFd/TH7CotBpgE9IcBUjpl1HQDoVWcBnKMs+65yWFM
--> ssh-ed25519 yg55bA zfExS48sAVvVfmhoNjrqu7b6YBPF8Nj+Uz7LyAswexk
-0m8ezLoCMw71c+HlEDgNA/V1IZeMsWu5MV+fvQEKsRA
--> .5;c~,-grease M^}>kjw ;yYsB Z 1}Z@jDzv
-2ZhEqtWhM/7boxsNVSQHc+eDs41VyWaj3JoyYPBdQf1Gm9OVToKAfM03EuTYKvGk
-IgoyvRNeEsXRJA3gnApmlQC/gGsaR/bMs+/sDuZzsNpMo7cFjPcfQZ+TM3A
---- ACmisGCqSllpxxoCa1FKK79Jmf1TjNCcQe+ouccHttA
-mm5f}r._%)�7G�~}��{�� ��{o�u�b�N�3�@>V�4��:?��,�
\ No newline at end of file
+-> ssh-ed25519 7owkuQ llLFRhDH+x5Igkw1CcsjKwKgmXh67zVuLXjCKpD+bks
+QqR+Iqlqip3t0oRs+RUyJWHK19zGSLEx1jXSrYCW6nw
+-> ssh-ed25519 ks0k0A sZY5SVZt8p+W8lC1q+P57JSUGDgZJZ1OsCe4nvgw1hw
+5iKTgCzIqKEUgKtVS8wNoy0TfPxQsvM5Nk+ErppL/tY
+-> ssh-ed25519 0LL3PQ rKU2Mk4CQIv6QUK0Y40AwLG8WR4iutQ5S0mBt1zcXR8
+aSkny0uNkb4s4YeCo3Gkp7CtZXepeEDEPLJl2ONIK8g
+-> ssh-ed25519 0dJ6Mg Pw6bWIyyLTkGJJoYmy2BrijbLI0rLDFrT5OhIsZfl10
+594tiWAh7VsGXainw2VYMVRmYdymgcVERAAOHnagxxE
+-> g<z||@]-grease =0y{6( N1r\ ZzIw'o|
+Du1hjWuKTnLWu70pnHNqsdgNw5JlsDlzx90YGBmsjHxDTKw7ZRnvZcdNBLXI/fXJ
+ntB6/NbU10RLgPQwPswt01I
+--- +bayuQ0F1wE+Qpx5HNoTiVk8a6HkiOhcvE2U35bo4f0
+�Y\�nAq�"6��Q`�z����0�y�?	���|�l$h�'���b�K{�pr
\ No newline at end of file
diff --git a/nix/secrets/restic_sgbk_pwd.age b/nix/secrets/restic_sgbk_pwd.age
index 04cd71dc..a7d310bb 100644
--- a/nix/secrets/restic_sgbk_pwd.age
+++ b/nix/secrets/restic_sgbk_pwd.age
@@ -1,10 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ 4qJGfzwkiTLxMp29ap8xS4Yrr4v5+WuEgR2l6kk1u3g
-/ez+z5soKOZJYd1ETWcZ9WwGQkcI4hdOhS63oshjBWM
--> ssh-ed25519 yg55bA is0cfph0fc3Yd4btpE4+HqN9YWWlkkQ9hj0LDtkCPwQ
-K3zdjEN3dlTaticQtVi774mQOM1KUg+dk0JvjQxctnk
--> zou8qv-grease $$C.n1_ #
-N5iTy0ERftclPNDFgpa4ClqGCIvTDIKj03Iyzy+az2l3bs8MXUS/4hqh+uDCW3GG
-t4gL59TG
---- U3g4gGvkEQKWkM6gMEA3AFK9y5y4i7jnoNWb7xgDqeo
-�(�}A�2t80����_�s#�5�kˀ���|�A�&�p�@F#�p��� 
\ No newline at end of file
+-> ssh-ed25519 7owkuQ hyi5QyY0Nb/tRA5YHqvLGCk57rWJOclsYTSA+M58cXY
+QlI51+l50n5AZoqekc2oVJlGuoWMT521m3/X8lWtJks
+-> ssh-ed25519 ks0k0A jHfzQrfnTCHUnQN5kchnRNcC5jDrH5ZLtmojgwesClI
+nTtQ4pSwVk+shVoSISQXnLuc0eQ4Sn93XcSw56jErzo
+-> ssh-ed25519 0LL3PQ NaZ+jpzvUM5d5FturtNv8T9yq5/AXVAD7jWmdrUK20M
+45SEaLV70W/R5WmRt+cHUk6lC3uBPllwY/djK9VUFww
+-> ssh-ed25519 0dJ6Mg 4AFLZqFmCnRcwgiGLY0WnLonRMGbQxH41u6Qg00zX3c
+2Tz7qnUOFIXNPrMMWdOS7jjcmAcZLe+Zptz5UOLYWx4
+-> }?-grease Rs]
+/IzXx/FD8S/6X6hMWHwFvHLFFiouDjdAIAAb8ZkyRDoqUO4RbqTJ95zk2riKoFF+
+VEk
+--- /YEZAkDcEUTff6GSoh6MfDYZzI6eCsy1apPcQS/mGVQ
