From b098f753a53b88c17f1674bacce9533195e88216 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 13 Jan 2026 11:39:09 +0100
Subject: reaktor2: 0.4.4 -> 0.4.5

---
 krebs/5pkgs/haskell/reaktor2/default.nix | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/krebs/5pkgs/haskell/reaktor2/default.nix b/krebs/5pkgs/haskell/reaktor2/default.nix
index f40b3cc89..d75de3a51 100644
--- a/krebs/5pkgs/haskell/reaktor2/default.nix
+++ b/krebs/5pkgs/haskell/reaktor2/default.nix
@@ -1,28 +1,29 @@
 { mkDerivation, aeson, async, attoparsec, base, base64, blessings
-, bytestring, containers, data-default, fetchgit, filepath
-, hashable, lens, lens-aeson, lib, network, network-simple
-, network-simple-tls, network-uri, pcre-light, process, random
-, servant-server, string-conversions, stringsearch, text, time
-, transformers, unagi-chan, unix, unordered-containers, vector, wai
-, warp
+, bytestring, containers, data-default, directory, fetchgit
+, filepath, hashable, http-types, lens, lens-aeson, lib, network
+, network-simple, network-simple-tls, network-uri, pcre-light
+, process, random, servant-server, string-conversions, stringsearch
+, text, time, transformers, unagi-chan, unix, unordered-containers
+, vector, wai, warp
 }:
 mkDerivation {
   pname = "reaktor2";
-  version = "0.4.4";
+  version = "0.4.5";
   src = fetchgit {
     url = "https://cgit.krebsco.de/reaktor2";
-    sha256 = "1r0dbhniq81z2akb3lxng92y288d7pffj5byyq9mbry241np7631";
-    rev = "f50e8b2186042f40392c823845eb3a184d0278de";
+    sha256 = "0arcw06k3hhmcp6kk5lxrzadin3lx6ywxrznicljr92flkgj8isc";
+    rev = "6ff1335c7c9775e1cf167b950b6de97359d3b659";
     fetchSubmodules = true;
   };
   isLibrary = false;
   isExecutable = true;
   executableHaskellDepends = [
     aeson async attoparsec base base64 blessings bytestring containers
-    data-default filepath hashable lens lens-aeson network
-    network-simple network-simple-tls network-uri pcre-light process
-    random servant-server string-conversions stringsearch text time
-    transformers unagi-chan unix unordered-containers vector wai warp
+    data-default directory filepath hashable http-types lens lens-aeson
+    network network-simple network-simple-tls network-uri pcre-light
+    process random servant-server string-conversions stringsearch text
+    time transformers unagi-chan unix unordered-containers vector wai
+    warp
   ];
   license = lib.licenses.mit;
   mainProgram = "reaktor";
-- 
cgit v1.2.3


From 30be9ada2486b92c39ddc464676f028dce980b55 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 13 Jan 2026 13:55:34 +0100
Subject: gitignore: fix bug introduced by 68d3c92

---
 default.nix                                      |  2 +-
 krebs/1systems/ponte/config.nix                  | 12 ++++++++
 krebs/2configs/nameserver.nix                    |  4 +++
 krebs/3modules/github/known-hosts.nix            |  1 +
 krebs/3modules/hosts.nix                         |  1 -
 krebs/3modules/iptables.nix                      |  8 +++++
 krebs/3modules/per-user.nix                      |  7 ++++-
 krebs/3modules/permown.nix                       |  6 ++++
 krebs/3modules/reaktor2.nix                      |  6 ++++
 krebs/3modules/setuid.nix                        |  7 ++++-
 krebs/3modules/ssh.nix                           | 38 +++++++++++++-----------
 krebs/3modules/tinc.nix                          | 20 +++++++------
 krebs/3modules/urlwatch.nix                      |  1 +
 krebs/3modules/zones.nix                         |  3 +-
 krebs/5pkgs/simple/TabFS/src.json                |  2 --
 krebs/5pkgs/simple/airdcpp-webclient/default.nix |  2 +-
 krebs/5pkgs/simple/default.nix                   | 10 +++++++
 krebs/5pkgs/simple/font-size.nix                 |  1 +
 krebs/5pkgs/simple/git-hooks/default.nix         |  1 +
 krebs/5pkgs/simple/gitignore.nix                 |  4 +--
 krebs/5pkgs/simple/htgen-imgur/src/htgen-imgur   | 36 ++++++++++++----------
 lib/default.nix                                  |  1 -
 lib/eval-source.nix                              |  3 +-
 lib/impure.nix                                   |  3 --
 lib/pure.nix                                     |  4 +--
 lib/types.nix                                    | 24 ++++++++++++++-
 26 files changed, 146 insertions(+), 61 deletions(-)
 delete mode 100644 lib/default.nix
 delete mode 100644 lib/impure.nix

diff --git a/default.nix b/default.nix
index 9368dcd9e..45b4f03f6 100644
--- a/default.nix
+++ b/default.nix
@@ -1,7 +1,7 @@
 import <nixpkgs/nixos> {} // rec {
   lib = import ./lib;
   systems = with lib; let
-    namespace = getEnv "LOGNAME";
+    namespace = krebs;
     systemsDir = <stockholm> + "/${namespace}/1systems";
   in
     genAttrs
diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix
index 8bb14d517..5deeb9923 100644
--- a/krebs/1systems/ponte/config.nix
+++ b/krebs/1systems/ponte/config.nix
@@ -8,6 +8,18 @@
     <stockholm/krebs/2configs/nameserver.nix>
   ];
 
+  #networking.defaultGateway6 = {
+  #  address = "fe80::1";
+  #  interface = "ens3";
+  #};
+  #networking.interfaces.ens3.ipv6.addresses = [
+  #  {
+  #    # old: address = "2a03:4000:13:4c::1";
+  #    address = "2a03:4000:1a:cf::1"; #/64"
+  #    prefixLength = 64;
+  #  }
+  #];
+
   networking.firewall.allowedTCPPorts = [ 80 443 ];
   networking.firewall.logRefusedConnections = false;
   networking.firewall.logRefusedUnicastsOnly = false;
diff --git a/krebs/2configs/nameserver.nix b/krebs/2configs/nameserver.nix
index fb22dc6f9..c394f312d 100644
--- a/krebs/2configs/nameserver.nix
+++ b/krebs/2configs/nameserver.nix
@@ -146,10 +146,14 @@ in {
     '';
   };
 
+  #krebs.systemd.services.knot.restartIfCredentialsChange = true;
   systemd.services."knsupdate-krebsco.de" = {
     serviceConfig = {
       Type = "oneshot";
       SyslogIdentifier = "knsupdate-krebsco.de";
+      #LoadCredential = [
+      #  "keys.conf:/var/src/secrets/knot-keys.conf"
+      #];
       ExecStart = pkgs.writeDash "knsupdate-krebsco.de" /* sh */ ''
         set -efu
 
diff --git a/krebs/3modules/github/known-hosts.nix b/krebs/3modules/github/known-hosts.nix
index 3725ff2b8..6f10452e9 100644
--- a/krebs/3modules/github/known-hosts.nix
+++ b/krebs/3modules/github/known-hosts.nix
@@ -8,4 +8,5 @@
     ;
     publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=";
   };
+  # ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
 }
diff --git a/krebs/3modules/hosts.nix b/krebs/3modules/hosts.nix
index 51aeefb9f..148b58d14 100644
--- a/krebs/3modules/hosts.nix
+++ b/krebs/3modules/hosts.nix
@@ -2,7 +2,6 @@
 with lib; let
   check = hostname: any (domain: hasSuffix ".${domain}" hostname) domains;
   domains = attrNames (filterAttrs (_: slib.eq "hosts") config.krebs.dns.providers);
-  # we need this import because we have infinite recursion otherwise
   slib = lib.slib or (import ../../lib/pure.nix { inherit lib; });
 in {
 
diff --git a/krebs/3modules/iptables.nix b/krebs/3modules/iptables.nix
index 16f1f3c84..1cde42dc3 100644
--- a/krebs/3modules/iptables.nix
+++ b/krebs/3modules/iptables.nix
@@ -19,6 +19,14 @@ let
   api = {
     enable = mkEnableOption "iptables";
 
