chore: remove mihomo-party

feat: add netbird for homelab, keep tailscale for work (#225 )
refactor: grafana - add more datasources, rewrite in nix
2026-05-28 18:39:31 +02:00 · 2025-10-02 11:50:46 +08:00 · 2025-10-02 11:49:05 +08:00 · 2025-09-26 23:46:54 +08:00 · 2025-09-26 21:37:23 +08:00 · 2025-09-26 19:12:45 +08:00
357 changed files with 24406 additions and 7557 deletions
@@ -25,9 +25,9 @@ jobs:
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      - name: Install nix
-        uses: cachix/install-nix-action@v24
+        uses: cachix/install-nix-action@v31
        with:
          install_url: https://nixos.org/nix/install
          extra_nix_config: |
@@ -8,3 +8,4 @@ logs/
 core*
 !core/
 !core.nix
 !coredns*
@@ -1,10 +1,21 @@
 [files]
 # Respect .ignore files.
 ignore-dot = true
 # Respect ignore files.
 ignore-files = true
-extend-exclude = ["themes/", "data/", "static-surprises/", "resources/"]
+# Typos-specific ignore globs (gitignore syntax).
 # NOTE: This setting is ignored when you pass the path directly on the command line, as cachix/git-hooks.nix does.
 # To ignore those files, you must also exclude those directories via git-hooks.hooks.typos.settings.exclude.
 extend-exclude = [
  "data/",
  "rime-data/",
 ]
 [default]
 # Check binary files as text.
 binary = false
 # Verify spelling in file names.
 check-filename = true
 # ignore some special identifiers(sha256, mac address, crypto keys, etc)
 extend-ignore-re = [
  "iterm2",
@@ -77,7 +77,7 @@ shell:
 [group('nix')]
 fmt:
  # format the nix files in this repo
-  nix fmt
+  ls **/*.nix | each { |it| nixfmt $it.name }
 # Show all the auto gc roots in the nix store
 [group('nix')]
@@ -108,19 +108,29 @@ up-nix:
 #
 ############################################################################
 # Deploy the nixosConfiguration by hostname match
 [linux]
 [group('homelab')]
 local mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *;
  nixos-switch (hostname) {{mode}}
 # Deploy the hyprland nixosConfiguration by hostname match
 [linux]
 [group('desktop')]
 hypr mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *;
-  nixos-switch ai-hyprland {{mode}}
+  nixos-switch $"(hostname)-hyprland" {{mode}}
 # Deploy the niri nixosConfiguration by hostname match
 [linux]
 [group('desktop')]
-s-hypr mode="default":
+niri mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *;
-  nixos-switch shoukei-hyprland {{mode}}
+  nixos-switch $"(hostname)-niri" {{mode}}
 ############################################################################
 #
@@ -141,23 +151,15 @@ darwin-rollback:
  use {{utils_nu}} *;
  darwin-rollback
-# Depoly to fern(macOS host)
+# Deploy the darwinConfiguration by hostname match
 [macos]
 [group('desktop')]
-fe mode="default": 
+local mode="default": 
  #!/usr/bin/env nu
  use {{utils_nu}} *;
-  darwin-build "fern" {{mode}};
+  darwin-build (hostname) {{mode}};
-  darwin-switch "fern" {{mode}}
+  darwin-switch (hostname) {{mode}}
 # Depoly to frieren(macOS host)
 [macos]
 [group('desktop')]
 fr mode="default": 
  #!/usr/bin/env nu
  use {{utils_nu}} *;
  darwin-build "frieren" {{mode}};
  darwin-switch "frieren" {{mode}}
 # Reset launchpad to force it to reindex Applications
 [macos]
@@ -178,13 +180,6 @@ reset-launchpad:
 col tag:
  colmena apply --on '@{{tag}}' --verbose --show-trace
 [linux]
 [group('homelab')]
 local name mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *;
  nixos-switch {{name}} {{mode}}
 # Build and upload a vm image
 [linux]
 [group('homelab')]
@@ -204,37 +199,16 @@ lab:
 shoryu:
  colmena apply --on '@kubevirt-shoryu' --verbose --show-trace
 [linux]
 [group('homelab')]
 shoryu-local mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *; 
  nixos-switch kubevirt-shoryu {{mode}}
 [linux]
 [group('homelab')]
 shushou:
  colmena apply --on '@kubevirt-shushou' --verbose --show-trace
 [linux]
 [group('homelab')]
 shushou-local mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *; 
  nixos-switch kubevirt-shushou {{mode}}
 [linux]
 [group('homelab')]
 youko:
  colmena apply --on '@kubevirt-youko' --verbose --show-trace
 [linux]
 [group('homelab')]
 youko-local mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *; 
  nixos-switch kubevirt-youko {{mode}}
 ############################################################################
 #
 # Commands for other Virtual Machines
@@ -256,37 +230,16 @@ upload-idols mode="default":
 aqua:
  colmena apply --on '@aqua' --verbose --show-trace
 [linux]
 [group('homelab')]
 aqua-local mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *; 
  nixos-switch aquamarine {{mode}}
 [linux]
 [group('homelab')]
 ruby:
  colmena apply --on '@ruby' --verbose --show-trace
 [linux]
 [group('homelab')]
 ruby-local mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *; 
  nixos-switch ruby {{mode}}
 [linux]
 [group('homelab')]
 kana:
  colmena apply --on '@kana' --verbose --show-trace
 [linux]
 [group('homelab')]
 kana-local mode="default":
  #!/usr/bin/env nu
  use {{utils_nu}} *; 
  nixos-switch kana {{mode}}
 ############################################################################
 #
 # Kubernetes related commands
@@ -56,15 +56,15 @@ You don't have to go through the pain I've experienced again! Check out my
 |                             | NixOS(Wayland)                                                                                                      |
 | --------------------------- | ------------------------------------------------------------------------------------------------------------------- |
-| **Window Manager**          | [Hyprland][Hyprland]                                                                                                |
+| **Window Manager**          | [Hyprland][Hyprland] / [Niri][Niri]                                                                                 |
-| **Terminal Emulator**       | [Zellij][Zellij] + [Kitty][Kitty]                                                                                   |
+| **Terminal Emulator**       | [Zellij][Zellij] + [foot][foot]/[Kitty][Kitty]/[Alacritty][Alacritty]/[Ghostty][Ghostty]                            |
 | **Bar**                     | [Waybar][Waybar]                                                                                                    |
 | **Application Launcher**    | [anyrun][anyrun]                                                                                                    |
 | **Notification Daemon**     | [Mako][Mako]                                                                                                        |
-| **Display Manager**         | [GDM][GDM]                                                                                                          |
+| **Display Manager**         | [tuigreet][tuigreet]                                                                                                |
-| **Color Scheme**            | [Catppuccin][Catppuccin]                                                                                            |
+| **Color Scheme**            | [catppuccin-nix][catppuccin-nix]                                                                                    |
 | **network management tool** | [NetworkManager][NetworkManager]                                                                                    |
-| **Input method framework**  | [Fcitx5][Fcitx5]                                                                                                    |
+| **Input method framework**  | [Fcitx5][Fcitx5] + [rime][rime] + [小鹤音形 flypy][flypy]                                                           |
 | **System resource monitor** | [Btop][Btop]                                                                                                        |
 | **File Manager**            | [Yazi][Yazi] + [thunar][thunar]                                                                                     |
 | **Shell**                   | [Nushell][Nushell] + [Starship][Starship]                                                                           |
@@ -74,7 +74,7 @@ You don't have to go through the pain I've experienced again! Check out my
 | **Image Viewer**            | [imv][imv]                                                                                                          |
 | **Screenshot Software**     | [hyprshot][hyprshot]                                                                                                |
 | **Screen Recording**        | [OBS][OBS]                                                                                                          |
-| **Filesystem & Encryption** | tmpfs on `/`, [Btrfs][Btrfs] subvolumes on a [LUKS][LUKS] encrypted partition for persistent, unlock via passphrase |
+| **Filesystem & Encryption** | tmpfs as `/`, [Btrfs][Btrfs] subvolumes on a [LUKS][LUKS] encrypted partition for persistent, unlock via passphrase |
 | **Secure Boot**             | [lanzaboote][lanzaboote]                                                                                            |
 Wallpapers: https://github.com/ryan4yin/wallpapers
@@ -109,14 +109,16 @@ For NixOS:
 > To deploy this flake from NixOS's official ISO image (purest installation method), please refer to
 > [./nixos-installer/](./nixos-installer/)
 > Need to restart the machine when switching between `wayland` and `xorg`.
 ```bash
 # deploy one of the configuration based on the hostname
 sudo nixos-rebuild switch --flake .#ai-hyprland
 # deploy via `just`(a command runner with similar syntax to make) & Justfile
-just hypr  # deploy my pc with hyprland compositor
+# Deploy the hyprland nixosConfiguration by hostname match
 just hypr
 # Deploy the niri nixosConfiguration by hostname match
 just niri
 # or we can deploy with details
 just hypr debug
@@ -132,11 +134,11 @@ nix-shell -p just nushell
 # 3. comment home-manager's code in lib/macosSystem.nix to speed up the first deployment.
 # 4. comment out the proxy settings in scripts/darwin_set_proxy.py if the proxy is not ready yet.
-# deploy fern's configuration(Apple Silicon)
+# Deploy the darwinConfiguration by hostname match
-just fe
+just local
 # deploy with details
-just fe debug
+just local debug
 ```
 > [What y'all will need when Nix drives you to drink.](https://www.youtube.com/watch?v=Eni9PPPPBpg)
@@ -175,7 +177,11 @@ Other dotfiles that inspired me:
  - [1amSimp1e/dots](https://github.com/1amSimp1e/dots)
 [Hyprland]: https://github.com/hyprwm/Hyprland
 [Niri]: https://github.com/YaLTeR/niri
 [Kitty]: https://github.com/kovidgoyal/kitty
 [foot]: https://codeberg.org/dnkl/foot
 [Alacritty]: https://github.com/alacritty/alacritty
 [Ghostty]: https://github.com/ghostty-org/ghostty
 [Nushell]: https://github.com/nushell/nushell
 [Starship]: https://github.com/starship/starship
 [Waybar]: https://github.com/Alexays/Waybar
@@ -184,6 +190,8 @@ Other dotfiles that inspired me:
 [anyrun]: https://github.com/Kirottu/anyrun
 [Dunst]: https://github.com/dunst-project/dunst
 [Fcitx5]: https://github.com/fcitx/fcitx5
 [rime]: https://wiki.archlinux.org/title/Rime
 [flypy]: https://flypy.cc/
 [Btop]: https://github.com/aristocratos/btop
 [mpv]: https://github.com/mpv-player/mpv
 [Zellij]: https://github.com/zellij-org/zellij
@@ -194,10 +202,10 @@ Other dotfiles that inspired me:
 [OBS]: https://obsproject.com
 [Mako]: https://github.com/emersion/mako
 [Nerd fonts]: https://github.com/ryanoasis/nerd-fonts
-[catppuccin]: https://github.com/catppuccin/catppuccin
+[catppuccin-nix]: https://github.com/catppuccin/nix
 [NetworkManager]: https://wiki.gnome.org/Projects/NetworkManager
 [wl-clipboard]: https://github.com/bugaevc/wl-clipboard
-[GDM]: https://wiki.archlinux.org/title/GDM
+[tuigreet]: https://github.com/apognu/tuigreet
 [thunar]: https://gitlab.xfce.org/xfce/thunar
 [Yazi]: https://github.com/sxyazi/yazi
 [Catppuccin]: https://github.com/catppuccin/catppuccin
@@ -3,5 +3,21 @@
 This is my private Private Key Infrastructure (PKI) / Certificate Authority (CA) for my personal
 use. It is used to issue certificates for my own servers and services.
