chore: niri - hotkey-overlay skip-at-startup

fix: niri keybinding for wlogout
flake.lock: Update
2026-05-28 18:39:31 +02:00 · 2025-12-19 10:09:18 +08:00 · 2025-12-19 10:06:04 +08:00 · 2025-12-19 09:57:01 +08:00 · 2025-12-18 19:56:46 -06:00 · 2025-12-17 19:18:52 +08:00
195 changed files with 12932 additions and 7084 deletions
@@ -25,9 +25,9 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
      - name: Install nix
-        uses: cachix/install-nix-action@v24
+        uses: cachix/install-nix-action@v31
        with:
          install_url: https://nixos.org/nix/install
          extra_nix_config: |
@@ -8,3 +8,4 @@ logs/
 core*
 !core/
 !core.nix
+!coredns*
@@ -1,10 +1,21 @@
 [files]
+# Respect .ignore files.
 ignore-dot = true
+# Respect ignore files.
 ignore-files = true
-extend-exclude = ["themes/", "data/", "static-surprises/", "resources/"]
+# Typos-specific ignore globs (gitignore syntax).
+# NOTE: This setting is ignored when you pass the path directly on the command line, as cachix/git-hooks.nix does.
+# To ignore those files, you must also exclude those directories via git-hooks.hooks.typos.settings.exclude.
+extend-exclude = [
+  "data/",
+  "rime-data/",
+]

 [default]
+# Check binary files as text.
 binary = false
+# Verify spelling in file names.
+check-filename = true
 # ignore some special identifiers(sha256, mac address, crypto keys, etc)
 extend-ignore-re = [
  "iterm2",
@@ -100,7 +100,7 @@ repair-store *paths:
 # Update all Nixpkgs inputs
 [group('nix')]
 up-nix:
-  nix flake update nixpkgs nixpkgs-stable nixpkgs-unstable nixpkgs-darwin nixpkgs-ollama
+  nix flake update nixpkgs nixpkgs-stable nixpkgs-unstable nixpkgs-darwin nixpkgs-patched

 ############################################################################
 #
@@ -8,9 +8,9 @@
 	<a href="https://github.com/ryan4yin/nix-config/stargazers">
 		<img alt="Stargazers" src="https://img.shields.io/github/stars/ryan4yin/nix-config?style=for-the-badge&logo=starship&color=C9CBFF&logoColor=D9E0EE&labelColor=302D41"></a>
    <a href="https://nixos.org/">
-        <img src="https://img.shields.io/badge/NixOS-25.05-informational.svg?style=for-the-badge&logo=nixos&color=F2CDCD&logoColor=D9E0EE&labelColor=302D41"></a>
+        <img src="https://img.shields.io/badge/NixOS-25.11-informational.svg?style=for-the-badge&logo=nixos&color=F2CDCD&logoColor=D9E0EE&labelColor=302D41"></a>
    <a href="https://github.com/ryan4yin/nixos-and-flakes-book">
-        <img src="https://img.shields.io/static/v1?label=Nix Flakes&message=learning&style=for-the-badge&logo=nixos&color=DDB6F2&logoColor=D9E0EE&labelColor=302D41"></a>
+        <img src="https://img.shields.io/badge/Nix%20Flakes-learning-informational.svg?style=for-the-badge&logo=nixos&color=F2CDCD&logoColor=D9E0EE&labelColor=302D41"></a>
  </a>
 </p>

@@ -57,14 +57,14 @@ You don't have to go through the pain I've experienced again! Check out my
 |                             | NixOS(Wayland)                                                                                                      |
 | --------------------------- | ------------------------------------------------------------------------------------------------------------------- |
 | **Window Manager**          | [Hyprland][Hyprland] / [Niri][Niri]                                                                                 |
-| **Terminal Emulator**       | [Zellij][Zellij] + [Kitty][Kitty]                                                                                   |
+| **Terminal Emulator**       | [Zellij][Zellij] + [foot][foot]/[Kitty][Kitty]/[Alacritty][Alacritty]/[Ghostty][Ghostty]                            |
 | **Bar**                     | [Waybar][Waybar]                                                                                                    |
 | **Application Launcher**    | [anyrun][anyrun]                                                                                                    |
 | **Notification Daemon**     | [Mako][Mako]                                                                                                        |
-| **Display Manager**         | [GDM][GDM]                                                                                                          |
-| **Color Scheme**            | [Catppuccin][Catppuccin]                                                                                            |
+| **Display Manager**         | [tuigreet][tuigreet]                                                                                                |
+| **Color Scheme**            | [catppuccin-nix][catppuccin-nix]                                                                                    |
 | **network management tool** | [NetworkManager][NetworkManager]                                                                                    |
-| **Input method framework**  | [Fcitx5][Fcitx5]                                                                                                    |
+| **Input method framework**  | [Fcitx5][Fcitx5] + [rime][rime] + [小鹤音形 flypy][flypy]                                                           |
 | **System resource monitor** | [Btop][Btop]                                                                                                        |
 | **File Manager**            | [Yazi][Yazi] + [thunar][thunar]                                                                                     |
 | **Shell**                   | [Nushell][Nushell] + [Starship][Starship]                                                                           |
@@ -74,7 +74,7 @@ You don't have to go through the pain I've experienced again! Check out my
 | **Image Viewer**            | [imv][imv]                                                                                                          |
 | **Screenshot Software**     | [hyprshot][hyprshot]                                                                                                |
 | **Screen Recording**        | [OBS][OBS]                                                                                                          |
-| **Filesystem & Encryption** | tmpfs on `/`, [Btrfs][Btrfs] subvolumes on a [LUKS][LUKS] encrypted partition for persistent, unlock via passphrase |
+| **Filesystem & Encryption** | tmpfs as `/`, [Btrfs][Btrfs] subvolumes on a [LUKS][LUKS] encrypted partition for persistent, unlock via passphrase |
 | **Secure Boot**             | [lanzaboote][lanzaboote]                                                                                            |

 Wallpapers: https://github.com/ryan4yin/wallpapers
@@ -109,8 +109,6 @@ For NixOS:
 > To deploy this flake from NixOS's official ISO image (purest installation method), please refer to
 > [./nixos-installer/](./nixos-installer/)

-> Need to restart the machine when switching between `wayland` and `xorg`.
-
 ```bash
 # deploy one of the configuration based on the hostname
 sudo nixos-rebuild switch --flake .#ai-hyprland
@@ -119,6 +117,9 @@ sudo nixos-rebuild switch --flake .#ai-hyprland
 # Deploy the hyprland nixosConfiguration by hostname match
 just hypr

+# Deploy the niri nixosConfiguration by hostname match
+just niri
+
 # or we can deploy with details
 just hypr debug
 ```
@@ -178,6 +179,9 @@ Other dotfiles that inspired me:
 [Hyprland]: https://github.com/hyprwm/Hyprland
 [Niri]: https://github.com/YaLTeR/niri
 [Kitty]: https://github.com/kovidgoyal/kitty
+[foot]: https://codeberg.org/dnkl/foot
+[Alacritty]: https://github.com/alacritty/alacritty
+[Ghostty]: https://github.com/ghostty-org/ghostty
 [Nushell]: https://github.com/nushell/nushell
 [Starship]: https://github.com/starship/starship
 [Waybar]: https://github.com/Alexays/Waybar
@@ -186,6 +190,8 @@ Other dotfiles that inspired me:
 [anyrun]: https://github.com/Kirottu/anyrun
 [Dunst]: https://github.com/dunst-project/dunst
 [Fcitx5]: https://github.com/fcitx/fcitx5
+[rime]: https://wiki.archlinux.org/title/Rime
+[flypy]: https://flypy.cc/
 [Btop]: https://github.com/aristocratos/btop
 [mpv]: https://github.com/mpv-player/mpv
 [Zellij]: https://github.com/zellij-org/zellij
@@ -196,10 +202,10 @@ Other dotfiles that inspired me:
 [OBS]: https://obsproject.com
 [Mako]: https://github.com/emersion/mako
 [Nerd fonts]: https://github.com/ryanoasis/nerd-fonts
-[catppuccin]: https://github.com/catppuccin/catppuccin
+[catppuccin-nix]: https://github.com/catppuccin/nix
 [NetworkManager]: https://wiki.gnome.org/Projects/NetworkManager
 [wl-clipboard]: https://github.com/bugaevc/wl-clipboard
-[GDM]: https://wiki.archlinux.org/title/GDM
+[tuigreet]: https://github.com/apognu/tuigreet
 [thunar]: https://gitlab.xfce.org/xfce/thunar
 [Yazi]: https://github.com/sxyazi/yazi
 [Catppuccin]: https://github.com/catppuccin/catppuccin
@@ -3,5 +3,21 @@
 This is my private Private Key Infrastructure (PKI) / Certificate Authority (CA) for my personal
 use. It is used to issue certificates for my own servers and services.

-All the private keys are ignored by git, and will be stored in my private secrets repo
-[../secrets](../secrets/)
+## Current Structure
+
+- **ecc-ca.crt** - ECC CA certificate file
+- **ecc-ca.srl** - CA serial number file for certificate tracking
+- **ecc-csr.conf** - OpenSSL configuration file for certificate signing requests
+- **ecc-server.crt** - Server certificate signed by the ECC CA
+- **gen-certs.sh** - Shell script to generate certificates automatically
+
+## Security Notes
+
+All private keys (`.key` files) are ignored by git and stored in a private secrets repository. The
+public certificates and configuration files are committed to this repository for reference.
+
+## Usage
+
+Run `./gen-certs.sh` to generate new certificates using the ECC CA configuration.
+
+See [../secrets](../secrets/) for the corresponding private key management.
@@ -16,14 +16,14 @@
  nixConfig = {
    # substituers will be appended to the default substituters when fetching packages
    extra-substituters = [
-      "https://anyrun.cachix.org"
      # "https://nix-gaming.cachix.org"
      # "https://nixpkgs-wayland.cachix.org"
+      # "https://install.determinate.systems"
    ];
    extra-trusted-public-keys = [
-      "anyrun.cachix.org-1:pqBobmOjI7nKlsUMV25u9QHa9btJK65/C8vnO3p346s="
      # "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
      # "nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
+      # "cache.flakehub.com-3:hJuILl5sVK4iKm86JzgdXW12Y2Hwd5G07qKtHTOcDCM="
    ];
  };

@@ -35,14 +35,18 @@

    # Official NixOS package source, using nixos's unstable branch by default
    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    # nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.05";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
+    # revert mesa to 25.2.6
+    nixpkgs-mesa.url = "github:nixos/nixpkgs/2b1f0ea3ee3952e68b164efa0a1c5e394ef2e781";
+    nixpkgs-2505.url = "github:nixos/nixpkgs/nixos-25.05";

-    nixpkgs-ollama.url = "github:nixos/nixpkgs/nixos-unstable";
+    # nixpkgs with some custom patches
+    nixpkgs-patched.url = "github:ryan4yin/nixpkgs/nixos-unstable-patched";
+    # get some latest packages from the master branch
+    nixpkgs-master.url = "github:nixos/nixpkgs/master";

    # for macos
-    # nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-25.05-darwin";
+    # nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-25.11-darwin";
    nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-unstable";
    nix-darwin = {
      url = "github:lnl7/nix-darwin";
@@ -52,7 +56,7 @@
    # home-manager, used for managing user configuration
    home-manager = {
      url = "github:nix-community/home-manager/master";
-      # url = "github:nix-community/home-manager/release-25.05";
+      # url = "github:nix-community/home-manager/release-25.11";

      # The `follows` keyword in inputs is used for inheritance.
      # Here, `inputs.nixpkgs` of home-manager is kept consistent with the `inputs.nixpkgs` of the current flake,
@@ -67,7 +71,7 @@
    };

    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v0.4.2";
+      url = "github:nix-community/lanzaboote/v0.4.3";
      inputs.nixpkgs.follows = "nixpkgs";
    };

@@ -77,9 +81,10 @@

    # community wayland nixpkgs
    # nixpkgs-wayland.url = "github:nix-community/nixpkgs-wayland";
+
    # anyrun - a wayland launcher
    anyrun = {
-      url = "github:Kirottu/anyrun";
+      url = "github:/anyrun-org/anyrun/v25.9.3";
      inputs.nixpkgs.follows = "nixpkgs";
    };

@@ -97,11 +102,6 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    nix-gaming = {
-      url = "github:fufexan/nix-gaming";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
    disko = {
      url = "github:nix-community/disko/v1.11.0";
      inputs.nixpkgs.follows = "nixpkgs";
@@ -129,7 +129,7 @@
    };

    ghostty = {
-      url = "github:ghostty-org/ghostty";
+      url = "github:ghostty-org/ghostty/tip"; # Latest Continuous Release
    };

    blender-bin = {
@@ -138,17 +138,33 @@
    };

    nixos-apple-silicon = {
-      # 2025-07-04
-      url = "github:nix-community/nixos-apple-silicon/release-2025-08-10";
+      # asahi-6.17.7-2
+      url = "github:nix-community/nixos-apple-silicon/release-2025-11-18";
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    niri.url = "github:sodiboo/niri-flake";
+    helix = {
+      # Helix with steel as plugin system
+      # https://github.com/helix-editor/helix/pull/8675
+      url = "github:mattwparas/helix/steel-event-system";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # -------------- Gaming ---------------------
+
+    nix-gaming = {
+      url = "github:fufexan/nix-gaming";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    aagl = {
+      url = "github:ezKEa/aagl-gtk-on-nix/release-25.11";
+      # inputs.nixpkgs.follows = "nixpkgs";
+    };

    ########################  Some non-flake repositories  #########################################

-    polybar-themes = {
-      url = "github:adi1090x/polybar-themes";
+    nu_scripts = {
+      url = "github:ryan4yin/nu_scripts";
      flake = false;
    };

@@ -12,14 +12,53 @@
  1. Accessing the network when they don't need to.
  1. Accessing hardware devices they don't need.

-## Current Status
+## Current Structure

-1. **System Level**:
-   - [ ] AppArmor
-   - [ ] Kernel & System Hardening
-1. **Per-App Level**:
-   - Nixpak (Bubblewrap, running at user-level)
-   - Firejail (a SUID program, meaning it's running as root)
+### 1. **System Level**
+
+- **AppArmor** (`apparmor/`): AppArmor profiles and configuration
+- **Kernel & System Hardening** (`profiles/`): System-wide hardening profiles
+
+### 2. **Per-App Level**
+
+- **Nixpak** (`nixpaks/`): Bubblewrap-based sandboxing for applications
+  - Firefox configuration
+  - QQ (Chinese messaging app) configuration
+  - Modular system with reusable components
+- **Firejail** (legacy): SUID-based sandboxing (not used)
+- **Bubblewrap** (`bwraps/`): Direct bubblewrap configurations
+  - WeChat sandboxing configuration
+
+## Current Implementation Status
+
+| Component         | Status    | Notes                          |
+| ----------------- | --------- | ------------------------------ |
+| AppArmor Profiles | 🚧 WIP    | Basic structure in place       |
+| Nixpak Firefox    | ✅ Active | Firefox sandboxing via nixpak  |
+| Nixpak QQ         | ✅ Active | QQ application sandboxing      |
+| Bubblewrap WeChat | ✅ Active | WeChat specific sandboxing     |
+| System Profiles   | 🚧 WIP    | Hardened system configurations |
+
+## Directory Structure
+
+```
+hardening/
+├── README.md
+├── apparmor/           # AppArmor security profiles
+│   └── default.nix
+├── bwraps/            # Direct bubblewrap configurations
+│   ├── default.nix
+│   └── wechat.nix
+├── nixpaks/           # Nixpak application sandboxing
+│   ├── default.nix
+│   ├── firefox.nix
+│   ├── qq.nix
+│   └── modules/       # Reusable nixpak modules
+│       ├── gui-base.nix
+│       └── network.nix
+└── profiles/          # System hardening profiles
+    └── default.nix
+```

 ## Kernel Hardening

@@ -69,13 +108,6 @@ provide a much higher level of security.
 - [Paranoid NixOS Setup - xeiaso](https://xeiaso.net/blog/paranoid-nixos-2021-07-18/)
 - [nix-mineral](https://github.com/cynicsketch/nix-mineral): NixOS module for convenient system
  hardening.
- nixpak configs:
-  - https://github.com/pokon548/OysterOS/tree/b97604d89953373d6316286b96f6a964af2c398d/desktop/application
-  - https://github.com/segment-tree/my-nixos/tree/ceb6041f73bd9edcb78a8818b27a28f7c629193b/hm/me/apps/nixpak
-  - https://github.com/Keksgesicht/nixos-config/tree/91cc77d8d6b598da7c4dbed143e0009c2dea6940/packages/nixpak
-  - https://github.com/bluskript/nix-config/blob/7ecb6a7254c1ac4969072f4c4febdc19f8b83b30/pkgs/nixpak/default.nix
- firejail configs:
-  - https://github.com/stelcodes/nixos-config/blob/f8967c82a5e5f3d128eb1aaf7498b5f918f719ec/packages/overlay.nix#L261
 - apparmor configs:
  - https://github.com/zramctl/dotfiles/blob/4fe177f6984154960942bb47d5a375098ec6ed6a/modules/nixos/security/apparmor.nix#L4
  - https://git.grimmauld.de/Grimmauld/grimm-nixos-laptop/src/branch/main/hardening
@@ -1,5 +1,6 @@
 {
  pkgs,
+  pkgs-master,
  nixpak,
  ...
 }:
@@ -14,21 +15,17 @@ let
      (sloth.concat' sloth.homeDir mapdir)
    ];
  };
-  wrapper = _pkgs: path: (_pkgs.callPackage path callArgs).config.script;
+  wrapper = _pkgs: path: (_pkgs.callPackage path callArgs);
 in
 {
  # Add nixpaked Apps into nixpkgs, and reference them in home-manager or other nixos modules
  nixpkgs.overlays = [
    (_: super: {
      nixpaks = {
-        qq = wrapper super ./qq.nix;
-        qq-desktop-item = super.callPackage ./qq-desktop-item.nix { };
-
+        qq = wrapper pkgs-master ./qq.nix;
        wechat = wrapper super ./wechat.nix;
-        wechat-desktop-item = super.callPackage ./wechat-desktop-item.nix { };
-
+        telegram-desktop = wrapper super ./telegram-desktop.nix;
        firefox = wrapper super ./firefox.nix;
-        firefox-desktop-item = super.callPackage ./firefox-desktop-item.nix { };
      };
    })
  ];
@@ -1,11 +0,0 @@
-{ makeDesktopItem }:
-makeDesktopItem {
-  name = "firefox";
-  desktopName = "firefox";
-  exec = "firefox %U";
-  terminal = false;
-  icon = "firefox";
-  type = "Application";
-  categories = [ "Network" ];
-  comment = "firefox boxed";
-}
@@ -5,84 +5,123 @@
 # - Firefox's flatpak manifest: https://hg.mozilla.org/mozilla-central/file/tip/taskcluster/docker/firefox-flatpak/runme.sh#l151
 {
  lib,
-  pkgs,
+  firefox,
  mkNixPak,
+  buildEnv,
+  makeDesktopItem,
  ...
 }:
-mkNixPak {
-  config =
-    {
-      config,
-      sloth,
-      ...
-    }:
-    {
-      app = {
-        package = pkgs.firefox-wayland;
-        binPath = "bin/firefox";
-      };
-      flatpak.appId = "org.mozilla.firefox";

-      imports = [
-        ./modules/gui-base.nix
-        ./modules/network.nix
-      ];
+let
+  appId = "org.mozilla.firefox";
+  wrapped = mkNixPak {
+    config =
+      {
+        config,
+        sloth,
+        ...
+      }:
+      {
+        app = {
+          package = firefox;
+          binPath = "bin/firefox";
+        };
+        flatpak.appId = appId;