+    rules4 = mkOption {
+      default = buildTables "v4" cfg.tables;
+    };
+
+    rules6 = mkOption {
+      default = buildTables "v6" cfg.tables;
+    };
+
     #tables.filter.INPUT = {
     # policy = "DROP";
     # rules = [
diff --git a/krebs/3modules/per-user.nix b/krebs/3modules/per-user.nix
index c0368ee85..f83a29acb 100644
--- a/krebs/3modules/per-user.nix
+++ b/krebs/3modules/per-user.nix
@@ -28,7 +28,12 @@ in {
             };
           })
           (filterAttrs (_: per-user: per-user.packages != []) cfg);
-      profiles = ["/etc/per-user/$LOGNAME"];
+
+      # XXX this breaks /etc/pam/environment because $LOGNAME doesn't get
+      # replaced by @{PAM_USER} the way $USER does.
+      # See <nixpkgs/nixos/modules/config/system-environment.nix>
+      #profiles = ["/etc/per-user/$LOGNAME"];
+      profiles = ["/etc/per-user/$USER"];
     };
   };
 }
diff --git a/krebs/3modules/permown.nix b/krebs/3modules/permown.nix
index d65ce2a31..51f5cb752 100644
--- a/krebs/3modules/permown.nix
+++ b/krebs/3modules/permown.nix
@@ -73,6 +73,12 @@ with lib; {
           pkgs.findutils
           pkgs.inotify-tools
         ];
+        # TODO
+        # der code könnte aber bisschen vorbereitet werden, damit man später einfach file-modes einbauen kann
+        # die drei finds müssten zu `find "$ROOT_PATH" -exec ${permown}` {} \;` werden
+        # und der while-block zu:
+        # ${permown} "$path" (egal ob vor oder nach dem if test -d)
+        # und dann müsste man danach nur das permown script bearbeiten
         serviceConfig = {
           ExecStart = pkgs.writeDash "permown" ''
             set -efu
diff --git a/krebs/3modules/reaktor2.nix b/krebs/3modules/reaktor2.nix
index b977df99a..d552178f9 100644
--- a/krebs/3modules/reaktor2.nix
+++ b/krebs/3modules/reaktor2.nix
@@ -69,6 +69,12 @@ with lib.slib or (import ../../lib/pure.nix { inherit lib; }); {
           Group = "reaktor2";
           DynamicUser = true;
           StateDirectory = cfg.username;
+          #ExecStartPre = [
+          #  (pkgs.writeDash "test-dynamic-user" ''
+          #    set -efux
+          #    ${pkgs.coreutils}/bin/id
+          #  '')
+          #];
           ExecStart = let
             configFile = pkgs.writers.writeJSON configFileName configValue;
             configFileName = "${cfg.systemd-service-name}.config.json";
diff --git a/krebs/3modules/setuid.nix b/krebs/3modules/setuid.nix
index ce41548ae..d13fcccaa 100644
--- a/krebs/3modules/setuid.nix
+++ b/krebs/3modules/setuid.nix
@@ -33,7 +33,7 @@ let
         };
         capabilities = mkOption {
           default = [];
-          type = types.listOf types.str;
+          type = types.listOf types.str; # TODO
         };
         owner = mkOption {
           default = "root";
@@ -52,6 +52,8 @@ let
             merge = mergeOneOption;
           };
         };
+        # TODO clear non-standard wrapperDirs
+        # TODO? allow only wrapperDirs below /run/wrappers?
         wrapperDir = mkOption {
           default = config.security.wrapperDir;
           type = types.absolute-pathname;
@@ -73,13 +75,16 @@ let
         chown ${cfg.owner}:${cfg.group} ${dst}
         chmod ${cfg.mode} ${dst}
         ${optionalString (cfg.capabilities != []) /* sh */ ''
+          set -x
           ${pkgs.libcap.out}/bin/setcap ${concatMapStringsSep "," shell.escape cfg.capabilities} ${dst}
+          set +x
         ''}
       '';
     }));
   };
 
   imp = {
+    # run after "wrappers" so config.security.wrapperDir can be hijacked.
     systemd.services."krebs.setuid" = {
       wantedBy = [ "suid-sgid-wrappers.service" ];
       after = [ "suid-sgid-wrappers.service" ];
diff --git a/krebs/3modules/ssh.nix b/krebs/3modules/ssh.nix
index aba825c29..012b365fb 100644
--- a/krebs/3modules/ssh.nix
+++ b/krebs/3modules/ssh.nix
@@ -62,24 +62,26 @@ let
               }
             ]));
 
-      programs.ssh.extraConfig = concatMapStrings
-        (net: ''
-          Host ${toString (net.aliases ++ net.addrs)}
-            Port ${toString net.ssh.port}
-        '')
-        (filter
-          (net: net.ssh.port != 22)
-          (concatMap (host: attrValues host.nets)
-            (mapAttrsToList
-              (_: host: recursiveUpdate host
-                (optionalAttrs (cfg.dns.search-domain != null &&
-                                hasAttr cfg.dns.search-domain host.nets) {
-                  nets."" = host.nets.${cfg.dns.search-domain} // {
-                    aliases = [host.name];
-                    addrs = [];
-                  };
-                }))
-              config.krebs.hosts)));
+      programs.ssh.extraConfig =
+        mkBefore/*<-KILLME*/
+          (concatMapStrings
+            (net: ''
+              Host ${toString (net.aliases ++ net.addrs)}
+                Port ${toString net.ssh.port}
+            '')
+            (filter
+              (net: net.ssh.port != 22)
+              (concatMap (host: attrValues host.nets)
+                (mapAttrsToList
+                  (_: host: recursiveUpdate host
+                    (optionalAttrs (cfg.dns.search-domain != null &&
+                                    hasAttr cfg.dns.search-domain host.nets) {
+                      nets."" = host.nets.${cfg.dns.search-domain} // {
+                        aliases = [host.name];
+                        addrs = [];
+                      };
+                    }))
+                  config.krebs.hosts))));
     }
   ];
 
diff --git a/krebs/3modules/tinc.nix b/krebs/3modules/tinc.nix
index 02b3eeb9d..65f4f6a2b 100644
--- a/krebs/3modules/tinc.nix
+++ b/krebs/3modules/tinc.nix
@@ -1,5 +1,6 @@
-{ config, pkgs, lib, ... }:
-with lib.slib or (import ../../lib/pure.nix { inherit lib; }); {
+{ config, pkgs, lib, ... }: let
+  slib = lib.slib or (import ../../lib/pure.nix { inherit lib; });
+in with slib; {
   options.krebs.tinc = mkOption {
     default = {};
     description = ''
@@ -235,13 +236,14 @@ with lib.slib or (import ../../lib/pure.nix { inherit lib; }); {
               "$CREDENTIALS_DIRECTORY"/rsa_key.priv \
               /etc/tinc/${netname}/
         '';
-        ExecStart = "+" + toString [
-          "${cfg.tincPackage}/sbin/tincd"
-          "-D"
-          "-U ${cfg.username}"
-          "-d 0"
-          "-n ${netname}"
-        ];
+        ExecStart = "+" + pkgs.writers.writeDash "tinc-${netname}" ''
+          set -efu
+          exec ${cfg.tincPackage}/sbin/tincd \
+              -D \
+              -U ${cfg.username} \
+              -d 0 \
+              -n ${netname}
+        '';
         SyslogIdentifier = netname;
         DynamicUser = true;
         User = cfg.username;
diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix
index 8d3bdfbe0..b2c264a06 100644
--- a/krebs/3modules/urlwatch.nix
+++ b/krebs/3modules/urlwatch.nix
@@ -214,6 +214,7 @@ let
       };
       filter = mkOption {
         default = null;
+        # TODO nullOr subtypes.filter
         type =
           with types;
           nullOr (either str (listOf (pkgs.formats.json {}).type));
diff --git a/krebs/3modules/zones.nix b/krebs/3modules/zones.nix
index 51e559d88..6ac2ebac2 100644
--- a/krebs/3modules/zones.nix
+++ b/krebs/3modules/zones.nix
@@ -10,7 +10,8 @@ with lib; {
     default = {
       "krebsco.de" = /* bindzone */ ''
         $TTL 60
-        @ 3600 IN SOA spam.krebsco.de. spam.krebsco.de. 0 7200 3600 86400 3600
+        @ IN SOA spam.krebsco.de. spam.krebsco.de. 0 7200 3600 86400 3600
+
         @ 3600 IN NS ns1
         @ 3600 IN NS ni
         @ 3600 IN NS ns2.he.net.
diff --git a/krebs/5pkgs/simple/TabFS/src.json b/krebs/5pkgs/simple/TabFS/src.json
index 24e36aef3..931c9ecb8 100644
--- a/krebs/5pkgs/simple/TabFS/src.json
+++ b/krebs/5pkgs/simple/TabFS/src.json
@@ -1,8 +1,6 @@
 {
   "url": "https://cgit.krebsco.de/TabFS",
   "rev": "a6045e0e29b85e3e66c468f3561009ded1db6ec5",
-  "date": "2021-01-14T23:56:09+01:00",
-  "path": "/nix/store/mbcywm1yq5vr7awxqb533faz34minfax-TabFS",
   "sha256": "1z0kj95zh0jl8laa0whra1jys8pws3199sy29vmlv2nxrkz13blv",
   "fetchSubmodules": false,
   "deepClone": false,
diff --git a/krebs/5pkgs/simple/airdcpp-webclient/default.nix b/krebs/5pkgs/simple/airdcpp-webclient/default.nix
index 754fecf9c..f4634b595 100644
--- a/krebs/5pkgs/simple/airdcpp-webclient/default.nix
+++ b/krebs/5pkgs/simple/airdcpp-webclient/default.nix
@@ -4,7 +4,7 @@
 stdenv.mkDerivation rec {
   name = "airdcpp-webclient-${version}";
   version = "2.3.0";
-  
+
   src = fetchurl {
     url = http://web-builds.airdcpp.net/stable/airdcpp_2.3.0_webui-2.3.0_64-bit_portable.tar.gz;
     sha256 = "0yvcl0nc70fghc7vfsgvbpryi5q97arld8adql4way4qa0mdnyv1";
diff --git a/krebs/5pkgs/simple/default.nix b/krebs/5pkgs/simple/default.nix
index a07e88c3b..e0b9ffdae 100644
--- a/krebs/5pkgs/simple/default.nix
+++ b/krebs/5pkgs/simple/default.nix
@@ -13,5 +13,15 @@ let
         lib.compareVersions upstream.name override.name != -1
     then lib.trace "Upstream `${upstream.name}' gets overridden by `${override.name}'." override
     else override;
+
+  ## This callPackage will try to detect obsolete overrides.
+  #callPackage = path: args: let
+  #  pname = (parseDrvName override.name).name;
+  #  override = self.callPackage path args;
+  #  upstream = super.${pname} or { name = ""; };
+  #in
+  #  override.overrideAttrs (old: {
+  #    name = warnOldVersion upstream.name old.name;
+  #  });
 in
   lib.mapNixDir (path: callPackage path {}) ./.
diff --git a/krebs/5pkgs/simple/font-size.nix b/krebs/5pkgs/simple/font-size.nix
index 21097ed6a..829325192 100644
--- a/krebs/5pkgs/simple/font-size.nix
+++ b/krebs/5pkgs/simple/font-size.nix
@@ -1,3 +1,4 @@
+# TODO kill me in favor of urxvt-resize-font
 { writeDashBin }:
 writeDashBin "font-size" ''
   set -efu
diff --git a/krebs/5pkgs/simple/git-hooks/default.nix b/krebs/5pkgs/simple/git-hooks/default.nix
index 51b4babfc..fe159c833 100644
--- a/krebs/5pkgs/simple/git-hooks/default.nix
+++ b/krebs/5pkgs/simple/git-hooks/default.nix
@@ -114,6 +114,7 @@ with stockholm.lib;
           git diff --stat $id2..$id \
             | sed '$!s/\(+*\)\(-*\)$/'$(green '\1')$(red '\2')'/'
         )"
+        echo "$(red "$message")"
       ''}
 