-All the private keys are ignored by git, and will be stored in my private secrets repo
+## Current Structure
-[../secrets](../secrets/)
+
 - **ecc-ca.crt** - ECC CA certificate file
 - **ecc-ca.srl** - CA serial number file for certificate tracking
 - **ecc-csr.conf** - OpenSSL configuration file for certificate signing requests
 - **ecc-server.crt** - Server certificate signed by the ECC CA
 - **gen-certs.sh** - Shell script to generate certificates automatically
 ## Security Notes
 All private keys (`.key` files) are ignored by git and stored in a private secrets repository. The
 public certificates and configuration files are committed to this repository for reference.
 ## Usage
 Run `./gen-certs.sh` to generate new certificates using the ECC CA configuration.
 See [../secrets](../secrets/) for the corresponding private key management.
@@ -16,14 +16,14 @@
  nixConfig = {
    # substituers will be appended to the default substituters when fetching packages
    extra-substituters = [
      "https://anyrun.cachix.org"
      # "https://nix-gaming.cachix.org"
      # "https://nixpkgs-wayland.cachix.org"
      # "https://install.determinate.systems"
    ];
    extra-trusted-public-keys = [
      "anyrun.cachix.org-1:pqBobmOjI7nKlsUMV25u9QHa9btJK65/C8vnO3p346s="
      # "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
      # "nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
      # "cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM="
    ];
  };
@@ -41,6 +41,8 @@
    nixpkgs-ollama.url = "github:nixos/nixpkgs/nixos-unstable";
    nixpkgs-patched.url = "github:ryan4yin/nixpkgs/nixos-unstable-patched";
    # for macos
    # nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-25.05-darwin";
    nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-unstable";
@@ -60,6 +62,8 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    determinate.url = "https://flakehub.com/f/DeterminateSystems/determinate/*";
    # https://github.com/catppuccin/nix
    catppuccin = {
      url = "github:catppuccin/nix";
@@ -77,9 +81,10 @@
    # community wayland nixpkgs
    # nixpkgs-wayland.url = "github:nix-community/nixpkgs-wayland";
    # anyrun - a wayland launcher
    anyrun = {
-      url = "github:Kirottu/anyrun";
+      url = "github:/anyrun-org/anyrun/v25.9.0";
      inputs.nixpkgs.follows = "nixpkgs";
    };
@@ -97,11 +102,6 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };
    nix-gaming = {
      url = "github:fufexan/nix-gaming";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    disko = {
      url = "github:nix-community/disko/v1.11.0";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -109,7 +109,7 @@
    # add git hooks to format nix code before commit
    pre-commit-hooks = {
-      url = "github:cachix/pre-commit-hooks.nix";
+      url = "github:cachix/git-hooks.nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
@@ -138,8 +138,21 @@
    };
    nixos-apple-silicon = {
-      # 2025-07-04
+      # 2025-08-25 asahi-6.15.10-3
-      url = "github:nix-community/nixos-apple-silicon/eba4b40c816e5aff8951ae231ac237e8aab8ec1d";
+      url = "github:nix-community/nixos-apple-silicon/b99bf9bf7445416fe55da09034fc4a6cd733805c";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    niri.url = "github:sodiboo/niri-flake";
    # -------------- Gaming ---------------------
    nix-gaming = {
      url = "github:fufexan/nix-gaming";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    aagl = {
      url = "github:ezKEa/aagl-gtk-on-nix";
      inputs.nixpkgs.follows = "nixpkgs";
    };
@@ -12,14 +12,53 @@
  1. Accessing the network when they don't need to.
  1. Accessing hardware devices they don't need.
-## Current Status
+## Current Structure
-1. **System Level**:
+### 1. **System Level**
-   - [ ] AppArmor
+
-   - [ ] Kernel & System Hardening
+- **AppArmor** (`apparmor/`): AppArmor profiles and configuration
-1. **Per-App Level**:
+- **Kernel & System Hardening** (`profiles/`): System-wide hardening profiles
-   - Nixpak (Bubblewrap, running at user-level)
+
-   - Firejail (a SUID program, meaning it's running as root)
+### 2. **Per-App Level**
 - **Nixpak** (`nixpaks/`): Bubblewrap-based sandboxing for applications
  - Firefox configuration
  - QQ (Chinese messaging app) configuration
  - Modular system with reusable components
 - **Firejail** (legacy): SUID-based sandboxing (not used)
 - **Bubblewrap** (`bwraps/`): Direct bubblewrap configurations
  - WeChat sandboxing configuration
 ## Current Implementation Status
 | Component         | Status    | Notes                          |
 | ----------------- | --------- | ------------------------------ |
 | AppArmor Profiles | 🚧 WIP    | Basic structure in place       |
 | Nixpak Firefox    | ✅ Active | Firefox sandboxing via nixpak  |
 | Nixpak QQ         | ✅ Active | QQ application sandboxing      |
 | Bubblewrap WeChat | ✅ Active | WeChat specific sandboxing     |
 | System Profiles   | 🚧 WIP    | Hardened system configurations |
 ## Directory Structure
 ```
 hardening/
 ├── README.md
 ├── apparmor/           # AppArmor security profiles
 │   └── default.nix
 ├── bwraps/            # Direct bubblewrap configurations
 │   ├── default.nix
 │   └── wechat.nix
 ├── nixpaks/           # Nixpak application sandboxing
 │   ├── default.nix
 │   ├── firefox.nix
 │   ├── qq.nix
 │   └── modules/       # Reusable nixpak modules
 │       ├── gui-base.nix
 │       └── network.nix
 └── profiles/          # System hardening profiles
    └── default.nix
 ```
 ## Kernel Hardening
@@ -69,13 +108,6 @@ provide a much higher level of security.
 - [Paranoid NixOS Setup - xeiaso](https://xeiaso.net/blog/paranoid-nixos-2021-07-18/)
 - [nix-mineral](https://github.com/cynicsketch/nix-mineral): NixOS module for convenient system
  hardening.
 - nixpak configs:
  - https://github.com/pokon548/OysterOS/tree/b97604d89953373d6316286b96f6a964af2c398d/desktop/application
  - https://github.com/segment-tree/my-nixos/tree/ceb6041f73bd9edcb78a8818b27a28f7c629193b/hm/me/apps/nixpak
  - https://github.com/Keksgesicht/nixos-config/tree/91cc77d8d6b598da7c4dbed143e0009c2dea6940/packages/nixpak
  - https://github.com/bluskript/nix-config/blob/7ecb6a7254c1ac4969072f4c4febdc19f8b83b30/pkgs/nixpak/default.nix
 - firejail configs:
  - https://github.com/stelcodes/nixos-config/blob/f8967c82a5e5f3d128eb1aaf7498b5f918f719ec/packages/overlay.nix#L261
 - apparmor configs:
  - https://github.com/zramctl/dotfiles/blob/4fe177f6984154960942bb47d5a375098ec6ed6a/modules/nixos/security/apparmor.nix#L4
  - https://git.grimmauld.de/Grimmauld/grimm-nixos-laptop/src/branch/main/hardening
@@ -2,7 +2,8 @@
  config,
  pkgs,
  ...
-}: {
+}:
 {
  services.dbus.apparmor = "enabled";
  security.apparmor = {
    enable = true;
@@ -2,7 +2,7 @@
  nixpkgs.overlays = [
    (_: super: {
      bwraps = {
-        wechat = super.callPackage ./wechat.nix {};
+        wechat = super.callPackage ./wechat.nix { };
      };
    })
  ];
@@ -10,7 +10,8 @@
  appimageTools,
  fetchurl,
  stdenvNoCC,
-}: let
+}:
 let
  pname = "wechat";
  # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/we/wechat/package.nix
  sources = {
@@ -41,58 +42,58 @@
    '';
  };
 in
-  appimageTools.wrapAppImage {
+appimageTools.wrapAppImage {
-    inherit pname version;
+  inherit pname version;
-    src = appimageContents;
+  src = appimageContents;
-    extraInstallCommands = ''
+  extraInstallCommands = ''
-      mkdir -p $out/share/applications
+    mkdir -p $out/share/applications
-      cp ${appimageContents}/wechat.desktop $out/share/applications/
+    cp ${appimageContents}/wechat.desktop $out/share/applications/
-      mkdir -p $out/share/pixmaps
+    mkdir -p $out/share/pixmaps
-      cp ${appimageContents}/wechat.png $out/share/pixmaps/
+    cp ${appimageContents}/wechat.png $out/share/pixmaps/
-      substituteInPlace $out/share/applications/wechat.desktop --replace-fail AppRun wechat
+    substituteInPlace $out/share/applications/wechat.desktop --replace-fail AppRun wechat
-    '';
+  '';
-    # Add these root paths to FHS sandbox to prevent WeChat from accessing them by default
+  # Add these root paths to FHS sandbox to prevent WeChat from accessing them by default
-    # Adapted from https://aur.archlinux.org/cgit/aur.git/tree/wechat-universal.sh?h=wechat-universal-bwrap
+  # Adapted from https://aur.archlinux.org/cgit/aur.git/tree/wechat-universal.sh?h=wechat-universal-bwrap
-    extraPreBwrapCmds = ''
+  extraPreBwrapCmds = ''
-      XDG_DOCUMENTS_DIR="''${XDG_DOCUMENTS_DIR:-$(xdg-user-dir DOCUMENTS)}"
+    XDG_DOCUMENTS_DIR="''${XDG_DOCUMENTS_DIR:-$(xdg-user-dir DOCUMENTS)}"
-      if [[ -z "''${XDG_DOCUMENTS_DIR}" ]]; then
+    if [[ -z "''${XDG_DOCUMENTS_DIR}" ]]; then
-          echo 'Error: Failed to get XDG_DOCUMENTS_DIR, refuse to continue'
+        echo 'Error: Failed to get XDG_DOCUMENTS_DIR, refuse to continue'
-          exit 1
+        exit 1
-      fi
+    fi
-      WECHAT_DATA_DIR="''${XDG_DOCUMENTS_DIR}/WeChat_Data"
+    WECHAT_DATA_DIR="''${XDG_DOCUMENTS_DIR}/WeChat_Data"
-      # Using ''${WECHAT_DATA_DIR} as Wechat Data folder
+    # Using ''${WECHAT_DATA_DIR} as Wechat Data folder
-      WECHAT_HOME_DIR="''${WECHAT_DATA_DIR}/home"
+    WECHAT_HOME_DIR="''${WECHAT_DATA_DIR}/home"
-      WECHAT_FILES_DIR="''${WECHAT_DATA_DIR}/xwechat_files"
+    WECHAT_FILES_DIR="''${WECHAT_DATA_DIR}/xwechat_files"
-      mkdir -p "''${WECHAT_FILES_DIR}"
+    mkdir -p "''${WECHAT_FILES_DIR}"
-      mkdir -p "''${WECHAT_HOME_DIR}"
+    mkdir -p "''${WECHAT_HOME_DIR}"
-      ln -snf "''${WECHAT_FILES_DIR}" "''${WECHAT_HOME_DIR}/xwechat_files"
+    ln -snf "''${WECHAT_FILES_DIR}" "''${WECHAT_HOME_DIR}/xwechat_files"
-    '';
+  '';
-    extraBwrapArgs = [
+  extraBwrapArgs = [
-      "--tmpfs /home"
+    "--tmpfs /home"
-      "--tmpfs /root"
+    "--tmpfs /root"
-      # format: --bind <host-path> <sandbox-path>
+    # format: --bind <host-path> <sandbox-path>
-      "--bind \${WECHAT_HOME_DIR} \${HOME}"
+    "--bind \${WECHAT_HOME_DIR} \${HOME}"
-      "--bind \${WECHAT_FILES_DIR} \${WECHAT_FILES_DIR}"
+    "--bind \${WECHAT_FILES_DIR} \${WECHAT_FILES_DIR}"
-      "--chdir \${HOME}"
+    "--chdir \${HOME}"
-      # wechat-universal only supports xcb
+    # wechat-universal only supports xcb
-      "--setenv QT_QPA_PLATFORM xcb"
+    "--setenv QT_QPA_PLATFORM xcb"
-      "--setenv QT_AUTO_SCREEN_SCALE_FACTOR 1"
+    "--setenv QT_AUTO_SCREEN_SCALE_FACTOR 1"
-      # use fcitx as IME
+    # use fcitx as IME
-      "--setenv QT_IM_MODULE fcitx"
+    "--setenv QT_IM_MODULE fcitx"
-      "--setenv GTK_IM_MODULE fcitx"
+    "--setenv GTK_IM_MODULE fcitx"
-    ];
+  ];
-    chdirToPwd = false;
+  chdirToPwd = false;
-    unshareNet = false;
+  unshareNet = false;
-    unshareIpc = true;
+  unshareIpc = true;
-    unsharePid = true;
+  unsharePid = true;
-    unshareUts = true;
+  unshareUts = true;
-    unshareCgroup = true;
+  unshareCgroup = true;
-    privateTmp = true;
+  privateTmp = true;
-  }
+}
@@ -1,8 +1,10 @@
 {
  pkgs,
  pkgs-patched,
  nixpak,
  ...