-      # list all dbus services:
-      #   ls -al /run/current-system/sw/share/dbus-1/services/
-      #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
-      dbus.policies = {
-        "org.mozilla.firefox.*" = "own"; # firefox
-        "org.mozilla.firefox_beta.*" = "own"; # firefox beta
-        "org.mpris.MediaPlayer2.firefox.*" = "own";
-        "org.freedesktop.NetworkManager" = "talk";
-
-        "org.gnome.Shell.Screencast" = "talk";
-        # System tray icon
-        "org.freedesktop.Notifications" = "talk";
-        "org.kde.StatusNotifierWatcher" = "talk";
-        # File Manager
-        "org.freedesktop.FileManager1" = "talk";
-        # Uses legacy StatusNotifier implementation
-        "org.kde.*" = "own";
-      };
-
-      bubblewrap = {
-        # To trace all the home files QQ accesses, you can use the following nushell command:
-        #   just trace-access firefox
-        # See the Justfile in the root of this repository for more information.
-        bind.rw = [
-          # given the read write permission to the following directories.
-          # NOTE: sloth.mkdir is used to create the directory if it does not exist!
-          (sloth.mkdir (sloth.concat' sloth.homeDir "/.mozilla"))
-
-          sloth.xdgDocumentsDir
-          sloth.xdgDownloadDir
-          sloth.xdgMusicDir
-          sloth.xdgVideosDir
-        ];
-        bind.ro = [
-          "/sys/bus/pci"
-          [
-            "${config.app.package}/lib/firefox"
-            "/app/etc/firefox"
-          ]
-
-          # ================ for browserpass extension ===============================
-          "/etc/gnupg"
-          (sloth.concat' sloth.homeDir "/.gnupg") # gpg's config
-          (sloth.concat' sloth.homeDir "/.local/share/password-store") # my secrets
-          (sloth.concat' sloth.runtimeDir "/gnupg") # for access gpg-agent socket
-
-          # Unsure
-          (sloth.concat' sloth.xdgConfigHome "/dconf")
+        imports = [
+          ./modules/gui-base.nix
+          ./modules/network.nix
+          ./modules/common.nix
        ];

-        sockets = {
-          x11 = false;
-          wayland = true;
-          pipewire = true;
+        bubblewrap = {
+          # To trace all the home files Firefox accesses, you can use the following nushell command:
+          #   just trace-access firefox
+          # See the Justfile in the root of this repository for more information.
+          bind.rw = [
+            # given the read write permission to the following directories.
+            # NOTE: sloth.mkdir is used to create the directory if it does not exist!
+            (sloth.mkdir (sloth.concat' sloth.homeDir "/.mozilla"))
+
+            sloth.xdgDocumentsDir
+            sloth.xdgDownloadDir
+            sloth.xdgMusicDir
+            sloth.xdgVideosDir
+            sloth.xdgPicturesDir
+          ];
+          bind.ro = [
+            "/sys/bus/pci"
+            [
+              "${config.app.package}/lib/firefox"
+              "/app/etc/firefox"
+            ]
+
+            # ================ for browserpass extension ===============================
+            "/etc/gnupg"
+            (sloth.concat' sloth.homeDir "/.gnupg") # gpg's config
+            (sloth.concat' sloth.homeDir "/.local/share/password-store") # my secrets
+            (sloth.concat' sloth.runtimeDir "/gnupg") # for access gpg-agent socket
+
+            # Unsure
+            (sloth.concat' sloth.xdgConfigHome "/dconf")
+          ];
+
+          sockets = {
+            x11 = false;
+            wayland = true;
+            pipewire = true;
+          };
        };
      };
-    };
+  };
+  exePath = lib.getExe wrapped.config.script;
+in
+buildEnv {
+  inherit (wrapped.config.script) name meta passthru;
+  paths = [
+    wrapped.config.script
+    (makeDesktopItem {
+      name = appId;
+      desktopName = "Firefox";
+      genericName = "Firefox Boxed";
+      comment = "Firefox Browser";
+      exec = "${exePath} %U";
+      terminal = false;
+      icon = "firefox";
+      startupNotify = true;
+      startupWMClass = "firefox";
+      type = "Application";
+      categories = [
+        "Network"
+        "WebBrowser"
+      ];
+      mimeTypes = [
+        "text/html"
+        "text/xml"
+        "application/xhtml+xml"
+        "application/vnd.mozilla.xul+xml"
+        "x-scheme-handler/http"
+        "x-scheme-handler/https"
+      ];
+
+      actions = {
+        new-private-window = {
+          name = "New Private Window";
+          exec = "${exePath} --private-window %U";
+        };
+        new-window = {
+          name = "New Window";
+          exec = "${exePath} --new-window %U";
+        };
+        profile-manager-window = {
+          name = "Profile Manager";
+          exec = "${exePath} --ProfileManager";
+        };
+      };
+
+      extraConfig = {
+        X-Flatpak = appId;
+      };
+    })
+  ];
 }
@@ -0,0 +1,234 @@
+# https://github.com/mnixry/nixos-config/blob/74913c2b90d06e31170bbbaa0074f915721da224/desktop/packages/nixpaks-common.nix
+# https://github.com/Kraftland/portable/blob/09c4a4227538a3f42de208a6ecbdc938ac9c00dd/portable.sh
+# https://flatpak.github.io/xdg-desktop-portal/docs/api-reference.html
+{
+  lib,
+  sloth,
+  config,
+  ...
+}:
+let
+  inherit (config.flatpak) appId;
+in
+{
+  config = {
+    # list all dbus services:
+    #   ls -al /run/current-system/sw/share/dbus-1/services/
+    #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
+    dbus = {
+      # `--see`: The bus name can be enumerated by the application.
+      # `--talk`: The application can send messages to, and receive replies and signals from, the bus name.
+      # `--own`: The application can own the bus name
+      policies = {
+        "${appId}" = "own";
+        "${appId}.*" = "own";
+        "org.freedesktop.DBus" = "talk";
+        "ca.desrt.dconf" = "talk";
+        "org.freedesktop.appearance" = "talk";
+        "org.freedesktop.appearance.*" = "talk";
+      }
+      // (builtins.listToAttrs (
+        map (id: lib.nameValuePair "org.kde.StatusNotifierItem-${toString id}-1" "own") (
+          lib.lists.range 2 29
+        )
+      ))
+      // {
+        # --- MPRIS Media Control ---
+        # Allows the app to register as a media player. These are derived from the appID.
+        "org.mpris.MediaPlayer2.${appId}" = "own";
+        "org.mpris.MediaPlayer2.${appId}.*" = "own";
+        "org.mpris.MediaPlayer2.${lib.lists.last (lib.strings.splitString "." appId)}" = "own";
+        "org.mpris.MediaPlayer2.${lib.lists.last (lib.strings.splitString "." appId)}.*" = "own";
+
+        # --- General Desktop Integration ---
+        "com.canonical.AppMenu.Registrar" = "talk"; # For Ubuntu AppMenu
+        "org.freedesktop.FileManager1" = "talk";
+        "org.freedesktop.Notifications" = "talk";
+        "org.kde.StatusNotifierWatcher" = "talk";
+        "org.gnome.Shell.Screencast" = "talk";
+
+        # --- Accessibility (a11y) 无障碍服务 ---
+        "org.a11y.Bus" = "see";
+
+        # --- Portal Access ---
+        # "org.freedesktop.portal.*" = "talk";
+        "org.freedesktop.portal.Documents" = "talk";
+        "org.freedesktop.portal.FileTransfer" = "talk";
+        "org.freedesktop.portal.FileTransfer.*" = "talk";
+        "org.freedesktop.portal.Notification" = "talk";
+        "org.freedesktop.portal.OpenURI" = "talk";
+        "org.freedesktop.portal.OpenURI.OpenFile" = "talk";
+        "org.freedesktop.portal.OpenURI.OpenURI" = "talk";
+        "org.freedesktop.portal.Print" = "talk";
+        "org.freedesktop.portal.Request" = "see";
+
+        # --- Input Method Portals ---
+        "org.freedesktop.portal.Fcitx" = "talk";
+        "org.freedesktop.portal.Fcitx.*" = "talk";
+        "org.freedesktop.portal.IBus" = "talk";
+        "org.freedesktop.portal.IBus.*" = "talk";
+      };
+      # '--call' rules permit specific method calls on D-Bus interfaces.
+      rules.call = {
+        # --- Accessibility (a11y) 无障碍服务 ---
+        "org.a11y.Bus" = [
+          "org.a11y.Bus.GetAddress@/org/a11y/bus"
+          "org.freedesktop.DBus.Properties.Get@/org/a11y/bus"
+        ];
+
+        # --- General Portal Rules ---
+        "org.freedesktop.FileManager1" = [ "*" ];
+        "org.freedesktop.Notifications.*" = [ "*" ];
+        "org.freedesktop.portal.Documents" = [ "*" ];
+        "org.freedesktop.portal.FileTransfer" = [ "*" ];
+        "org.freedesktop.portal.FileTransfer.*" = [ "*" ];
+        "org.freedesktop.portal.Fcitx" = [ "*" ];
+        "org.freedesktop.portal.Fcitx.*" = [ "*" ];
+        "org.freedesktop.portal.IBus" = [ "*" ];
+        "org.freedesktop.portal.IBus.*" = [ "*" ];
+        "org.freedesktop.portal.Notification" = [ "*" ];
+        "org.freedesktop.portal.OpenURI" = [ "*" ];
+        "org.freedesktop.portal.OpenURI.OpenFile" = [ "*" ];
+        "org.freedesktop.portal.OpenURI.OpenURI" = [ "*" ];
+        "org.freedesktop.portal.Print" = [ "*" ];
+        "org.freedesktop.portal.Request" = [ "*" ];
+
+        # --- Main Desktop Portal Interface ---
+        # A comprehensive list of permissions for interacting with the desktop environment.
+        "org.freedesktop.portal.Desktop" = [
+          # Properties & Settings
+          "org.freedesktop.DBus.Properties.GetAll"
+          "org.freedesktop.DBus.Properties.Get@/org/freedesktop/portal/desktop"
+          "org.freedesktop.portal.Session.Close"
+          "org.freedesktop.portal.Settings.ReadAll"
+          "org.freedesktop.portal.Settings.Read"
+          "org.freedesktop.portal.Account.GetUserInformation"
+
+          # Network & Proxy
+          "org.freedesktop.portal.NetworkMonitor"
+          "org.freedesktop.portal.NetworkMonitor.*"
+          "org.freedesktop.portal.ProxyResolver.Lookup"
+          "org.freedesktop.portal.ProxyResolver.Lookup.*"
+
+          # Screenshot / Screen Capture & Sharing
+          "org.freedesktop.portal.ScreenCast"
+          "org.freedesktop.portal.ScreenCast.*"
+          "org.freedesktop.portal.Screenshot"
+          "org.freedesktop.portal.Screenshot.Screenshot"
+
+          # Device Access(Camera / USB)
+          "org.freedesktop.portal.Camera"
+          "org.freedesktop.portal.Camera.*"
+          "org.freedesktop.portal.Usb"
+          "org.freedesktop.portal.Usb.*"
+
+          # Remote Desktop
+          "org.freedesktop.portal.RemoteDesktop"
+          "org.freedesktop.portal.RemoteDesktop.*"
+
+          # File Operations
+          "org.freedesktop.portal.Documents"
+          "org.freedesktop.portal.Documents.*"
+          "org.freedesktop.portal.FileChooser"
+          "org.freedesktop.portal.FileChooser.*"
+          "org.freedesktop.portal.FileTransfer"
+          "org.freedesktop.portal.FileTransfer.*"
+
+          # Notifications & Printing
+          "org.freedesktop.portal.Notification"
+          "org.freedesktop.portal.Notification.*"
+          "org.freedesktop.portal.Print"
+          "org.freedesktop.portal.Print.*"
+
+          # Open/Launch Handlers
+          "org.freedesktop.portal.OpenURI"
+          "org.freedesktop.portal.OpenURI.*"
+          "org.freedesktop.portal.Email.ComposeEmail"
+
+          # Input Methods
+          "org.freedesktop.portal.Fcitx"
+          "org.freedesktop.portal.Fcitx.*"
+          "org.freedesktop.portal.IBus"
+          "org.freedesktop.portal.IBus.*"
+
+          # Secrets (Keyring)
+          "org.freedesktop.portal.Secret"
+          "org.freedesktop.portal.Secret.RetrieveSecret"
+
+          # Get/Update GlobalShortcuts
+          # "org.freedesktop.portal.GlobalShortcuts"
+          # "org.freedesktop.portal.GlobalShortcuts.*"
+
+          # -- get the user's location
+          # "org.freedesktop.portal.Location"
+          # "org.freedesktop.portal.Location.*"
+
+          # -- inhibit the user session from ending, suspending, idling or getting switched away.
+          "org.freedesktop.portal.Inhibit"
+          "org.freedesktop.portal.Inhibit.*"
+
+          # Generic Request Fallback
+          "org.freedesktop.portal.Request"
+        ];
+      };
+
+      # 'broadcast' rules permit receiving signals from D-Bus names.
+      rules.broadcast = {
+        "org.freedesktop.portal.*" = [ "@/org/freedesktop/portal/*" ];
+      };
+      args = [
+        "--filter"
+        "--sloppy-names"
+        "--log"
+      ];
+    };
+
+    etc.sslCertificates.enable = true;
+    bubblewrap = {
+      network = lib.mkDefault true;
+      sockets = {
+        wayland = true;
+        pulse = true;
+      };
+
+      bind.rw = with sloth; [
+        [
+          (mkdir appDataDir)
+          xdgDataHome
+        ]
+        [
+          (mkdir appConfigDir)
+          xdgConfigHome
+        ]
+        [
+          (mkdir appCacheDir)
+          xdgCacheHome
+        ]
+
+        (sloth.concat [
+          sloth.runtimeDir
+          "/"
+          (sloth.envOr "WAYLAND_DISPLAY" "no")
+        ])
+        (sloth.concat' sloth.runtimeDir "/at-spi/bus")
+        (sloth.concat' sloth.runtimeDir "/gvfsd")
+        (sloth.concat' sloth.runtimeDir "/dconf")
+
+        (sloth.concat' sloth.xdgCacheHome "/fontconfig")
+        (sloth.concat' sloth.xdgCacheHome "/mesa_shader_cache")
+        (sloth.concat' sloth.xdgCacheHome "/mesa_shader_cache_db")
+        (sloth.concat' sloth.xdgCacheHome "/radv_builtin_shaders")
+      ];
+      bind.ro = [
+        (sloth.concat' sloth.runtimeDir "/doc")
+        (sloth.concat' sloth.xdgConfigHome "/kdeglobals")
+        (sloth.concat' sloth.xdgConfigHome "/gtk-2.0")
+        (sloth.concat' sloth.xdgConfigHome "/gtk-3.0")
+        (sloth.concat' sloth.xdgConfigHome "/gtk-4.0")
+        (sloth.concat' sloth.xdgConfigHome "/fontconfig")
+        (sloth.concat' sloth.xdgConfigHome "/dconf")
+      ];
+      bind.dev = [ "/dev/shm" ] ++ (map (id: "/dev/video${toString id}") (lib.lists.range 0 9));
+    };
+  };
+}
@@ -16,15 +16,7 @@ in
  config = {
    dbus.policies = {
      "${config.flatpak.appId}" = "own";
-      "org.freedesktop.DBus" = "talk";
-      "org.gtk.vfs.*" = "talk";
-      "org.gtk.vfs" = "talk";
-      "ca.desrt.dconf" = "talk";
-      "org.a11y.Bus" = "talk";
-
-      # for default portal & gtk/hyprland's portal
-      "org.freedesktop.portal.*" = "talk";
-      "org.freedesktop.impl.portal.desktop.*" = "talk";
+      # we add other policies in ./common.nix
    };
    # https://github.com/nixpak/nixpak/blob/master/modules/gpu.nix
    # 1. bind readonly - /run/opengl-driver
@@ -69,8 +61,8 @@ in
        (sloth.concat' sloth.xdgConfigHome "/fontconfig")

        "/etc/fonts" # for fontconfig
-        "/etc/machine-id"
-        "/etc/localtime"
+        "/etc/localtime" # this is a symlink to /etc/zoneinfo/xxx
+        "/etc/zoneinfo"

        # Fix: libEGL warning: egl: failed to create dri2 screen
        "/etc/egl"
@@ -1,17 +0,0 @@
-{
-  makeDesktopItem,
-  qq,
-}:
-makeDesktopItem {
-  name = "qq";
-  desktopName = "QQ";
-  exec = "${qq}/bin/qq %U";
-  terminal = false;
-  # To find the icon name(nushell):
-  #   let p = NIXPKGS_ALLOW_UNFREE=1 nix eval --impure nixpkgs#qq.outPath | str trim --char '"'
-  #   tree $"($p)/share/icons"
-  icon = "${qq}/share/icons/hicolor/512x512/apps/qq.png";
-  type = "Application";
-  categories = [ "Network" ];
-  comment = "QQ boxed";
-}
@@ -5,65 +5,75 @@
 # - QQ's flatpak manifest: https://github.com/flathub/com.qq.QQ/blob/master/com.qq.QQ.yaml
 {
  lib,
-  pkgs,
+  qq,
  mkNixPak,
+  buildEnv,
+  makeDesktopItem,
  ...
 }:
-mkNixPak {
-  config =
-    { sloth, ... }:
-    {
-      app = {
-        package = pkgs.qq.override {
-          # fix fcitx5 input method
-          commandLineArgs = lib.concatStringsSep " " [ "--enable-wayland-ime" ];
+
+let
+  appId = "com.qq.QQ";
+
+  wrapped = mkNixPak {
+    config =
+      { sloth, ... }:
+      {
+        app = {
+          package = qq;
+          binPath = "bin/qq";
        };
-        binPath = "bin/qq";
-      };
-      flatpak.appId = "com.tencent.qq";
+        flatpak.appId = appId;

-      imports = [
-        ./modules/gui-base.nix
-        ./modules/network.nix
-      ];
-
-      # list all dbus services:
-      #   ls -al /run/current-system/sw/share/dbus-1/services/
-      #   ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
-      dbus.policies = {
-        "org.gnome.Shell.Screencast" = "talk";
-        # System tray icon
-        "org.freedesktop.Notifications" = "talk";
-        "org.kde.StatusNotifierWatcher" = "talk";
-        # File Manager
-        "org.freedesktop.FileManager1" = "talk";
-        # Uses legacy StatusNotifier implementation
-        "org.kde.*" = "own";
-      };
-      bubblewrap = {
-        # To trace all the home files QQ accesses, you can use the following nushell command:
-        #   just trace-access qq
-        # See the Justfile in the root of this repository for more information.
-        bind.rw = [
-          # given the read write permission to the following directories.
-          # NOTE: sloth.mkdir is used to create the directory if it does not exist!
-          (sloth.mkdir (
-            sloth.concat [
-              sloth.xdgConfigHome
-              "/QQ"
-            ]
-          ))
-
-          sloth.xdgDocumentsDir
-          sloth.xdgDownloadDir
-          sloth.xdgMusicDir
-          sloth.xdgVideosDir
+        imports = [
+          ./modules/gui-base.nix
+          ./modules/network.nix
+          ./modules/common.nix
        ];
-        sockets = {
-          x11 = false;
-          wayland = true;
-          pipewire = true;
+
+        bubblewrap = {
+          # To trace all the home files QQ accesses, you can use the following nushell command:
+          #   just trace-access qq
+          # See the Justfile in the root of this repository for more information.
+          bind.rw = [
+            sloth.xdgDocumentsDir
+            sloth.xdgDownloadDir
+            sloth.xdgMusicDir
+            sloth.xdgVideosDir
+            sloth.xdgPicturesDir
+          ];
+          sockets = {
+            x11 = false;
+            wayland = true;
+            pipewire = true;
+          };
        };
      };
-    };
+  };
+  exePath = lib.getExe wrapped.config.script;
+in
+buildEnv {
+  inherit (wrapped.config.script) name meta passthru;
+  paths = [
+    wrapped.config.script
+    (makeDesktopItem {
+      name = appId;
+      desktopName = "QQ";
+      genericName = "QQ Boxed";
+      comment = "Tencent QQ, also known as QQ, is an instant messaging software service and web portal developed by the Chinese technology company Tencent.";
+      exec = "${exePath} %U";
+      terminal = false;
+      icon = "${qq}/share/icons/hicolor/512x512/apps/qq.png";
+      startupNotify = true;
+      startupWMClass = "QQ";
+      type = "Application";
+      categories = [
+        "InstantMessaging"
+        "Network"
+      ];
+      extraConfig = {
+        X-Flatpak = appId;
+      };
+    })
+  ];
 }
@@ -0,0 +1,101 @@
+{
+  lib,
+  telegram-desktop,
+  buildEnv,
+  mkNixPak,
+  makeDesktopItem,
+  ...
+}:
+let
+  appId = "org.telegram.desktop";
+  wrapped = mkNixPak {
+    config =
+      { sloth, ... }:
+      {
+        imports = [
+          ./modules/gui-base.nix
+          ./modules/network.nix
+          ./modules/common.nix
+        ];
+        app.package = telegram-desktop;
+        flatpak = {
+          appId = appId;
+        };
+        dbus = {
+          enable = true;
+          policies = {
+            "com.canonical.indicator.application" = "talk";
+            "org.ayatana.indicator.application" = "talk";
+            "org.sigxcpu.Feedback" = "talk";
+          };
+        };
+
+        bubblewrap = {
+          bind.rw = [
+            sloth.xdgDocumentsDir
+            sloth.xdgDownloadDir
+            sloth.xdgMusicDir
+            sloth.xdgVideosDir
+            sloth.xdgPicturesDir
+          ];
+          sockets = {
+            x11 = false;
+            wayland = true;
+            pipewire = true;
+          };
+        };
+      };
+  };
+  exePath = lib.getExe wrapped.config.script;
+in
+buildEnv {
+  inherit (wrapped.config.script) name meta passthru;
+  paths = [
+    wrapped.config.script
+    (makeDesktopItem {
+      name = appId;
+      desktopName = "Telegram";
+      comment = "New era of messaging";
+      tryExec = "${exePath}";
+      exec = "${exePath} -- %u";
+      icon = appId;
+      startupNotify = true;
+      startupWMClass = appId;
+      terminal = false;
+      type = "Application";
+      categories = [
+        "Chat"
+        "Network"
+        "InstantMessaging"
+        "Qt"
+      ];
+      mimeTypes = [
+        "x-scheme-handler/tg"
+        "x-scheme-handler/tonsite"
+      ];
+      keywords = [
+        "tg"
+        "chat"
+        "im"
+        "messaging"
+        "messenger"
+        "sms"
+        "tdesktop"
+      ];
+      actions = {
+        quit = {
+          name = "Quit Telegram";
+          exec = "${exePath} -quit";
+          icon = "application-exit";
+        };
+      };
+      extraConfig = {
+        X-Flatpak = appId;
+        DBusActivatable = "true";
+        SingleMainWindow = "true";
+        X-GNOME-UsesNotifications = "true";
+        X-GNOME-SingleWindow = "true";
+      };
+    })
+  ];
+}
@@ -1,5 +1,49 @@
 # Home Manager's Submodules