     done
diff --git a/krebs/5pkgs/simple/gitignore.nix b/krebs/5pkgs/simple/gitignore.nix
index b7a9f7eb5..50c8d6190 100644
--- a/krebs/5pkgs/simple/gitignore.nix
+++ b/krebs/5pkgs/simple/gitignore.nix
@@ -1,4 +1,4 @@
-{ pkgs, writeDash }:
+{ pkgs, writeDashBin }:
 
 /* gitignore - Filter for intentionally untracked lines or blocks of code
 
@@ -34,7 +34,7 @@ Installation:
   [2]: For more information about assigning filters see gitattributes(5).
 */
 
-writeDash "gitignore" ''
+writeDashBin "gitignore" ''
   exec ${pkgs.gnused}/bin/sed '
     /#gitignore-begin/,/#gitignore-end/d
     /#gitignore/d
diff --git a/krebs/5pkgs/simple/htgen-imgur/src/htgen-imgur b/krebs/5pkgs/simple/htgen-imgur/src/htgen-imgur
index 696d1c00d..bdfb3eb61 100644
--- a/krebs/5pkgs/simple/htgen-imgur/src/htgen-imgur
+++ b/krebs/5pkgs/simple/htgen-imgur/src/htgen-imgur
@@ -1,3 +1,4 @@
+# TODO dedup with paste
 find_item() {
   if test ${#1} -ge 7; then
     set -- "$(find "$STATEDIR/items" -mindepth 1 -maxdepth 1 \
@@ -58,6 +59,9 @@ read_uri() {
     $uri |
     capture("^((?<scheme>[^:]*):)?(//(?<authority>[^/]*))?(?<path>[^?#]*)([?](?<query>[^#]*))?([#](?<fragment>.*))?$") |
     . + {
+      #authority: (.authority | if . != null then
+      #  capture("^((?<userinfo>[^@]*)@)?(?<host>[^:]*)(:(?<port>.*))?$")
+      #else . end),
       query: (.query | if . != null then
         split("&") |
         map(split("=") | {key:.[0],value:.[1]}) |
@@ -141,26 +145,26 @@ case "$Method $path" in
           description: $uri.query.description,
           datetime: now,
           type: $info["MIME type"],
-          animated: false,
+          animated: false, # TODO
           width: $info.width,
           height: $info.height,
           size: $info.size,
-          views: 0,
-          bandwidth: 0,
-          vote: null,
-          favorite: false,
-          nsfw: null,
-          section: null,
-          account_url: null,
-          acount_id: 0,
-          is_ad: false,
-          is_most_viral: false,
-          tags: [],
-          ad_type: 0,
-          ad_url: "",
-          in_gallery: false,
+          views: 0, # TODO
+          bandwidth: 0, # TODO
+          vote: null, # TODO
+          favorite: false, # TODO
+          nsfw: null, # TODO
+          section: null, # TODO
+          account_url: null, # TODO
+          acount_id: 0, # TODO
+          is_ad: false, # TODO
+          is_most_viral: false, # TODO
+          tags: [], # TODO
+          ad_type: 0, # TODO
+          ad_url: "", # TODO
+          in_gallery: false, # TODO
           deletehash: @uri "\($id)?deletehash=\($deletehash)",
-          name: "",
+          name: "", # TODO
           link: $link,
         }
       ')
diff --git a/lib/default.nix b/lib/default.nix
deleted file mode 100644
index f9f2f1579..000000000
--- a/lib/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-import ./impure.nix
diff --git a/lib/eval-source.nix b/lib/eval-source.nix
index ff853185b..93320a218 100644
--- a/lib/eval-source.nix
+++ b/lib/eval-source.nix
@@ -1,4 +1,5 @@
-with import <stockholm/lib>;
+{ lib }:
+with lib;
 let
   eval = _file: source: evalModules {
     modules = singleton {
diff --git a/lib/impure.nix b/lib/impure.nix
deleted file mode 100644
index 3f95c375f..000000000
--- a/lib/impure.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-import ./pure.nix {
-  lib = import <nixpkgs/lib>;
-}
diff --git a/lib/pure.nix b/lib/pure.nix
index 3fe51cd54..6b5f229e6 100644
--- a/lib/pure.nix
+++ b/lib/pure.nix
@@ -9,7 +9,7 @@ let
       };
     in filterAttrsRecursive (name: _: !hasPrefix "_" name) eval.config;
 
-    evalSource = import ./eval-source.nix;
+    evalSource = import ./eval-source.nix { lib = stockholm.lib; };
 
     evalSubmodule = submodule: modules: let
       prefix = ["evalSubmodule"];
@@ -37,7 +37,7 @@ let
 
     eq = x: y: x == y;
     ne = x: y: x != y;
-    mod = x: y: x - y * (x / y);
+    #mod = x: y: x - y * (x / y);
 
     on = b: u: x: y: b (u x) (u y);
 
diff --git a/lib/types.nix b/lib/types.nix
index ad8421b18..f0165c523 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -1,5 +1,4 @@
 { lib, ... }:
-
 let
   inherit (lib)
     all any attrNames concatMapStringsSep concatStringsSep const filter flip
@@ -198,9 +197,32 @@ rec {
       };
       tinc = mkOption {
         type = let net = config; in nullOr (submodule ({ config, ... }: {
+          config = {
+            config = 
+              #assert (with builtins; trace "xxxxxx ${toJSON config.subnets}" true);
+              concatStringsSep "\n" (
+                (optionals (net.via != null)
+                  (map (a: "Address = ${a} ${toString config.port}") net.via.addrs))
+                ++
+                (map (a: "Subnet = ${a}") config.subnets)
+                ++
+                (map (a: "Subnet = ${a}") net.addrs)
+                ++
+                [config.extraConfig]
+                ++
+                [config.pubkey]
+                ++
+                optional (config.pubkey_ed25519 != null) ''
+                  Ed25519PublicKey = ${config.pubkey_ed25519}
+                ''
+                ++
+                optional (config.weight != null) "Weight = ${toString config.weight}"
+              );
+          };
           options = {
             config = mkOption {
               type = str;
+              # TODO: readOnly = true;
               default = concatStringsSep "\n" (
                 (optionals (net.via != null)
                   (map (a: "Address = ${a} ${toString config.port}") net.via.addrs))
-- 
cgit v1.2.3


From 24ae7ddd8f67bf9226391eaa365931f78c811b11 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 16 Jan 2026 23:04:53 +0100
Subject: repo-sync: GitPython -> gitpython

---
 krebs/5pkgs/simple/repo-sync/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/5pkgs/simple/repo-sync/default.nix b/krebs/5pkgs/simple/repo-sync/default.nix
index 5dc5ecb98..801e3b1ba 100644
--- a/krebs/5pkgs/simple/repo-sync/default.nix
+++ b/krebs/5pkgs/simple/repo-sync/default.nix
@@ -7,7 +7,7 @@ with python3Packages; buildPythonPackage rec {
   build-system = [ python3Packages.setuptools ];
   propagatedBuildInputs = [
     docopt
-    GitPython
+    gitpython
     pkgs.git
   ];
   src = fetchFromGitHub {
-- 
cgit v1.2.3


From 5a444a8213f8339f878fcdc4cd2e13541a882322 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 20 Jan 2026 16:11:14 +0100
Subject: htgen: use bash while dash is broken

Since dash a065467, dash's read is broken when used with tcpserver.