-}: let
+}:
 let
  callArgs = {
    mkNixPak = nixpak.lib.nixpak {
      inherit (pkgs) lib;
@@ -13,20 +15,17 @@
      (sloth.concat' sloth.homeDir mapdir)
    ];
  };
-  wrapper = _pkgs: path: (_pkgs.callPackage path callArgs).config.script;
+  wrapper = _pkgs: path: (_pkgs.callPackage path callArgs);
-in {
+in
 {
  # Add nixpaked Apps into nixpkgs, and reference them in home-manager or other nixos modules
  nixpkgs.overlays = [
    (_: super: {
      nixpaks = {
-        qq = wrapper super ./qq.nix;
+        qq = wrapper pkgs-patched ./qq.nix;
        qq-desktop-item = super.callPackage ./qq-desktop-item.nix {};
        wechat = wrapper super ./wechat.nix;
-        wechat-desktop-item = super.callPackage ./wechat-desktop-item.nix {};
+        telegram-desktop = wrapper super ./telegram-desktop.nix;
        firefox = wrapper super ./firefox.nix;
        firefox-desktop-item = super.callPackage ./firefox-desktop-item.nix {};
      };
    })
  ];
@@ -1,11 +0,0 @@
 {makeDesktopItem}:
 makeDesktopItem {
  name = "firefox";
  desktopName = "firefox";
  exec = "firefox %U";
  terminal = false;
  icon = "firefox";
  type = "Application";
  categories = ["Network"];
  comment = "firefox boxed";
 }
@@ -5,79 +5,136 @@
 # - Firefox's flatpak manifest: https://hg.mozilla.org/mozilla-central/file/tip/taskcluster/docker/firefox-flatpak/runme.sh#l151
 {
  lib,
-  pkgs,
+  firefox-wayland,
  mkNixPak,
  buildEnv,
  makeDesktopItem,
  ...
 }:
 mkNixPak {
  config = {
    config,
    sloth,
    ...
  }: {
    app = {
      package = pkgs.firefox-wayland;
      binPath = "bin/firefox";
    };
    flatpak.appId = "org.mozilla.firefox";
-    imports = [
+let
-      ./modules/gui-base.nix
+  appId = "org.mozilla.firefox";
-      ./modules/network.nix
+  wrapped = mkNixPak {
-    ];
+    config =
      {
        config,
        sloth,
        ...
      }:
      {
        app = {
          package = firefox-wayland;
          binPath = "bin/firefox";
        };
        flatpak.appId = appId;
-    # list all dbus services:
+        imports = [
-    #   ls -al /run/current-system/sw/share/dbus-1/services/
+          ./modules/gui-base.nix
-    #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
+          ./modules/network.nix
-    dbus.policies = {
+          ./modules/common.nix
-      "org.mozilla.firefox.*" = "own"; # firefox
+        ];
      "org.mozilla.firefox_beta.*" = "own"; # firefox beta
      "org.mpris.MediaPlayer2.firefox.*" = "own";
      "org.freedesktop.NetworkManager" = "talk";
-      "org.gnome.Shell.Screencast" = "talk";
+        # list all dbus services:
-      # System tray icon
+        #   ls -al /run/current-system/sw/share/dbus-1/services/
-      "org.freedesktop.Notifications" = "talk";
+        #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
-      "org.kde.StatusNotifierWatcher" = "talk";
+        dbus.policies = {
-      # File Manager
+          "org.mozilla.firefox.*" = "own"; # firefox
-      "org.freedesktop.FileManager1" = "talk";
+          "org.mozilla.firefox_beta.*" = "own"; # firefox beta
-      # Uses legacy StatusNotifier implementation
+          "org.mpris.MediaPlayer2.firefox.*" = "own";
      "org.kde.*" = "own";
    };
-    bubblewrap = {
+          "org.gnome.Shell.Screencast" = "talk";
-      # To trace all the home files QQ accesses, you can use the following nushell command:
+          # System tray icon
-      #   just trace-access firefox
+          "org.freedesktop.Notifications" = "talk";
-      # See the Justfile in the root of this repository for more information.
+          "org.kde.StatusNotifierWatcher" = "talk";
-      bind.rw = [
+        };
        # given the read write permission to the following directories.
        # NOTE: sloth.mkdir is used to create the directory if it does not exist!
        (sloth.mkdir (sloth.concat' sloth.homeDir "/.mozilla"))
-        sloth.xdgDocumentsDir
+        bubblewrap = {
-        sloth.xdgDownloadDir
+          # To trace all the home files Firefox accesses, you can use the following nushell command:
-        sloth.xdgMusicDir
+          #   just trace-access firefox
-        sloth.xdgVideosDir
+          # See the Justfile in the root of this repository for more information.
-      ];
+          bind.rw = [
-      bind.ro = [
+            # given the read write permission to the following directories.
-        "/sys/bus/pci"
+            # NOTE: sloth.mkdir is used to create the directory if it does not exist!
-        ["${config.app.package}/lib/firefox" "/app/etc/firefox"]
+            (sloth.mkdir (sloth.concat' sloth.homeDir "/.mozilla"))
-        # ================ for browserpass extension ===============================
+            sloth.xdgDocumentsDir
-        "/etc/gnupg"
+            sloth.xdgDownloadDir
-        (sloth.concat' sloth.homeDir "/.gnupg") # gpg's config
+            sloth.xdgMusicDir
-        (sloth.concat' sloth.homeDir "/.local/share/password-store") # my secrets
+            sloth.xdgVideosDir
-        (sloth.concat' sloth.runtimeDir "/gnupg") # for access gpg-agent socket
+          ];
          bind.ro = [
            "/sys/bus/pci"
            [
              "${config.app.package}/lib/firefox"
              "/app/etc/firefox"
            ]
-        # Unsure
+            # ================ for browserpass extension ===============================
-        (sloth.concat' sloth.xdgConfigHome "/dconf")
+            "/etc/gnupg"
-      ];
+            (sloth.concat' sloth.homeDir "/.gnupg") # gpg's config
            (sloth.concat' sloth.homeDir "/.local/share/password-store") # my secrets
            (sloth.concat' sloth.runtimeDir "/gnupg") # for access gpg-agent socket
-      sockets = {
+            # Unsure
-        x11 = false;
+            (sloth.concat' sloth.xdgConfigHome "/dconf")
-        wayland = true;
+          ];
-        pipewire = true;
+
          sockets = {
            x11 = false;
            wayland = true;
            pipewire = true;
          };
        };
      };
    };
  };
  exePath = lib.getExe wrapped.config.script;
 in
 buildEnv {
  inherit (wrapped.config.script) name meta passthru;
  paths = [
    wrapped.config.script
    (makeDesktopItem {
      name = appId;
      desktopName = "Firefox";
      genericName = "Firefox Boxed";
      comment = "Firefox Browser";
      exec = "${exePath} %U";
      terminal = false;
      icon = "firefox";
      startupNotify = true;
      startupWMClass = "firefox";
      type = "Application";
      categories = [
        "Network"
        "WebBrowser"
      ];
      mimeTypes = [
        "text/html"
        "text/xml"
        "application/xhtml+xml"
        "application/vnd.mozilla.xul+xml"
        "x-scheme-handler/http"
        "x-scheme-handler/https"
      ];
      actions = {
        new-private-window = {
          name = "New Private Window";
          exec = "${exePath} --private-window %U";
        };
        new-window = {
          name = "New Window";
          exec = "${exePath} --new-window %U";
        };
        profile-manager-window = {
          name = "Profile Manager";
          exec = "${exePath} --ProfileManager";
        };
      };
      extraConfig = {
        X-Flatpak = appId;
      };
    })
  ];
 }
@@ -0,0 +1,236 @@
 {
  lib,
  pkgs,
  sloth,
  config,
  ...
 }:
 {
  config = {
    dbus =
      let
        inherit (config.flatpak) appId;
      in
      {
        policies = {
          "${appId}" = "own";
          "${appId}.*" = "own";
          "org.freedesktop.DBus" = "talk";
          "org.gtk.vfs.*" = "talk";
          "org.gtk.vfs" = "talk";
          "ca.desrt.dconf" = "talk";
          "org.freedesktop.portal.*" = "talk";
          "org.a11y.Bus" = "talk";
          "org.freedesktop.appearance" = "talk";
          "org.freedesktop.appearance.*" = "talk";
        }
        // (builtins.listToAttrs (
          map (id: lib.nameValuePair "org.kde.StatusNotifierItem-${toString id}-1" "own") (
            lib.lists.range 2 11
          )
        ))
        // {
          # --- MPRIS Media Control ---
          # Allows the app to register as a media player. These are derived from the appID.
          "org.mpris.MediaPlayer2.${appId}" = "own";
          "org.mpris.MediaPlayer2.${appId}.*" = "own";
          "org.mpris.MediaPlayer2.${lib.lists.last (lib.strings.splitString "." appId)}" = "own";
          "org.mpris.MediaPlayer2.${lib.lists.last (lib.strings.splitString "." appId)}.*" = "own";
          # Conditionally allows a custom, friendlier MPRIS name if 'mprisName' is set.
          #       "org.mpris.MediaPlayer2.${mprisName}" = "own";
          #       "org.mpris.MediaPlayer2.${mprisName}.*" = "own";
          # --- General Desktop Integration ---
          "com.canonical.AppMenu.Registrar" = "talk"; # For Ubuntu AppMenu
          "org.freedesktop.FileManager1" = "talk";
          "org.freedesktop.Notifications" = "talk";
          # --- Accessibility (a11y) ---
          "org.a11y.Bus" = "see";
          # --- Portal Access ---
          "org.freedesktop.portal.Documents" = "talk";
          "org.freedesktop.portal.FileTransfer" = "talk";
          "org.freedesktop.portal.FileTransfer.*" = "talk";
          "org.freedesktop.portal.Notification" = "talk";
          "org.freedesktop.portal.OpenURI" = "talk";
          "org.freedesktop.portal.OpenURI.OpenFile" = "talk";
          "org.freedesktop.portal.OpenURI.OpenURI" = "talk";
          "org.freedesktop.portal.Print" = "talk";
          "org.freedesktop.portal.Request" = "see";
          # --- Input Method Portals ---
          "org.freedesktop.portal.Fcitx" = "talk";
          "org.freedesktop.portal.Fcitx.*" = "talk";
          "org.freedesktop.portal.IBus" = "talk";
          "org.freedesktop.portal.IBus.*" = "talk";
        };
        rules = {
          # 'call' rules permit specific method calls on D-Bus interfaces.
          call = {
            # --- Accessibility ---
            "org.a11y.Bus" = [
              "org.a11y.Bus.GetAddress@/org/a11y/bus"
              "org.freedesktop.DBus.Properties.Get@/org/a11y/bus"
            ];
            # --- General Portal Rules ---
            "org.freedesktop.FileManager1" = [ "*" ];
            "org.freedesktop.Notifications.*" = [ "*" ];
            "org.freedesktop.portal.Documents" = [ "*" ];
            "org.freedesktop.portal.FileTransfer" = [ "*" ];
            "org.freedesktop.portal.FileTransfer.*" = [ "*" ];
            "org.freedesktop.portal.Fcitx" = [ "*" ];
            "org.freedesktop.portal.Fcitx.*" = [ "*" ];
            "org.freedesktop.portal.IBus" = [ "*" ];
            "org.freedesktop.portal.IBus.*" = [ "*" ];
            "org.freedesktop.portal.Notification" = [ "*" ];
            "org.freedesktop.portal.OpenURI" = [ "*" ];
            "org.freedesktop.portal.OpenURI.OpenFile" = [ "*" ];
            "org.freedesktop.portal.OpenURI.OpenURI" = [ "*" ];
            "org.freedesktop.portal.Print" = [ "*" ];
            "org.freedesktop.portal.Request" = [ "*" ];