-1. `base`: The base module that is suitable for both Linux and macOS.
-2. `linux`: Linux-specific configuration.
-3. `darwin`: macOS-specific configuration.
+This directory contains all Home Manager configurations organized by platform and functionality.
+
+## Current Structure
+
+```
+home/
+├── base/              # Cross-platform home manager configurations
+│   ├── core/          # Essential applications and settings
+│   │   ├── editors/   # Editor configurations (Neovim, Helix)
+│   │   ├── shells/    # Shell configurations (Nushell, Zellij)
+│   │   └── ...
+│   ├── gui/           # GUI applications and desktop settings
+│   │   ├── terminal/  # Terminal emulators (Kitty, Alacritty, etc.)
+│   │   └── ...
+│   ├── tui/           # Terminal/TUI applications
+│   │   ├── editors/   # TUI editors and related tools
+│   │   ├── encryption/ # GPG, password-store, etc.
+│   │   └── ...
+│   └── home.nix       # Main home manager entry point
+├── linux/             # Linux-specific home manager configurations
+│   ├── base/          # Linux base configurations
+│   ├── gui/           # Linux GUI applications
+│   │   ├── hyprland/  # Hyprland window manager
+│   │   ├── niri/      # Niri window manager
+│   │   └── ...
+│   ├── editors/       # Linux-specific editors
+│   └── ...
+└── darwin/            # macOS-specific home manager configurations
+    ├── aerospace/     # macOS window manager
+    ├── proxy/         # Proxy configurations
+    └── ...
+```
+
+## Module Overview
+
+1. **base**: The base module suitable for both Linux and macOS
+   - Cross-platform applications and settings
+   - Shared configurations for editors, shells, and essential tools
+
+2. **linux**: Linux-specific configuration
+   - Desktop environments (Hyprland, Niri)
+   - Linux-specific GUI applications
+   - System integration tools
+
+3. **darwin**: macOS-specific configuration
+   - macOS applications and services
+   - Platform-specific integrations (Aerospace, Squirrel, etc.)
@@ -1,5 +1,66 @@
 # Home Manager's Base Submodules

-1. `server`: Configuration which is suitable for both servers and desktops.
-1. `desktop`: Configuration for desktop environments, such as Hyprland, I3, etc.
-1. `core.nix`: Minimal home-manager's config
+This directory contains cross-platform base configurations that are shared between Linux and Darwin
+systems.
+
+## Configuration Structure
+
+### Core System
+
+- **core/**: Essential cross-platform configurations
+  - **core.nix**: Minimal home-manager configuration
+  - **shells/**: Shell configurations (bash, zsh, fish, nu)
+  - **editors/**: Text editor configurations
+    - **neovim/**: Neovim with custom plugins and settings
+    - **helix/**: Helix editor configuration
+  - **btop.nix**: System monitoring tools
+  - **git.nix**: Git configuration and aliases
+  - **npm.nix**: Node.js package management
+  - **pip.nix**: Python package management
+  - **starship.nix**: Cross-shell prompt configuration
+  - **theme.nix**: Color schemes and theming
+  - **yazi.nix**: Terminal file manager configuration
+  - **zellij/**: Terminal multiplexer with custom layouts
+
+### Desktop Environment
+
+- **gui/**: Cross-platform GUI applications and configurations
+  - **dev-tools.nix**: Development tools and IDEs
+  - **media.nix**: Media players and utilities
+  - **terminal/**: Terminal emulator configurations
+    - **alacritty/**: Alacritty terminal
+    - **kitty/**: Kitty terminal
+    - **foot/**: Foot terminal (Linux)
+    - **ghostty/**: Ghostty terminal
+
+### Terminal Interface
+
+- **tui/**: Terminal-based interface configurations
+  - **cloud/**: Cloud development tools (Terraform, etc.)
+  - **container.nix**: Container tools (Docker, Podman)
+  - **dev-tools.nix**: Terminal-based development tools
+  - **editors/**: Terminal editor configurations
+  - **encryption/**: Encryption and security tools
+  - **gpg/**: GPG key management
+  - **password-store/**: Password management with pass
+  - **shell.nix**: Shell environment configurations
+  - **ssh/**: SSH configuration and management
+  - **zellij/**: Terminal workspace management
+
+### System Management
+
+- **home.nix**: Main home manager configuration file
+
+## Platform Compatibility
+
+All configurations in this directory are designed to work across:
+
+- **Linux**: All distributions with Nix and Home Manager
+- **macOS**: Darwin systems with Home Manager
+- **WSL**: Windows Subsystem for Linux
+
+## Usage
+
+These base configurations provide the foundation for both Linux and Darwin systems, ensuring
+consistent environments across different platforms while allowing for platform-specific
+customizations.
@@ -1,34 +1,6 @@
 { pkgs, ... }:
 {
  home.packages = with pkgs; [
-    # Misc
-    cowsay
-    gnupg
-    gnumake
-
-    # Modern cli tools, replacement of grep/sed/...
-
-    # Interactively filter its input using fuzzy searching, not limit to filenames.
-    fzf
-    # search for files by name, faster than find
-    fd
-    # search for files by its content, replacement of grep
-    (ripgrep.override { withPCRE2 = true; })
-
-    # A fast and polyglot tool for code searching, linting, rewriting at large scale
-    # supported languages: only some mainstream languages currently(do not support nix/nginx/yaml/toml/...)
-    ast-grep
-
-    sad # CLI search and replace, just like sed, but with diff preview.
-    yq-go # yaml processor https://github.com/mikefarah/yq
-    just # a command runner like make, but simpler
-    hyperfine # command-line benchmarking tool
-    gping # ping, but with a graph(TUI)
-    doggo # DNS client for humans
-    duf # Disk Usage/Free Utility - a better 'df' alternative
-    du-dust # A more intuitive version of `du` in rust
-    gdu # disk usage analyzer(replacement of `du`)
-
    # nix related
    #
    # it provides the command `nom` works just like `nix
@@ -42,10 +14,15 @@
    # https://github.com/utdemir/nix-tree
    nix-tree # A TUI to visualize the dependency graph of a nix derivation

-    # productivity
+    # misc
+    cowsay
+    gnupg
    caddy # A webserver with automatic HTTPS via Let's Encrypt(replacement of nginx)
-    croc # File transfer between computers securely and easily
-    ncdu # analyzer your disk usage Interactively, via TUI(replacement of `du`)
+    # A fast and polyglot tool for code searching, linting, rewriting at large scale
+    # supported languages: only some mainstream languages currently(do not support nix/nginx/yaml/toml/...)
+    ast-grep
+
+    # other core cli tools are installed at system-level
  ];

  # A modern replacement for ‘ls’
@@ -1,3 +1,10 @@
 # Editors

-See [desktop/editors/](../../desktop/editors/) for more details.
+This directory contains editor configurations that are shared across different environments.
+
+## Available Editors
+
+- **neovim/**: Neovim configuration with AstroNvim
+- **helix/**: Helix editor configuration
+
+These configurations are designed to work across both terminal and GUI environments.
@@ -1,6 +1,4 @@
 { pkgs, ... }:
 {
-  programs.helix = {
-    enable = true;
-  };
+  programs.helix.enable = true;
 }
@@ -40,18 +40,27 @@
    enable = true;
    lfs.enable = true;

-    userName = myvars.userfullname;
-    userEmail = myvars.useremail;
+    # signing = {
+    #   key = "xxx";
+    #   signByDefault = true;
+    # };

    includes = [
      {
-        # use different email & name for work
+        # use different email & name for work:
+        #
+        # [user]
+        #   email = "xxx@xxx.com"
+        #   name = "Ryan Yin"
        path = "~/work/.gitconfig";
        condition = "gitdir:~/work/";
      }
    ];

-    extraConfig = {
+    settings = {
+      user.email = myvars.useremail;
+      user.name = myvars.userfullname;
+
      init.defaultBranch = "main";
      trim.bases = "develop,master,main"; # for git-trim
      push.autoSetupRemote = true;
@@ -63,58 +72,51 @@
        "ssh://git@github.com/ryan4yin" = {
          insteadOf = "https://github.com/ryan4yin";
        };
-        # "ssh://git@gitlab.com/" = {
-        #   insteadOf = "https://gitlab.com/";
-        # };
-        # "ssh://git@bitbucket.com/" = {
-        #   insteadOf = "https://bitbucket.com/";
+        # "ssh://git@bitbucket.com/ryan4yin" = {
+        #   insteadOf = "https://bitbucket.com/ryan4yin";
        # };
      };
-    };

-    # signing = {
-    #   key = "xxx";
-    #   signByDefault = true;
-    # };
+      aliases = {
+        # common aliases
+        br = "branch";
+        co = "checkout";
+        st = "status";
+        ls = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate";
+        ll = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate --numstat";
+        cm = "commit -m"; # commit via `git cm <message>`
+        ca = "commit -am"; # commit all changes via `git ca <message>`
+        dc = "diff --cached";

-    # A syntax-highlighting pager for git, diff, grep, and blame output
-    delta = {
-      enable = true;
-      options = {
-        diff-so-fancy = true;
-        line-numbers = true;
-        true-color = "always";
-        # features => named groups of settings, used to keep related settings organized
-        # features = "";
+        amend = "commit --amend -m"; # amend commit message via `git amend <message>`
+        unstage = "reset HEAD --"; # unstage file via `git unstage <file>`
+        merged = "branch --merged"; # list merged(into HEAD) branches via `git merged`
+        unmerged = "branch --no-merged"; # list unmerged(into HEAD) branches via `git unmerged`
+        nonexist = "remote prune origin --dry-run"; # list non-exist(remote) branches via `git nonexist`
+
+        # delete merged branches except master & dev & staging
+        #  `!` indicates it's a shell script, not a git subcommand
+        delmerged = ''! git branch --merged | egrep -v "(^\*|main|master|dev|staging)" | xargs git branch -d'';
+        # delete non-exist(remote) branches
+        delnonexist = "remote prune origin";
+
+        # aliases for submodule
+        update = "submodule update --init --recursive";
+        foreach = "submodule foreach";
      };
    };
+  };

-    aliases = {
-      # common aliases
-      br = "branch";
-      co = "checkout";
-      st = "status";
-      ls = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate";
-      ll = "log --pretty=format:\"%C(yellow)%h%Cred%d\\\\ %Creset%s%Cblue\\\\ [%cn]\" --decorate --numstat";
-      cm = "commit -m"; # commit via `git cm <message>`
-      ca = "commit -am"; # commit all changes via `git ca <message>`
-      dc = "diff --cached";
-
-      amend = "commit --amend -m"; # amend commit message via `git amend <message>`
-      unstage = "reset HEAD --"; # unstage file via `git unstage <file>`
-      merged = "branch --merged"; # list merged(into HEAD) branches via `git merged`
-      unmerged = "branch --no-merged"; # list unmerged(into HEAD) branches via `git unmerged`
-      nonexist = "remote prune origin --dry-run"; # list non-exist(remote) branches via `git nonexist`
-
-      # delete merged branches except master & dev & staging
-      #  `!` indicates it's a shell script, not a git subcommand
-      delmerged = ''! git branch --merged | egrep -v "(^\*|main|master|dev|staging)" | xargs git branch -d'';
-      # delete non-exist(remote) branches
-      delnonexist = "remote prune origin";
-
-      # aliases for submodule
-      update = "submodule update --init --recursive";
-      foreach = "submodule foreach";
+  # A syntax-highlighting pager for git, diff, grep, and blame output
+  programs.delta = {
+    enable = true;
+    enableGitIntegration = true;
+    options = {
+      diff-so-fancy = true;
+      line-numbers = true;
+      true-color = "always";
+      # features => named groups of settings, used to keep related settings organized
+      # features = "";
    };
  };

@@ -122,5 +124,5 @@
  programs.lazygit.enable = true;

  # Yet another Git TUI (written in rust).
-  programs.gitui.enable = true;
+  programs.gitui.enable = false;
 }
@@ -27,7 +27,6 @@ in
  # NOTE: nushell will be launched in bash, so it can inherit all the eenvironment variables.
  programs.nushell = {
    enable = true;
-    # package = pkgs-unstable.nushell;
    configFile.source = ./config.nu;
    inherit shellAliases;
  };
@@ -6,20 +6,24 @@
    enableZshIntegration = true;
    enableNushellIntegration = true;

+    # https://starship.rs/config/
    settings = {
+      # Get editor completions based on the config schema
+      "$schema" = "https://starship.rs/config-schema.json";
      character = {
-        success_symbol = "[›](bold green)";
-        error_symbol = "[›](bold red)";
+        success_symbol = "[➜](bold green)";
+        error_symbol = "[➜](bold red)";
      };
-      aws = {
-        symbol = "🅰 ";
-      };
-      gcloud = {
-        # do not show the account/project's info
-        # to avoid the leak of sensitive information when sharing the terminal
-        format = "on [$symbol$active(\($region\))]($style) ";
-        symbol = "🅶 ️";
+      # I never rely on the defaults, so this module is useless to me—disabled.
+      # I prefer adding --project, --region to very gcloud/aws command.
+      aws.disabled = true;
+      gcloud.disabled = true;
+
+      kubernetes = {
+        symbol = "⛵";
+        disabled = false;
      };
+      os.disabled = false;
    };
  };
 }
@@ -52,7 +52,7 @@ Error opening terminal: xterm-kitty.

 NixOS preserve the `TERMINFO` and `TERMINFO_DIRS` environment variables, for `root` and the `wheel`
 group:
-[nixpkgs/nixos/modules/config/terminfo.nix](https://github.com/NixOS/nixpkgs/blob/nixos-25.05/nixos/modules/config/terminfo.nix#L18)
+[nixpkgs/nixos/modules/config/terminfo.nix](https://github.com/NixOS/nixpkgs/blob/nixos-25.11/nixos/modules/config/terminfo.nix#L18)

 For nix-darwin, take a look at <https://github.com/LnL7/nix-darwin/wiki/Terminfo-issues>

@@ -1,6 +1,5 @@
 {
  pkgs,
-  pkgs-unstable,
  ...
 }:
 ###########################################################
@@ -26,7 +25,6 @@
 {
  programs.alacritty = {
    enable = true;
-    # package = pkgs-unstable.alacritty;
    # https://alacritty.org/config-alacritty.html
    settings = {
      window = {
@@ -52,7 +50,7 @@
        bold_italic = {
          family = "Maple Mono NF CN";
        };
-        size = if pkgs.stdenv.isDarwin then 14 else 13;
+        size = 13;
      };
      terminal = {
        # Spawn a nushell in login mode via `bash`
@@ -17,8 +17,9 @@
    settings = {
      main = {
        term = "foot"; # or "xterm-256color" for maximum compatibility
-        font = "Maple Mono NF CN:size=14";
+        font = "Maple Mono NF CN:size=13";
        dpi-aware = "no"; # scale via window manager instead
+        resize-keep-grid = "no"; # do not resize the window on font resizing

        # Spawn a nushell in login mode via `bash`
        shell = "${pkgs.bash}/bin/bash --login -c 'nu --login --interactive'";
@@ -16,7 +16,7 @@
        pkgs.hello # pkgs.ghostty is currently broken on darwin
      else
        pkgs.ghostty; # the stable version
-    # package = ghostty.packages.${pkgs.system}.default; # the latest version
+    # package = ghostty.packages.${pkgs.stdenv.hostPlatform.system}.default; # the latest version
    enableBashIntegration = false;
    installBatSyntax = false;
    # installVimSyntax = true;
@@ -19,7 +19,7 @@
    font = {
      name = "Maple Mono NF CN";
      # use different font size on macOS
-      size = if pkgs.stdenv.isDarwin then 14 else 13;
+      size = 13;
    };

    # consistent with other terminal emulators
@@ -1,6 +1,6 @@
 {
  pkgs,
-  pkgs-unstable,
+  pkgs-2505,
  nur-ryan4yin,
  ...
 }:
@@ -14,6 +14,7 @@

    kubectl
    kubectx # kubectx & kubens
+    kubie # same as kubectl-ctx, but per-shell (won’t touch kubeconfig).
    kubectl-view-secret # kubectl view-secret
    kubectl-tree # kubectl tree
    kubectl-node-shell # exec into node
@@ -24,7 +25,7 @@
    istioctl
    clusterctl # for kubernetes cluster-api
    kubevirt # virtctl
-    kubernetes-helm
+    pkgs-2505.kubernetes-helm
    fluxcd
    argocd

@@ -1,6 +1,5 @@
 {
  pkgs,
-  pkgs-unstable,
  ...
 }:
 {
@@ -18,6 +17,8 @@
  home.packages = with pkgs; [
    colmena # nixos's remote deployment tool

+    tokei # count lines of code, alternative to cloc
+
    # db related
    mycli
    pgcli
@@ -34,7 +35,6 @@
    devbox
    bfg-repo-cleaner # remove large files from git history
    k6 # load testing tool
-    protobuf # protocol buffer compiler