Example: when test.sh is `read test; echo test=$test`, then
`echo test | socat STDIN SYSTEM:'dash test.sh'` will output `test=`
instead of `test=test`.
---
 krebs/5pkgs/simple/htgen/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/5pkgs/simple/htgen/default.nix b/krebs/5pkgs/simple/htgen/default.nix
index 1ee13783b..c2c8ef50c 100644
--- a/krebs/5pkgs/simple/htgen/default.nix
+++ b/krebs/5pkgs/simple/htgen/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     {
-      echo '#! ${pkgs.dash}/bin/dash'
+      echo '#! ${pkgs.bash}/bin/bash'
       echo 'export PATH=${lib.makeBinPath [
         pkgs.coreutils
         pkgs.jq
-- 
cgit v1.2.3


From 20d5f58986c6f33161453ef35e6db3504cf17d08 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 20 Jan 2026 20:47:09 +0100
Subject: sync-containers3: migrate resolved.extraConfig to settings

The extraConfig option has been removed from NixOS.
---
 krebs/3modules/sync-containers3.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/krebs/3modules/sync-containers3.nix b/krebs/3modules/sync-containers3.nix
index 872f04db2..cbffeb6f3 100644
--- a/krebs/3modules/sync-containers3.nix
+++ b/krebs/3modules/sync-containers3.nix
@@ -358,9 +358,7 @@ in {
       networking.useNetworkd = true;
       services.resolved = {
         enable = true;
-        extraConfig = ''
-          Domains=~.
-        '';
+        settings.Resolve.Domains = [ "~." ];
       };
       systemd.network = {
         enable = true;
-- 
cgit v1.2.3


From f9253df83653caf3dca5298b1ba3ded0e34cc2e8 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 01:46:46 +0100
Subject: htgen: bash -> busybox sh

---
 krebs/5pkgs/simple/htgen/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/5pkgs/simple/htgen/default.nix b/krebs/5pkgs/simple/htgen/default.nix
index c2c8ef50c..945801bfe 100644
--- a/krebs/5pkgs/simple/htgen/default.nix
+++ b/krebs/5pkgs/simple/htgen/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     {
-      echo '#! ${pkgs.bash}/bin/bash'
+      echo '#! ${pkgs.busybox}/bin/sh'
       echo 'export PATH=${lib.makeBinPath [
         pkgs.coreutils
         pkgs.jq
-- 
cgit v1.2.3


From 14ef3e7438fdf7fc32b333eb30ac31f9cb4774e4 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:24:28 +0100
Subject: dic: emigrate

---
 krebs/5pkgs/simple/dic/default.nix | 39 --------------------------------------
 1 file changed, 39 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/dic/default.nix

diff --git a/krebs/5pkgs/simple/dic/default.nix b/krebs/5pkgs/simple/dic/default.nix
deleted file mode 100644
index 39402c012..000000000
--- a/krebs/5pkgs/simple/dic/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ fetchgit, lib, stdenv
-, coreutils, curl, gnugrep, gnused, util-linux
-}:
-
-stdenv.mkDerivation {
-  name = "dic";
-
-  src = fetchgit {
-    url = https://cgit.ni.krebsco.de/dic;
-    rev = "refs/tags/v1.1.1";
-    sha256 = "1gbj967a5hj53fdkkxijqgwnl9hb8kskz0cmpjq7v65ffz3v6vag";
-  };
-
-  phases = [
-    "unpackPhase"
-    "installPhase"
-  ];
-
-  installPhase =
-    let
-      path = lib.makeBinPath [
-        coreutils
-        curl
-        gnused
-        gnugrep
-        util-linux
-      ];
-    in
-    ''
-      mkdir -p $out/bin
-
-      sed \
-        's,^main() {$,&\n  PATH=${path}; export PATH,' \
-        < ./dic \
-        > $out/bin/dic
-
-      chmod +x $out/bin/dic
-    '';
-}
-- 
cgit v1.2.3


From ca00f942c97354468896bf9183ce622046c12236 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:32:03 +0100
Subject: with-tmpdir: emigrate

---
 krebs/5pkgs/simple/with-tmpdir/default.nix | 29 -----------------------------
 1 file changed, 29 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/with-tmpdir/default.nix

diff --git a/krebs/5pkgs/simple/with-tmpdir/default.nix b/krebs/5pkgs/simple/with-tmpdir/default.nix
deleted file mode 100644
index 9862671f8..000000000
--- a/krebs/5pkgs/simple/with-tmpdir/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ stdenv, fetchgit, coreutils, dash, ... }:
-
-stdenv.mkDerivation {
-  name = "with-tmpdir-1";
-
-  src = fetchgit {
-    url = http://cgit.ni.krebsco.de/with-tmpdir;
-    rev = "3243c02ed8cd27a04c080bd39560204980f6c16a";
-    sha256 = "80ee6cafb2c337999ddcd1e41747d6256b7cfcea605358c2046eb7e3729555c6";
-  };
-
-  phases = [
-    "unpackPhase"
-    "installPhase"
-  ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-
-    { echo '#! ${dash}/bin/dash'
-      echo 'OLDPATH=$PATH'
-      echo 'PATH=${coreutils}/bin'
-      sed '$s/^/#/' ./with-tmpdir
-      echo '(PATH=$OLDPATH; exec "$@")'
-    } > $out/bin/with-tmpdir
-
-    chmod +x $out/bin/with-tmpdir
-  '';
-}
-- 
cgit v1.2.3


From e8790c7eafb532cc720c30235a94590deca935db Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:41:25 +0100
Subject: K_belwagen: emigrate

---
 krebs/5pkgs/simple/K_belwagen.nix | 38 --------------------------------------
 1 file changed, 38 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/K_belwagen.nix

diff --git a/krebs/5pkgs/simple/K_belwagen.nix b/krebs/5pkgs/simple/K_belwagen.nix
deleted file mode 100644
index 2f64bb09d..000000000
--- a/krebs/5pkgs/simple/K_belwagen.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, pkgs, stdenv }:
-
-stdenv.mkDerivation {
-  pname = "K_belwagen";
-  version = "1.0";
-
-  src = pkgs.painload;
-  sourceRoot = "source/K_belwagen";
-
-  buildInputs = [
-    pkgs.jack1
-    pkgs.pkg-config
-  ];
-
-  patchPhase = ''
-    sed -i '
-      s@^cd@# &@
-      s@^make@# &@
-      s@^jackd@# &@
-      s@^trap@# &@
-
-      s@^set.*@&\nPATH=${lib.makeBinPath [
-        pkgs.bc
-        pkgs.coreutils
-      ]}; export PATH@
-
-      s@\./a\.out@'"$out"'/lib/a.out@
-    ' alarm
-  '';
-
-  installPhase = ''
-    mkdir -p $out/lib
-    mkdir -p $out/bin
-
-    cp alarm $out/bin
-    cp a.out $out/lib
-  '';
-}
-- 
cgit v1.2.3


From 688cda3018b8371438fac7ba445d81ece6f0bcd0 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:41:48 +0100
Subject: certaids: emigrate

---
 krebs/5pkgs/simple/certaids.nix | 114 ----------------------------------------
 1 file changed, 114 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/certaids.nix