+YH���gj3^�Ђ�aƴ��]-H��T��u���k!�N%�%��5B���w`f��
\ No newline at end of file
diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix
index a3b4ab52..2ac15506 100644
--- a/nix/secrets/secrets.nix
+++ b/nix/secrets/secrets.nix
@@ -1,9 +1,7 @@
 let
-  ids = import ../identities.nix;
-
-  all =
-    builtins.concatMap builtins.attrValues (builtins.attrValues ids);
-in {
+  all = import ../identities.nix;
+in
+{
   "wpa_password.age".publicKeys = all;
 
   "restic_backblaze_pwd.age".publicKeys = all;
diff --git a/nix/secrets/sgbk_pwd.age b/nix/secrets/sgbk_pwd.age
index 58602dda..ca2082b2 100644
--- a/nix/secrets/sgbk_pwd.age
+++ b/nix/secrets/sgbk_pwd.age
@@ -1,10 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ rAj9h0wtf1gsdtlvGDmaxdHjRreUyfRpZBNnI01edhY
-jCTGmhWgEy3BPdWQdv7goL0Vd2obIdRFn1HHApQdIpI
--> ssh-ed25519 yg55bA 9oZRoMwVSR5W7gFufctfhQcrunzGABm0eY5Zrd30CHw
-10sx6yDe/qhGSo7yfJi33bqrilLE5BBMjLuw46xZ/xo
--> 6<-grease # $q0gf& d+*Zn G7~`
-4wM1yc2zThJt4kjBR5Evb0sKVQTk+2/UxCyRclcj+c5WoFnZAUkweu5J9NKKZZY1
-eQDsxMy2VTCwKH21kt6GMThqd8uFLWlNIG8Rd+p1UQ
---- 4ITweNL+AK2o11O1NyophxQQsMYL4Lu6iBedFz9c7TE
-�����BQe~��n	bʙk�86��q�}�gې��+�c���;�]ɣK��
\ No newline at end of file
+-> ssh-ed25519 7owkuQ l4cFFHAGF9B6eJUBCReUSeMptRCOvmMbjKGqYjSkVAc
+u3LTp1N/nke8Z45MqfsXFKea/HlGbBIbDOVGrP4c6cM
+-> ssh-ed25519 ks0k0A ZtpZOThwG73Mza6EdPOSfiWbaurdFup0b4UFaLbSk30
+4Io9rkANNH4Auu562OY1idS2yZpy8gwbnVNnecvwoAQ
+-> ssh-ed25519 0LL3PQ La8Eho6itkMJFBE9h1eh5dBDO6xX5W1SXoPEsClK/SM
+tRWc436jOvH5lnLlSSd9DcDAQWj98edZ1WT24EwQ0rg
+-> ssh-ed25519 0dJ6Mg dIQDEi2rsms/r1tO/BT4JMrr5IO48CY+I09vA82kiQg
+Ur6P3I9Kq9iJKHys2T7rHPlek/yypPnrAWQe46NrGfE
+-> pkM5Nxe|-grease AZ 0> 0}5TA &9TD
+J5694/wXDMfpyEVV3jxia/ZTKKJ1rcWWF+PKxid4rg0zh/+fJv7qrEHEbc9LCTzR
+jZWL5knDhzWK
+--- e7fyHg0amnzuMqw7fDntjIMwwiAmg5DU081kFt/Fnz0
+e
t����Ts���m��2�u=�ϼc� �qa�o�Q^M�MeA��ON0)�
\ No newline at end of file
diff --git a/nix/secrets/sshconfig.age b/nix/secrets/sshconfig.age
index 7ddfaa72..24c12882 100644
Binary files a/nix/secrets/sshconfig.age and b/nix/secrets/sshconfig.age differ
diff --git a/nix/secrets/two_pwd.age b/nix/secrets/two_pwd.age
index 54ff2e64..ac20a22b 100644
--- a/nix/secrets/two_pwd.age
+++ b/nix/secrets/two_pwd.age
@@ -1,10 +1,15 @@
 age-encryption.org/v1
--> ssh-ed25519 7owkuQ 19/isGgYZjRCPON85JEAYTaM766DiIvvFaaoijZivxU
-OE/HYTXVW4JMx7naMAORiYfQXyfrJEuegco97PBlfs4