    # solve coding extercises - learn by doing
    exercism
@@ -1,8 +1,29 @@
-{ pkgs, ... }:
 {
+  config,
+  pkgs,
+  helix,
+  ...
+}:
+
+let
+  helixPackages = helix.packages.${pkgs.stdenv.hostPlatform.system};
+in
+{
+  # to make steel work, we need to git clone this repo to your home directory.
+  home.sessionVariables.HELIX_STEEL_CONFIG = "${config.home.homeDirectory}/nix-config/home/base/tui/editors/helix/steel";
+
+  home.packages = with pkgs; [
+    steel
+  ];
+
  programs.helix = {
    enable = true;
-    package = pkgs.helix;
+    # enable steel as the plugin system
+    # https://github.com/helix-editor/helix/pull/8675
+    # https://github.com/mattwparas/helix/blob/steel-event-system/STEEL.md
+    package = helixPackages.default.overrideAttrs (prevAttrs: {
+      cargoBuildFeatures = prevAttrs.cargoBuildFeatures or [ ] ++ [ "steel" ];
+    });
    settings = {
      editor = {
        line-number = "relative";
@@ -0,0 +1,40 @@
+;; The helix.scm module will be loaded first before anything else, 
+;; the runtime will require this module, and any functions exported
+;; will now be available to be used as typed commands, e.g. :git-add :open-helix-scm
+
+(require "helix/editor.scm")
+(require (prefix-in helix. "helix/commands.scm"))
+(require (prefix-in helix.static. "helix/static.scm"))
+
+(provide shell git-add open-helix-scm open-init-scm)
+
+(define (current-path)
+  (let* ([focus (editor-focus)]
+         [focus-doc-id (editor->doc-id focus)])
+    (editor-document->path focus-doc-id)))
+
+;;@doc
+;; Specialized shell implementation, where % is a wildcard for the current file
+(define (shell . args)
+  (helix.run-shell-command
+    (string-join
+      ;; Replace the % with the current file
+      (map (lambda (x) (if (equal? x "%") (current-path) x)) args)
+      " ")))
+
+;;@doc
+;; Adds the current file to git	
+(define (git-add)
+  (shell "git" "add" "%"))
+
+;;@doc
+;; Open the helix.scm file
+(define (open-helix-scm)
+  (helix.open (helix.static.get-helix-scm-path)))
+
+;;@doc
+;; Opens the init.scm file
+(define (open-init-scm)
+  (helix.open (helix.static.get-init-scm-path)))
+  
+  
@@ -0,0 +1,24 @@
+;; The init.scm file is run at the top level, immediately after the helix.scm module is required.
+;; The helix context is available here, so you can interact with the editor.
+
+;; configure the LSP for steel
+(require "helix/configuration.scm")
+(define-lsp "steel-language-server" (command "steel-language-server") (args '()))
+(define-language "scheme"
+                 (language-servers '("steel-language-server")))
+
+;; show splash screen - when you open with no argument
+(require "mattwparas-helix-package/splash.scm")
+(when (equal? (command-line) '("hx"))
+  (show-splash))
+
+;; Terminal & shell
+(require "steel-pty/term.scm")
+(set-default-shell! "nu")
+
+;; File Watcher
+(require "helix-file-watcher/file-watcher.scm")
+(spawn-watcher)
+
+;; File Tree
+(require "mattwparas-helix-package/cogs/file-tree.scm")
@@ -2,7 +2,6 @@
  config,
  lib,
  pkgs,
-  pkgs-unstable,
  ...
 }:
 ###############################################################################
@@ -29,7 +28,7 @@ in

  programs.neovim = {
    enable = true;
-    package = pkgs-unstable.neovim-unwrapped;
+    package = pkgs.neovim-unwrapped;

    # defaultEditor = true; # set EDITOR at system-wide level
    viAlias = true;
@@ -1,6 +1,6 @@
 {
  pkgs,
-  pkgs-unstable,
+  pkgs-master,
  ...
 }:
 {
@@ -30,13 +30,13 @@

        #-- dockerfile
        hadolint # Dockerfile linter
-        nodePackages.dockerfile-language-server-nodejs
+        dockerfile-language-server

        #-- markdown
        marksman # language server for markdown
        glow # markdown previewer
        pandoc # document converter
-        pkgs-unstable.hugo # static site generator
+        pkgs-master.hugo # static site generator

        #-- sql
        sqlfluff
@@ -63,14 +63,15 @@
          vscode-extensions.vadimcn.vscode-lldb.adapter # codelldb - debugger

          #-- python
-          pipx # Install and Run Python Applications in Isolated Environments
-          uv # python project package manager
-          pyright # python language server
          (python313.withPackages (
            ps: with ps; [
+              # python language server
+              pyright
              ruff
+
+              pipx # Install and Run Python Applications in Isolated Environments
              black # python formatter
-              # debugpy
+              uv # python project package manager

              # my commonly used python packages
              jupyter
@@ -80,16 +81,20 @@
              pyquery
              pyyaml
              boto3
+
+              # misc
+              protobuf # protocol buffer compiler
+              numpy
            ]
          ))

          #-- rust
          # we'd better use the rust-overlays for rust development
-          pkgs-unstable.rustc
-          pkgs-unstable.rust-analyzer
-          pkgs-unstable.cargo # rust package manager
-          pkgs-unstable.rustfmt
-          pkgs-unstable.clippy # rust linter
+          pkgs-master.rustc
+          pkgs-master.rust-analyzer
+          pkgs-master.cargo # rust package manager
+          pkgs-master.rustfmt
+          pkgs-master.clippy # rust linter

          #-- golang
          go
@@ -136,7 +141,7 @@
      #   fnlfmt # fennel
      #   (
      #     if pkgs.stdenv.isLinux && pkgs.stdenv.isx86
-      #     then pkgs-unstable.akkuPackages.scheme-langserver
+      #     then pkgs-master.akkuPackages.scheme-langserver
      #     else pkgs.emptyDirectory
      #   )
      # ]
@@ -1,6 +1,5 @@
 {
  pkgs,
-  pkgs-unstable,
  ...
 }:
 {
@@ -1,53 +0,0 @@
-{
-  config,
-  pkgs-unstable,
-  ...
-}:
-let
-  inherit (pkgs-unstable) nu_scripts;
-in
-{
-  programs.nushell = {
-    # load the alias file for work
-    # the file must exist, otherwise nushell will complain about it!
-    #
-    # currently, nushell does not support conditional sourcing of files
-    # https://github.com/nushell/nushell/issues/8214
-    extraConfig = ''
-      source /etc/agenix/alias-for-work.nushell
-
-      # using claude-code with kimi k2
-      $env.ANTHROPIC_BASE_URL = "https://api.moonshot.cn/anthropic/"
-      $env.ANTHROPIC_API_KEY = $env.MOONSHOT_API_KEY
-
-      # Directories in this constant are searched by the
-      # `use` and `source` commands.
-      const NU_LIB_DIRS = $NU_LIB_DIRS ++ ['${nu_scripts}/share/nu_scripts']
-
-      # completion
-      use custom-completions/cargo/cargo-completions.nu *
-      use custom-completions/curl/curl-completions.nu *
-      use custom-completions/git/git-completions.nu *
-      use custom-completions/glow/glow-completions.nu *
-      use custom-completions/just/just-completions.nu *
-      use custom-completions/make/make-completions.nu *
-      use custom-completions/man/man-completions.nu *
-      use custom-completions/nix/nix-completions.nu *
-      use custom-completions/ssh/ssh-completions.nu *
-      use custom-completions/tar/tar-completions.nu *
-      use custom-completions/tcpdump/tcpdump-completions.nu *
-      use custom-completions/zellij/zellij-completions.nu *
-      # use custom-completions/zoxide/zoxide-completions.nu *
-
-      # alias
-      # use aliases/git/git-aliases.nu *
-      use aliases/eza/eza-aliases.nu *
-      use aliases/bat/bat-aliases.nu *
-
-      # modules
-      use modules/argx *
-      use modules/lg *
-      use modules/kubernetes *
-    '';
-  };
-}
@@ -0,0 +1,39 @@
+# Google Cloud CLI aliases
+# Based on https://cloud.google.com/sdk/docs/configurations
+# Note: Avoided conflicts with common git aliases (gc, gca, gcl, gcs, gcu, gs, etc.)
+
+# Configuration management
+export alias gccfg = gcloud config configurations create
+export alias gcact = gcloud config configurations activate
+export alias gclist = gcloud config configurations list
+export alias gcdel = gcloud config configurations delete
+export alias gcset = gcloud config set
+export alias gcunset = gcloud config unset
+export alias gcconfig = gcloud config list
+ 
+# Authentication
+export alias gclogin = gcloud auth login
+export alias gcauth = gcloud auth list
+export alias gcapp = gcloud auth application-default login
+ 
+# Project management
+export alias gcproj = gcloud config set project
+export alias gcget = gcloud config get-value project
+ 
+# Compute Engine
+export alias gcinst = gcloud compute instances list
+export alias gccreate = gcloud compute instances create
+export alias gcdelete = gcloud compute instances delete
+export alias gcssh = gcloud compute ssh
+export alias gck8sget = gcloud container clusters get-credentials
+ 
+# Storage
+export alias gcst = gcloud storage
+export alias gcstls = gcloud storage ls
+export alias gcstcp = gcloud storage cp
+export alias gcstrm = gcloud storage rm
+ 
+# General shortcuts
+export alias gcloud = gcloud
+export alias gcinfo = gcloud info
+export alias gcver = gcloud version
@@ -0,0 +1,72 @@
+{
+  nu_scripts,
+  ...
+}:
+{
+  programs.nushell = {
+    # load the alias file for work
+    # the file must exist, otherwise nushell will complain about it!
+    #
+    # currently, nushell does not support conditional sourcing of files
+    # https://github.com/nushell/nushell/issues/8214
+    extraConfig = ''
+      source /etc/agenix/alias-for-work.nushell
+
+      $env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = "1"
+      # using claude-code with kimi k2
+      # https://platform.moonshot.cn/docs/guide/agent-support
+      # $env.ANTHROPIC_BASE_URL = "https://api.moonshot.cn/anthropic/"
+      # $env.ANTHROPIC_AUTH_TOKEN = $env.MOONSHOT_API_KEY
+      # $env.ANTHROPIC_MODEL = "kimi-k2-thinking"
+      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "kimi-k2-thinking-turbo"
+
+      # using claude-code with glm llm
+      # https://docs.bigmodel.cn/cn/coding-plan/tool/claude
+      $env.ANTHROPIC_BASE_URL = "https://open.bigmodel.cn/api/anthropic"
+      $env.ANTHROPIC_AUTH_TOKEN = $env.ZAI_API_KEY
+      $env.ANTHROPIC_MODEL = "glm-4.6"
+      $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "glm-4.5-air"
+
+      # using claude-code with qwen llm
+      # https://bailian.console.aliyun.com/?tab=doc#/doc/?type=model&url=2949529
+      # $env.ANTHROPIC_BASE_URL = "https://dashscope.aliyuncs.com/apps/anthropic"
+      # $env.ANTHROPIC_AUTH_TOKEN = $env.DASHSCOPE_API_KEY
+      # $env.ANTHROPIC_MODEL = "qwen-plus" # 千万别用 qwen-max, 价格
+      # $env.ANTHROPIC_DEFAULT_HAIKU_MODEL = "qwen-turbo"
+
+      # Directories in this constant are searched by the
+      # `use` and `source` commands.
+      const NU_LIB_DIRS = $NU_LIB_DIRS ++ ['${nu_scripts}']
+
+      # -*- completion -*-
+      use custom-completions/cargo/cargo-completions.nu *
+      use custom-completions/curl/curl-completions.nu *
+      use custom-completions/git/git-completions.nu *
+      use custom-completions/glow/glow-completions.nu *
+      use custom-completions/just/just-completions.nu *
+      use custom-completions/make/make-completions.nu *
+      use custom-completions/man/man-completions.nu *
+      use custom-completions/nix/nix-completions.nu *
+      use custom-completions/ssh/ssh-completions.nu *
+      use custom-completions/tar/tar-completions.nu *
+      use custom-completions/tcpdump/tcpdump-completions.nu *
+      use custom-completions/zellij/zellij-completions.nu *
+      use custom-completions/zoxide/zoxide-completions.nu *
+
+      # -*- alias -*-
+      use aliases/git/git-aliases.nu *
+      use aliases/eza/eza-aliases.nu *
+      use aliases/bat/bat-aliases.nu *
+      use ${./aliases/gcloud.nu} *
+
+      # -*- modules -*-
+      # argx & lg is required by the kubernetes module
+      use modules/argx *
+      use modules/lg *
+      # k8s/helm aliases, completions, 
+      use modules/kubernetes *
+      # a wrapper around the jc cli tool, convert cli outputs to nushell tables
+      # use modules/jc
+    '';
+  };
+}
@@ -9,8 +9,21 @@
  programs.ssh = {
    enable = true;

-    # "a private key that is used during authentication will be added to ssh-agent if it is running"
-    addKeysToAgent = "yes";
+    # default config
+    enableDefaultConfig = false;
+    matchBlocks."*" = {
+      forwardAgent = false;
+      # "a private key that is used during authentication will be added to ssh-agent if it is running"
+      addKeysToAgent = "yes";
+      compression = true;
+      serverAliveInterval = 0;
+      serverAliveCountMax = 3;
+      hashKnownHosts = false;
+      userKnownHostsFile = "~/.ssh/known_hosts";
+      controlMaster = "no";
+      controlPath = "~/.ssh/master-%r@%n:%p";
+      controlPersist = "no";
+    };

    matchBlocks = {
      "github.com" = {
@@ -1,6 +1,33 @@
 # Home Manager's Darwin Submodules

-1. `core.nix`: some basic configuration.
-2. `shell.nix`: shell related.
-3. `rime-squirrel.nix`: [rime-squirrel](https://github.com/rime/squirrel)'s configuration.
-4. `default.nix`: the entrypoint of darwin's configuration, it import all the submodules above.
+This directory contains macOS-specific Home Manager configurations for Darwin systems.
+
+## Configuration Modules
+
+### Core Configurations
+
+- **default.nix**: Entry point that imports all Darwin configurations
+- **shell.nix**: Shell configurations and environment settings
+- **rime-squirrel.nix**: [Rime Squirrel](https://github.com/rime/squirrel) input method
+  configuration
+
+### Window Management
+
+- **aerospace/**: [Aerospace](https://github.com/nikitabobko/AeroSpace) tiling window manager
+  configuration
+  - Custom keybindings and workspace management
+  - Application-specific window rules
+
+### Network Configuration
+
+- **proxy/**: Network proxy configurations
+  - `proxychains.conf`: Proxy chains configuration for network routing
+  - Proxy settings for development tools and applications
+
+## Features
+
+- macOS-specific package installations and configurations
+- Native macOS applications and utilities
+- Touch ID and system integration
+- Homebrew integration for additional packages
+- macOS-specific shell configurations and aliases
@@ -130,8 +130,8 @@ alt-3 = 'workspace 3Work'
 alt-4 = 'workspace 4Firefox'
 alt-5 = 'workspace 5Chrome'
 alt-6 = 'workspace 6Chat'
-alt-7 = 'workspace 7Music'
-alt-8 = 'workspace 8Mail'
+alt-7 = 'workspace 7Work'
+alt-8 = 'workspace 8Music'
 alt-9 = 'workspace 9File'
 alt-0 = 'workspace 0Other'
 alt-a = 'workspace A'          # In your config, you can drop workspace bindings that you don't need
@@ -146,8 +146,8 @@ alt-shift-3 = 'move-node-to-workspace 3Work'
 alt-shift-4 = 'move-node-to-workspace 4Firefox'
 alt-shift-5 = 'move-node-to-workspace 5Chrome'
 alt-shift-6 = 'move-node-to-workspace 6Chat'
-alt-shift-7 = 'move-node-to-workspace 7Music'
-alt-shift-8 = 'move-node-to-workspace 8Mail'
+alt-shift-7 = 'move-node-to-workspace 7Work'
+alt-shift-8 = 'move-node-to-workspace 8Music'
 alt-shift-9 = 'move-node-to-workspace 9File'
 alt-shift-0 = 'move-node-to-workspace 0Other'
 alt-shift-a = 'move-node-to-workspace A'
@@ -246,22 +246,22 @@ run = 'move-node-to-workspace 6Chat'
 if.app-id = 'com.tencent.qq'
 run = 'move-node-to-workspace 6Chat'

-[[on-window-detected]]
-if.app-id = 'com.tencent.QQMusicMac'
-run = 'move-node-to-workspace 7Music'
-
-[[on-window-detected]]
-if.app-id = 'com.netease.163music'
-run = 'move-node-to-workspace 7Music'
-
 [[on-window-detected]]
 if.app-id = 'com.apple.mail'
-run = 'move-node-to-workspace 8Mail'
+run = 'move-node-to-workspace 7Work'

 # calendar
 [[on-window-detected]]
 if.app-id = 'com.apple.iCal'
-run = 'move-node-to-workspace 8Mail'
+run = 'move-node-to-workspace 7Work'
+
+[[on-window-detected]]
+if.app-id = 'com.tencent.QQMusicMac'
+run = 'move-node-to-workspace 8Music'
+
+[[on-window-detected]]
+if.app-id = 'com.netease.163music'
+run = 'move-node-to-workspace 8Music'

 [[on-window-detected]]
 if.app-id = 'com.apple.finder'
@@ -296,6 +296,11 @@ run = ['layout floating', 'move-node-to-workspace 0Other']
 if.app-id = 'ai.elementlabs.lmstudio'
 run = ['layout floating', 'move-node-to-workspace 0Other']

+# Clash Verge - has problem with floating
+[[on-window-detected]]
+if.app-id = 'io.github.clash-verge-rev.clash-verge-rev'
+run = ['move-node-to-workspace 0Other']
+
 [[on-window-detected]]
 if.app-id = 'us.zoom.xos'
 run = 'move-node-to-workspace 0Other'
@@ -310,11 +315,6 @@ run = ['layout floating']
 if.app-id = 'com.apple.systempreferences'
 run = ['layout floating']

-# Clash Verge - has problem with floating
-[[on-window-detected]]
-if.app-id = 'io.github.clash-verge-rev.clash-verge-rev'
-run = ['move-node-to-workspace 0Other']
-
 # Make all windows float by default
 [[on-window-detected]]
 check-further-callbacks = true
@@ -331,7 +331,7 @@ run = ['layout floating']
 4Firefox = ['main']
 5Chrome = ['main']
 6Chat = ['built-in']
-7Music = ['built-in']
-8Mail = ['main']
+7Work = ['main']
+8Music = ['built-in']
 9File = ['main']
 0Other = ['main']
@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  fontSize = 15;
+in
+{
+  programs.alacritty.settings.font.size = lib.mkForce fontSize;
+  programs.ghostty.settings.font-size = lib.mkForce fontSize;
+  programs.kitty.font.size = lib.mkForce fontSize;
+}
@@ -1,10 +1,34 @@
 # Home Manager's Linux Submodules

-1. `base`: The base module that is suitable for any NixOS environment.
-2. `desktop`: Configuration for desktop environments, such as Hyprland, I3, etc.
-3. `server.nix`: Configuration which is suitable for both servers and desktops. It import only
-   `base` as its submodule.
-   1. used by all my nixos servers.
-4. `desktop.nix`: the entrypoint of desktop's configuration, it import both `base` and `desktop` as
-   its submodules.
-   1. used by all my nixos desktops.
+This directory contains Linux-specific Home Manager configurations organized for different use
+cases.
+
+## Configuration Modules
+
+### Core Configurations
+
+- **core.nix**: Essential Linux-specific configurations and settings
+- **base/**: Base Linux configurations including shell, tools, and utilities
+  - `shell.nix`: Shell configurations and aliases
+  - `tools.nix`: Essential command-line tools and utilities
+
+### Desktop Configurations
+
+- **gui/**: Desktop environment configurations
+  - **hyprland/**: Hyprland window manager with custom keybindings and settings
+  - **niri/**: Niri compositor configuration
+  - **base/**: Common desktop applications and services
+  - **editors/**: Text editor configurations for desktop environments
+
+### Available Entry Points
+
+- **core.nix**: Core Linux configuration, suitable for basic setups
+- **tui.nix**: Terminal-based interface configuration for lightweight environments
+- **gui.nix**: Graphical user interface configuration entry point, imports desktop environments
+
+## Usage
+
+- **Lightweight/Terminal**: Use `core.nix` or `tui.nix` for terminal-focused setups
+- **Desktops**: Use `gui.nix` for full desktop environments with window managers like Hyprland or
+  Niri
+- **Custom**: Mix and match configurations as needed for your specific use case
@@ -1,17 +1,49 @@
-# Desktop Related
+# Desktop Environment Configurations

-3. `base`: all common configurations for all desktops.
-4. `hyprland`: Hyprland's configuration.
+This directory contains desktop environment and window manager configurations managed by Home
+Manager.