diff --git a/krebs/5pkgs/simple/certaids.nix b/krebs/5pkgs/simple/certaids.nix
deleted file mode 100644
index 094868680..000000000
--- a/krebs/5pkgs/simple/certaids.nix
+++ /dev/null
@@ -1,114 +0,0 @@
-{ pkgs }:
-
-let
-  cert2json = pkgs.writeDash "cert2json" ''
-    # usage: cert2json < CERT > JSON
-    set -efu
-
-    ${pkgs.openssl}/bin/openssl crl2pkcs7 -nocrl -certfile /dev/stdin |
-    ${pkgs.openssl}/bin/openssl pkcs7 -print_certs -text |
-    ${pkgs.gawk}/bin/awk -F, -f ${pkgs.writeText "cert2json.awk" ''
-      function abort(msg) {
-        print(msg) > "/dev/stderr"
-        exit 1
-      }
-
-      function toJSON(x,   type, ret) {
-        type = typeof(x)
-        switch (type) {
-          case "array":
-            if (isArray(x)) return arrayToJSON(x)
-            if (isObject(x)) return objectToJSON(x)
-            abort("cannot render array to JSON", x)
-          case "number":
-            return numberToJSON(x)
-          case "string":
-            return stringToJSON(x)
-          case "strnum":
-          case "unassigned":
-          case "regexp":
-          case "untyped":
-          default:
-            abort("cannot render type: " type)
-        }
-      }
-
-      function isArray(x,   i, k) {
-        i = 1
-        for (k in x) {
-          if (k != i++) return 0
-          i++
-        }
-        return 1
-      }
-
-      function isObject(x,   k) {
-        for (k in x) {
-          if (typeof(k) != "string") return 0
-        }
-        return 1
-      }
-
-      function arrayToJSON(x,   k, ret) {
-        ret = "["
-        for (k in x) {
-          ret=ret toJSON(x[k]) ","
-        }
-        sub(/,$/,"",ret)
-        ret=ret "]"
-        return ret
-      }
-
-      function objectToJSON(x,   k,ret) {
-        ret = "{"
-        for (k in x) {
-          ret = ret toJSON(k) ":" toJSON(x[k]) ","
-        }
-        sub(/,$/, "", ret)
-        ret = ret "}"
-        return ret
-      }
-
-      function numberToJSON(x) {
-        return x
-      }
-
-      function stringToJSON(x) {
-        gsub(/\\/, "&&",x)
-        gsub(/\n/, "\\n", x)
-        return "\"" x "\""
-      }
-
-      $1 ~ /^ *(Subject|Issuer):/ {
-        sub(/^ */, "")
-        sub(/: */, ",")
-        key=tolower($1)
-        sub(/[^,]*,/, "")
-
-        # Normalize separators between relative distinguished names.
-        # [1]: RFC2253, 3. Parsing a String back to a Distinguished Name
-        # TODO support any distinguished name
-        gsub(/ *[;,] */, ",")
-
-        for(i = 0; i <= NF; i++) {
-          split($i, a, "=")
-          cache[key][a[1]] = a[2]
-        }
-      }
-
-      /BEGIN CERTIFICATE/,/END CERTIFICATE/{
-        cache["certificate"] = cache["certificate"] $0 "\n"
-      }
-
-      /END CERTIFICATE/{
-        print toJSON(cache)
-        delete cache
-      }
-    ''}
-  '';
-in
-
-pkgs.runCommand "certaids" {} ''
-  mkdir -p $out/bin
-  ln -s ${cert2json} $out/bin/cert2json
-''
-- 
cgit v1.2.3


From 04a4f4edb1a69a51e6de98a5eadc1f4c6754fe91 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:42:16 +0100
Subject: eximlog: emigrate

---
 krebs/5pkgs/simple/eximlog.nix | 28 ----------------------------
 1 file changed, 28 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/eximlog.nix

diff --git a/krebs/5pkgs/simple/eximlog.nix b/krebs/5pkgs/simple/eximlog.nix
deleted file mode 100644
index 4abbcfc5a..000000000
--- a/krebs/5pkgs/simple/eximlog.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ jq, lib, systemd, writeDashBin }:
-
-let
-  stockholm.lib = import ../../../lib/pure.nix { inherit lib; };
-  user = "exim"; # TODO make this configurable
-in
-
-# TODO execute eximlog only if journalctl doesn't fail
-# bash's set -o pipefail isn't enough
-
-writeDashBin "eximlog" ''
-  ${systemd}/bin/journalctl \
-      -u ${stockholm.lib.shell.escape user} \
-      -o short-unix \
-      "$@" \
-    |
-  ${jq}/bin/jq -Rr '
-    # Only select lines that start with a timestamp
-    select(test("^[0-9]")) |
-
-    split(" ") |
-    (.[0] | tonumber) as $time |
-    (.[3:] | join(" ")) as $message |
-
-    "\($time | strftime("%Y-%m-%d %H:%M:%S %z")) \($message)"
-
-  '
-''
-- 
cgit v1.2.3


From bb7a74fd14742580cea4bc5241880ac41c569efe Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:42:37 +0100
Subject: gitignore: emigrate

---
 krebs/5pkgs/simple/gitignore.nix | 42 ----------------------------------------
 1 file changed, 42 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/gitignore.nix

diff --git a/krebs/5pkgs/simple/gitignore.nix b/krebs/5pkgs/simple/gitignore.nix
deleted file mode 100644
index 50c8d6190..000000000
--- a/krebs/5pkgs/simple/gitignore.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ pkgs, writeDashBin }:
-
-/* gitignore - Filter for intentionally untracked lines or blocks of code
-
-This is a filter that allows specifying intentionally untracked lines and
-blocks of code that Git should ignore.
-
-Example:
-
-  int main(void) {
-    printf("I would never say derp.\n");
-    //#gitignore-begin
-    printf("DERP!\n");
-    //#gitignore-end
-    printf("DERP!\n"); //#gitignore
-    return 0;
-  }
-
-Installation:
-
-  Define a filter, e.g. in ~/.config/git/config[1]:
-
-      [filter "gitignore"]
-        clean = gitignore
-        smudge = cat
-
-  Assing that filter to some paths, e.g. in ~/.config/git/attributes[2]:
-
-      *.hs filter=gitignore
-      *.c filter=gitignore
-      ...
-
-  [1]: For more information about defining filters see git-config(1).
-  [2]: For more information about assigning filters see gitattributes(5).
-*/
-
-writeDashBin "gitignore" ''
-  exec ${pkgs.gnused}/bin/sed '
-    /#gitignore-begin/,/#gitignore-end/d
-    /#gitignore/d
-  '
-''
-- 
cgit v1.2.3


From 98f69a2c58e97fa8a02b6e0891f293179c57bbba Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:44:03 +0100
Subject: hashPassword: emigrate

---
 krebs/5pkgs/simple/hashPassword/default.nix | 15 ---------------
 1 file changed, 15 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/hashPassword/default.nix

diff --git a/krebs/5pkgs/simple/hashPassword/default.nix b/krebs/5pkgs/simple/hashPassword/default.nix
deleted file mode 100644
index 8d3ba2525..000000000
--- a/krebs/5pkgs/simple/hashPassword/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ lib, pkgs, ... }:
-
-pkgs.writers.writeDashBin "hashPassword" ''
-  # usage: hashPassword [...]
-  set -euf
-
-  export PATH=${lib.makeBinPath (with pkgs; [
-    coreutils
-    mkpasswd
-    openssl
-  ])}
-
-  salt=$(openssl rand -base64 16 | tr -d '+=' | head -c 16)
-  exec mkpasswd -m sha-512 -S "$salt" "$@"
-''
-- 
cgit v1.2.3


From 4cc3f2c8b9d858bdef00e1fab97f47db62e21550 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:44:32 +0100
Subject: logf: emigrate

---
 krebs/5pkgs/simple/logf/default.nix | 112 ------------------------------------
 1 file changed, 112 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/logf/default.nix

diff --git a/krebs/5pkgs/simple/logf/default.nix b/krebs/5pkgs/simple/logf/default.nix
deleted file mode 100644
index 3a4c84de2..000000000
--- a/krebs/5pkgs/simple/logf/default.nix
+++ /dev/null
@@ -1,112 +0,0 @@
-{ lib, pkgs, writeDash, writeDashBin, writeJSON, writeJq, ... }:
-
-let
-  default-host-colors = writeJSON "logf.default-host-colors.json" {
-  };
-  default-prio-colors = writeJSON "logf.default-prio-colors.json" {
-    "0" = 196; # emerg
-    "1" = 160; # alert
-    "2" = 124; # crit
-    "3" = 009; # err
-    "4" = 011; # warning
-    "5" = 255; # notice
-    "6" = 250; # info
-    "7" = 139; # debug
-    "-" = 005; # undefined priority
-  };
-  default-urgent = writeJSON "logf.default-urgent.json" [
-  ];
-in
-
-writeDashBin "logf" ''
-  export LOGF_HOST_COLORS LOGF_PRIO_COLORS LOGF_URGENT
-  LOGF_HOST_COLORS=$(cat "''${LOGF_HOST_COLORS-${default-host-colors}}")
-  LOGF_PRIO_COLORS=$(cat "''${LOGF_PRIO_COLORS-${default-prio-colors}}")
-  LOGF_URGENT=$(cat "''${LOGF_URGENT-${default-urgent}}")
-  printf '%s\0' "$@" \
-    | ${pkgs.findutils}/bin/xargs -0 -P 0 -n 1 ${writeDash "logf-remote" ''
-        target=$1
-        target_host=$(echo "$1" | sed 's/^.*@//;s/\..*//')
-        exec 3>&1
-        2>&1 1>&3 ssh "$target" -T \
-            -o PreferredAuthentications=publickey \
-            -o StrictHostKeyChecking=yes \
-            exec journalctl -af -n 0 -o json \
-          | stdbuf -oL jq -Rcf ${writeJq "logf-remote-error.jq" ''
-              {
-                PRIORITY: "4",
-                MESSAGE: .,
-                SYSLOG_IDENTIFIER: env.target_host,
-              }
-            ''}
-        sleep 10m
-        exec "$0" "$@"
-      ''} \
-    | ${pkgs.jq}/bin/jq -Rrf ${writeJq "logf-filter.jq" ''
-        (env.LOGF_HOST_COLORS | fromjson) as $host_colors |
-        (env.LOGF_PRIO_COLORS | fromjson) as $prio_colors |
-        (env.LOGF_URGENT | fromjson | map("(\(.))") | join("|"))
-          as $urgent_regex |
-
-        def when(c; f): if c then f else . end;
-
-        # anaphoric gsub
-        def agsub(re; f):
-          # Don't try empty regex: https://github.com/stedolan/jq/issues/1206
-          when(re != ""; gsub("(?<it>\(re))"; .it | f));
-
-        # :: [int] -> sgr
-        def sgr: "\u001b[\(map(tostring) | join(";"))m";
-
-        # :: sgr
-        def rst: [] | sgr;
-
-        # :: int -> sgr
-        def fg(i): [38,5,i]|sgr;
-        # TODO def fg(r;g;b): [38,2,r,g,b]|sgr;
-        # http://cvs.schmorp.de/rxvt-unicode/src/command.C?revision=1.570&view=markup&sortby=log&sortdir=down
-
-        # (sgr; sgr) | (null; any) :: str -> str
-        def col(a; b): when(a != null; a + . + b);
-        def col(a): col(a; rst);
-
-
-        def p_time:
-          ._SOURCE_REALTIME_TIMESTAMP
-          | if . != null then . | fromjson | . / 1000000 else now end
-          | gmtime
-          | todateiso8601
-          | col(fg(237));
-
-        def p_host:
-          ._HOSTNAME
-          | if . != null then . else "-" end
-          | col($host_colors[.]|when(. != null; fg(.)));
-
-        def p_ident:
-          if .SYSLOG_IDENTIFIER != null then .SYSLOG_IDENTIFIER
-          else ._COMM end
-          | col(fg(244));
-
-        def p_message:
-          fg($prio_colors[if has("PRIORITY") then .PRIORITY else "-" end])
-            as $prio_c |
-          .MESSAGE
-          | sub("\r$"; "")
-          | agsub($urgent_regex; "\(.)\u0007" | col(fg(219); $prio_c))
-          | col($prio_c);
-
-        try fromjson catch {
-          _SOURCE_REALTIME_TIMESTAMP: now | tostring | sub("[.]"; ""),
-          SYSLOG_IDENTIFIER: "logf/journalctl",
-          MESSAGE: .,
-        } |
-
-        [ p_time
-        , p_host
-        , p_ident
-        , p_message
-        ]
-        | join(" ")
-      ''}
-''
-- 
cgit v1.2.3