--> ssh-ed25519 yg55bA qsSTyN6LX3FPcfS9Mo0zZFxlv8bN+tSm3kfr7JInzE8
-OUNksovVTZjecBLo2G2EksGl/f1qMfCv2IKcgWWc7hA
--> 8~-grease ^
-TtU/CcXzUV6vxDjnnSs4UHT0skFZdOOGAPZ54XYS9VI5qD5zYPdxlt4Xs293QALL
-+EYnfX/02ga1Xik2diAn2/pefStizBztyrqZ6n4ZSFwbYlg66WmG7y+mW+M
---- skqsOtKqWNBNuPKITV3vEQp27npkPn8DmVvT98XFnTw
-s�2[�>�m�虠��J�HO��[�{��=�ʆ��{�`s�jw:�	�4)�;�vRp���F�{9TX��<
\ No newline at end of file
+-> ssh-ed25519 7owkuQ ICj2WyiOMlAaoQ80r4rJvXam8JaVBtrpBhG6+FrsaTw
+oAhVMZ/u1ZdVlQqyGzwOUhXHXq7nT4xWNTBEoHwMIko
+-> ssh-ed25519 ks0k0A iVHtaqoMzsof7Gj4sFoL6/twZxeAKaHOycVd45fGfnk
+1XrtZ4nsGTqnqfXX75xT8pfpn2rZxZcMhv5ZKIxeNY0
+-> ssh-ed25519 0LL3PQ pUhnIplLUPX9uSatlr9mocn+iz9SYlNNZZMESi51SUQ
+udOD6vY0B0XmNXIU3Pslmttww8o4dB4n3nE5AZfWRhQ
+-> ssh-ed25519 0dJ6Mg d21p0eOmBQl8XeG7h5x4GQG/QjEDwAoiLYvmr8H0lS4
+SsUWCtuCYS7P1JbunEDXnFdb1LDZMvdfTFMLmwfNtxE
+-> 8V~yC-grease
+WMtDLWBx1Ed/qXRIw8U5ZBek3GtGTi9+2U5is073cLARPsAk8Qgc5H9F68u5QLhK
+FFlie0WlBwYHsCx2McB8kUg0vLEoqBTDYWcD2RImmdXsmddndFVi
+--- JM1EDOAtO8Fztqpteu70vsuOs1o0zmit5Hl9GGPBcVE
+�R}�N�n����,��
+.Si0��u����f	P�ny������K9�{�ǭ���L�3v嗥��E�f
\ No newline at end of file
diff --git a/nix/secrets/typst-bot_token.age b/nix/secrets/typst-bot_token.age
index da1052de..e1895578 100644
Binary files a/nix/secrets/typst-bot_token.age and b/nix/secrets/typst-bot_token.age differ
diff --git a/nix/secrets/wpa_password.age b/nix/secrets/wpa_password.age
index 42ffe14d..511c4742 100644
Binary files a/nix/secrets/wpa_password.age and b/nix/secrets/wpa_password.age differ
diff --git a/npins/default.nix b/npins/default.nix
index 78ca0251..850b02ae 100644
--- a/npins/default.nix
+++ b/npins/default.nix
@@ -1,11 +1,11 @@
 /*
-This file is provided under the MIT licence:
+  This file is provided under the MIT licence:
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+  Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+  The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+  THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
 # Generated by npins. Do not modify; will be overwritten regularly
 let
@@ -13,10 +13,8 @@ let
   version = data.version;
 
   # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
-  range = first: last:
-    if first > last
-    then []
-    else builtins.genList (n: first + n) (last - first + 1);
+  range =
+    first: last: if first > last then [ ] else builtins.genList (n: first + n) (last - first + 1);
 
   # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
   stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
@@ -29,137 +27,142 @@ let
   # If the environment variable NPINS_OVERRIDE_${name} is set, then use
   # the path directly as opposed to the fetched source.
   # (Taken from Niv for compatibility)
-  mayOverride = name: path: let
-    envVarName = "NPINS_OVERRIDE_${saneName}";
-    saneName = stringAsChars (c:
-      if (builtins.match "[a-zA-Z0-9]" c) == null
-      then "_"
-      else c)
-    name;
-    ersatz = builtins.getEnv envVarName;
-  in
-    if ersatz == ""
-    then path
+  mayOverride =
+    name: path:
+    let
+      envVarName = "NPINS_OVERRIDE_${saneName}";
+      saneName = stringAsChars (c: if (builtins.match "[a-zA-Z0-9]" c) == null then "_" else c) name;
+      ersatz = builtins.getEnv envVarName;
+    in
+    if ersatz == "" then
+      path
     else
       # this turns the string into an actual Nix path (for both absolute and
       # relative paths)
       builtins.trace "Overriding path of \"${name}\" with \"${ersatz}\" due to set \"${envVarName}\"" (
-        if builtins.substring 0 1 ersatz == "/"
-        then /. + ersatz
-        else /. + builtins.getEnv "PWD" + "/${ersatz}"
+        if builtins.substring 0 1 ersatz == "/" then
+          /. + ersatz
+        else
+          /. + builtins.getEnv "PWD" + "/${ersatz}"
       );
 
-  mkSource = name: spec:
-    assert spec ? type; let
+  mkSource =
+    name: spec:
+    assert spec ? type;
+    let
       path =
-        if spec.type == "Git"
-        then mkGitSource spec
-        else if spec.type == "GitRelease"
-        then mkGitSource spec
-        else if spec.type == "PyPi"
-        then mkPyPiSource spec
-        else if spec.type == "Channel"
-        then mkChannelSource spec
-        else if spec.type == "Tarball"
-        then mkTarballSource spec
-        else builtins.throw "Unknown source type ${spec.type}";
+        if spec.type == "Git" then
+          mkGitSource spec
+        else if spec.type == "GitRelease" then
+          mkGitSource spec
+        else if spec.type == "PyPi" then
+          mkPyPiSource spec
+        else if spec.type == "Channel" then
+          mkChannelSource spec
+        else if spec.type == "Tarball" then
+          mkTarballSource spec
+        else
+          builtins.throw "Unknown source type ${spec.type}";
     in
-      spec
-      // rec {
-        outPath = mayOverride name path;
+    spec
+    // rec {
+      outPath = mayOverride name path;
 
-        # Waiting for discussion upstream
-        # https://github.com/andir/npins/issues/159
-        asFlake =
-          if sources ? flake-compat
-          then (import sources.flake-compat {src = outPath;}).outputs
-          else throw ".asFlake needs flake-compat as a source";
-      };
+      # Waiting for discussion upstream
+      # https://github.com/andir/npins/issues/159
+      asFlake =
+        if sources ? flake-compat then
+          (import sources.flake-compat { src = outPath; }).outputs
+        else
+          throw ".asFlake needs flake-compat as a source";
+    };
 
-  mkGitSource = {
-    repository,
-    revision,
-    url ? null,
-    submodules,
-    hash,
-    branch ? null,
-    ...
-  }:
+  mkGitSource =
+    {
+      repository,
+      revision,
+      url ? null,
+      submodules,
+      hash,
+      branch ? null,
+      ...