-## Why install I3/Hyprland in Home Manager instead of a NixOS Module?
+## Available Configurations

-1. I3 & Hyprland's configuration file is located in `~/.config`, which can be easily managed by Home
-   Manager.
-2. I have many user-specific systemd services, such gammastep, wallpaper-switcher, etc. Which can be
-   easily managed by Home Manager, but if we add i3/hyprland in a NixOS Module, those user-level
-   services may failed to start automatically. With i3/hyprland in a Home Manager Module, we can
-   control their systemd service's dependent order more easily, so we can avoid issues like this.
-3. By install packages as less as possible in NixOS Module, we can:
-   1. Make the NixOS system more secure and stable.
-   2. Make this flake more portable to other non-NixOS systems, as home-manager can be installed on
-      any Linux system.
+### Window Managers
+
+- **hyprland**: Hyprland compositor configuration with custom keybindings, settings, and window
+  rules
+- **niri**: Niri compositor configuration with custom settings, keybindings, spawn-at-startup rules,
+  and window rules
+
+### Base Desktop Environment
+
+- **base**: Common desktop configurations shared across all environments, including:
+  - Desktop applications (anyrun, mako, waybar, wlogout)
+  - Creative tools and media applications
+  - Development tools
+  - Eye protection utilities (gammastep)
+  - Fcitx5 input method framework
+  - Games and gaming utilities
+  - GTK theme configurations
+  - Immutable file handling
+  - Note-taking applications
+  - Wallpaper management with auto-switcher
+  - Wayland applications
+  - XDG desktop configurations
+
+### Editor Configurations
+
+- **editors**: Text editor configurations and integrations
+
+## Why install Desktop Environments in Home Manager instead of NixOS Module?
+
+1. **Configuration Location**: Desktop environment configuration files are located in `~/.config`,
+   which can be easily managed by Home Manager.
+
+2. **User-specific Services**: Many user-specific systemd services (gammastep, wallpaper-switcher,
+   etc.) can be easily managed by Home Manager. If desktop environments were configured via NixOS
+   Module, these user-level services might fail to start automatically. With Home Manager modules,
+   we can control systemd service dependency order more effectively.
+
+3. **System Benefits**: By minimizing package installation through NixOS Module:
+   - Makes the NixOS system more secure and stable
+   - Increases portability to non-NixOS systems, as Home Manager can be installed on any Linux
+     system
+   - Allows for easier switching between different window managers without system-level changes
@@ -0,0 +1,15 @@
+{
+  pkgs,
+  ...
+}:
+{
+  home.packages = with pkgs; [
+    nixpaks.firefox
+  ];
+
+  # source code: https://github.com/nix-community/home-manager/blob/master/modules/programs/chromium.nix
+  programs.google-chrome = {
+    enable = true;
+    package = if pkgs.stdenv.isAarch64 then pkgs.chromium else pkgs.google-chrome;
+  };
+}
@@ -1,9 +1,6 @@
 {
  lib,
  pkgs,
-  pkgs-unstable,
-  # pkgs-stable,
-  nur-ryan4yin,
  blender-bin,
  ...
 }:
@@ -23,56 +20,52 @@
      # aseprite # Animated sprite editor & pixel art tool

      # this app consumes a lot of storage, so do not install it currently
-      # kicad     # 3d printing, eletrical engineering
+      # kicad     # 3d printing, electrical engineering
    ]
    ++ (lib.optionals pkgs.stdenv.isx86_64 [
      # https://github.com/edolstra/nix-warez/blob/master/blender/flake.nix
-      blender-bin.packages.${pkgs.system}.blender_4_2 # 3d modeling
+      blender-bin.packages.${pkgs.stdenv.hostPlatform.system}.blender_4_2 # 3d modeling

      ldtk # A modern, versatile 2D level editor

      # fpga
-      python313Packages.apycula # gowin fpga
-      yosys # fpga synthesis
-      nextpnr # fpga place and route
-      openfpgaloader # fpga programming
-      # nur-ryan4yin.packages.${pkgs.system}.gowin-eda-edu-ide # app: `gowin-env` => `gw_ide` / `gw_pack` / ...
+      # python313Packages.apycula # gowin fpga
+      # yosys # fpga synthesis
+      # nextpnr # fpga place and route
+      # openfpgaloader # fpga programming
+      # nur-ryan4yin.packages.${pkgs.stdenv.hostPlatform.system}.gowin-eda-edu-ide # app: `gowin-env` => `gw_ide` / `gw_pack` / ...
    ]);

  programs = {
    # live streaming
    obs-studio = {
      enable = pkgs.stdenv.isx86_64;
-      plugins =
-        with pkgs.obs-studio-plugins;
-        [
-          # screen capture
-          wlrobs
-          # obs-ndi
-          # obs-nvfbc
-          obs-teleport
-          # obs-hyperion
-          droidcam-obs
-          obs-vkcapture
-          obs-gstreamer
-          input-overlay
-          obs-multi-rtmp
-          obs-source-clone
-          obs-shaderfilter
-          obs-source-record
-          obs-livesplit-one
-          looking-glass-obs
-          obs-vintage-filter
-          obs-command-source
-          obs-move-transition
-          obs-backgroundremoval
-          # advanced-scene-switcher
-          obs-pipewire-audio-capture
-        ]
-        ++ (lib.optionals pkgs.stdenv.isx86_64 [
-          obs-vaapi
-          obs-3d-effect
-        ]);
+      plugins = with pkgs.obs-studio-plugins; [
+        # screen capture
+        wlrobs
+        # obs-ndi
+        # obs-nvfbc
+        obs-teleport
+        # obs-hyperion
+        droidcam-obs
+        obs-vkcapture
+        obs-gstreamer
+        input-overlay
+        obs-multi-rtmp
+        obs-source-clone
+        obs-shaderfilter
+        obs-source-record
+        obs-livesplit-one
+        looking-glass-obs
+        obs-vintage-filter
+        obs-command-source
+        obs-move-transition
+        obs-backgroundremoval
+        # advanced-scene-switcher
+        obs-pipewire-audio-capture
+        obs-vaapi
+        obs-3d-effect
+      ];
    };
  };
 }
@@ -3,83 +3,64 @@
  anyrun,
  ...
 }:
+
+let
+  anyrunPackages = anyrun.packages.${pkgs.stdenv.hostPlatform.system};
+in
 {
+
+  imports = [
+    (
+      { modulesPath, ... }:
+      {
+        # Important! We disable home-manager's module to avoid option
+        # definition collisions
+        disabledModules = [ "${modulesPath}/programs/anyrun.nix" ];
+      }
+    )
+    anyrun.homeManagerModules.default
+  ];
+
  programs.anyrun = {
    enable = true;
+    # The package should come from the same flake as all the plugins to avoid breakage.
+    package = anyrunPackages.anyrun;
    config = {
-      plugins = with anyrun.packages.${pkgs.system}; [
-        applications
-        randr
-        rink
-        shell
-        symbols
-        translate
-      ];
+      # The horizontal position.
+      # when using `fraction`, it sets a fraction of the width or height of the screen
+      x.fraction = 0.5; # at the middle of the screen
+      # The vertical position.
+      y.fraction = 0.05; # at the top of the screen
+      # The width of the runner.
+      width.fraction = 0.3; # 30% of the screen

-      width.fraction = 0.3;
-      y.absolute = 15;
-      hidePluginInfo = true;
+      hideIcons = false;
+      ignoreExclusiveZones = false;
+      layer = "overlay";
+      hidePluginInfo = false;
      closeOnClick = true;
+      showResultsImmediately = true;
+      maxEntries = null;
+
+      # https://github.com/anyrun-org/anyrun/tree/master/plugins
+      plugins = with anyrunPackages; [
+        applications # Launch applications
+        dictionary # Look up word definitions using the Free Dictionary API.
+        nix-run # search & run graphical apps from nixpkgs via `nix run`, without installing it.
+        # randr         # quickly change monitor configurations on the fly
+        rink # A simple calculator plugin
+        symbols # Look up unicode symbols and custom user defined symbols.
+        translate # ":zh <text to translate>" Quickly translate text using the Google Translate API.
+        niri-focus # Search for & focus the window via title/appid on Niri
+      ];
    };

-    # custom css for anyrun, based on catppuccin-mocha
-    extraCss = ''
-      @define-color bg-col  rgba(30, 30, 46, 0.7);
-      @define-color bg-col-light rgba(150, 220, 235, 0.7);
-      @define-color border-col rgba(30, 30, 46, 0.7);
-      @define-color selected-col rgba(150, 205, 251, 0.7);
-      @define-color fg-col #D9E0EE;
-      @define-color fg-col2 #F28FAD;
-
-      * {
-        transition: 200ms ease;
-        font-family: "Maple Mono NF CN";
-        font-size: 1.3rem;
-      }
-
-      #window {
-        background: transparent;
-      }
-
-      #plugin,
-      #main {
-        border: 3px solid @border-col;
-        color: @fg-col;
-        background-color: @bg-col;
-      }
-      /* anyrun's input window - Text */
-      #entry {
-        color: @fg-col;
-        background-color: @bg-col;
-      }
-
-      /* anyrun's output matches entries - Base */
-      #match {
-        color: @fg-col;
-        background: @bg-col;
-      }
-
-      /* anyrun's selected entry - Red */
-      #match:selected {
-        color: @fg-col2;
-        background: @selected-col;
-      }
-
-      #match {
-        padding: 3px;
-        border-radius: 16px;
-      }
-
-      #entry, #plugin:hover {
-        border-radius: 16px;
-      }
-
-      box#main {
-        background: rgba(30, 30, 46, 0.7);
-        border: 1px solid @border-col;
-        border-radius: 15px;
-        padding: 5px;
-      }
-    '';
+    extraConfigFiles = {
+      "symbols.ron".source = ./conf/anyrun/symbols.ron;
+      "applications.ron".source = ./conf/anyrun/applications.ron;
+    };
  };
+
+  # https://github.com/anyrun-org/anyrun/discussions/179
+  xdg.configFile."anyrun/style.css".source = ./conf/anyrun/style.css;
 }
@@ -0,0 +1,16 @@
+Config(
+  // Also show the Desktop Actions defined in the desktop files, e.g. "New Window" from LibreWolf
+  desktop_actions: true,
+
+  max_entries: 5,
+
+  // The terminal used for running terminal based desktop entries, if left as `None` a static list of terminals is used
+  // to determine what terminal to use.
+  terminal: Some(Terminal(
+    // The main terminal command
+    command: "alacritty",
+    // What arguments should be passed to the terminal process to run the command correctly
+    // {} is replaced with the command in the desktop entry
+    args: "-e {}",
+  )),
+)
@@ -0,0 +1,101 @@
+/* ===== Color variables ===== */
+:root {
+  --bg-color: #313244;
+  --fg-color: #cdd6f4;
+  --primary-color: #89b4fa;
+  --secondary-color: #cba6f7;
+  --border-color: var(--primary-color);
+  --selected-bg-color: var(--primary-color);
+  --selected-fg-color: var(--bg-color);
+}
+
+/* ===== Global reset ===== */
+* {
+  all: unset;
+  font-family: "JetBrainsMono Nerd Font", monospace;
+}
+
+/* ===== Transparent window ===== */
+window {
+  background: transparent;
+}
+
+/* ===== Main container ===== */
+box.main {
+  border-radius: 16px;
+  background-color: color-mix(in srgb, var(--bg-color) 80%, transparent);
+  border: 0.5px solid color-mix(in srgb, var(--fg-color) 25%, transparent);
+  padding: 12px; /* add uniform padding around the whole box */
+}
+
+/* ===== Input field ===== */
+text {
+  font-size: 1.3rem;
+  background: transparent;
+  border: 1px solid var(--border-color);
+  border-radius: 16px;
+  margin-bottom: 12px;
+  padding: 5px 10px;
+  min-height: 44px;
+  caret-color: var(--primary-color);
+}
+
+/* ===== List container ===== */
+.matches {
+  background-color: transparent;
+}
+
+/* ===== Single match row ===== */
+.match {
+  font-size: 1.1rem;
+  padding: 4px 10px; /* tight vertical spacing */
+  border-radius: 6px;
+}
+
+/* Remove default label margins */
+.match * {
+  margin: 0;
+  padding: 0;
+  line-height: 1;
+}
+
+/* Selected / hover state */
+.match:selected,
+.match:hover {
+  background-color: var(--selected-bg-color);
+  color: var(--selected-fg-color);
+}
+
+.match:selected label.plugin.info,
+.match:hover label.plugin.info {
+  color: var(--selected-fg-color);
+}
+
+.match:selected label.match.description,
+.match:hover label.match.description {
+  color: color-mix(in srgb, var(--selected-fg-color) 90%, transparent);
+}
+
+/* ===== Plugin info label ===== */
+label.plugin.info {
+  color: var(--fg-color);
+  font-size: 1rem;
+  min-width: 160px;
+  text-align: left;
+}
+
+/* ===== Description label ===== */
+label.match.description {
+  font-size: 0rem;
+  color: var(--fg-color);
+}
+
+/* ===== Fade-in animation ===== */
+@keyframes fade {
+  0% {
+    opacity: 0;
+  }
+  100% {
+    opacity: 1;
+  }
+}
@@ -0,0 +1,10 @@
+Config(
+  // The prefix that the search needs to begin with to yield symbol results
+  prefix: "",
+  // Custom user defined symbols to be included along the unicode symbols
+  symbols: {
+    // "name": "text to be copied"
+    "shrug": "¯\\_(ツ)_/¯",
+  },
+  max_entries: 3,
+)
@@ -30,11 +30,13 @@
    wl-clipboard # copying and pasting
    hyprpicker # color picker
    brightnessctl
-    hyprshot # screen shot
-    wf-recorder # screen recording
    # audio
    alsa-utils # provides amixer/alsamixer/...
    networkmanagerapplet # provide GUI app: nm-connection-editor
+    # screenshot/screencast
+    flameshot
+    hyprshot # screen shot
+    wf-recorder # screen recording
  ];

  xdg.configFile =
@@ -0,0 +1,59 @@
+{
+  lib,
+  pkgs,
+  pkgs-master,
+  ...
+}:
+
+let
+  vscodeCliArgs = [
+    # https://code.visualstudio.com/docs/configure/settings-sync#_recommended-configure-the-keyring-to-use-with-vs-code
+    # For use with any package that implements the Secret Service API
+    # (for example gnome-keyring, kwallet5, KeepassXC)
+    "--password-store=gnome-libsecret"
+  ];
+
+  code-cursor = pkgs-master.code-cursor;
+  # (pkgs-master.code-cursor.override {
+  #   commandLineArgs = lib.concatStringsSep " " vscodeCliArgs;
+  # }).overrideAttrs
+  #   (oldAttrs: rec {
+  #     pname = "cursor";
+  #     version = "2.1.36";
+  #     src =
+  #       with pkgs-master;
+  #       appimageTools.extract {
+  #         inherit pname version;
+  #         src =
+  #           let
+  #             sources = {
+  #               x86_64-linux = fetchurl {
+  #                 # curl -s https://api2.cursor.sh/updates/api/download/stable/linux-x64/cursor | jq
+  #                 url = "https://downloads.cursor.com/production/9cd7c8b6cebcbccc1242df211dee45a4b6fe15e4/linux/x64/Cursor-2.1.36-x86_64.AppImage";
+  #                 hash = "sha256-aaprRB2BAaUCHj7m5aGacCBHisjN2pVZ+Ca3u1ifxBA=";
+  #               };
+  #               aarch64-linux = fetchurl {
+  #                 # curl -s https://api2.cursor.sh/updates/api/download/stable/linux-arm64/cursor | jq
+  #                 url = "https://downloads.cursor.com/production/9cd7c8b6cebcbccc1242df211dee45a4b6fe15e4/linux/arm64/Cursor-2.1.36-aarch64.AppImage";
+  #                 hash = "sha256-S2vFYBI6m0zjBJEDbk7gc6/zFiKWyhM73OUm1xsNx6Q=";
+  #               };
+  #             };
+  #           in
+  #           sources.${stdenv.hostPlatform.system};
+  #       };
+  #     sourceRoot = "${pname}-${version}-extracted/usr/share/cursor";
+  #   });
+in
+{
+  home.packages = [
+    pkgs.zed-editor
+    code-cursor
+  ];
+
+  programs.vscode = {
+    enable = true;
+    package = pkgs-master.vscode.override {
+      commandLineArgs = vscodeCliArgs;
+    };
+  };
+}
@@ -14,13 +14,15 @@
    type = "fcitx5";
    fcitx5.waylandFrontend = true;
    fcitx5.addons = with pkgs; [
-      # for flypy chinese input method
-      fcitx5-rime
-      # needed enable rime using configtool after installed
-      fcitx5-configtool
-      fcitx5-chinese-addons
-      # fcitx5-mozc    # japanese input method
+      qt6Packages.fcitx5-configtool # GUI for fcitx5
      fcitx5-gtk # gtk im module
+
+      # Chinese
+      fcitx5-rime # for flypy chinese input method
+      # fcitx5-chinese-addons # we use rime instead
+
+      # Japanese
+      fcitx5-mozc-ut
    ];
  };
 }
@@ -1,10 +1,10 @@
 [Groups/0]
 # Group Name
-Name=Default
+Name=Intl
 # Layout
 Default Layout=us
 # Default Input Method
-DefaultIM=rime
+DefaultIM=keyboard-us-altgr-intl

 [Groups/0/Items/0]
 # Name
@@ -14,10 +14,43 @@ Layout=

 [Groups/0/Items/1]
 # Name
+Name=keyboard-us-intl
+# Layout
+Layout=
+
+[Groups/0/Items/2]
+# Name
+Name=keyboard-us-altgr-intl
+# Layout
+Layout=
+
+[Groups/1]
+# Group Name
+Name=Default
+# Layout
+Default Layout=us
+# Default Input Method
+DefaultIM=rime
+
+[Groups/1/Items/0]
+# Name
+Name=keyboard-us
+# Layout
+Layout=
+
+[Groups/1/Items/1]
+# Name
 Name=rime
 # Layout
 Layout=

+[Groups/1/Items/2]
+# Name
+Name=mozc
+# Layout
+Layout=
+
 [GroupOrder]
 0=Default
+1=Intl

@@ -1,13 +0,0 @@
-{
-  pkgs,
-  nix-gaming,
-  ...
-}:
-{
-  home.packages = with pkgs; [
-    # nix-gaming.packages.${pkgs.system}.osu-laser-bin
-    gamescope # SteamOS session compositing window manager
-    prismlauncher # A free, open source launcher for Minecraft
-    winetricks # A script to install DLLs needed to work around problems in Wine
-  ];
-}
@@ -0,0 +1,76 @@
+{
+  pkgs,
+  pkgs-x64,
+  osConfig,
+  config,
+  lib,
+  ...
+}:
+with lib;
+let
+  cfg = config.modules.desktop.gaming;
+in
+{
+  options.modules.desktop = {
+    gaming = {
+      enable = mkEnableOption "Install Game Suite(steam, lutris, etc)";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # ==========================================================================
+    # Other Optimizations
+    # Usage:
+    #  Lutris - enable advanced options, go to the System options -> Command prefix, add: `mangohud`
+    #  Steam  - add this as a launch option: `mangohud %command%` / `gamemoderun %command%`
+    # ==========================================================================
+
+    home.packages =
+      (with pkgs; [
+        # https://github.com/flightlessmango/MangoHud
+        # a simple overlay program for monitoring FPS, temperature, CPU and GPU load, and more.
+        mangohud
+
+        # GUI for installing custom Proton versions like GE_Proton
+        # proton - a Wine distribution aimed at gaming
+        protonplus
+        # Script to install various redistributable runtime libraries in Wine.
+        winetricks
+        # https://github.com/Open-Wine-Components/umu-launcher
+        # a unified launcher for Windows games on Linux
+        umu-launcher
+
+        # Sed-like editor for binary files
+        # required by some games to fix problems
+        bbe
+      ])
+      ++ (with pkgs-x64; [
+        # a game launcher - great for epic games and gog games
+        (heroic.override {
+          extraPkgs = _pkgs: [
+            pkgs.gamescope # aarch64
+          ];
+        })
+      ]);
+
+    # a GUI game launcher for Steam/GoG/Epic
+    # https://lutris.net/games?ordering=-popularity
+    programs.lutris = {
+      enable = true;
+      defaultWinePackage = pkgs-x64.proton-ge-bin;
+      steamPackage = osConfig.programs.steam.package;
+      protonPackages = [ pkgs-x64.proton-ge-bin ];
+      winePackages = with pkgs-x64; [
+        wineWow64Packages.full
+        wineWowPackages.stagingFull
+      ];
+      extraPackages = with pkgs; [
+        winetricks
+        gamescope
+        gamemode
+        mangohud
+        umu-launcher
+      ];
+    };
+  };
+}
@@ -1,30 +1,25 @@
 {
  pkgs,
-  pkgs-unstable,
-  nur-ryan4yin,
+  pkgs-x64,
  ...
 }:
 # media - control and enjoy audio/video
 {
-  home.packages =
-    with pkgs;
-    [
-      # audio control
-      pavucontrol
-      playerctl
-      pulsemixer
-      imv # simple image viewer
+  home.packages = with pkgs; [
+    # audio control
+    pavucontrol
+    playerctl
+    pulsemixer
+    imv # simple image viewer