From 96edfacf69007c775d257331c931ff21ac981210 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:44:58 +0100
Subject: netcup: emigrate

---
 krebs/5pkgs/simple/netcup/default.nix | 33 ---------------------------------
 1 file changed, 33 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/netcup/default.nix

diff --git a/krebs/5pkgs/simple/netcup/default.nix b/krebs/5pkgs/simple/netcup/default.nix
deleted file mode 100644
index 750e9cfa9..000000000
--- a/krebs/5pkgs/simple/netcup/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ coreutils, curl, fetchgit, gawk, gnugrep, gnused, jq, stdenv, stockholm, w3m, ... }:
-with stockholm.lib;
-
-let
-  readJSON = path: fromJSON (readFile path);
-  sed.escape = replaceStrings ["/"] ["\\/"]; # close enough
-  PATH = makeBinPath [
-    coreutils
-    curl
-    gawk
-    gnugrep
-    gnused
-    jq
-    w3m
-  ];
-in
-stdenv.mkDerivation {
-  name = "netcup-1.0.0";
-  src = fetchgit {
-    url = "http://cgit.ni.krebsco.de/netcup";
-    rev = "refs/tags/v1.0.0";
-    sha256 = "1rn7bncfhjw0bqjbvj38m7lks4nyf5qcvkj9dg0zr99ba6dylzx5";
-  };
-  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
-  patchPhase = ''
-    path=${shell.escape (sed.escape PATH)}
-    sed -i "1s/.*/&\nPATH=$path/" vcp
-  '';
-  installPhase = ''
-    mkdir -p $out/bin
-    cp vcp $out/bin
-  '';
-}
-- 
cgit v1.2.3


From 2c4091f0e64df51d2d9db4976cf9b46bc1090d38 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 04:45:20 +0100
Subject: nixos-format-error: emigrate

---
 krebs/5pkgs/simple/nixos-format-error.nix | 107 ------------------------------
 1 file changed, 107 deletions(-)
 delete mode 100644 krebs/5pkgs/simple/nixos-format-error.nix

diff --git a/krebs/5pkgs/simple/nixos-format-error.nix b/krebs/5pkgs/simple/nixos-format-error.nix
deleted file mode 100644
index aa1c57926..000000000
--- a/krebs/5pkgs/simple/nixos-format-error.nix
+++ /dev/null
@@ -1,107 +0,0 @@
-{ writeGawkBin, ... }:
-
-writeGawkBin "nixos-format-error" ''
-  # usage: nixos-rebuild ... 2>&1 | nixos-format-error
-
-  function out() {
-    print
-    next
-  }
-
-  BEGIN {
-    IDLE = 0
-    ACTIVE = 1
-    PASSIVE = 2
-    ERROR = 3
-
-    start_state = IDLE
-
-    state = start_state
-  }
-
-  END {
-    if (trace_count)
-      for (i = trace_count - 1; i >= 0; i--)
-        print trace[i]
-  }
-
-  state == PASSIVE {
-    out()
-  }
-
-  state == IDLE {
-    if ($0 ~ /^building the system configuration\.\.\.
?$/) {
-      state = ACTIVE
-    }
-    out()
-  }
-
-  state == ACTIVE {
-    if ($1 ~ /(\[[0-9;]+m)?error:(\[[0-9;]m)?/) {
-      state = ERROR
-      sub(/^/,"\x1b[31;1m"); sub(/$/,"\x1b[m")
-      trace[trace_count++] = $0
-
-      "stty -F /dev/tty size" |& getline
-      COLUMNS = gensub(/.* ([0-9]+)$/, "\\1", "1")
-
-      next
-    }
-    if ($0 ~ /^these [0-9]+ derivations will be built:/) {
-      state = PASSIVE
-    }
-    if ($0 == "activating the configuration...") {
-      state = PASSIVE
-    }
-    out()
-  }
-
-  state == ERROR {
-    sub(/
$/, "")
-    gsub(/\[[0-9;]*m/, "")
-
-    if ($0 ~ /^\s*at /) {
-      location = gensub(/^\s*at (.*):$/,"\\1","1")
-      content = ""
-      lnumcol = gensub(/^.*:([0-9]+:[0-9]+)$/,"\\1","1",location)
-      lnum = gensub(/:.*/,"","1",lnumcol)
-      col = gensub(/.*:/,"","1",lnumcol)
-      next
-    }
-
-    if ($1 == lnum "|") {
-      content = gensub(/^\s*[0-9]+\|(.*)/,"\\1","1")
-
-      location = sprintf("%50s", location)
-
-      preview_size = COLUMNS - length(location " ")
-
-      prefix = gensub(/^\s*/,"","1",substr(content, 1, col))
-      infix = gensub(/^([0-9a-zA-Z]+|.).*$/, "\\1", "1", substr(content, col + 1))
-      suffix = substr(content, col + length(infix) + 1)
-
-      if (length(prefix infix suffix) > preview_size) {
-        n = (preview_size - length(infix)) / 2 - length(" ")
-        prefix = substr(prefix, length(prefix) - n + 1)
-        if (prefix != "") { prefix = "…" prefix }
-        suffix = substr(suffix, 1, n)
-        if (suffix != "") { suffix = suffix "…" }
-      }
-
-      preview = \
-        "\x1b[38;5;244m" prefix "\x1b[m" \
-        "\x1b[38;5;230m" infix "\x1b[m" \
-        "\x1b[38;5;244m" suffix "\x1b[m"
-
-      trace[trace_count++] = location " " preview
-      next
-    }
-
-    if ($0 == "") next
-    if ($0 ~ /^\s*… (from|while)/) next
-    if ($0 ~ /^\s*([0-9]*)\|/) next
-
-    trace[trace_count++] = $0
-    next
-  }
-''
-- 
cgit v1.2.3


From e8fa783b7f335be8dca8b507454dce5fec7ed033 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 21:32:26 +0100
Subject: flake.lock: update