+    }:
     assert repository ? type;
     # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
     # In the latter case, there we will always be an url to the tarball
-      if url != null && !submodules
-      then
-        builtins.fetchTarball {
-          inherit url;
-          sha256 = hash; # FIXME: check nix version & use SRI hashes
-        }
-      else let
+    if url != null && !submodules then
+      builtins.fetchTarball {
+        inherit url;
+        sha256 = hash; # FIXME: check nix version & use SRI hashes
+      }
+    else
+      let
         url =
-          if repository.type == "Git"
-          then repository.url
-          else if repository.type == "GitHub"
-          then "https://github.com/${repository.owner}/${repository.repo}.git"
-          else if repository.type == "GitLab"
-          then "${repository.server}/${repository.repo_path}.git"
-          else throw "Unrecognized repository type ${repository.type}";
-        urlToName = url: rev: let
-          matched = builtins.match "^.*/([^/]*)(\\.git)?$" url;
+          if repository.type == "Git" then
+            repository.url
+          else if repository.type == "GitHub" then
+            "https://github.com/${repository.owner}/${repository.repo}.git"
+          else if repository.type == "GitLab" then
+            "${repository.server}/${repository.repo_path}.git"
+          else
+            throw "Unrecognized repository type ${repository.type}";
+        urlToName =
+          url: rev:
+          let
+            matched = builtins.match "^.*/([^/]*)(\\.git)?$" url;
 
-          short = builtins.substring 0 7 rev;
+            short = builtins.substring 0 7 rev;
 
-          appendShort =
-            if (builtins.match "[a-f0-9]*" rev) != null
-            then "-${short}"
-            else "";
-        in "${
-          if matched == null
-          then "source"
-          else builtins.head matched
-        }${appendShort}";
+            appendShort = if (builtins.match "[a-f0-9]*" rev) != null then "-${short}" else "";
+          in
+          "${if matched == null then "source" else builtins.head matched}${appendShort}";
         name = urlToName url revision;
       in
-        builtins.fetchGit {
-          rev = revision;
-          inherit name;
-          # hash = hash;
-          inherit url submodules;
-        };
+      builtins.fetchGit {
+        rev = revision;
+        inherit name;
+        # hash = hash;
+        inherit url submodules;
+      };
 
-  mkPyPiSource = {
-    url,
-    hash,
-    ...
-  }:
+  mkPyPiSource =
+    {
+      url,
+      hash,
+      ...
+    }:
     builtins.fetchurl {
       inherit url;
       sha256 = hash;
     };
 
-  mkChannelSource = {
-    url,
-    hash,
-    ...
-  }:
+  mkChannelSource =
+    {
+      url,
+      hash,
+      ...
+    }:
     builtins.fetchTarball {
       inherit url;
       sha256 = hash;
     };
 
-  mkTarballSource = {
-    url,
-    locked_url ? url,
-    hash,
-    ...
-  }:
+  mkTarballSource =
+    {
+      url,
+      locked_url ? url,
+      hash,
+      ...
+    }:
     builtins.fetchTarball {
       url = locked_url;
       sha256 = hash;
     };
 
   sources =
-    if version == 5
-    then builtins.mapAttrs mkSource data.pins
-    else throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`";
+    if version == 5 then
+      builtins.mapAttrs mkSource data.pins
+    else
+      throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`";
 in
-  sources
+sources
diff --git a/npins/sources.json b/npins/sources.json
index 07131616..d84bc0d3 100644
--- a/npins/sources.json
+++ b/npins/sources.json