            # --- Main Desktop Portal Interface ---
            # A comprehensive list of permissions for interacting with the desktop environment.
            "org.freedesktop.portal.Desktop" = [
              # Device Access
              "org.freedesktop.portal.Camera"
              "org.freedesktop.portal.Camera.*"
              "org.freedesktop.portal.Usb"
              "org.freedesktop.portal.Usb.*"
              # File Chooser & Documents
              "org.freedesktop.portal.Documents"
              "org.freedesktop.portal.Documents.*"
              "org.freedesktop.portal.FileChooser"
              "org.freedesktop.portal.FileChooser.*"
              "org.freedesktop.portal.FileTransfer"
              "org.freedesktop.portal.FileTransfer.*"
              # Input Methods
              "org.freedesktop.portal.Fcitx"
              "org.freedesktop.portal.Fcitx.*"
              "org.freedesktop.portal.IBus"
              "org.freedesktop.portal.IBus.*"
              # Notifications & Printing
              "org.freedesktop.portal.Notification"
              "org.freedesktop.portal.Notification.*"
              "org.freedesktop.portal.Print"
              "org.freedesktop.portal.Print.*"
              # Open/Launch Handlers
              "org.freedesktop.portal.Email.ComposeEmail"
              "org.freedesktop.portal.OpenURI"
              "org.freedesktop.portal.OpenURI.*"
              # Properties & Session Management
              "org.freedesktop.DBus.Properties.GetAll"
              "org.freedesktop.DBus.Properties.Get@/org/freedesktop/portal/desktop"
              "org.freedesktop.portal.Session.Close"
              # Screen Capture & Sharing
              "org.freedesktop.portal.RemoteDesktop"
              "org.freedesktop.portal.RemoteDesktop.*"
              "org.freedesktop.portal.ScreenCast"
              "org.freedesktop.portal.ScreenCast.*"
              "org.freedesktop.portal.Screenshot"
              "org.freedesktop.portal.Screenshot.Screenshot"
              # Secrets (Keyring)
              "org.freedesktop.portal.Secret"
              "org.freedesktop.portal.Secret.RetrieveSecret"
              # Settings
              "org.freedesktop.portal.Settings.Read"
              "org.freedesktop.portal.Settings.ReadAll"
              # System Information
              "org.freedesktop.portal.Account.GetUserInformation"
              "org.freedesktop.portal.NetworkMonitor"
              "org.freedesktop.portal.NetworkMonitor.*"
              "org.freedesktop.portal.ProxyResolver.Lookup"
              "org.freedesktop.portal.ProxyResolver.Lookup.*"
              # Generic Request Fallback
              "org.freedesktop.portal.Request"
              # --- Conditional Portal Rules ---
              # These would be enabled based on config flags in a real implementation.
              # Enabled if 'allowGlobalShortcuts = true'
              "org.freedesktop.portal.GlobalShortcuts"
              "org.freedesktop.portal.GlobalShortcuts.*"
              # Enabled if 'allowInhibit = true'
              "org.freedesktop.portal.Inhibit"
              "org.freedesktop.portal.Inhibit.*"
              # Enabled if 'XDG_CURRENT_DESKTOP = "GNOME"'
              "org.freedesktop.portal.Location"
              "org.freedesktop.portal.Location.*"
            ];
          };
          # 'broadcast' rules permit receiving signals from D-Bus names.
          broadcast = {
            "org.freedesktop.portal.*" = [ "@/org/freedesktop/portal/*" ];
          };
        };
        args = [
          "--filter"
          "--sloppy-names"
          "--log"
        ];
      };
    etc.sslCertificates.enable = true;
    bubblewrap = {
      network = lib.mkDefault true;
      sockets = {
        wayland = true;
        pulse = true;
      };
      bind.rw = with sloth; [
        [
          (mkdir appDataDir)
          xdgDataHome
        ]
        [
          (mkdir appConfigDir)
          xdgConfigHome
        ]
        [
          (mkdir appCacheDir)
          xdgCacheHome
        ]
        (sloth.concat [
          sloth.runtimeDir
          "/"
          (sloth.envOr "WAYLAND_DISPLAY" "no")
        ])
        (sloth.concat' sloth.runtimeDir "/at-spi/bus")
        (sloth.concat' sloth.runtimeDir "/gvfsd")
        (sloth.concat' sloth.runtimeDir "/dconf")
        (sloth.concat' sloth.xdgCacheHome "/fontconfig")
        (sloth.concat' sloth.xdgCacheHome "/mesa_shader_cache")
        (sloth.concat' sloth.xdgCacheHome "/mesa_shader_cache_db")
        (sloth.concat' sloth.xdgCacheHome "/radv_builtin_shaders")
      ];
      bind.ro = [
        (sloth.concat' sloth.runtimeDir "/doc")
        (sloth.concat' sloth.xdgConfigHome "/kdeglobals")
        (sloth.concat' sloth.xdgConfigHome "/gtk-2.0")
        (sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
        (sloth.concat' sloth.xdgConfigHome "/gtk-4.0")
        (sloth.concat' sloth.xdgConfigHome "/fontconfig")
        (sloth.concat' sloth.xdgConfigHome "/dconf")
      ];
      bind.dev = [ "/dev/shm" ] ++ (map (id: "/dev/video${toString id}") (lib.lists.range 0 9));
    };
  };
 }
@@ -5,24 +5,18 @@
  pkgs,
  sloth,
  ...
-}: let
+}:
 let
  envSuffix = envKey: suffix: sloth.concat' (sloth.env envKey) suffix;
  # cursor & icon's theme should be the same as the host's one.
  cursorTheme = pkgs.bibata-cursors;
  iconTheme = pkgs.papirus-icon-theme;
-in {
+in
 {
  config = {
    dbus.policies = {
      "${config.flatpak.appId}" = "own";
-      "org.freedesktop.DBus" = "talk";
+      # we add other policies in ./common.nix
      "org.gtk.vfs.*" = "talk";
      "org.gtk.vfs" = "talk";
      "ca.desrt.dconf" = "talk";
      "org.a11y.Bus" = "talk";
      # for default portal & gtk/hyprland's portal
      "org.freedesktop.portal.*" = "talk";
      "org.freedesktop.impl.portal.desktop.*" = "talk";
    };
    # https://github.com/nixpak/nixpak/blob/master/modules/gpu.nix
    # 1. bind readonly - /run/opengl-driver
@@ -67,8 +61,8 @@ in {
        (sloth.concat' sloth.xdgConfigHome "/fontconfig")
        "/etc/fonts" # for fontconfig
-        "/etc/machine-id"
+        "/etc/localtime" # this is a symlink to /etc/zoneinfo/xxx
-        "/etc/localtime"
+        "/etc/zoneinfo"
        # Fix: libEGL warning: egl: failed to create dri2 screen
        "/etc/egl"
@@ -89,15 +83,19 @@ in {
      ];
      env = {
-        XDG_DATA_DIRS = lib.mkForce (lib.makeSearchPath "share" [
+        XDG_DATA_DIRS = lib.mkForce (
-          iconTheme
+          lib.makeSearchPath "share" [
-          cursorTheme
+            iconTheme
-          pkgs.shared-mime-info
+            cursorTheme
-        ]);
+            pkgs.shared-mime-info
-        XCURSOR_PATH = lib.mkForce (lib.concatStringsSep ":" [
+          ]
-          "${cursorTheme}/share/icons"
+        );
-          "${cursorTheme}/share/pixmaps"
+        XCURSOR_PATH = lib.mkForce (
-        ]);
+          lib.concatStringsSep ":" [
            "${cursorTheme}/share/icons"
            "${cursorTheme}/share/pixmaps"
          ]
        );
      };
    };
  };
@@ -2,7 +2,7 @@
 {
  etc.sslCertificates.enable = true;
  bubblewrap = {
-    bind.ro = ["/etc/resolv.conf"];
+    bind.ro = [ "/etc/resolv.conf" ];
    network = true;
  };
 }
@@ -1,17 +0,0 @@
 {
  makeDesktopItem,
  qq,
 }:
 makeDesktopItem {
  name = "qq";
  desktopName = "QQ";
  exec = "${qq}/bin/qq %U";
  terminal = false;
  # To find the icon name(nushell):
  #   let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#qq.outPath | str trim --char '"'
  #   tree $"($p)/share/icons"
  icon = "${qq}/share/icons/hicolor/512x512/apps/qq.png";
  type = "Application";
  categories = ["Network"];
  comment = "QQ boxed";
 }
@@ -5,58 +5,87 @@
 # - QQ's flatpak manifest: https://github.com/flathub/com.qq.QQ/blob/master/com.qq.QQ.yaml
 {
  lib,
-  pkgs,
+  qq,
  mkNixPak,
  buildEnv,
  makeDesktopItem,
  ...
 }:
-mkNixPak {
+
-  config = {sloth, ...}: {
+let
-    app = {
+  appId = "com.qq.QQ";
-      package = pkgs.qq.override {
+
-        # fix fcitx5 input method
+  wrapped = mkNixPak {
-        commandLineArgs = lib.concatStringsSep " " ["--enable-wayland-ime"];
+    config =
      { sloth, ... }:
      {
        app = {
          package = qq;
          binPath = "bin/qq";
        };
        flatpak.appId = appId;
        imports = [
          ./modules/gui-base.nix
          ./modules/network.nix
          ./modules/common.nix
        ];
        # list all dbus services:
        #   ls -al /run/current-system/sw/share/dbus-1/services/
        #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
        dbus.policies = {
          "org.gnome.Shell.Screencast" = "talk";
          # System tray icon
          "org.freedesktop.Notifications" = "talk";
          "org.kde.StatusNotifierWatcher" = "talk";
          # File Manager
          "org.freedesktop.FileManager1" = "talk";
          # Uses legacy StatusNotifier implementation
          "org.kde.*" = "own";
        };
        bubblewrap = {
          # To trace all the home files QQ accesses, you can use the following nushell command:
          #   just trace-access qq
          # See the Justfile in the root of this repository for more information.
          bind.rw = [
            sloth.xdgDocumentsDir
            sloth.xdgDownloadDir
            sloth.xdgMusicDir
            sloth.xdgVideosDir
          ];
          sockets = {
            x11 = false;
            wayland = true;
            pipewire = true;
          };
        };
      };
      binPath = "bin/qq";
    };
    flatpak.appId = "com.tencent.qq";
    imports = [
      ./modules/gui-base.nix
      ./modules/network.nix
    ];
    # list all dbus services:
    #   ls -al /run/current-system/sw/share/dbus-1/services/
    #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
    dbus.policies = {
      "org.gnome.Shell.Screencast" = "talk";
      # System tray icon
      "org.freedesktop.Notifications" = "talk";
      "org.kde.StatusNotifierWatcher" = "talk";
      # File Manager
      "org.freedesktop.FileManager1" = "talk";
      # Uses legacy StatusNotifier implementation
      "org.kde.*" = "own";
    };
    bubblewrap = {
      # To trace all the home files QQ accesses, you can use the following nushell command:
      #   just trace-access qq
      # See the Justfile in the root of this repository for more information.
      bind.rw = [
        # given the read write permission to the following directories.
        # NOTE: sloth.mkdir is used to create the directory if it does not exist!
        (sloth.mkdir (sloth.concat [sloth.xdgConfigHome "/QQ"]))
        sloth.xdgDocumentsDir
        sloth.xdgDownloadDir
        sloth.xdgMusicDir
        sloth.xdgVideosDir
      ];
      sockets = {
        x11 = false;
        wayland = true;
        pipewire = true;
      };
    };
  };
  exePath = lib.getExe wrapped.config.script;
 in
 buildEnv {
  inherit (wrapped.config.script) name meta passthru;
  paths = [
    wrapped.config.script
    (makeDesktopItem {
      name = appId;
      desktopName = "QQ";
      genericName = "QQ Boxed";
      comment = "Tencent QQ, also known as QQ, is an instant messaging software service and web portal developed by the Chinese technology company Tencent.";
      exec = "${exePath} %U";
      terminal = false;
      icon = "${qq}/share/icons/hicolor/512x512/apps/qq.png";
      startupNotify = true;
      startupWMClass = "QQ";
      type = "Application";
      categories = [
        "InstantMessaging"
        "Network"
      ];
      extraConfig = {
        X-Flatpak = appId;
      };
    })
  ];
 }
@@ -0,0 +1,104 @@
 {
  lib,
  telegram-desktop,
  buildEnv,
  mkNixPak,
  makeDesktopItem,
  ...