-      # video/audio tools
-      libva-utils
-      vdpauinfo
-      vulkan-tools
-      glxinfo
-      nvitop
-    ]
-    ++ (lib.optionals pkgs.stdenv.isx86_64 [
-      (zoom-us.override { hyprlandXdgDesktopPortalSupport = true; })
-    ]);
+    # video/audio tools
+    libva-utils
+    vdpauinfo
+    vulkan-tools
+    mesa-demos
+    nvitop
+    (pkgs-x64.zoom-us.override { hyprlandXdgDesktopPortalSupport = true; })
+  ];

  programs.mpv = {
    enable = true;
@@ -1,6 +1,5 @@
 {
  pkgs,
-  pkgs-unstable,
  ...
 }:
 {
@@ -10,19 +9,16 @@
    # do not support .pdf
    foliate

-    # instant messaging
-    telegram-desktop
-    # discord # update too frequently, use the web version instead
-
    # remote desktop(rdp connect)
    remmina
    freerdp # required by remmina

    # my custom hardened packages
-    pkgs.nixpaks.qq
-    pkgs.nixpaks.qq-desktop-item
+    nixpaks.qq
+    nixpaks.telegram-desktop
    # qqmusic
-    pkgs.bwraps.wechat
+    bwraps.wechat
+    # discord # update too frequently, use the web version instead
  ];

  # allow fontconfig to discover fonts and configurations installed through home.packages
@@ -5,6 +5,6 @@
    (lib.optionals pkgs.stdenv.isx86_64 [
      # https://joplinapp.org/help/
      joplin # joplin-cli
-      joplin-desktop
+      # joplin-desktop
    ]);
 }
@@ -10,8 +10,7 @@
    Unit = {
      Description = "Wallpaper Switcher daemon";
      After = [
-        "graphical-session-pre.target"
-        "xdg-desktop-autostart.target"
+        "graphical-session.target"
      ];
      Wants = [ "graphical-session-pre.target" ];
    };
@@ -1,54 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  home.packages = with pkgs; [
-    # firefox-wayland
-    nixpaks.firefox
-    nixpaks.firefox-desktop-item
-  ];
-
-  programs = {
-    # source code: https://github.com/nix-community/home-manager/blob/master/modules/programs/chromium.nix
-    google-chrome = {
-      enable = true;
-      package = if pkgs.stdenv.isAarch64 then pkgs.chromium else pkgs.google-chrome;
-
-      # https://wiki.archlinux.org/title/Chromium#Native_Wayland_support
-      commandLineArgs = [
-        "--ozone-platform-hint=auto"
-        "--ozone-platform=wayland"
-        # make it use GTK_IM_MODULE if it runs with Gtk4, so fcitx5 can work with it.
-        # (only supported by chromium/chrome at this time, not electron)
-        "--gtk-version=4"
-        # make it use text-input-v1, which works for kwin 5.27 and weston
-        "--enable-wayland-ime"
-
-        # enable hardware acceleration - vulkan api
-        # "--enable-features=Vulkan"
-      ];
-    };
-
-    vscode = {
-      enable = true;
-      package = pkgs.vscode.override {
-        isInsiders = false;
-        # https://wiki.archlinux.org/title/Wayland#Electron
-        commandLineArgs = [
-          "--ozone-platform-hint=auto"
-          "--ozone-platform=wayland"
-          # make it use GTK_IM_MODULE if it runs with Gtk4, so fcitx5 can work with it.
-          # (only supported by chromium/chrome at this time, not electron)
-          "--gtk-version=4"
-          # make it use text-input-v1, which works for kwin 5.27 and weston
-          "--enable-wayland-ime"
-
-          # TODO: fix https://github.com/microsoft/vscode/issues/187436
-          # still not works...
-          "--password-store=gnome" # use gnome-keyring as password store
-        ];
-      };
-    };
-  };
-}
@@ -1,7 +0,0 @@
-{ pkgs, ... }:
-{
-  home.packages = with pkgs; [
-    zed-editor
-    code-cursor
-  ];
-}
@@ -136,3 +136,14 @@ bind =   CTRL,       Print,  exec,  hyprshot -m region -o ~/Pictures/Screenshots
 bind =   CTRL ALT,   l,      exec,  swaylock
 bind =   $mod SHIFT, x,      exec,  wlogout
 bind =   $mod,       n,      exec,  nm-connection-editor  # need install network-manager-applet
+
+
+# Gestures
+# ============================================================================
+# https://wiki.hypr.land/Configuring/Gestures/
+
+# gesture = fingers, direction, action, options
+gesture = 3, horizontal, workspace
+gesture = 3, down, mod: ALT, close
+gesture = 3, up, mod: SUPER, scale: 1.5, fullscreen
+
@@ -103,11 +103,6 @@ master {
  new_on_top = true
 }

-# See: https://wiki.hyprland.org/Configuring/Variables
-gestures {
-  workspace_swipe = off
-}
-
 #-- Input ----------------------------------------------------
 # Configure mouse and touchpad here.
 input {
@@ -45,6 +45,7 @@ in
      variables = [ "--all" ];
    };
  };
+  services.polkit-gnome.enable = true; # polkit

  # NOTE: this executable is used by greetd to start a wayland session when system boot up
  # with such a vendor-no-locking script, we can switch to another wayland compositor without modifying greetd's config in NixOS module
@@ -7,12 +7,8 @@
      common = {
        # Use xdg-desktop-portal-gtk for every portal interface...
        default = [
-          "gtk"
          "hyprland"
-        ];
-        # except for the secret portal, which is handled by gnome-keyring
-        "org.freedesktop.impl.portal.Secret" = [
-          "gnome-keyring"
+          "gtk"
        ];
      };
    };
@@ -0,0 +1,232 @@
+// This config is in the KDL format: https://kdl.dev
+// "/-" comments out the following node.
+// Check the wiki for a full description of the configuration:
+// https://yalter.github.io/niri/Configuration:-Introduction
+
+// This is the main configuration file that includes all other config files
+include "./keybindings.kdl"
+include "./windowrules.kdl"
+include "./spawn-at-startup.kdl"
+include "./niri-hardware.kdl"
+
+// Input device configuration.
+// Find the full list of options on the wiki:
+// https://yalter.github.io/niri/Configuration:-Input
+input {
+    keyboard {
+        xkb {
+            // You can set rules, model, layout, variant and options.
+            // For more information, see xkeyboard-config(7).
+
+            // For example:
+            // layout "us,ru"
+            // options "grp:win_space_toggle,compose:ralt,ctrl:nocaps"
+
+            // If this section is empty, niri will fetch xkb settings
+            // from org.freedesktop.locale1. You can control these using
+            // localectl set-x11-keymap.
+        }
+
+        // Enable numlock on startup, omitting this setting disables it.
+        // numlock
+
+        // You can set the keyboard repeat parameters. The defaults match wlroots and sway.
+        // Delay is in milliseconds before the repeat starts. Rate is in characters per second.
+        // repeat-delay 600
+        // repeat-rate 25
+
+        // Niri can remember the keyboard layout globally (the default) or per-window.
+        // - "global" - layout change is global for all windows.
+        // - "window" - layout is tracked for each window individually.
+        // track-layout "global"
+    }
+
+    // Next sections include libinput settings.
+    // Omitting settings disables them, or leaves them at their default values.
+    // All commented-out settings here are examples, not defaults.
+    touchpad {
+        // tap  // tap-to-click
+        dwt // disable-when-typing.
+        // dwtp // disable-when-trackpointing.
+        natural-scroll // inverts the scrolling direction.
+        // accel-speed 0.2
+        // accel-profile "flat"
+        // tap-button-map "left-middle-right"
+    }
+
+    mouse {
+        // natural-scroll // inverts the scrolling direction.
+        // accel-speed 0.2
+        // accel-profile "flat"
+    }
+
+    // Uncomment this to make the mouse warp to the center of newly focused windows.
+    // warp-mouse-to-focus
+
+    // Focus windows and outputs automatically when moving the mouse into them.
+    // Setting max-scroll-amount="0%" makes it work only on windows already fully on screen.
+    // focus-follows-mouse max-scroll-amount="0%"
+}
+
+// Settings that influence how windows are positioned and sized.
+// Find more information on the wiki:
+// https://yalter.github.io/niri/Configuration:-Layout
+layout {
+    // Set gaps around windows in logical pixels.
+    gaps 8
+
+    // When to center a column when changing focus, options are:
+    // - "never", default behavior, focusing an off-screen column will keep at the left
+    //   or right edge of the screen.
+    // - "always", the focused column will always be centered.
+    // - "on-overflow", focusing a column will center it if it doesn't fit
+    //   together with the previously focused column.
+    center-focused-column "never"
+
+    // You can customize the widths that "switch-preset-column-width" (Mod+R) toggles between.
+    preset-column-widths {
+        // Proportion sets the width as a fraction of the output width, taking gaps into account.
+        // For example, you can perfectly fit four windows sized "proportion 0.25" on an output.
+        // The default preset widths are 1/3, 1/2 and 2/3 of the output.
+        proportion 0.333333
+        proportion 0.500000
+        proportion 0.666667
+
+        // Fixed sets the width in logical pixels exactly.
+        // fixed 1920
+    }
+
+    // You can change the default width of the new windows.
+    default-column-width { proportion 0.500000; }
+    // If you leave the brackets empty, the windows themselves will decide their initial width.
+    // default-column-width {}
+
+    // By default focus ring and border are rendered as a solid background rectangle
+    // behind windows. That is, they will show up through semitransparent windows.
+    // This is because windows using client-side decorations can have an arbitrary shape.
+    //
+    // If you don't like that, you should uncomment `prefer-no-csd` below.
+    // Niri will draw focus ring and border *around* windows that agree to omit their
+    // client-side decorations.
+    //
+    // Alternatively, you can override it with a window rule called
+    // `draw-border-with-background`.
+
+    // You can change how the focus ring looks.
+    focus-ring {
+        // Uncomment this line to disable the focus ring.
+        // off
+
+        // How many logical pixels the ring extends out from the windows.
+        width 4
+
+        // Colors can be set in a variety of ways:
+        // - CSS named colors: "red"
+        // - RGB hex: "#rgb", "#rgba", "#rrggbb", "#rrggbbaa"
+        // - CSS-like notation: "rgb(255, 127, 0)", rgba(), hsl() and a few others.
+
+        // Color of the ring on the active monitor.
+        active-color "#7fc8ff"
+
+        // Color of the ring on inactive monitors.
+        //
+        // The focus ring only draws around the active window, so the only place
+        // where you can see its inactive-color is on other monitors.
+        inactive-color "#505050"
+
+        // You can also use gradients. They take precedence over solid colors.
+        // Gradients are rendered the same as CSS linear-gradient(angle, from, to).
+        // The angle is the same as in linear-gradient, and is optional,
+        // defaulting to 180 (top-to-bottom gradient).
+        // You can use any CSS linear-gradient tool on the web to set these up.
+        // Changing the color space is also supported, check the wiki for more info.
+        //
+        // active-gradient from="#80c8ff" to="#c7ff7f" angle=45
+
+        // You can also color the gradient relative to the entire view
+        // of the workspace, rather than relative to just the window itself.
+        // To do that, set relative-to="workspace-view".
+        //
+        // inactive-gradient from="#505050" to="#808080" angle=45 relative-to="workspace-view"
+    }
+
+    // You can also add a border. It's similar to the focus ring, but always visible.
+    border {
+        // The settings are the same as for the focus ring.
+        // If you enable the border, you probably want to disable the focus ring.
+        off
+
+        width 4
+        active-color "#ffc87f"
+        inactive-color "#505050"
+
+        // Color of the border around windows that request your attention.
+        urgent-color "#9b0000"
+
+        // Gradients can use a few different interpolation color spaces.
+        // For example, this is a pastel rainbow gradient via in="oklch longer hue".
+        //
+        // active-gradient from="#e5989b" to="#ffb4a2" angle=45 relative-to="workspace-view" in="oklch longer hue"
+
+        // inactive-gradient from="#505050" to="#808080" angle=45 relative-to="workspace-view"
+    }
+
+    // Struts shrink the area occupied by windows, similarly to layer-shell panels.
+    // You can think of them as a kind of outer gaps. They are set in logical pixels.
+    // Left and right struts will cause the next window to the side to always be visible.
+    // Top and bottom struts will simply add outer gaps in addition to the area occupied by
+    // layer-shell panels and regular gaps.
+    struts {
+        // left 64
+        // right 64
+        // top 64
+        // bottom 64
+    }
+}
+
+cursor {
+    // Change the theme and size of the cursor as well as set the
+    // `XCURSOR_THEME` and `XCURSOR_SIZE` env variables.
+    // xcursor-theme "default"
+    // xcursor-size 24
+}
+
+hotkey-overlay {
+    // Uncomment this line to disable the "Important Hotkeys" pop-up at startup.
+    skip-at-startup
+}
+
+// Uncomment this line to ask the clients to omit their client-side decorations if possible.
+// If the client will specifically ask for CSD, the request will be honored.
+// Additionally, clients will be informed that they are tiled, removing some client-side rounded corners.
+// This option will also fix border/focus ring drawing behind some semitransparent windows.
+// After enabling or disabling this, you need to restart the apps for this to take effect.
+// prefer-no-csd
+
+// You can change the path where screenshots are saved.
+// A ~ at the front will be expanded to the home directory.
+// The path is formatted with strftime(3) to give you the screenshot date and time.
+screenshot-path "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png"
+
+// You can also set this to null to disable saving screenshots to disk.
+// screenshot-path null
+
+// Animation settings.
+// The wiki explains how to configure individual animations:
+// https://yalter.github.io/niri/Configuration:-Animations
+animations {
+    // Uncomment to turn off all animations.
+    // off
+
+    // Slow down all animations by this factor. Values below 1 speed them up instead.
+    // slowdown 3.0
+}
+
+// Window rules let you adjust behavior for individual windows.
+// Find more information on the wiki:
+// https://yalter.github.io/niri/Configuration:-Window-Rules
+
+layer-rule {
+    match namespace="waybar"
+    opacity 0.800000
+}
@@ -0,0 +1,239 @@
+binds {
+    // Keys consist of modifiers separated by + signs, followed by an XKB key name
+    // in the end. To find an XKB name for a particular key, you may use a program
+    // like wev.
+    //
+    // "Mod" is a special modifier equal to Super when running on a TTY, and to Alt
+    // when running as a winit window.
+    //
+    // Most actions that you can bind here can also be invoked programmatically with
+    // `niri msg action do-something`.
+
+    // Mod-Shift-/, which is usually the same as Mod-?,
+    // shows a list of important hotkeys.
+    Mod+Shift+Slash { show-hotkey-overlay; }
+
+    // Suggested binds for running programs: terminal, app launcher, screen locker.
+    Mod+Return { spawn "foot"; }
+    Mod+Shift+Return { spawn "alacritty"; }
+    Mod+D { spawn "anyrun"; }
+    CTRL+Alt+L { spawn "swaylock"; }
+
+    // Use spawn-sh to run a shell command. Do this if you need pipes, multiple commands, etc.
+    // Note: the entire command goes as a single argument. It's passed verbatim to `sh -c`.
+    // For example, this is a standard bind to toggle the screen reader (orca).
+    // Super+Alt+S allow-when-locked=true hotkey-overlay-title=null { spawn-sh "pkill orca || exec orca"; }
+
+    // Example volume keys mappings for PipeWire & WirePlumber.
+    // The allow-when-locked=true property makes them work even when the session is locked.
+    // Using spawn-sh allows to pass multiple arguments together with the command.
+    // "-l 1.0" limits the volume to 100%.
+    XF86AudioRaiseVolume allow-when-locked=true { spawn-sh "wpctl set-volume @DEFAULT_AUDIO_SINK@ 0.1+ -l 1.0"; }
+    XF86AudioLowerVolume allow-when-locked=true { spawn-sh "wpctl set-volume @DEFAULT_AUDIO_SINK@ 0.1-"; }
+    XF86AudioMute        allow-when-locked=true { spawn-sh "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"; }
+    XF86AudioMicMute     allow-when-locked=true { spawn-sh "wpctl set-mute @DEFAULT_AUDIO_SOURCE@ toggle"; }
+
+    // Example media keys mapping using playerctl.
+    // This will work with any MPRIS-enabled media player.
+    XF86AudioPlay        allow-when-locked=true { spawn-sh "playerctl play-pause"; }
+    XF86AudioStop        allow-when-locked=true { spawn-sh "playerctl stop"; }
+    XF86AudioPrev        allow-when-locked=true { spawn-sh "playerctl previous"; }
+    XF86AudioNext        allow-when-locked=true { spawn-sh "playerctl next"; }
+
+    // Example brightness key mappings for brightnessctl.
+    // You can use regular spawn with multiple arguments too (to avoid going through "sh"),
+    // but you need to manually put each argument in separate "" quotes.
+    XF86MonBrightnessUp allow-when-locked=true { spawn "brightnessctl" "--class=backlight" "set" "+10%"; }
+    XF86MonBrightnessDown allow-when-locked=true { spawn "brightnessctl" "--class=backlight" "set" "10%-"; }
+
+    // Open/close the Overview: a zoomed-out view of workspaces and windows.
+    // You can also move the mouse into the top-left hot corner,
+    // or do a four-finger swipe up on a touchpad.
+    // Mod+O repeat=false { toggle-overview; }
+
+    Mod+Q repeat=false { close-window; }
+    Mod+Left { focus-column-left; }
+    Mod+Down { focus-window-down; }
+    Mod+Up { focus-window-up; }
+    Mod+Right { focus-column-right; }
+    Mod+H { focus-column-left; }
+    Mod+J { focus-window-down; }
+    Mod+K { focus-window-up; }
+    Mod+L { focus-column-right; }
+    Mod+Ctrl+Left { move-column-left; }
+    Mod+Ctrl+Down { move-window-down; }
+    Mod+Ctrl+Up { move-window-up; }
+    Mod+Ctrl+Right { move-column-right; }
+    Mod+Ctrl+H { move-column-left; }
+    Mod+Ctrl+J { move-window-down; }
+    Mod+Ctrl+K { move-window-up; }
+    Mod+Ctrl+L { move-column-right; }
+
+    // Alternative commands that move across workspaces when reaching
+    // the first or last window in a column.
+    // Mod+J     { focus-window-or-workspace-down; }
+    // Mod+K     { focus-window-or-workspace-up; }
+    // Mod+Ctrl+J     { move-window-down-or-to-workspace-down; }
+    // Mod+Ctrl+K     { move-window-up-or-to-workspace-up; }
+
+    Mod+Home { focus-column-first; }
+    Mod+End  { focus-column-last; }
+    Mod+Ctrl+Home { move-column-to-first; }
+    Mod+Ctrl+End  { move-column-to-last; }
+
+    Mod+Shift+Left  { focus-monitor-left; }
+    Mod+Shift+Down  { focus-monitor-down; }
+    Mod+Shift+Up    { focus-monitor-up; }
+    Mod+Shift+Right { focus-monitor-right; }
+    Mod+Shift+H     { focus-monitor-left; }
+    Mod+Shift+J     { focus-monitor-down; }
+    Mod+Shift+K     { focus-monitor-up; }
+    Mod+Shift+L     { focus-monitor-right; }
+
+    Mod+Shift+Ctrl+Left  { move-column-to-monitor-left; }
+    Mod+Shift+Ctrl+Down  { move-column-to-monitor-down; }
+    Mod+Shift+Ctrl+Up    { move-column-to-monitor-up; }
+    Mod+Shift+Ctrl+Right { move-column-to-monitor-right; }
+    Mod+Shift+Ctrl+H     { move-column-to-monitor-left; }
+    Mod+Shift+Ctrl+J     { move-column-to-monitor-down; }
+    Mod+Shift+Ctrl+K     { move-column-to-monitor-up; }
+    Mod+Shift+Ctrl+L     { move-column-to-monitor-right; }
+
+    // Alternatively, there are commands to move just a single window:
+    // Mod+Shift+Ctrl+Left  { move-window-to-monitor-left; }
+    // ...
+
+    // And you can also move a whole workspace to another monitor:
+    // Mod+Shift+Ctrl+Left  { move-workspace-to-monitor-left; }
+    // ...
+
+    "Mod+Page_Down"      { focus-workspace-down; }
+    "Mod+Page_Up" { focus-workspace-up; }
+    Mod+U { focus-workspace-down; }
+    Mod+I { focus-workspace-up; }
+    "Mod+Ctrl+Page_Down" { move-column-to-workspace-down; }
+    "Mod+Ctrl+Page_Up" { move-column-to-workspace-up; }
+    Mod+Ctrl+U { move-column-to-workspace-down; }
+    Mod+Ctrl+I { move-column-to-workspace-up; }
+    "Mod+Shift+Page_Down" { move-workspace-down; }
+    "Mod+Shift+Page_Up" { move-workspace-up; }
+    Mod+Shift+U { move-workspace-down; }
+    Mod+Shift+I { move-workspace-up; }
+
+      // You can refer to workspaces by index. However, keep in mind that
+    // niri is a dynamic workspace system, so these commands are kind of
+    // "best effort". Trying to refer to a workspace index bigger than
+    // the current workspace count will instead refer to the bottommost
+    // (empty) workspace.
+    //
+    // For example, with 2 workspaces + 1 empty, indices 3, 4, 5 and so on
+    // will all refer to the 3rd workspace.
+    Mod+1 { focus-workspace "1terminal"; }
+    Mod+2 { focus-workspace "2browser"; }
+    Mod+3 { focus-workspace "3chat"; }
+    Mod+4 { focus-workspace "4music"; }
+    Mod+5 { focus-workspace "5mail"; }
+    Mod+6 { focus-workspace "6file"; }
+    Mod+7 { focus-workspace 7; }
+    Mod+8 { focus-workspace 8; }
+    Mod+9 { focus-workspace 9; }
+    Mod+0 { focus-workspace "0other"; }
+    Mod+Ctrl+1 { move-column-to-workspace "1terminal"; }
+    Mod+Ctrl+2 { move-column-to-workspace "2browser"; }
+    Mod+Ctrl+3 { move-column-to-workspace "3chat"; }
+    Mod+Ctrl+4 { move-column-to-workspace "4music"; }
+    Mod+Ctrl+5 { move-column-to-workspace "5mail"; }
+    Mod+Ctrl+6 { move-column-to-workspace "6file"; }
+    Mod+Ctrl+7 { move-column-to-workspace 7; }
+    Mod+Ctrl+8 { move-column-to-workspace 8; }
+    Mod+Ctrl+9 { move-column-to-workspace 9; }
+    Mod+Ctrl+0 { move-column-to-workspace "0other"; }
+
+    // Alternatively, there are commands to move just a single window:
+    // Mod+Ctrl+1 { move-window-to-workspace 1; }
+
+    // Switches focus between the current and the previous workspace.
+    // Mod+Tab { focus-workspace-previous; }
+
+    // The following binds move the focused window in and out of a column.
+    // If the window is alone, they will consume it into the nearby column to the side.
+    // If the window is already in a column, they will expel it out.
+    Mod+BracketLeft  { consume-or-expel-window-left; }
+    Mod+BracketRight { consume-or-expel-window-right; }
+
+    // Consume one window from the right to the bottom of the focused column.
+    Mod+Comma  { consume-window-into-column; }
+    // Expel the bottom window from the focused column to the right.
+    Mod+Period { expel-window-from-column; }
+
+    Mod+R { switch-preset-column-width; }
+    // Cycling through the presets in reverse order is also possible.
+    // Mod+R { switch-preset-column-width-back; }
+    Mod+Shift+R { switch-preset-window-height; }
+    Mod+Ctrl+R { reset-window-height; }
+    Mod+F { maximize-column; }
+    Mod+Shift+F { fullscreen-window; }
+
+    // Expand the focused column to space not taken up by other fully visible columns.
+    // Makes the column "fill the rest of the space".
+    Mod+Ctrl+F { expand-column-to-available-width; }
+
+    Mod+C { center-column; }
+
+    // Center all fully visible columns on screen.
+    Mod+Ctrl+C { center-visible-columns; }
+
+    // Finer width adjustments.
+    // This command can also:
+    // * set width in pixels: "1000"
+    // * adjust width in pixels: "-5" or "+5"
+    // * set width as a percentage of screen width: "25%"
+    // * adjust width as a percentage of screen width: "-10%" or "+10%"
+    // Pixel sizes use logical, or scaled, pixels. I.e. on an output with scale 2.0,
+    // set-column-width "100" will make the column occupy 200 physical screen pixels.
+    Mod+Minus { set-column-width "-10%"; }
+    Mod+Equal { set-column-width "+10%"; }
+
+    // Finer height adjustments when in column with other windows.
+    Mod+Shift+Minus { set-window-height "-10%"; }
+    Mod+Shift+Equal { set-window-height "+10%"; }
+
+    // Move the focused window between the floating and the tiling layout.
+    Mod+V       { toggle-window-floating; }
+    Mod+Shift+V { switch-focus-between-floating-and-tiling; }
+
+    // Toggle tabbed column display mode.
+    // Windows in this column will appear as vertical tabs,
+    // rather than stacked on top of each other.
+    Mod+W { toggle-column-tabbed-display; }
+
+    // Actions to switch layouts.
+    // Note: if you uncomment these, make sure you do NOT have
+    // a matching layout switch hotkey configured in xkb options above.
+    // Having both at once on the same hotkey will break the switching,
+    // since it will switch twice upon pressing the hotkey (once by xkb, once by niri).
+    // Mod+Space       { switch-layout "next"; }
+    // Mod+Shift+Space { switch-layout "prev"; }
+
+    Print { screenshot; }
+    Ctrl+Print { screenshot-screen; }
+    Alt+Print { screenshot-window; }
+
+    // Applications such as remote-desktop clients and software KVM switches may
+    // request that niri stops processing the keyboard shortcuts defined here
+    // so they may, for example, forward the key presses as-is to a remote machine.
+    // It's a good idea to bind an escape hatch to toggle the inhibitor,
+    // so a buggy application can't hold your session hostage.
+    //
+    // The allow-inhibiting=false property can be applied to other binds as well,
+    // which ensures niri always processes them, even when an inhibitor is active.
+    Mod+Escape allow-inhibiting=false { toggle-keyboard-shortcuts-inhibit; }
+
+    Mod+Shift+E { wlogout; }
+    // The quit action will show a confirmation dialog to avoid accidental exits.
+    Ctrl+Alt+Delete { quit; }
+
+    // Powers off the monitors. To turn them back on, do any input like
+    // moving the mouse or pressing any other key.
+    Mod+Shift+P { power-off-monitors; }
+}
@@ -0,0 +1,26 @@
+// Add lines like this to spawn processes at startup.
+// Note that running niri as a session supports xdg-desktop-autostart,
+// which may be more convenient to use.
+// See the binds section below for more spawn examples.
+
+// This line starts waybar, a commonly used bar for Wayland compositors.
+// spawn-at-startup "waybar"
+
+// To run a shell command (with variables, pipes, etc.), use spawn-sh-at-startup:
+// spawn-sh-at-startup "qs -c ~/source/qs/MyAwesomeShell"
+
+// Terminal applications
+spawn-at-startup "foot"
+spawn-at-startup "alacritty"
+spawn-at-startup "ghostty"
+
+// Network proxy
+spawn-at-startup "clash-verge"
+
+// Web browsers
+spawn-at-startup "firefox"
+spawn-at-startup "google-chrome-stable"
+spawn-at-startup "chromium-browser"
+
+// Communication applications
+spawn-at-startup "Telegram"
@@ -0,0 +1,103 @@
+// Window rules let you adjust behavior for individual windows.
+// Find more information on the wiki:
+// https://yalter.github.io/niri/Configuration:-Window-Rules
+
+// Terminal applications - open in workspace 1
+window-rule {
+    match app-id="foot"
+    open-on-workspace "1terminal"
+    open-maximized true
+}
+window-rule {
+    match app-id="Alacritty"
+    open-on-workspace "1terminal"
+    open-maximized true
+}
+window-rule {
+    match app-id="com.mitchellh.ghostty"
+    open-on-workspace "1terminal"
+    open-maximized true
+}
+
+// Web browsers - open in workspace 2
+window-rule {
+    match app-id="firefox"
+    open-on-workspace "2browser"
+    open-maximized true
+}
+window-rule {
+    match app-id="google-chrome"
+    open-on-workspace "2browser"
+    open-maximized true
+}
+window-rule {
+    match app-id="chromium-browser"
+    open-on-workspace "2browser"
+    open-maximized true
+}
+
+// Chat applications - open in workspace 3
+window-rule {
+    match app-id="org.telegram.desktop"
+    open-on-workspace "3chat"
+}
+window-rule {
+    match app-id="wechat"
+    open-on-workspace "3chat"
+}
+window-rule {
+    match app-id="QQ"
+    open-on-workspace "3chat"
+}
+
+// Gaming applications - open in workspace 4
+window-rule {
+    match app-id="steam"
+    open-on-workspace "4gaming"
+}
+window-rule {
+    match app-id="steam_app_default"
+    open-on-workspace "4gaming"
+}
+window-rule {
+    match app-id="heroic"
+    open-on-workspace "4gaming"
+}
+window-rule {
+    match app-id="net.lutris.Lutris"
+    open-on-workspace "4gaming"
+}
+window-rule {
+    match app-id="com.vysp3r.ProtonPlus"
+    open-on-workspace "4gaming"
+}
+window-rule {
+    // Run anime games on Linux
+    match app-id="^moe.launcher"
+    open-on-workspace "4gaming"
+}
+window-rule {
+    // All *.exe (Windows applications)
+    match app-id=".exe$"
+    open-on-workspace "4gaming"
+}
+
+// File management applications - open in workspace 6
+window-rule {
+    match app-id="com.github.johnfactotum.Foliate"
+    open-on-workspace "6file"
+}
+window-rule {
+    match app-id="thunar"
+    open-on-workspace "6file"
+}
+
+// Other applications - open in workspace 0
+window-rule {
+    match app-id="clash-verge"
+    open-on-workspace "0other"
+}
+window-rule {
+    match app-id="Zoom Workplace"
+    open-on-workspace "0other"
+}
@@ -2,7 +2,6 @@
  pkgs,
  config,
  lib,
-  niri,
  ...
 }@args:
 let
@@ -11,32 +10,46 @@ in
 {
  options.modules.desktop.niri = {
    enable = lib.mkEnableOption "niri compositor";
-    settings = lib.mkOption {
-      type =
-        with lib.types;
-        let
-          valueType =
-            nullOr (oneOf [
-              bool
-              int
-              float
-              str
-              path
-              (attrsOf valueType)
-              (listOf valueType)
-            ])
-            // {
-              description = "niri configuration value";
-            };
-        in
-        valueType;
-      default = { };
-    };
  };