@@ -71,9 +71,9 @@
       },
       "branch": "taiwanese",
       "submodules": true,
-      "revision": "48a7a51516302e070479156b54d2911ba9fbfce8",
+      "revision": "cba16e03fd43b1ee8a15d20e14ecf0fb1c6762fa",
       "url": null,
-      "hash": "07d2mzjnggbxlpqarcj65xdndkqxcab38lkbbqh65cyfqzqahdg0",
+      "hash": "0ryb3cng4py2zrm95p5ial9w13p7w4ws0bl0lddrij1sq42kzg8l",
       "frozen": true
     },
     "flake-compat": {
@@ -112,11 +112,11 @@
         "owner": "nix-community",
         "repo": "home-manager"
       },
-      "branch": "release-25.05",
+      "branch": "release-25.11",
       "submodules": false,
-      "revision": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
-      "url": "https://github.com/nix-community/home-manager/archive/3b955f5f0a942f9f60cdc9cacb7844335d0f21c3.tar.gz",
-      "hash": "0q3lv288xlzxczh6lc5lcw0zj9qskvjw3pzsrgvdh8rl8ibyq75s"
+      "revision": "3fdd076e08049a9c7a83149b270440d9787d2df5",
+      "url": "https://github.com/nix-community/home-manager/archive/3fdd076e08049a9c7a83149b270440d9787d2df5.tar.gz",
+      "hash": "07k47xnkzha7ilcyak57wrh2ngka2j4f0d95zyyxn8jz8195q2q6"
     },
     "infuse": {
       "type": "GitRelease",
@@ -135,40 +135,6 @@
       "url": "https://codeberg.org/api/v1/repos/amjoseph/infuse.nix/archive/v2.4.tar.gz",
       "hash": "1s3d1v27jxsw5050qi0bq6agpf5gpw6jmcyigzpdgwfm9d6w6wz1"
     },
-    "lix": {
-      "type": "GitRelease",
-      "repository": {
-        "type": "Forgejo",
-        "server": "https://git.lix.systems/",
-        "owner": "lix-project",
-        "repo": "lix"
-      },
-      "pre_releases": false,
-      "version_upper_bound": null,
-      "release_prefix": null,
-      "submodules": false,
-      "version": "2.93.3",
-      "revision": "017e93ae637ce6dfc958001e5cdc2a3e0182be6f",
-      "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/2.93.3.tar.gz",
-      "hash": "152xjnlr733z34ndyxnhdaw7d4f3zcj5w028mlmwy378wvhk9b1s"
-    },
-    "lix-module": {
-      "type": "GitRelease",
-      "repository": {
-        "type": "Forgejo",
-        "server": "https://git.lix.systems/",
-        "owner": "lix-project",
-        "repo": "nixos-module"
-      },
-      "pre_releases": false,
-      "version_upper_bound": null,
-      "release_prefix": null,
-      "submodules": false,
-      "version": "2.93.1",
-      "revision": "c3c78a32273e89d28367d8605a4c880f0b6607e3",
-      "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/2.93.1.tar.gz",
-      "hash": "1m1lk9mjmcjfi30h1yckjrbdy9yf4msav2dnk8lpn0hrj4mkkw0i"
-    },
     "nil": {
       "type": "Git",
       "repository": {
@@ -221,22 +187,22 @@
       },
       "branch": "master",
       "submodules": false,
-      "revision": "d6645c340ef7d821602fd2cd199e8d1eed10afbc",
-      "url": "https://github.com/NixOS/nixos-hardware/archive/d6645c340ef7d821602fd2cd199e8d1eed10afbc.tar.gz",
-      "hash": "0m84zxwanfq34j568w4xkvip5hwpwbhsk46xjvnl063y77i54vfs"
+      "revision": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
+      "url": "https://github.com/NixOS/nixos-hardware/archive/9154f4569b6cdfd3c595851a6ba51bfaa472d9f3.tar.gz",
+      "hash": "1vmlcda7864ya2byxivnpzkqf41cavj9ms5hjh6i0h8anls56lk6"
     },
     "nixpkgs": {
       "type": "Git",
       "repository": {
         "type": "GitHub",
-        "owner": "NixOS",
+        "owner": "nixos",
         "repo": "nixpkgs"
       },
-      "branch": "nixos-25.05-small",
+      "branch": "nixos-25.11-small",
       "submodules": false,
-      "revision": "4d9bd66e3ea558621ae800445e9302a2aa1bb687",
-      "url": "https://github.com/NixOS/nixpkgs/archive/4d9bd66e3ea558621ae800445e9302a2aa1bb687.tar.gz",