---
 flake.lock | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/flake.lock b/flake.lock
index b11c289b4..09187d83b 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1760516981,
-        "narHash": "sha256-4AYTAH7WDL6C6WKktc9UEQRiav6oPzVpKuFWRyYeuTQ=",
+        "lastModified": 1768927382,
+        "narHash": "sha256-qdmb8Pm73PADLgO8Q06QfyPbEQS6el9Si+dGQc3TB1I=",
         "owner": "Mic92",
         "repo": "buildbot-nix",
-        "rev": "01dfc9a07c070092e3187be8edbd2243a9e301a5",
+        "rev": "eb4e904a8dc1aa12a964752e4fd9977c6aead724",
         "type": "github"
       },
       "original": {
@@ -31,11 +31,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1756770412,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "lastModified": 1768135262,
+        "narHash": "sha256-PVvu7OqHBGWN16zSi6tEmPwwHQ4rLPU9Plvs8/1TUBY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "80daad04eddbbf5a4d883996a73f3f542fa437ac",
         "type": "github"
       },
       "original": {
@@ -71,11 +71,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758022363,
-        "narHash": "sha256-ENUhCRWgSX4ni751HieNuQoq06dJvApV/Nm89kh+/A0=",
+        "lastModified": 1768476106,
+        "narHash": "sha256-V0YOJRum50gtKgwavsAfwXc9+XAsJCC7386YZx1sWGQ=",
         "owner": "hercules-ci",
         "repo": "hercules-ci-effects",
-        "rev": "1a3667d33e247ad35ca250698d63f49a5453d824",
+        "rev": "c19e263e6e22ec7379d972f19e6a322f943c73fb",
         "type": "github"
       },
       "original": {
@@ -120,11 +120,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1760878510,
-        "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
+        "lastModified": 1768886240,
+        "narHash": "sha256-C2TjvwYZ2VDxYWeqvvJ5XPPp6U7H66zeJlRaErJKoEM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e2a59a5b1a82f89f2c7e598302a9cacebb72a67",
+        "rev": "80e4adbcf8992d3fd27ad4964fbb84907f9478b0",
         "type": "github"
       },
       "original": {
@@ -149,11 +149,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1758728421,
-        "narHash": "sha256-ySNJ008muQAds2JemiyrWYbwbG+V7S5wg3ZVKGHSFu8=",
+        "lastModified": 1768158989,
+        "narHash": "sha256-67vyT1+xClLldnumAzCTBvU0jLZ1YBcf4vANRWP3+Ak=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "5eda4ee8121f97b218f7cc73f5172098d458f1d1",
+        "rev": "e96d59dff5c0d7fddb9d113ba108f03c3ef99eca",
         "type": "github"
       },
       "original": {
-- 
cgit v1.2.3


From abadd969966d5fe951731a5c8086885d44bac045 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 21:36:17 +0100
Subject: flake: set nix-writer.inputs.nixpkgs.follows

---
 flake.lock | 21 ++++-----------------
 flake.nix  |  1 +
 2 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/flake.lock b/flake.lock
index 09187d83b..c7b051683 100644
--- a/flake.lock
+++ b/flake.lock
@@ -87,7 +87,9 @@
     "nix-writers": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1677612737,
@@ -104,21 +106,6 @@
       }
     },
     "nixpkgs": {
-      "locked": {
-        "lastModified": 1677608380,
-        "narHash": "sha256-k82O23qBAK+43X0KSBjsMYXG2x4kWWXeAmpPTc2KRGY=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "4aba90e89f6d4ac6138939961f62842bd94ec929",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
       "locked": {
         "lastModified": 1768886240,
         "narHash": "sha256-C2TjvwYZ2VDxYWeqvvJ5XPPp6U7H66zeJlRaErJKoEM=",
@@ -138,7 +125,7 @@
       "inputs": {
         "buildbot-nix": "buildbot-nix",
         "nix-writers": "nix-writers",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs"
       }
     },
     "treefmt-nix": {
diff --git a/flake.nix b/flake.nix
index c3a218dcf..527e4c8ef 100644
--- a/flake.nix
+++ b/flake.nix
@@ -2,6 +2,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nix-writers.url = "git+https://cgit.krebsco.de/nix-writers";
+    nix-writers.inputs.nixpkgs.follows = "nixpkgs";
     # disko.url = "github:nix-community/disko";
     # disko.inputs.nixpkgs.follows = "nixpkgs";
     buildbot-nix.url = "github:Mic92/buildbot-nix";
-- 
cgit v1.2.3


From 9f8e108072cf80f53a37659955107f5ae76de8ca Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 21:44:48 +0100
Subject: reaktor2: taskwarrior -> taskwarrior2

---
 krebs/2configs/reaktor2.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/krebs/2configs/reaktor2.nix b/krebs/2configs/reaktor2.nix
index e7d348d50..600f7cd6d 100644
--- a/krebs/2configs/reaktor2.nix
+++ b/krebs/2configs/reaktor2.nix
@@ -235,20 +235,20 @@ let
     env.TASKDATA = "${stateDir}/${name}";
     commands = rec {
       add.filename = pkgs.writers.writeDash "${name}-task-add" ''
-        ${pkgs.taskwarrior}/bin/task rc:${taskRcFile} add "$1"
+        ${pkgs.taskwarrior2}/bin/task rc:${taskRcFile} add "$1"
       '';
       list.filename = pkgs.writers.writeDash "${name}-task-list" ''
-        ${pkgs.taskwarrior}/bin/task rc:${taskRcFile} export \
+        ${pkgs.taskwarrior2}/bin/task rc:${taskRcFile} export \
           | ${pkgs.jq}/bin/jq -r '
               .[] | select(.id != 0) | "\(.id) \(.description)"
             '
       '';
       delete.filename = pkgs.writers.writeDash "${name}-task-delete" ''
-        ${pkgs.taskwarrior}/bin/task rc:${taskRcFile} delete "$1"
+        ${pkgs.taskwarrior2}/bin/task rc:${taskRcFile} delete "$1"
       '';
       del = delete;
       done.filename = pkgs.writers.writeDash "${name}-task-done" ''
-        ${pkgs.taskwarrior}/bin/task rc:${taskRcFile} done "$1"
+        ${pkgs.taskwarrior2}/bin/task rc:${taskRcFile} done "$1"
       '';
     };
   };
@@ -456,7 +456,7 @@ in {
           printf 'HTTP/1.1 200 OK\r\n'
           printf 'Connection: close\r\n'
           printf '\r\n'
-          TASKDATA=/var/lib/reaktor2/agenda ${pkgs.taskwarrior}/bin/task rc:${taskRcFile} export
+          TASKDATA=/var/lib/reaktor2/agenda ${pkgs.taskwarrior2}/bin/task rc:${taskRcFile} export
           exit
         ;;
       esac
-- 
cgit v1.2.3


From 904a6641bd2fee9400f38f801fa21fa4305479f8 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 21:50:54 +0100
Subject: repo-sync: fix path to konsens ssh key

---
 krebs/2configs/repo-sync.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix
index a488fdfea..126048625 100644
--- a/krebs/2configs/repo-sync.nix
+++ b/krebs/2configs/repo-sync.nix
@@ -98,7 +98,7 @@ in {
   krebs.secret.files.konsens = {
     path = "/var/lib/konsens/.ssh/id_ed25519";
     owner = konsens-user;
-    source-path = "${config.krebs.secret.directory}/konsens.id_ed25519>";
+    source-path = "${config.krebs.secret.directory}/konsens.id_ed25519";
   };
 
   imports = [
-- 
cgit v1.2.3


From 99e91b56e30e7e747a7dfeed6c508f7c0e0b0f5a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 21:52:27 +0100
Subject: secrets: fix non-absolute source-path

---
 krebs/3modules/secret.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/3modules/secret.nix b/krebs/3modules/secret.nix
index 13c4ecaec..ad9ceccbe 100644
--- a/krebs/3modules/secret.nix
+++ b/krebs/3modules/secret.nix
@@ -15,7 +15,7 @@ in {
           secret-file
         else
           secret-file // {
-            source-path = "${config.krebs.secret.directory}/secret-file.source-path";
+            source-path = "${config.krebs.secret.directory}/${secret-file.source-path}";
           }
       );
     };
-- 
cgit v1.2.3


From 197bf404014b3bf33932ef8b7941ae0e26ea52a3 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:09:11 +0100
Subject: hotdog: cherry-pick nginx recommendedTlsSettings

---
 krebs/1systems/hotdog/config.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index 91071ec85..655192077 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -5,6 +5,17 @@
     ../../../krebs
     ../../../krebs/2configs
     ../../../krebs/2configs/nginx.nix
+    {
+      # Cherry-pick services.nginx.recommendedTlsSettings to fix:
+      # nginx: [emerg] "ssl_conf_command" directive is not supported on this platform
+      services.nginx.recommendedTlsSettings = lib.mkForce false;
+      services.nginx.appendHttpConfig = ''
+        ssl_session_timeout 1d;
+        ssl_session_cache shared:SSL:10m;
+        ssl_session_tickets off;
+        ssl_prefer_server_ciphers off;
+      '';
+    }
 
     ../../../krebs/2configs/binary-cache/nixos.nix
     ../../../krebs/2configs/ircd.nix
-- 
cgit v1.2.3


From 1508097670d1b128452692a4b787a576f40fb4f1 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:13:44 +0100
Subject: ci: pollinterval -> pollInterval

---
 krebs/3modules/ci/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/3modules/ci/default.nix b/krebs/3modules/ci/default.nix
index 1f029276a..18fe46a98 100644
--- a/krebs/3modules/ci/default.nix
+++ b/krebs/3modules/ci/default.nix
@@ -50,7 +50,7 @@ let
               "${url}",
               workdir='${name}-${elemAt(splitString "." url) 1}', branches=True,
               project='${name}',
-              pollinterval=30
+              pollInterval=30
           )
         '') repo.urls
       ) cfg.repos;
-- 
cgit v1.2.3