 }:
 let
  appId = "org.telegram.desktop";
  wrapped = mkNixPak {
    config =
      { sloth, ... }:
      {
        imports = [
          ./modules/gui-base.nix
          ./modules/network.nix
          ./modules/common.nix
        ];
        app.package = telegram-desktop;
        flatpak = {
          appId = appId;
        };
        dbus = {
          enable = true;
          policies = {
            "org.gnome.Mutter.IdleMonitor" = "talk";
            "org.freedesktop.Notifications" = "talk";
            "org.kde.StatusNotifierWatcher" = "talk";
            "com.canonical.AppMenu.Registrar" = "talk";
            "com.canonical.indicator.application" = "talk";
            "org.ayatana.indicator.application" = "talk";
            "org.sigxcpu.Feedback" = "talk";
          };
        };
        bubblewrap = {
          bind.rw = [
            sloth.xdgDocumentsDir
            sloth.xdgDownloadDir
            sloth.xdgMusicDir
            sloth.xdgVideosDir
          ];
          sockets = {
            x11 = false;
            wayland = true;
            pipewire = true;
          };
        };
      };
  };
  exePath = lib.getExe wrapped.config.script;
 in
 buildEnv {
  inherit (wrapped.config.script) name meta passthru;
  paths = [
    wrapped.config.script
    (makeDesktopItem {
      name = appId;
      desktopName = "Telegram";
      comment = "New era of messaging";
      tryExec = "${exePath}";
      exec = "${exePath} -- %u";
      icon = appId;
      startupNotify = true;
      startupWMClass = appId;
      terminal = false;
      type = "Application";
      categories = [
        "Chat"
        "Network"
        "InstantMessaging"
        "Qt"
      ];
      mimeTypes = [
        "x-scheme-handler/tg"
        "x-scheme-handler/tonsite"
      ];
      keywords = [
        "tg"
        "chat"
        "im"
        "messaging"
        "messenger"
        "sms"
        "tdesktop"
      ];
      actions = {
        quit = {
          name = "Quit Telegram";
          exec = "${exePath} -quit";
          icon = "application-exit";
        };
      };
      extraConfig = {
        X-Flatpak = appId;
        DBusActivatable = "true";
        SingleMainWindow = "true";
        X-GNOME-UsesNotifications = "true";
        X-GNOME-SingleWindow = "true";
      };
    })
  ];
 }
@@ -1,4 +1,5 @@
-{modulesPath, ...}: {
+{ modulesPath, ... }:
 {
  imports = [
    (modulesPath + "/profiles/hardened.nix")
  ];
@@ -1,5 +1,49 @@
 # Home Manager's Submodules
-1. `base`: The base module that is suitable for both Linux and macOS.
+This directory contains all Home Manager configurations organized by platform and functionality.
-2. `linux`: Linux-specific configuration.
+
-3. `darwin`: macOS-specific configuration.
+## Current Structure
 ```
 home/
 ├── base/              # Cross-platform home manager configurations
 │   ├── core/          # Essential applications and settings
 │   │   ├── editors/   # Editor configurations (Neovim, Helix)
 │   │   ├── shells/    # Shell configurations (Nushell, Zellij)
 │   │   └── ...
 │   ├── gui/           # GUI applications and desktop settings
 │   │   ├── terminal/  # Terminal emulators (Kitty, Alacritty, etc.)
 │   │   └── ...
 │   ├── tui/           # Terminal/TUI applications
 │   │   ├── editors/   # TUI editors and related tools
 │   │   ├── encryption/ # GPG, password-store, etc.
 │   │   └── ...
 │   └── home.nix       # Main home manager entry point
 ├── linux/             # Linux-specific home manager configurations
 │   ├── base/          # Linux base configurations
 │   ├── gui/           # Linux GUI applications
 │   │   ├── hyprland/  # Hyprland window manager
 │   │   ├── niri/      # Niri window manager
 │   │   └── ...
 │   ├── editors/       # Linux-specific editors
 │   └── ...
 └── darwin/            # macOS-specific home manager configurations
    ├── aerospace/     # macOS window manager
    ├── proxy/         # Proxy configurations
    └── ...
 ```
 ## Module Overview
 1. **base**: The base module suitable for both Linux and macOS
   - Cross-platform applications and settings
   - Shared configurations for editors, shells, and essential tools
 2. **linux**: Linux-specific configuration
   - Desktop environments (Hyprland, Niri)
   - Linux-specific GUI applications
   - System integration tools
 3. **darwin**: macOS-specific configuration
   - macOS applications and services
   - Platform-specific integrations (Aerospace, Squirrel, etc.)
@@ -1,5 +1,66 @@
 # Home Manager's Base Submodules
-1. `server`: Configuration which is suitable for both servers and desktops.
+This directory contains cross-platform base configurations that are shared between Linux and Darwin
-1. `desktop`: Configuration for desktop environments, such as Hyprland, I3, etc.
+systems.
-1. `core.nix`: Minimal home-manager's config
+
 ## Configuration Structure
 ### Core System
 - **core/**: Essential cross-platform configurations
  - **core.nix**: Minimal home-manager configuration
  - **shells/**: Shell configurations (bash, zsh, fish, nu)
  - **editors/**: Text editor configurations
    - **neovim/**: Neovim with custom plugins and settings
    - **helix/**: Helix editor configuration
  - **btop.nix**: System monitoring tools
  - **git.nix**: Git configuration and aliases
  - **npm.nix**: Node.js package management
  - **pip.nix**: Python package management
  - **starship.nix**: Cross-shell prompt configuration
  - **theme.nix**: Color schemes and theming
  - **yazi.nix**: Terminal file manager configuration
  - **zellij/**: Terminal multiplexer with custom layouts
 ### Desktop Environment
 - **gui/**: Cross-platform GUI applications and configurations
  - **dev-tools.nix**: Development tools and IDEs
  - **media.nix**: Media players and utilities
  - **terminal/**: Terminal emulator configurations
    - **alacritty/**: Alacritty terminal
    - **kitty/**: Kitty terminal
    - **foot/**: Foot terminal (Linux)
    - **ghostty/**: Ghostty terminal
 ### Terminal Interface
 - **tui/**: Terminal-based interface configurations
  - **cloud/**: Cloud development tools (Terraform, etc.)
  - **container.nix**: Container tools (Docker, Podman)
  - **dev-tools.nix**: Terminal-based development tools
  - **editors/**: Terminal editor configurations
  - **encryption/**: Encryption and security tools
  - **gpg/**: GPG key management
  - **password-store/**: Password management with pass
  - **shell.nix**: Shell environment configurations
  - **ssh/**: SSH configuration and management
  - **zellij/**: Terminal workspace management
 ### System Management
 - **home.nix**: Main home manager configuration file
 ## Platform Compatibility
 All configurations in this directory are designed to work across:
 - **Linux**: All distributions with Nix and Home Manager
 - **macOS**: Darwin systems with Home Manager
 - **WSL**: Windows Subsystem for Linux
 ## Usage
 These base configurations provide the foundation for both Linux and Darwin systems, ensuring
 consistent environments across different platforms while allowing for platform-specific
 customizations.
@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
 {
  home.packages = with pkgs; [
    # Misc
    cowsay
@@ -12,7 +13,7 @@
    # search for files by name, faster than find
    fd
    # search for files by its content, replacement of grep
-    (ripgrep.override {withPCRE2 = true;})
+    (ripgrep.override { withPCRE2 = true; })
    # A fast and polyglot tool for code searching, linting, rewriting at large scale
    # supported languages: only some mainstream languages currently(do not support nix/nginx/yaml/toml/...)
@@ -1,3 +1,4 @@
-{mylib, ...}: {
+{ mylib, ... }:
 {
  imports = mylib.scanPaths ./.;
 }
@@ -1,3 +1,10 @@
 # Editors
-See [desktop/editors/](../../desktop/editors/) for more details.
+This directory contains editor configurations that are shared across different environments.
 ## Available Editors
 - **neovim/**: Neovim configuration with AstroNvim
 - **helix/**: Helix editor configuration
 These configurations are designed to work across both terminal and GUI environments.
@@ -1,3 +1,4 @@
-{mylib, ...}: {
+{ mylib, ... }:
 {
  imports = mylib.scanPaths ./.;
 }
@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
 {
  programs.helix = {
    enable = true;
  };
@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
 {
  programs = {
    neovim = {
      enable = true;
@@ -4,12 +4,13 @@
  pkgs,
  myvars,
  ...
-}: {
+}:
 {
  # `programs.git` will generate the config file: ~/.config/git/config
  # to make git use this config file, `~/.gitconfig` should not exist!
  #
  #    https://git-scm.com/docs/git-config#Documentation/git-config.txt---global
-  home.activation.removeExistingGitconfig = lib.hm.dag.entryBefore ["checkLinkTargets"] ''
+  home.activation.removeExistingGitconfig = lib.hm.dag.entryBefore [ "checkLinkTargets" ] ''
    rm -f ${config.home.homeDirectory}/.gitconfig
  '';
@@ -1,4 +1,5 @@
-{config, ...}: {
+{ config, ... }:
 {
  # make `npm install -g <pkg>` happey
  #
  # mainly used to install npm packages that updates frequently
@@ -1,4 +1,5 @@
-{config, ...}: let
+{ config, ... }:
 let
  shellAliases = {
    k = "kubectl";
@@ -10,7 +11,8 @@
  goBin = "${config.home.homeDirectory}/go/bin";
  rustBin = "${config.home.homeDirectory}/.cargo/bin";
  npmBin = "${config.home.homeDirectory}/.npm/bin";
-in {
+in
 {
  programs.bash = {
    enable = true;
    enableCompletion = true;
@@ -6,20 +6,24 @@
    enableZshIntegration = true;
    enableNushellIntegration = true;
    # https://starship.rs/config/
    settings = {
      # Get editor completions based on the config schema
      "$schema" = "https://starship.rs/config-schema.json";
      character = {
-        success_symbol = "[›](bold green)";
+        success_symbol = "[➜](bold green)";
-        error_symbol = "[›](bold red)";
+        error_symbol = "[➜](bold red)";
      };
-      aws = {
+      # I never rely on the defaults, so this module is useless to me—disabled.
-        symbol = "🅰 ";
+      # I prefer adding --project, --region to very gcloud/aws command.