-      "hash": "0dzq4bp8qamilabyy014qsjivr2ga7348da5fjiqbkp7y7fhbdk0"
+      "revision": "e9f8538978f954bed00f6535b764e7932dbc3eea",
+      "url": "https://github.com/nixos/nixpkgs/archive/e9f8538978f954bed00f6535b764e7932dbc3eea.tar.gz",
+      "hash": "07wdninn693v06jz537pn1d257idi7p3dqh1mvygsb2zf6y4hypm"
     },
     "nur": {
       "type": "Git",
@@ -247,9 +213,9 @@
       },
       "branch": "main",
       "submodules": false,
-      "revision": "e68fcda79871132cb42777c15a2c4a3ea563cad6",
-      "url": "https://github.com/nix-community/nur/archive/e68fcda79871132cb42777c15a2c4a3ea563cad6.tar.gz",
-      "hash": "0qng617rx1b5vifnigrhshlsb7rviwaii2czbpgbi8ljyivw10v0"
+      "revision": "cdeb308c4faaa430f951e81db2360cebb54feb58",
+      "url": "https://github.com/nix-community/nur/archive/cdeb308c4faaa430f951e81db2360cebb54feb58.tar.gz",
+      "hash": "1jjsgmg3maqkrncwc3fn7iqcsi88fjvfzkpchcc1iwih65kr91il"
     },
     "pin-emacs28": {
       "type": "Git",
@@ -386,9 +352,9 @@
       },
       "branch": "mistress",
       "submodules": false,
-      "revision": "189b0f83db95462244e2dc2e12c68741c924cb46",
-      "url": "https://git.confusedcompiler.org/leana8959/wallpapers/archive/189b0f83db95462244e2dc2e12c68741c924cb46.tar.gz",
-      "hash": "1fkspkw0b61q4k13zmnzi9pbw9b5yyd3v1id2ml44xbh1qa09w2m"
+      "revision": "377fc66de1961687bf81bd0182c5d385c1dfadb2",
+      "url": "https://git.confusedcompiler.org/leana8959/wallpapers/archive/377fc66de1961687bf81bd0182c5d385c1dfadb2.tar.gz",
+      "hash": "1j6mnb1n0wjlm69dfngi4jjrr76zf3kfmqm0wkbgjvm93cbg1p7j"
     },
     "wired-notify": {
       "type": "Git",
@@ -402,6 +368,19 @@
       "revision": "6a96aa2066d8ad945f2323b63dc217081ef51168",
       "url": "https://github.com/Toqozz/wired-notify/archive/6a96aa2066d8ad945f2323b63dc217081ef51168.tar.gz",
       "hash": "02b8pva12rzcciq5lavwk824xaym28igfsva4kikvd7mxs06ccwx"
+    },
+    "zen-browser": {
+      "type": "Git",
+      "repository": {
+        "type": "GitHub",
+        "owner": "0xc000022070",
+        "repo": "zen-browser-flake"
+      },
+      "branch": "main",
+      "submodules": false,
+      "revision": "8c9284cc227a5c7cd8f1e1fa7a6882b0907187c8",
+      "url": "https://github.com/0xc000022070/zen-browser-flake/archive/8c9284cc227a5c7cd8f1e1fa7a6882b0907187c8.tar.gz",
+      "hash": "1k0bxn3c9bsm5543wsijv6r73jb8c1a4pzcwqh7rjpn67n988hj2"
     }
   },
   "version": 5
diff --git a/shell.nix b/shell.nix
index 292dd1f7..1fc63cf4 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,30 +1,31 @@
 {
   sources ? import ./npins,
-  pkgs ?
-    import sources.nixpkgs {
-      overlays = map import [
-        ./nix/overlays/disko.nix
-      ];
-    },
+  pkgs ? import sources.nixpkgs {
+    overlays = map import [
+      ./nix/overlays/disko.nix
+    ];
+  },
   withGHC ? false,
-}: let
+}:
+let
   inherit (pkgs) lib;
 in
-  pkgs.mkShell {
-    packages = with pkgs;
-      [
-        just
-        jq
-        npins
-        disko
-      ]
-      ++ lib.optionals withGHC [
-        (haskellPackages.ghcWithPackages (self: [
-          self.xmonad-contrib
-          self.xmonad-extras
-          self.xmobar
-        ]))
-        haskell-language-server
-        cabal-install
-      ];
-  }
+pkgs.mkShell {
+  packages =
+    with pkgs;
+    [
+      just
+      jq
+      npins
+      nixos-anywhere # comes from nixpkgs
+      disko # comes from disko flake
+    ]
+    ++ lib.optionals withGHC [
+      (haskellPackages.ghcWithPackages (self: [
+        self.xmonad-contrib
+        self.xmonad-extras
+        self.xmobar
+      ]))
+      cabal-install
+    ];
+}