From 345259d513c642ee4191ce93c51f2cf51a70b406 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:15:12 +0100
Subject: buildbot-stockholm: RIP cgit.gum.r

---
 krebs/2configs/buildbot-stockholm.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/krebs/2configs/buildbot-stockholm.nix b/krebs/2configs/buildbot-stockholm.nix
index 32452e010..c51d3c651 100644
--- a/krebs/2configs/buildbot-stockholm.nix
+++ b/krebs/2configs/buildbot-stockholm.nix
@@ -19,7 +19,6 @@ with import ../../lib/pure.nix { inherit lib; };
     enable = true;
     repos = {
       disko.urls = [
-        "http://cgit.gum.r/disko"
         "http://cgit.ni.r/disko"
         "http://cgit.orange.r/disko"
       ];
@@ -33,7 +32,6 @@ with import ../../lib/pure.nix { inherit lib; };
         "http://cgit.orange.r/nix-writers"
       ];
       stockholm.urls = [
-        "http://cgit.gum.r/stockholm"
         "http://cgit.ni.r/stockholm"
         "http://cgit.orange.r/stockholm"
       ];
-- 
cgit v1.2.3


From 9272a2c2349186fa51e17a33539ff61f98588f71 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:16:24 +0100
Subject: reaktor2 stockholm-issue: rip cgit.gum

---
 krebs/5pkgs/simple/reaktor2-plugins/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/5pkgs/simple/reaktor2-plugins/default.nix b/krebs/5pkgs/simple/reaktor2-plugins/default.nix
index 3f2f6eac2..73c46755f 100644
--- a/krebs/5pkgs/simple/reaktor2-plugins/default.nix
+++ b/krebs/5pkgs/simple/reaktor2-plugins/default.nix
@@ -38,7 +38,7 @@ with stockholm.lib;
       filename = ./scripts/random-issue.sh;
       env = {
         PATH = makeBinPath (with pkgs; [ coreutils git gnused haskellPackages.lentil ]);
-        origin = "http://cgit.gum/stockholm";
+        origin = "https://cgit.krebsco.de/stockholm";
         state_dir = "/tmp/stockholm-issue";
       };
     };
-- 
cgit v1.2.3


From 505faa5ee647129dac64d65354c2979cff592ea4 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:17:56 +0100
Subject: repo-sync stockholm: update makefu remote

---
 krebs/2configs/repo-sync.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix
index 126048625..df0f2fc22 100644
--- a/krebs/2configs/repo-sync.nix
+++ b/krebs/2configs/repo-sync.nix
@@ -107,7 +107,7 @@ in {
       desc = "take all computers hostage, they love it";
       section = "configuration";
       remotes = {
-        makefu = "http://cgit.gum.r/stockholm";
+        makefu = "https://cgit.euer.krebsco.de/makefu/stockholm.git";
         tv = "http://cgit.ni.r/stockholm";
         lassulus = "http://cgit.orange.r/stockholm";
       };
-- 
cgit v1.2.3


From 5660788d09ba9b45508dc3364135632ed7dd6b8c Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:18:44 +0100
Subject: repo-sync stockholm: sort remotes

---
 krebs/2configs/repo-sync.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix
index df0f2fc22..9854b3dd5 100644
--- a/krebs/2configs/repo-sync.nix
+++ b/krebs/2configs/repo-sync.nix
@@ -107,9 +107,9 @@ in {
       desc = "take all computers hostage, they love it";
       section = "configuration";
       remotes = {
+        lassulus = "http://cgit.orange.r/stockholm";
         makefu = "https://cgit.euer.krebsco.de/makefu/stockholm.git";
         tv = "http://cgit.ni.r/stockholm";
-        lassulus = "http://cgit.orange.r/stockholm";
       };
     })
     ({ krebs.git = defineRepo {
-- 
cgit v1.2.3


From ddf64ae39bb652b46dccc036c68202511c393c39 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:19:10 +0100
Subject: repo-sync stockholm: add krebs remote

---
 krebs/2configs/repo-sync.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/krebs/2configs/repo-sync.nix b/krebs/2configs/repo-sync.nix
index 9854b3dd5..1c7ed4719 100644
--- a/krebs/2configs/repo-sync.nix
+++ b/krebs/2configs/repo-sync.nix
@@ -107,6 +107,7 @@ in {
       desc = "take all computers hostage, they love it";
       section = "configuration";
       remotes = {
+        krebs = "https://github.com/krebs/stockholm";
         lassulus = "http://cgit.orange.r/stockholm";
         makefu = "https://cgit.euer.krebsco.de/makefu/stockholm.git";
         tv = "http://cgit.ni.r/stockholm";
-- 
cgit v1.2.3


From 18f85d9fb0c79cdea8a3d863c41083f4677faa96 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:22:54 +0100
Subject: ci: use lib correctly

---
 ci.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ci.nix b/ci.nix
index 212114538..1aecc8e70 100644
--- a/ci.nix
+++ b/ci.nix
@@ -1,6 +1,6 @@
 # usage: nix-instantiate --eval --json --read-write-mode --strict ci.nix | jq .
-with import ./lib;
 let
+  lib = pkgs.lib;
   pkgs = import <nixpkgs> { overlays = [ (import ./submodules/nix-writers/pkgs) ]; };
   system =
     import <nixpkgs/nixos/lib/eval-config.nix> {
@@ -16,9 +16,9 @@ let
     }
   ;
 
-  ci-systems = filterAttrs (_: v: v.ci) system.config.krebs.hosts;
+  ci-systems = lib.filterAttrs (_: v: v.ci) system.config.krebs.hosts;
 
   build = host: owner:
-  ((import (toString ./. + "/${owner}/krops.nix") { name = host; }).test {target = "${getEnv "HOME"}/stockholm-build";});
+  ((import (toString ./. + "/${owner}/krops.nix") { name = host; }).test {target = "${builtins.getEnv "HOME"}/stockholm-build";});
 
-in mapAttrs (n: h: build n h.owner.name) ci-systems
+in lib.mapAttrs (n: h: build n h.owner.name) ci-systems
-- 
cgit v1.2.3


From f63817b3421dbf28b7101d73e6a710fd65d9bdcd Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:28:20 +0100
Subject: x220: vaapiIntel -> intel-vaapi-driver & co.

---
 krebs/2configs/hw/x220.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/krebs/2configs/hw/x220.nix b/krebs/2configs/hw/x220.nix
index a797673c9..937a20c29 100644
--- a/krebs/2configs/hw/x220.nix
+++ b/krebs/2configs/hw/x220.nix
@@ -17,8 +17,8 @@
   };
 
   hardware.opengl.extraPackages = [
-    pkgs.vaapiIntel
-    pkgs.vaapiVdpau
+    pkgs.intel-vaapi-driver
+    pkgs.libva-vdpau-driver
   ];
 
   services.xserver = {
-- 
cgit v1.2.3


From 4b80810e3669949ee9aa3c7ae93a1bc20f66f9fd Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:33:00 +0100
Subject: puyak: temporarily disable worlddomination

---
 krebs/1systems/puyak/config.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index 0c361cc42..3a7b114cc 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -27,7 +27,7 @@
 
     ### shackspace ###
     # handle the worlddomination map via coap
-    ../../2configs/shack/worlddomination.nix
+    #../../2configs/shack/worlddomination.nix (FIXME error: python3.13-LinkHeader-0.4.3 does not configure a `format`. To build with setuptools as before, set `pyproject = true` and `build-system = [ setuptools ]`.)
     ../../2configs/shack/ssh-keys.nix
 
     # drivedroid.shack for shackphone
-- 
cgit v1.2.3


From 5901b3d01a9bc786c0a559c644820c6eb2dbbebd Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:36:17 +0100
Subject: puyak: temporarily disable driverdroid

---
 krebs/1systems/puyak/config.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index 3a7b114cc..566f14f63 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -31,7 +31,7 @@
     ../../2configs/shack/ssh-keys.nix
 
     # drivedroid.shack for shackphone
-    ../../2configs/shack/drivedroid.nix
+    #../../2configs/shack/drivedroid.nix (FIXME error: attribute 'drivedroid-gen-repo' missing)
     # ../../2configs/shack/nix-cacher.nix
 
     # Say if muell will be collected
-- 
cgit v1.2.3


From ef8f9e3533be50ee657ceae7c699a1105d8745fb Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 21 Jan 2026 22:45:21 +0100
Subject: puyak: temporarily disable mobile.lounge.mpd.shack

---
 krebs/1systems/puyak/config.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/krebs/1systems/puyak/config.nix b/krebs/1systems/puyak/config.nix
index 566f14f63..60479fd90 100644
--- a/krebs/1systems/puyak/config.nix
+++ b/krebs/1systems/puyak/config.nix
@@ -70,7 +70,7 @@
     # ../../2configs/shack/share.nix
 
     # mobile.lounge.mpd.shack
-    ../../2configs/shack/mobile.mpd.n