  config = lib.mkIf cfg.enable (
    lib.mkMerge [
      {
+        home.packages = with pkgs; [
+          # Niri v25.08 will create X11 sockets on disk, export $DISPLAY, and spawn `xwayland-satellite` on-demand when an X11 client connects
+          xwayland-satellite
+        ];
+
+        xdg.configFile =
+          let
+            mkSymlink = config.lib.file.mkOutOfStoreSymlink;
+            confPath = "${config.home.homeDirectory}/nix-config/home/linux/gui/niri/conf";
+          in
+          {
+            "niri/config.kdl".source = mkSymlink "${confPath}/config.kdl";
+            "niri/keybindings.kdl".source = mkSymlink "${confPath}/keybindings.kdl";
+            "niri/spawn-at-startup.kdl".source = mkSymlink "${confPath}/spawn-at-startup.kdl";
+            "niri/windowrules.kdl".source = mkSymlink "${confPath}/windowrules.kdl";
+          };
+
+        systemd.user.services.niri-flake-polkit = {
+          Unit = {
+            Description = "PolicyKit Authentication Agent provided by niri-flake";
+            After = [
+              "graphical-session.target"
+            ];
+            Wants = [ "graphical-session-pre.target" ];
+          };
+          Install.WantedBy = [ "niri.service" ];
+          Service = {
+            Type = "simple";
+            ExecStart = "${pkgs.kdePackages.polkit-kde-agent-1}/libexec/polkit-kde-authentication-agent-1";
+            Restart = "on-failure";
+            RestartSec = 1;
+            TimeoutStopSec = 10;
+          };
+        };
+
        # NOTE: this executable is used by greetd to start a wayland session when system boot up
        # with such a vendor-no-locking script, we can switch to another wayland compositor without modifying greetd's config in NixOS module
        home.file.".wayland-session" = {
@@ -49,10 +62,6 @@ in
          executable = true;
        };
      }
-      (import ./settings.nix niri)
-      (import ./keybindings.nix niri)
-      (import ./spawn-at-startup.nix niri)
-      (import ./windowrules.nix niri)
    ]
  );