-      };
+      aws.disabled = true;
-      gcloud = {
+      gcloud.disabled = true;
-        # do not show the account/project's info
+
-        # to avoid the leak of sensitive information when sharing the terminal
+      kubernetes = {
-        format = "on [$symbol$active(\($region\))]($style) ";
+        symbol = "⛵";
-        symbol = "🅶 ️";
+        disabled = false;
      };
      os.disabled = false;
    };
  };
 }
@@ -1,4 +1,5 @@
-{catppuccin, ...}: {
+{ catppuccin, ... }:
 {
  # https://github.com/catppuccin/nix
  imports = [
    catppuccin.homeModules.catppuccin
@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
 {
  # terminal file manager
  programs.yazi = {
    enable = true;
@@ -2,7 +2,8 @@ let
  shellAliases = {
    "zj" = "zellij";
  };
-in {
+in
 {
  programs.zellij = {
    enable = true;
  };
@@ -1,3 +1,4 @@
-{mylib, ...}: {
+{ mylib, ... }:
 {
  imports = mylib.scanPaths ./.;
 }
@@ -1,5 +1,7 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
-  home.packages = with pkgs;
+{
  home.packages =
    with pkgs;
    [
      mitmproxy # http/https proxy tool
      wireshark # network analyzer
@@ -52,10 +52,7 @@
        bold_italic = {
          family = "Maple Mono NF CN";
        };
-        size =
+        size = if pkgs.stdenv.isDarwin then 14 else 13;
          if pkgs.stdenv.isDarwin
          then 14
          else 13;
      };
      terminal = {
        # Spawn a nushell in login mode via `bash`
@@ -1,3 +1,4 @@
-{mylib, ...}: {
+{ mylib, ... }:
 {
  imports = mylib.scanPaths ./.;
 }
@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
 {
  programs.foot = {
    # foot is designed only for Linux
    enable = pkgs.stdenv.isLinux;
@@ -12,9 +12,10 @@
  programs.ghostty = {
    enable = true;
    package =
-      if pkgs.stdenv.isDarwin
+      if pkgs.stdenv.isDarwin then
-      then pkgs.hello # pkgs.ghostty is currently broken on darwin
+        pkgs.hello # pkgs.ghostty is currently broken on darwin
-      else pkgs.ghostty; # the stable version
+      else
        pkgs.ghostty; # the stable version
    # package = ghostty.packages.${pkgs.system}.default; # the latest version
    enableBashIntegration = false;
    installBatSyntax = false;
@@ -19,10 +19,7 @@
    font = {
      name = "Maple Mono NF CN";
      # use different font size on macOS
-      size =
+      size = if pkgs.stdenv.isDarwin then 14 else 13;
        if pkgs.stdenv.isDarwin
        then 14
        else 13;
    };
    # consistent with other terminal emulators
@@ -48,6 +45,6 @@
    };
    # macOS specific settings
-    darwinLaunchOptions = ["--start-as=maximized"];
+    darwinLaunchOptions = [ "--start-as=maximized" ];
  };
 }
@@ -1,4 +1,5 @@
-{myvars, ...}: {
+{ myvars, ... }:
 {
  # Home Manager needs a bit of information about you and the
  # paths it should manage.
  home = {
@@ -2,7 +2,8 @@
  lib,
  pkgs,
  ...
-}: {
+}:
 {
  # https://developer.hashicorp.com/terraform/cli/config/config-file
  home.file.".terraformrc".source = ./terraformrc;
@@ -30,9 +31,12 @@
    # digitalocean
    doctl
    # google cloud
-    (google-cloud-sdk.withExtraComponents (with google-cloud-sdk.components; [
+    (google-cloud-sdk.withExtraComponents (
-      gke-gcloud-auth-plugin
+      with google-cloud-sdk.components;
-    ]))
+      [
        gke-gcloud-auth-plugin
      ]
    ))
    # cloud tools that nix do not have cache for.
    terraform
@@ -1,9 +1,10 @@
 {
  pkgs,
-  pkgs-unstable,
+  pkgs-stable,
  nur-ryan4yin,
  ...
-}: {
+}:
 {
  home.packages = with pkgs; [
    podman-compose
    dive # explore docker layers
@@ -13,16 +14,18 @@
    kubectl
    kubectx # kubectx & kubens
    kubie # same as kubectl-ctx, but per-shell (won’t touch kubeconfig).
    kubectl-view-secret # kubectl view-secret
    kubectl-tree # kubectl tree
    kubectl-node-shell # exec into node
    kubepug # kubernetes pre upgrade checker
    kubectl-cnpg # cloudnative-pg's cli tool
    kubebuilder
    istioctl
    clusterctl # for kubernetes cluster-api
    kubevirt # virtctl
-    kubernetes-helm
+    pkgs-stable.kubernetes-helm
    fluxcd
    argocd
@@ -1,3 +1,4 @@
-{mylib, ...}: {
+{ mylib, ... }:
 {
  imports = mylib.scanPaths ./.;
 }
@@ -2,7 +2,8 @@
  pkgs,
  pkgs-unstable,
  ...
-}: {
+}:
 {
  #############################################################
  #
  #  Basic settings for development environment
@@ -17,6 +18,8 @@
  home.packages = with pkgs; [
    colmena # nixos's remote deployment tool
    tokei # count lines of code, alternative to cloc
    # db related
    mycli
    pgcli
@@ -33,7 +36,6 @@
    devbox
    bfg-repo-cleaner # remove large files from git history
    k6 # load testing tool
    protobuf # protocol buffer compiler
    # solve coding extercises - learn by doing
    exercism
@@ -1,3 +1,4 @@
-{mylib, ...}: {
+{ mylib, ... }:
 {
  imports = mylib.scanPaths ./.;
 }
@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
 {
  programs.helix = {
    enable = true;
    package = pkgs.helix;
@@ -18,7 +18,8 @@ let
  # the path to nvim directory
  # to make this symlink work, we need to git clone this repo to your home directory.
  configPath = "${config.home.homeDirectory}/nix-config/home/base/tui/editors/neovim/nvim";
-in {
+in
 {
  xdg.configFile."nvim".source = config.lib.file.mkOutOfStoreSymlink configPath;
  # Disable catppuccin to avoid conflict with my non-nix config.
  catppuccin.nvim.enable = false;
@@ -52,7 +52,8 @@ return {
      "terraformls", -- terraform hcl
      "marksman", -- markdown ls
      "nickel_ls", -- nickel language server
-      "nil_ls", -- nix language server
+      -- "nil_ls", -- nix language server
      "nixd", -- another nix language server
      "buf_ls", -- protocol buffer language server
      "dockerls", -- dockerfile
      "cmake", -- cmake language server
@@ -39,7 +39,7 @@ return {
      formatting.shfmt, -- Shell formatter
      formatting.terraform_fmt, -- Terraform formatter
      formatting.stylua, -- Lua formatter
-      formatting.alejandra, -- Nix formatter
+      -- formatting.alejandra, -- Nix formatter
      formatting.sqlfluff.with { -- SQL formatter
        extra_args = { "--dialect", "postgres" }, -- change to your dialect
      },
@@ -2,154 +2,160 @@
  pkgs,
  pkgs-unstable,
  ...
-}: {
+}:
-  home.packages = with pkgs; (
+{
-    # -*- Data & Configuration Languages -*-#
+  home.packages =
-    [
+    with pkgs;
-      #-- nix
+    (
-      nil
+      # -*- Data & Configuration Languages -*-#
-      # rnix-lsp
+      [
-      # nixd
+        #-- nix
-      statix # Lints and suggestions for the nix programming language
+        nil
-      deadnix # Find and remove unused code in .nix source files
+        nixd
-      alejandra # Nix Code Formatter
+        statix # Lints and suggestions for the nix programming language
        deadnix # Find and remove unused code in .nix source files
        nixfmt # Nix Code Formatter
-      #-- nickel lang
+        #-- nickel lang
-      nickel
+        nickel
-      #-- json like
+        #-- json like
-      # terraform  # install via brew on macOS
+        # terraform  # install via brew on macOS
-      terraform-ls
+        terraform-ls
-      jsonnet
+        jsonnet
-      jsonnet-language-server
+        jsonnet-language-server
-      taplo # TOML language server / formatter / validator
+        taplo # TOML language server / formatter / validator
-      nodePackages.yaml-language-server
+        nodePackages.yaml-language-server
-      actionlint # GitHub Actions linter
+        actionlint # GitHub Actions linter
-      #-- dockerfile
+        #-- dockerfile
-      hadolint # Dockerfile linter
+        hadolint # Dockerfile linter
-      nodePackages.dockerfile-language-server-nodejs
+        dockerfile-language-server
-      #-- markdown
+        #-- markdown
-      marksman # language server for markdown
+        marksman # language server for markdown
-      glow # markdown previewer
+        glow # markdown previewer
-      pandoc # document converter
+        pandoc # document converter
-      pkgs-unstable.hugo # static site generator
+        pkgs-unstable.hugo # static site generator
-      #-- sql
+        #-- sql
-      sqlfluff
+        sqlfluff
-      #-- protocol buffer
+        #-- protocol buffer
-      buf # linting and formatting
+        buf # linting and formatting
-    ]
+      ]
-    ++
+      ++
-    #-*- General Purpose Languages -*-#
+        #-*- General Purpose Languages -*-#
-    [
+        [
-      #-- c/c++
+          #-- c/c++
-      cmake
+          cmake
-      cmake-language-server
+          cmake-language-server
-      gnumake
+          gnumake
-      checkmake
+          checkmake
-      # c/c++ compiler, required by nvim-treesitter!
+          # c/c++ compiler, required by nvim-treesitter!
-      gcc
+          gcc
-      gdb
+          gdb
-      # c/c++ tools with clang-tools, the unwrapped version won't
+          # c/c++ tools with clang-tools, the unwrapped version won't
-      # add alias like `cc` and `c++`, so that it won't conflict with gcc
+          # add alias like `cc` and `c++`, so that it won't conflict with gcc
-      # llvmPackages.clang-unwrapped
+          # llvmPackages.clang-unwrapped
-      clang-tools
+          clang-tools
-      lldb
+          lldb
-      vscode-extensions.vadimcn.vscode-lldb.adapter # codelldb - debugger
+          vscode-extensions.vadimcn.vscode-lldb.adapter # codelldb - debugger
-      #-- python
+          #-- python
-      pipx # Install and Run Python Applications in Isolated Environments
+          (python313.withPackages (
-      uv # python project package manager
+            ps: with ps; [
-      pyright # python language server
+              # python language server
-      (python313.withPackages (
+              pyright
-        ps:
+              ruff
          with ps; [
            ruff
            black # python formatter
            # debugpy
-            # my commonly used python packages
+              pipx # Install and Run Python Applications in Isolated Environments
-            jupyter
+              black # python formatter
-            ipython
+              uv # python project package manager
            pandas
            requests
            pyquery
            pyyaml
            boto3
          ]
      ))
-      #-- rust
+              # my commonly used python packages
-      # we'd better use the rust-overlays for rust development
+              jupyter
-      pkgs-unstable.rustc
+              ipython
-      pkgs-unstable.rust-analyzer
+              pandas
-      pkgs-unstable.cargo # rust package manager
+              requests
-      pkgs-unstable.rustfmt
+              pyquery
-      pkgs-unstable.clippy # rust linter
+              pyyaml
              boto3
-      #-- golang
+              # misc
-      go
+              protobuf # protocol buffer compiler
-      gomodifytags
+              numpy
-      iferr # generate error handling code for go
+            ]
-      impl # generate function implementation for go
+          ))
      gotools # contains tools like: godoc, goimports, etc.
      gopls # go language server
      delve # go debugger
-      # -- java
+          #-- rust
-      jdk17
+          # we'd better use the rust-overlays for rust development
-      gradle
+          pkgs-unstable.rustc
-      maven
+          pkgs-unstable.rust-analyzer
-      spring-boot-cli
+          pkgs-unstable.cargo # rust package manager
-      jdt-language-server
+          pkgs-unstable.rustfmt
          pkgs-unstable.clippy # rust linter
-      #-- zig
+          #-- golang
-      zls
+          go
          gomodifytags
          iferr # generate error handling code for go
          impl # generate function implementation for go
          gotools # contains tools like: godoc, goimports, etc.
          gopls # go language server
          delve # go debugger
-      #-- lua
+          # -- java
-      stylua
+          jdk17
-      lua-language-server
+          gradle
          maven
          spring-boot-cli
          jdt-language-server
-      #-- bash
+          #-- zig
-      nodePackages.bash-language-server
+          zls
      shellcheck
      shfmt
    ]
    #-*- Web Development -*-#
    ++ [
      nodePackages.nodejs
      nodePackages.typescript
      nodePackages.typescript-language-server
      # HTML/CSS/JSON/ESLint language servers extracted from vscode
      nodePackages.vscode-langservers-extracted
      nodePackages."@tailwindcss/language-server"
      emmet-ls
    ]
    # -*- Lisp like Languages -*-#
    # ++ [
    #   guile
    #   racket-minimal
    #   fnlfmt # fennel
    #   (
    #     if pkgs.stdenv.isLinux && pkgs.stdenv.isx86
    #     then pkgs-unstable.akkuPackages.scheme-langserver
    #     else pkgs.emptyDirectory
    #   )
    # ]
    ++ [
      proselint # English prose linter
-      #-- verilog / systemverilog
+          #-- lua
-      verible
+          stylua
          lua-language-server
-      #-- Optional Requirements:
+          #-- bash
-      nodePackages.prettier # common code formatter
+          nodePackages.bash-language-server
-      fzf
+          shellcheck
-      gdu # disk usage analyzer, required by AstroNvim
+          shfmt
-      (ripgrep.override {withPCRE2 = true;}) # recursively searches directories for a regex pattern
+        ]
-    ]
+      #-*- Web Development -*-#
-  );
+      ++ [
        nodePackages.nodejs
        nodePackages.typescript
        nodePackages.typescript-language-server
        # HTML/CSS/JSON/ESLint language servers extracted from vscode
        nodePackages.vscode-langservers-extracted
        nodePackages."@tailwindcss/language-server"
        emmet-ls
      ]
      # -*- Lisp like Languages -*-#
      # ++ [
      #   guile
      #   racket-minimal
      #   fnlfmt # fennel
      #   (
      #     if pkgs.stdenv.isLinux && pkgs.stdenv.isx86
      #     then pkgs-unstable.akkuPackages.scheme-langserver
      #     else pkgs.emptyDirectory
      #   )
      # ]
      ++ [
        proselint # English prose linter
        #-- verilog / systemverilog
        verible
        #-- Optional Requirements:
        nodePackages.prettier # common code formatter
        fzf
        gdu # disk usage analyzer, required by AstroNvim
        (ripgrep.override { withPCRE2 = true; }) # recursively searches directories for a regex pattern
      ]
    );
 }
@@ -2,7 +2,8 @@
  pkgs,
  pkgs-unstable,
  ...
-}: {
+}:
 {
  home.packages = with pkgs; [
    age
    sops
@@ -2,7 +2,8 @@
  config,
  mysecrets,
  ...
-}: {
+}:
 {
  programs.gpg = {
    enable = true;
    homedir = "${config.home.homeDirectory}/.gnupg";
@@ -3,9 +3,11 @@
  config,
  lib,
  ...
-}: let
+}:
 let
  passwordStoreDir = "${config.xdg.dataHome}/password-store";
-in {
+in
 {
  programs.password-store = {
    enable = true;
    package = pkgs.pass.withExtensions (exts: [
@@ -2,9 +2,11 @@
  config,
  pkgs-unstable,
  ...
-}: let
+}:
 let
  inherit (pkgs-unstable) nu_scripts;
-in {
+in
 {
  programs.nushell = {
    # load the alias file for work
    # the file must exist, otherwise nushell will complain about it!
@@ -38,7 +40,7 @@ in {
      # use custom-completions/zoxide/zoxide-completions.nu *
      # alias
-      use aliases/git/git-aliases.nu *
+      # use aliases/git/git-aliases.nu *
      use aliases/eza/eza-aliases.nu *
      use aliases/bat/bat-aliases.nu *
@@ -2,14 +2,28 @@
  config,
  mysecrets,
  ...
-}: {
+}:
 {
  home.file.".ssh/romantic.pub".source = "${mysecrets}/public/romantic.pub";
  programs.ssh = {
    enable = true;
-    # "a private key that is used during authentication will be added to ssh-agent if it is running"
+    # default config
-    addKeysToAgent = "yes";
+    enableDefaultConfig = false;
    matchBlocks."*" = {
      forwardAgent = false;
      # "a private key that is used during authentication will be added to ssh-agent if it is running"
      addKeysToAgent = "yes";
      compression = true;
      serverAliveInterval = 0;
      serverAliveCountMax = 3;
      hashKnownHosts = false;
      userKnownHostsFile = "~/.ssh/known_hosts";
      controlMaster = "no";
      controlPath = "~/.ssh/master-%r@%n:%p";
      controlPersist = "no";
    };
    matchBlocks = {
      "github.com" = {
@@ -1,8 +1,10 @@
-{pkgs, ...}: let
+{ pkgs, ... }:
 let
  shellAliases = {
    "zj" = "zellij";
  };
-in {
+in
 {
  programs.zellij = {
    enable = true;
    package = pkgs.zellij;
@@ -1,6 +1,33 @@
 # Home Manager's Darwin Submodules
-1. `core.nix`: some basic configuration.
+This directory contains macOS-specific Home Manager configurations for Darwin systems.
-2. `shell.nix`: shell related.
+
-3. `rime-squirrel.nix`: [rime-squirrel](https://github.com/rime/squirrel)'s configuration.
+## Configuration Modules
-4. `default.nix`: the entrypoint of darwin's configuration, it import all the submodules above.
+
 ### Core Configurations
 - **default.nix**: Entry point that imports all Darwin configurations
 - **shell.nix**: Shell configurations and environment settings
 - **rime-squirrel.nix**: [Rime Squirrel](https://github.com/rime/squirrel) input method
  configuration
 ### Window Management
 - **aerospace/**: [Aerospace](https://github.com/nikitabobko/AeroSpace) tiling window manager
  configuration
  - Custom keybindings and workspace management
  - Application-specific window rules
 ### Network Configuration
 - **proxy/**: Network proxy configurations
  - `proxychains.conf`: Proxy chains configuration for network routing
  - Proxy settings for development tools and applications
 ## Features
 - macOS-specific package installations and configurations
 - Native macOS applications and utilities
 - Touch ID and system integration
 - Homebrew integration for additional packages
 - macOS-specific shell configurations and aliases
@@ -1,5 +1,5 @@
-{config, ...}: {
+{ config, ... }:
 {
  home.file.".aerospace.toml".source =
-    config.lib.file.mkOutOfStoreSymlink
+    config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/nix-config/home/darwin/aerospace/aerospace.toml";
    "${config.home.homeDirectory}/nix-config/home/darwin/aerospace/aerospace.toml";
 }
@@ -2,16 +2,15 @@
  mylib,
  myvars,
  ...
-}: {
+}:
 {
  home.homeDirectory = "/Users/${myvars.username}";
-  imports =
+  imports = (mylib.scanPaths ./.) ++ [
-    (mylib.scanPaths ./.)
+    ../base/core
-    ++ [
+    ../base/tui
-      ../base/core
+    ../base/gui
-      ../base/tui
+    ../base/home.nix
-      ../base/gui
+  ];
      ../base/home.nix
    ];
  # enable management of XDG base directories on macOS.
  xdg.enable = true;
@@ -2,12 +2,12 @@
  config,
  pkgs,
  ...
-}: {
+}:
 {
  home.packages = with pkgs; [
    clash-meta
  ];
  home.file.".proxychains/proxychains.conf".source =
-    config.lib.file.mkOutOfStoreSymlink
+    config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/nix-config/home/darwin/proxy/proxychains.conf";
    "${config.home.homeDirectory}/nix-config/home/darwin/proxy/proxychains.conf";
 }
@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
 {
  # Squirrel Input Method
  home.file."Library/Rime" = {
    # my custom squirrel data (flypy input method)
@@ -1,4 +1,5 @@
-{lib, ...}: let
+{ lib, ... }:
 let
  envExtra = ''
    export PATH="$PATH:/opt/homebrew/bin:/usr/local/bin"
  '';
@@ -20,7 +21,8 @@
      true
    fi
  '';
-in {
+in
 {
  # Homebrew's default install location:
  #   /opt/homebrew for Apple Silicon
  #   /usr/local for macOS Intel
@@ -1,10 +1,34 @@
 # Home Manager's Linux Submodules
-1. `base`: The base module that is suitable for any NixOS environment.
+This directory contains Linux-specific Home Manager configurations organized for different use
-2. `desktop`: Configuration for desktop environments, such as Hyprland, I3, etc.
+cases.
-3. `server.nix`: Configuration which is suitable for both servers and desktops. It import only
+
-   `base` as its submodule.
+## Configuration Modules
-   1. used by all my nixos servers.
+
-4. `desktop.nix`: the entrypoint of desktop's configuration, it import both `base` and `desktop` as
+### Core Configurations
-   its submodules.
+
-   1. used by all my nixos desktops.
+- **core.nix**: Essential Linux-specific configurations and settings
 - **base/**: Base Linux configurations including shell, tools, and utilities
  - `shell.nix`: Shell configurations and aliases
  - `tools.nix`: Essential command-line tools and utilities
 ### Desktop Configurations
 - **gui/**: Desktop environment configurations
  - **hyprland/**: Hyprland window manager with custom keybindings and settings
  - **niri/**: Niri compositor configuration
  - **base/**: Common desktop applications and services
  - **editors/**: Text editor configurations for desktop environments
 ### Available Entry Points
 - **core.nix**: Core Linux configuration, suitable for basic setups
 - **tui.nix**: Terminal-based interface configuration for lightweight environments
 - **gui.nix**: Graphical user interface configuration entry point, imports desktop environments
 ## Usage
 - **Lightweight/Terminal**: Use `core.nix` or `tui.nix` for terminal-focused setups
 - **Desktops**: Use `gui.nix` for full desktop environments with window managers like Hyprland or
  Niri
 - **Custom**: Mix and match configurations as needed for your specific use case
@@ -1,3 +1,4 @@
-{mylib, ...}: {
+{ mylib, ... }:
 {
  imports = mylib.scanPaths ./.;
 }
@@ -2,11 +2,13 @@
  config,
  myvars,
  ...
-}: let
+}:
 let
  d = config.xdg.dataHome;
  c = config.xdg.configHome;
  cache = config.xdg.cacheHome;
-in rec {
+in
 rec {
  home.homeDirectory = "/home/${myvars.username}";
  # environment variables that always set at login
@@ -1,4 +1,5 @@
-{pkgs, ...}: {
+{ pkgs, ... }:
 {
  # Linux Only Packages, not available on Darwin
  home.packages = with pkgs; [
    # misc
@@ -1,17 +1,49 @@
-# Desktop Related
+# Desktop Environment Configurations
-3. `base`: all common configurations for all desktops.
+This directory contains desktop environment and window manager configurations managed by Home
-4. `hyprland`: Hyprland's configuration.
+Manager.
-## Why install I3/Hyprland in Home Manager instead of a NixOS Module?
+## Available Configurations
-1. I3 & Hyprland's configuration file is located in `~/.config`, which can be easily managed by Home
+### Window Managers
-   Manager.
+
-2. I have many user-specific systemd services, such gammastep, wallpaper-switcher, etc. Which can be
+- **hyprland**: Hyprland compositor configuration with custom keybindings, settings, and window
-   easily managed by Home Manager, but if we add i3/hyprland in a NixOS Module, those user-level
+  rules
-   services may failed to start automatically. With i3/hyprland in a Home Manager Module, we can
+- **niri**: Niri compositor configuration with custom settings, keybindings, spawn-at-startup rules,
-   control their systemd service's dependent order more easily, so we can avoid issues like this.
+  and window rules
-3. By install packages as less as possible in NixOS Module, we can:
+
-   1. Make the NixOS system more secure and stable.
+### Base Desktop Environment
-   2. Make this flake more portable to other non-NixOS systems, as home-manager can be installed on
+
-      any Linux system.
+- **base**: Common desktop configurations shared across all environments, including:
  - Desktop applications (anyrun, mako, waybar, wlogout)
  - Creative tools and media applications
  - Development tools
  - Eye protection utilities (gammastep)
  - Fcitx5 input method framework
  - Games and gaming utilities
  - GTK theme configurations
  - Immutable file handling
  - Note-taking applications
  - Wallpaper management with auto-switcher
  - Wayland applications
  - XDG desktop configurations
 ### Editor Configurations
 - **editors**: Text editor configurations and integrations
 ## Why install Desktop Environments in Home Manager instead of NixOS Module?
 1. **Configuration Location**: Desktop environment configuration files are located in `~/.config`,
   which can be easily managed by Home Manager.
 2. **User-specific Services**: Many user-specific systemd services (gammastep, wallpaper-switcher,
   etc.) can be easily managed by Home Manager. If desktop environments were configured via NixOS
   Module, these user-level services might fail to start automatically. With Home Manager modules,
   we can control systemd service dependency order more effectively.
 3. **System Benefits**: By minimizing package installation through NixOS Module:
   - Makes the NixOS system more secure and stable
   - Increases portability to non-NixOS systems, as Home Manager can be installed on any Linux
     system
   - Allows for easier switching between different window managers without system-level changes
@@ -6,8 +6,10 @@
  nur-ryan4yin,
  blender-bin,
  ...
-}: {
+}:
-  home.packages = with pkgs;
+{
  home.packages =
    with pkgs;
    [
      # creative
      # gimp      # image editing, I prefer using figma in browser instead of this one
@@ -30,10 +32,10 @@
      ldtk # A modern, versatile 2D level editor
      # fpga
-      python313Packages.apycula # gowin fpga
+      # python313Packages.apycula # gowin fpga
-      yosys # fpga synthesis
+      # yosys # fpga synthesis
-      nextpnr # fpga place and route
+      # nextpnr # fpga place and route
-      openfpgaloader # fpga programming
+      # openfpgaloader # fpga programming
      # nur-ryan4yin.packages.${pkgs.system}.gowin-eda-edu-ide # app: `gowin-env` => `gw_ide` / `gw_pack` / ...
    ]);
@@ -41,7 +43,8 @@
    # live streaming
    obs-studio = {
      enable = pkgs.stdenv.isx86_64;
-      plugins = with pkgs.obs-studio-plugins;
+      plugins =
        with pkgs.obs-studio-plugins;
        [
          # screen capture
          wlrobs
@@ -1,3 +1,4 @@
-{mylib, ...}: {
+{ mylib, ... }:
 {
  imports = mylib.scanPaths ./.;
 }
@@ -0,0 +1,66 @@
 {
  pkgs,
  anyrun,
  ...
 }:
 let
  anyrunPackages = anyrun.packages.${pkgs.system};
 in
 {
  imports = [
    (
      { modulesPath, ... }:
      {
        # Important! We disable home-manager's module to avoid option
        # definition collisions
        disabledModules = [ "${modulesPath}/programs/anyrun.nix" ];
      }
    )
    anyrun.homeManagerModules.default
  ];
  programs.anyrun = {
    enable = true;
    # The package should come from the same flake as all the plugins to avoid breakage.
    package = anyrunPackages.anyrun;
    config = {
      # The horizontal position.
      # when using `fraction`, it sets a fraction of the width or height of the screen
      x.fraction = 0.5; # at the middle of the screen
      # The vertical position.
      y.fraction = 0.05; # at the top of the screen
      # The width of the runner.
      width.fraction = 0.3; # 30% of the screen
      hideIcons = false;
      ignoreExclusiveZones = false;
      layer = "overlay";
      hidePluginInfo = false;
      closeOnClick = true;
      showResultsImmediately = true;
      maxEntries = null;
      # https://github.com/anyrun-org/anyrun/tree/master/plugins
      plugins = with anyrunPackages; [
        applications # Launch applications
        dictionary # Look up word definitions using the Free Dictionary API.
        nix-run # search & run graphical apps from nixpkgs via `nix run`, without installing it.
        # randr         # quickly change monitor configurations on the fly
        rink # A simple calculator plugin
        symbols # Look up unicode symbols and custom user defined symbols.
        translate # ":zh <text to translate>" Quickly translate text using the Google Translate API.
        niri-focus # Search for & focus the window via title/appid on Niri
      ];
    };
    extraConfigFiles = {
      "symbols.ron".source = ./conf/anyrun/symbols.ron;
      "applications.ron".source = ./conf/anyrun/applications.ron;
    };
  };
  # https://github.com/anyrun-org/anyrun/discussions/179
  xdg.configFile."anyrun/style.css".source = ./conf/anyrun/style.css;
 }
@@ -0,0 +1,16 @@
 Config(
  // Also show the Desktop Actions defined in the desktop files, e.g. "New Window" from LibreWolf
  desktop_actions: true,
  max_entries: 5,
  // The terminal used for running terminal based desktop entries, if left as `None` a static list of terminals is used
  // to determine what terminal to use.
  terminal: Some(Terminal(
    // The main terminal command
    command: "alacritty",
    // What arguments should be passed to the terminal process to run the command correctly
    // {} is replaced with the command in the desktop entry
    args: "-e {}",
  )),
 )
@@ -0,0 +1,101 @@
 /* ===== Color variables ===== */
 :root {
  --bg-color: #313244;
  --fg-color: #cdd6f4;
  --primary-color: #89b4fa;
  --secondary-color: #cba6f7;
  --border-color: var(--primary-color);
  --selected-bg-color: var(--primary-color);
  --selected-fg-color: var(--bg-color);
 }
 /* ===== Global reset ===== */
 * {
  all: unset;
  font-family: "JetBrainsMono Nerd Font", monospace;
 }
 /* ===== Transparent window ===== */
 window {
  background: transparent;
 }
 /* ===== Main container ===== */
 box.main {
  border-radius: 16px;
  background-color: color-mix(in srgb, var(--bg-color) 80%, transparent);
  border: 0.5px solid color-mix(in srgb, var(--fg-color) 25%, transparent);
  padding: 12px; /* add uniform padding around the whole box */
 }
 /* ===== Input field ===== */
 text {
  font-size: 1.3rem;
  background: transparent;
  border: 1px solid var(--border-color);
  border-radius: 16px;
  margin-bottom: 12px;
  padding: 5px 10px;
  min-height: 44px;
  caret-color: var(--primary-color);
 }
 /* ===== List container ===== */
 .matches {
  background-color: transparent;
 }
 /* ===== Single match row ===== */
 .match {
  font-size: 1.1rem;
  padding: 4px 10px; /* tight vertical spacing */
  border-radius: 6px;
 }
 /* Remove default label margins */
 .match * {
  margin: 0;
  padding: 0;
  line-height: 1;
 }
 /* Selected / hover state */
 .match:selected,
 .match:hover {
  background-color: var(--selected-bg-color);
  color: var(--selected-fg-color);
 }
 .match:selected label.plugin.info,
 .match:hover label.plugin.info {
  color: var(--selected-fg-color);
 }
 .match:selected label.match.description,
 .match:hover label.match.description {
  color: color-mix(in srgb, var(--selected-fg-color) 90%, transparent);
 }
 /* ===== Plugin info label ===== */
 label.plugin.info {
  color: var(--fg-color);
  font-size: 1rem;
  min-width: 160px;
  text-align: left;
 }
 /* ===== Description label ===== */
 label.match.description {
  font-size: 0rem;
  color: var(--fg-color);
 }
 /* ===== Fade-in animation ===== */
@keyframes fade {
  0% {
    opacity: 0;
  }
  100% {
    opacity: 1;
  }
 }
@@ -0,0 +1,10 @@
 Config(
  // The prefix that the search needs to begin with to yield symbol results
  prefix: "",
  // Custom user defined symbols to be included along the unicode symbols
  symbols: {
    // "name": "text to be copied"
    "shrug": "¯\\_(ツ)_/¯",
  },
  max_entries: 3,
 )
@@ -1,17 +1,17 @@
 general {
-    lock_cmd = pidof hyprlock || hyprlock              # avoid starting multiple instances
+    lock_cmd = pidof swaylock || swaylock              # avoid starting multiple instances
    before_sleep_cmd = loginctl lock-session          # lock before suspend
    after_sleep_cmd = hyprctl dispatch dpms on        # resume dpms after suspend
    ignore_dbus_inhibit = false                       # whether to ignore dbus-sent idle-inhibit requests
 }
-# turn off keyboard backlight, comment out this section if you dont have a keyboard backlight.
+listener { 
-# listener { 
+    timeout = 180                                                      # 3 minutes
-#     timeout = 180                                          # 3 minutes
+    # List devices: brightnessctl --list
-#     on-timeout = brightnessctl -sd rgb:kbd_backlight set 0 # turn off keyboard backlight.
+    # Adjust keyboard backlight: brightnessctl -d kbd_backlight set 50%
-#     on-resume = brightnessctl -rd rgb:kbd_backlight        # turn on keyboard backlight.
+    on-timeout = brightnessctl --save --device=kbd_backlight set 0     # turn off keyboard backlight.
-# }
+    on-resume = brightnessctl --restore --device=kbd_backlight         # turn on keyboard backlight.
 }
 # listener {
 #     timeout = 600                                # 10min.
@@ -20,13 +20,13 @@ general {
 # }
 listener {
-    timeout = 1200                                     # 20 minutes
+    timeout = 1600                                     # 20 minutes
-    on-timeout = pidof hyprlock || hyprlock           # lock screen
+    on-timeout = pidof swaylock || swaylock           # lock screen
    on-resume = hyprctl dispatch dpms on              # monitor wake up
 }
 listener {
-    timeout = 1260                                             # 21 minutes
+    timeout = 1660                                             # 31 minutes
    on-timeout = hyprctl dispatch dpms off                     # screen off
    on-resume = hyprctl dispatch dpms on && brightnessctl -r   # monitor wake up & screen on
 }
@@ -6,10 +6,10 @@
  "modules-center": ["custom/playerctl"],
  "modules-right": [
    "pulseaudio",
    "battery",
    "memory",
    "cpu",
    "network",
    "battery",
    "clock",
    "idle_inhibitor",
    "custom/powermenu",
@@ -91,12 +91,12 @@
  "network": {
    "interval": 5,
    "format": "{ifname}",
-    "format-wifi": " {essid} ({signalStrength}%)  Up: {bandwidthUpBits} Down: {bandwidthDownBits}",
+    "format-wifi": "  {signalStrength}% Down: {bandwidthDownBytes} Up: {bandwidthUpBytes} {essid}",
-    "format-ethernet": "  {ifname} Up: {bandwidthUpBits} Down: {bandwidthDownBits}",
+    "format-ethernet": "  {ifname} Down: {bandwidthDownBytes} Up: {bandwidthUpBytes}",
    "format-disconnected": "Disconnected ⚠",
    "tooltip-format": " {ifname} via {gwaddri}",
-    "tooltip-format-wifi": "  {ifname} @ {essid}\nIP: {ipaddr}\nStrength: {signalStrength}%\nFreq: {frequency}MHz\nUp: {bandwidthUpBits} Down: {bandwidthDownBits}",
+    "tooltip-format-wifi": "  {ifname} @ {essid}\nIP: {ipaddr}\nStrength: {signalStrength}%\nFreq: {frequency}MHz\nDown: {bandwidthDownBytes} Up: {bandwidthUpBytes}",
-    "tooltip-format-ethernet": " {ifname}\nIP: {ipaddr}\n up: {bandwidthUpBits} down: {bandwidthDownBits}",
+    "tooltip-format-ethernet": " {ifname}\nIP: {ipaddr}\n Down: {bandwidthDownBytes} Up: {bandwidthUpBytes}",
    "tooltip-format-disconnected": "Disconnected",
    "max-length": 50,
    "on-click-middle": "nm-connection-editor",
@@ -122,7 +122,7 @@
    "scroll-step": 5.0,
    // Commands to execute on events
    "on-click": "amixer set Master toggle",
-    "on-click-right": "pavucontrol",
+    "on-click-right": "GSK_RENDERER=opengl pavucontrol",
    "smooth-scrolling-threshold": 1,
  },
  "temperature": {
@@ -138,8 +138,6 @@
    "spacing": 5,
  },
  "battery": {
    "bat": "BAT0",
    "adapter": "ADP0",
    "interval": 60,
    "states": {
      "warning": 30,
--- a/Show More
+++ b/Show More