@@ -1,214 +0,0 @@
-niri: {
-  programs.niri.config =
-    let
-      inherit (niri.lib.kdl)
-        node
-        plain
-        leaf
-        flag
-        ;
-    in
-    [
-      (plain "binds" [
-        # Keys consist of modifiers separated by + signs, followed by an XKB key name
-        # in the end. To find an XKB name for a particular key, you may use a program
-        # like wev.
-        #
-        # "Mod" is a special modifier equal to Super when running on a TTY, and to Alt
-        # when running as a winit window.
-        #
-        # Most actions that you can bind here can also be invoked programmatically with
-        # `niri msg action do-something`.
-
-        # Mod-Shift-/, which is usually the same as Mod-?,
-        # shows a list of important hotkeys.
-        (plain "Mod+Shift+Slash" [ (flag "show-hotkey-overlay") ])
-
-        # Suggested binds for running programs: terminal, app launcher, screen locker.
-        (plain "Mod+Return" [ (leaf "spawn" [ "foot" ]) ])
-        (plain "Mod+Shift+Return" [ (leaf "spawn" [ "alacritty" ]) ])
-        (plain "Mod+D" [ (leaf "spawn" [ "anyrun" ]) ])
-        (plain "CTRL+Alt+L" [ (leaf "spawn" [ "swaylock" ]) ])
-
-        # You can also use a shell:
-        # (plain "Mod+T" [(leaf "spawn" [ "bash" "-c" "notify-send hello && exec alacritty" ])])
-
-        # Example volume keys mappings for PipeWire & WirePlumber.
-        (plain "XF86AudioRaiseVolume" [
-          (leaf "spawn" [
-            "wpctl"
-            "set-volume"
-            "@DEFAULT_AUDIO_SINK@"
-            "0.1+"
-          ])
-        ])
-        (plain "XF86AudioLowerVolume" [
-          (leaf "spawn" [
-            "wpctl"
-            "set-volume"
-            "@DEFAULT_AUDIO_SINK@"
-            "0.1-"
-          ])
-        ])
-
-        (plain "Mod+Q" [ (flag "close-window") ])
-
-        (plain "Mod+Left" [ (flag "focus-column-left") ])
-        (plain "Mod+Down" [ (flag "focus-window-down") ])
-        (plain "Mod+Up" [ (flag "focus-window-up") ])
-        (plain "Mod+Right" [ (flag "focus-column-right") ])
-        (plain "Mod+H" [ (flag "focus-column-left") ])
-        (plain "Mod+J" [ (flag "focus-window-down") ])
-        (plain "Mod+K" [ (flag "focus-window-up") ])
-        (plain "Mod+L" [ (flag "focus-column-right") ])
-
-        (plain "Mod+Ctrl+Left" [ (flag "move-column-left") ])
-        (plain "Mod+Ctrl+Down" [ (flag "move-window-down") ])
-        (plain "Mod+Ctrl+Up" [ (flag "move-window-up") ])
-        (plain "Mod+Ctrl+Right" [ (flag "move-column-right") ])
-        (plain "Mod+Ctrl+H" [ (flag "move-column-left") ])
-        (plain "Mod+Ctrl+J" [ (flag "move-window-down") ])
-        (plain "Mod+Ctrl+K" [ (flag "move-window-up") ])
-        (plain "Mod+Ctrl+L" [ (flag "move-column-right") ])
-
-        # Alternative commands that move across workspaces when reaching
-        # the first or last window in a column.
-        # (plain "Mod+J"      [(flag "focus-window-or-workspace-down")])
-        # (plain "Mod+K"      [(flag "focus-window-or-workspace-up")])
-        # (plain "Mod+Ctrl+J" [(flag "move-window-down-or-to-workspace-down")])
-        # (plain "Mod+Ctrl+K" [(flag "move-window-up-or-to-workspace-up")])
-
-        (plain "Mod+Home" [ (flag "focus-column-first") ])
-        (plain "Mod+End" [ (flag "focus-column-last") ])
-        (plain "Mod+Ctrl+Home" [ (flag "move-column-to-first") ])
-        (plain "Mod+Ctrl+End" [ (flag "move-column-to-last") ])
-
-        (plain "Mod+Shift+Left" [ (flag "focus-monitor-left") ])
-        (plain "Mod+Shift+Down" [ (flag "focus-monitor-down") ])
-        (plain "Mod+Shift+Up" [ (flag "focus-monitor-up") ])
-        (plain "Mod+Shift+Right" [ (flag "focus-monitor-right") ])
-        (plain "Mod+Shift+H" [ (flag "focus-monitor-left") ])
-        (plain "Mod+Shift+J" [ (flag "focus-monitor-down") ])
-        (plain "Mod+Shift+K" [ (flag "focus-monitor-up") ])
-        (plain "Mod+Shift+L" [ (flag "focus-monitor-right") ])
-
-        (plain "Mod+Shift+Ctrl+Left" [ (flag "move-column-to-monitor-left") ])
-        (plain "Mod+Shift+Ctrl+Down" [ (flag "move-column-to-monitor-down") ])
-        (plain "Mod+Shift+Ctrl+Up" [ (flag "move-column-to-monitor-up") ])
-        (plain "Mod+Shift+Ctrl+Right" [ (flag "move-column-to-monitor-right") ])
-        (plain "Mod+Shift+Ctrl+H" [ (flag "move-column-to-monitor-left") ])
-        (plain "Mod+Shift+Ctrl+J" [ (flag "move-column-to-monitor-down") ])
-        (plain "Mod+Shift+Ctrl+K" [ (flag "move-column-to-monitor-up") ])
-        (plain "Mod+Shift+Ctrl+L" [ (flag "move-column-to-monitor-right") ])
-
-        # Alternatively, there are commands to move just a single window:
-        # (plain "Mod+Shift+Ctrl+Left" [(flag "move-window-to-monitor-left")])
-        # ...
-
-        # And you can also move a whole workspace to another monitor:
-        # (plain "Mod+Shift+Ctrl+Left" [(flag "move-workspace-to-monitor-left")])
-        # ...
-
-        (plain "Mod+Page_Down" [ (flag "focus-workspace-down") ])
-        (plain "Mod+Page_Up" [ (flag "focus-workspace-up") ])
-        (plain "Mod+U" [ (flag "focus-workspace-down") ])
-        (plain "Mod+I" [ (flag "focus-workspace-up") ])
-        (plain "Mod+Ctrl+Page_Down" [ (flag "move-column-to-workspace-down") ])
-        (plain "Mod+Ctrl+Page_Up" [ (flag "move-column-to-workspace-up") ])
-        (plain "Mod+Ctrl+U" [ (flag "move-column-to-workspace-down") ])
-        (plain "Mod+Ctrl+I" [ (flag "move-column-to-workspace-up") ])
-
-        # Alternatively, there are commands to move just a single window:
-        # (plain "Mod+Ctrl+Page_Down" [(flag "move-window-to-workspace-down")])
-        # ...
-
-        (plain "Mod+Shift+Page_Down" [ (flag "move-workspace-down") ])
-        (plain "Mod+Shift+Page_Up" [ (flag "move-workspace-up") ])
-        (plain "Mod+Shift+U" [ (flag "move-workspace-down") ])
-        (plain "Mod+Shift+I" [ (flag "move-workspace-up") ])
-
-        # You can refer to workspaces by index. However, keep in mind that
-        # niri is a dynamic workspace system, so these commands are kind of
-        # "best effort". Trying to refer to a workspace index bigger than
-        # the current workspace count will instead refer to the bottommost
-        # (empty) workspace.
-        #
-        # For example, with 2 workspaces + 1 empty, indices 3, 4, 5 and so on
-        # will all refer to the 3rd workspace.
-        (plain "Mod+1" [ (leaf "focus-workspace" "1terminal") ])
-        (plain "Mod+2" [ (leaf "focus-workspace" "2browser") ])
-        (plain "Mod+3" [ (leaf "focus-workspace" "3chat") ])
-        (plain "Mod+4" [ (leaf "focus-workspace" "4music") ])
-        (plain "Mod+5" [ (leaf "focus-workspace" "5mail") ])
-        (plain "Mod+6" [ (leaf "focus-workspace" "6file") ])
-        (plain "Mod+7" [ (leaf "focus-workspace" 7) ])
-        (plain "Mod+8" [ (leaf "focus-workspace" 8) ])
-        (plain "Mod+9" [ (leaf "focus-workspace" 9) ])
-        (plain "Mod+0" [ (leaf "focus-workspace" "0other") ])
-        (plain "Mod+Ctrl+1" [ (leaf "move-column-to-workspace" "1terminal") ])
-        (plain "Mod+Ctrl+2" [ (leaf "move-column-to-workspace" "2browser") ])
-        (plain "Mod+Ctrl+3" [ (leaf "move-column-to-workspace" "3chat") ])
-        (plain "Mod+Ctrl+4" [ (leaf "move-column-to-workspace" "4music") ])
-        (plain "Mod+Ctrl+5" [ (leaf "move-column-to-workspace" "5mail") ])
-        (plain "Mod+Ctrl+6" [ (leaf "move-column-to-workspace" "6file") ])
-        (plain "Mod+Ctrl+7" [ (leaf "move-column-to-workspace" 7) ])
-        (plain "Mod+Ctrl+8" [ (leaf "move-column-to-workspace" 8) ])
-        (plain "Mod+Ctrl+9" [ (leaf "move-column-to-workspace" 9) ])
-        (plain "Mod+Ctrl+0" [ (leaf "move-column-to-workspace" "0other") ])
-
-        # Alternatively, there are commands to move just a single window:
-        # (plain "Mod+Ctrl+1" [(leaf "move-window-to-workspace" 1)])
-
-        (plain "Mod+Comma" [ (flag "consume-window-into-column") ])
-        (plain "Mod+Period" [ (flag "expel-window-from-column") ])
-
-        # There are also commands that consume or expel a single window to the side.
-        # (plain "Mod+BracketLeft"  [(flag "consume-or-expel-window-left")])
-        # (plain "Mod+BracketRight" [(flag "consume-or-expel-window-right")])
-
-        (plain "Mod+R" [ (flag "switch-preset-column-width") ])
-        (plain "Mod+F" [ (flag "maximize-column") ])
-        (plain "Mod+Shift+F" [ (flag "fullscreen-window") ])
-        (plain "Mod+C" [ (flag "center-column") ])
-
-        # Finer width adjustments.
-        # This command can also:
-        # * set width in pixels: "1000"
-        # * adjust width in pixels: "-5" or "+5"
-        # * set width as a percentage of screen width: "25%"
-        # * adjust width as a percentage of screen width: "-10%" or "+10%"
-        # Pixel sizes use logical, or scaled, pixels. I.e. on an output with scale 2.0,
-        # (leaf "set-column-width" "100") will make the column occupy 200 physical screen pixels.
-        (plain "Mod+Minus" [ (leaf "set-column-width" "-10%") ])
-        (plain "Mod+Equal" [ (leaf "set-column-width" "+10%") ])
-
-        # Finer height adjustments when in column with other windows.
-        (plain "Mod+Shift+Minus" [ (leaf "set-window-height" "-10%") ])
-        (plain "Mod+Shift+Equal" [ (leaf "set-window-height" "+10%") ])
-
-        # Actions to switch layouts.
-        # Note: if you uncomment these, make sure you do NOT have
-        # a matching layout switch hotkey configured in xkb options above.
-        # Having both at once on the same hotkey will break the switching,
-        # since it will switch twice upon pressing the hotkey (once by xkb, once by niri).
-        # (plain "Mod+Space"       [(leaf "switch-layout" "next")])
-        # (plain "Mod+Shift+Space" [(leaf "switch-layout" "prev")])
-
-        (plain "Print" [ (flag "screenshot") ])
-        (plain "Ctrl+Print" [ (flag "screenshot-screen") ])
-        (plain "Alt+Print" [ (flag "screenshot-window") ])
-
-        # The quit action will show a confirmation dialog to avoid accidental exits.
-        # If you want to skip the confirmation dialog, set the flag like so:
-        # (plain "Mod+Shift+E" [(leaf "quit" { skip-confirmation=true; })])
-        (plain "Mod+Shift+E" [ (flag "quit") ])
-
-        (plain "Mod+Shift+P" [ (flag "power-off-monitors") ])
-
-        # This debug bind will tint all surfaces green, unless they are being
-        # directly scanned out. It's therefore useful to check if direct scanout
-        # is working.
-        # (plain "Mod+Shift+Ctrl+T" [(flag "toggle-debug-tint")])
-      ])
-    ];
-}
@@ -1,276 +0,0 @@
-niri: {
-  programs.niri.config =
-    let
-      inherit (niri.lib.kdl)
-        node
-        plain
-        leaf
-        flag
-        ;
-    in
-    [
-      (plain "input" [
-        (plain "keyboard" [
-          (plain "xkb" [
-            # You can set rules, model, layout, variant and options.
-            # For more information, see xkeyboard-config(7).
-
-            # For example:
-            # (leaf "layout" "us,ru")
-            # (leaf "options" "grp:win_space_toggle,compose:ralt,ctrl:nocaps")
-          ])
-
-          # You can set the keyboard repeat parameters. The defaults match wlroots and sway.
-          # Delay is in milliseconds before the repeat starts. Rate is in characters per second.
-          # (leaf "repeat-delay" 600)
-          # (leaf "repeat-rate" 25)
-
-          # Niri can remember the keyboard layout globally (the default) or per-window.
-          # - "global" - layout change is global for all windows.
-          # - "window" - layout is tracked for each window individually.
-          # (leaf "track-layout" "global")
-        ])
-
-        # Next sections include libinput settings.
-        # Omitting settings disables them, or leaves them at their default values.
-        (plain "touchpad" [
-          (flag "tap")
-          # (flag "dwt")
-          # (flag "dwtp")
-          (flag "natural-scroll")
-          # (leaf "accel-speed" 0.2)
-          # (leaf "accel-profile" "flat")
-          # (leaf "tap-button-map" "left-middle-right")
-        ])
-
-        (plain "mouse" [
-          # (flag "natural-scroll")
-          # (leaf "accel-speed" 0.2)
-          # (leaf "accel-profile" "flat")
-        ])
-
-        # By default, niri will take over the power button to make it sleep
-        # instead of power off.
-        # Uncomment this if you would like to configure the power button elsewhere
-        # (i.e. logind.conf).
-        # (flag "disable-power-key-handling")
-      ])
-
-      (plain "layout" [
-        # By default focus ring and border are rendered as a solid background rectangle
-        # behind windows. That is, they will show up through semitransparent windows.
-        # This is because windows using client-side decorations can have an arbitrary shape.
-        #
-        # If you don't like that, you should uncomment `prefer-no-csd` below.
-        # Niri will draw focus ring and border *around* windows that agree to omit their
-        # client-side decorations.
-
-        # You can change how the focus ring looks.
-        (plain "focus-ring" [
-          # Uncomment this line to disable the focus ring.
-          # (flag "off")
-
-          # How many logical pixels the ring extends out from the windows.
-          (leaf "width" 4)
-
-          # Colors can be set in a variety of ways:
-          # - CSS named colors: "red"
-          # - RGB hex: "#rgb", "#rgba", "#rrggbb", "#rrggbbaa"
-          # - CSS-like notation: "rgb(255, 127, 0)", rgba(), hsl() and a few others.
-
-          # Color of the ring on the active monitor.
-          (leaf "active-color" "#7fc8ff")
-
-          # Color of the ring on inactive monitors.
-          (leaf "inactive-color" "#505050")
-
-          # Additionally, there's a legacy RGBA syntax:
-          # (leaf "active-color" [ 127 200 255 255 ])
-
-          # You can also use gradients. They take precedence over solid colors.
-          # Gradients are rendered the same as CSS linear-gradient(angle, from, to).
-          # The angle is the same as in linear-gradient, and is optional,
-          # defaulting to 180 (top-to-bottom gradient).
-          # You can use any CSS linear-gradient tool on the web to set these up.
-          #
-          # (leaf "active-gradient" { from="#80c8ff"; to="#bbddff"; angle=45; })
-
-          # You can also color the gradient relative to the entire view
-          # of the workspace, rather than relative to just the window itself.
-          # To do that, set relative-to="workspace-view";
-          #
-          # (leaf "inactive-gradient" { from="#505050"; to="#808080"; angle=45; relative-to="workspace-view"; })
-        ])
-
-        # You can also add a border. It's similar to the focus ring, but always visible.
-        (plain "border" [
-          # The settings are the same as for the focus ring.
-          # If you enable the border, you probably want to disable the focus ring.
-          (flag "off")
-
-          (leaf "width" 4)
-          (leaf "active-color" "#ffc87f")
-          (leaf "inactive-color" "#505050")
-
-          # (leaf "active-gradient" { from="#ffbb66"; to="#ffc880"; angle=45; relative-to="workspace-view"; })
-          # (leaf "inactive-gradient" { from="#505050"; to="#808080"; angle=45; relative-to="workspace-view"; })
-        ])
-
-        # You can customize the widths that "switch-preset-column-width" (Mod+R) toggles between.
-        (plain "preset-column-widths" [
-          # Proportion sets the width as a fraction of the output width, taking gaps into account.
-          # For example, you can perfectly fit four windows sized "proportion 0.25" on an output.
-          # The default preset widths are 1/3, 1/2 and 2/3 of the output.
-          (leaf "proportion" (1.0 / 3.0))
-          (leaf "proportion" (1.0 / 2.0))
-          (leaf "proportion" (2.0 / 3.0))
-
-          # Fixed sets the width in logical pixels exactly.
-          # (leaf "fixed" 1920)
-        ])
-
-        # You can change the default width of the new windows.
-        (plain "default-column-width" [
-          (leaf "proportion" 0.5)
-        ])
-        # If you leave the children empty, the windows themselves will decide their initial width.
-        # (plain "default-column-width" [])
-
-        # Set gaps around windows in logical pixels.
-        (leaf "gaps" 8)
-
-        # Struts shrink the area occupied by windows, similarly to layer-shell panels.
-        # You can think of them as a kind of outer gaps. They are set in logical pixels.
-        # Left and right struts will cause the next window to the side to always be visible.
-        # Top and bottom struts will simply add outer gaps in addition to the area occupied by
-        # layer-shell panels and regular gaps.
-        (plain "struts" [
-          # (leaf "left" 64)
-          # (leaf "right" 64)
-          # (leaf "top" 64)
-          # (leaf "bottom" 64)
-        ])
-
-        # When to center a column when changing focus, options are:
-        # - "never", default behavior, focusing an off-screen column will keep at the left
-        #   or right edge of the screen.
-        # - "on-overflow", focusing a column will center it if it doesn't fit
-        #   together with the previously focused column.
-        # - "always", the focused column will always be centered.
-        (leaf "center-focused-column" "never")
-      ])
-
-      (plain "cursor" [
-        # Change the theme and size of the cursor as well as set the
-        # `XCURSOR_THEME` and `XCURSOR_SIZE` env variables.
-        # (leaf "xcursor-theme" "default")
-        # (leaf "xcursor-size" 24)
-      ])
-
-      # Uncomment this line to ask the clients to omit their client-side decorations if possible.
-      # If the client will specifically ask for CSD, the request will be honored.
-      # Additionally, clients will be informed that they are tiled, removing some rounded corners.
-      # (flag "prefer-no-csd")
-
-      # You can change the path where screenshots are saved.
-      # A ~ at the front will be expanded to the home directory.
-      # The path is formatted with strftime(3) to give you the screenshot date and time.
-      (leaf "screenshot-path" "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png")
-
-      # You can also set this to null to disable saving screenshots to disk.
-      # (leaf "screenshot-path" null)
-
-      # Settings for the "Important Hotkeys" overlay.
-      (plain "hotkey-overlay" [
-        # Uncomment this line if you don't want to see the hotkey help at niri startup.
-        # (flag "skip-at-startup")
-      ])
-
-      (plain "layer-rule" [
-        (leaf "match" { namespace = "waybar"; })
-        (leaf "opacity" 0.8)
-      ])
-
-      # Animation settings.
-      (plain "animations" [
-        # Uncomment to turn off all animations.
-        # (flag "off")
-
-        # Slow down all animations by this factor. Values below 1 speed them up instead.
-        # (leaf "slowdown" 3.0)
-
-        # You can configure all individual animations.
-        # Available settings are the same for all of them.
-        # - off disables the animation.
-        #
-        # Niri supports two animation types: easing and spring.
-        # You can set properties for only ONE of them.
-        #
-        # Easing has the following settings:
-        # - duration-ms sets the duration of the animation in milliseconds.
-        # - curve sets the easing curve. Currently, available curves
-        #   are "ease-out-cubic" and "ease-out-expo".
-        #
-        # Spring animations work better with touchpad gestures, because they
-        # take into account the velocity of your fingers as you release the swipe.
-        # The parameters are less obvious and generally should be tuned
-        # with trial and error. Notably, you cannot directly set the duration.
-        # You can use this app to help visualize how the spring parameters
-        # change the animation: https://flathub.org/apps/app.drey.Elastic
-        #
-        # A spring animation is configured like this:
-        # - (leaf "spring" { damping-ratio=1.0; stiffness=1000; epsilon=0.0001; })
-        #
-        # The damping ratio goes from 0.1 to 10.0 and has the following properties:
-        # - below 1.0: underdamped spring, will oscillate in the end.
-        # - above 1.0: overdamped spring, won't oscillate.
-        # - 1.0: critically damped spring, comes to rest in minimum possible time
-        #    without oscillations.
-        #
-        # However, even with damping ratio = 1.0 the spring animation may oscillate
-        # if "launched" with enough velocity from a touchpad swipe.
-        #
-        # Lower stiffness will result in a slower animation more prone to oscillation.
-        #
-        # Set epsilon to a lower value if the animation "jumps" in the end.
-        #
-        # The spring mass is hardcoded to 1.0 and cannot be changed. Instead, change
-        # stiffness proportionally. E.g. increasing mass by 2x is the same as
-        # decreasing stiffness by 2x.
-
-        # Animation when switching workspaces up and down,
-        # including after the touchpad gesture.
-        (plain "workspace-switch" [
-          # (flag "off")
-          # (leaf "spring" { damping-ratio=1.0; stiffness=1000; epsilon=0.0001; })
-        ])
-
-        # All horizontal camera view movement:
-        # - When a window off-screen is focused and the camera scrolls to it.
-        # - When a new window appears off-screen and the camera scrolls to it.
-        # - When a window resizes bigger and the camera scrolls to show it in full.
-        # - And so on.
-        (plain "horizontal-view-movement" [
-          # (flag "off")
-          # (leaf "spring" { damping-ratio=1.0; stiffness=800; epsilon=0.0001; })
-        ])
-
-        # Window opening animation. Note that this one has different defaults.
-        (plain "window-open" [
-          # (flag "off")
-          # (leaf "duration-ms" 150)
-          # (leaf "curve" "ease-out-expo")
-
-          # Example for a slightly bouncy window opening:
-          # (leaf "spring" { damping-ratio=0.8; stiffness=1000; epsilon=0.0001; })
-        ])
-
-        # Config parse error and new default config creation notification
-        # open/close animation.
-        (plain "config-notification-open-close" [
-          # (flag "off")
-          # (leaf "spring" { damping-ratio=0.6; stiffness=1000; epsilon=0.001; })
-        ])
-      ])
-    ];
-}
@@ -1,28 +0,0 @@
-niri: {
-  programs.niri.config =
-    let
-      inherit (niri.lib.kdl)
-        node
-        plain
-        leaf
-        flag
-        ;
-    in
-    [
-      # Add lines like this to spawn processes at startup.
-      # Note that running niri as a session supports xdg-desktop-autostart,
-      # which may be more convenient to use.
-      # --------------- Terminal ---------------
-      (leaf "spawn-at-startup" [ "foot" ])
-      (leaf "spawn-at-startup" [ "alacritty" ])
-      (leaf "spawn-at-startup" [ "ghostty" ])
-      # --------------- Networking ---------------
-      (leaf "spawn-at-startup" [ "clash-verge" ])
-      # --------------- Browser ---------------
-      (leaf "spawn-at-startup" [ "firefox" ])
-      (leaf "spawn-at-startup" [ "google-chrome-stable" ])
-      (leaf "spawn-at-startup" [ "chromium-browser" ])
-      # --------------- Chatting ---------------
-      (leaf "spawn-at-startup" [ "Telegram" ])
-    ];
-}
@@ -1,68 +0,0 @@
-niri: {
-  programs.niri.config =
-    let
-      inherit (niri.lib.kdl)
-        node
-        plain
-        leaf
-        flag
-        ;
-    in
-    [
-      # ============= Window Rules =============
-      # Get all the window's information via:
-      #   niri msg windows
-
-      # --------------- Terminal ---------------
-      # foot → ws 13
-      (plain "window-rule" [
-        (leaf "match" { app-id = "foot"; })
-        (leaf "open-on-workspace" "1terminal")
-        (leaf "open-maximized" true)
-      ])
-
-      # Alacritty → ws 10
-      (plain "window-rule" [
-        (leaf "match" { app-id = "Alacritty"; })
-        (leaf "open-on-workspace" "1terminal")
-        (leaf "open-maximized" true)
-      ])
-
-      # Ghostty → ws 14
-      (plain "window-rule" [
-        (leaf "match" { app-id = "com.mitchellh.ghostty"; })
-        (leaf "open-on-workspace" "1terminal")
-        (leaf "open-maximized" true)
-      ])
-
-      # --------------- Networking ---------------
-
-      # Clash Verge → ws 7
-      (plain "window-rule" [
-        (leaf "match" { app-id = "clash-verge"; })
-        (leaf "open-on-workspace" "0other")
-      ])
-
-      # --------------- Browser ---------------
-
-      # Firefox → ws 11
-      (plain "window-rule" [
-        (leaf "match" { app-id = "firefox"; })
-        (leaf "open-on-workspace" "2browser")
-        (leaf "open-maximized" true)
-      ])
-      # Google Chrome → ws 12
-      (plain "window-rule" [
-        (leaf "match" { app-id = "google-chrome"; })
-        (leaf "open-on-workspace" "2browser")
-        (leaf "open-maximized" true)
-      ])
-
-      # --------------- Chatting ---------------
-      # Telegram → ws 6
-      (plain "window-rule" [
-        (leaf "match" { app-id = "org.telegram.desktop"; })
-        (leaf "open-on-workspace" "3chat")
-      ])
-    ];
-}
@@ -1,7 +1,9 @@
 {
-  pkgs-unstable,
+  lib,
+  pkgs,
  nixos-apple-silicon,
  my-asahi-firmware,
+  nixpkgs-mesa,
  ...
 }:
 {
@@ -9,6 +11,31 @@
    nixos-apple-silicon.nixosModules.default
  ];

+  zramSwap.memoryPercent = lib.mkForce 75;
+
+  # Workaround for Mesa 25.3.1 regression
+  # https://github.com/nix-community/nixos-apple-silicon/issues/380
+  # https://github.com/NixOS/nixpkgs/pull/461866
+  hardware.graphics.package =
+    assert pkgs.mesa.version == "25.3.1";
+    (import nixpkgs-mesa { localSystem = pkgs.stdenv.hostPlatform; }).mesa;
+
+  nix.settings = {
+    extra-substituters = [
+      "https://nixos-apple-silicon.cachix.org"
+    ];
+    extra-trusted-public-keys = [
+      "nixos-apple-silicon.cachix.org-1:8psDu5SA5dAD7qA0zMy5UT292TxeEPzIz8VVEr2Js20="
+    ];
+  };
+
+  environment.systemPackages = with pkgs; [
+    box64 # Linux Userspace x86 and x86_64 Emulator, run x86_64 apps(such as games, gui apps) on aarch64.
+    # https://asahilinux.org/2024/12/muvm-x11-bridging/
+    # https://github.com/nix-community/nixos-apple-silicon/issues/237
+    muvm # run x86_64 Apps/Games in a microVM, used as a workaround of apple silicon's 16k page size.
+  ];
+
  networking.wireless.iwd = {
    enable = true;
    settings.General.EnableNetworkConfiguration = true;
@@ -30,7 +57,7 @@
  # Hibernate: Store system state & RAM to Disk, and then poweroff the system.
  #
  # NOTE: Hibernate is not supported by Asahi Linux.
-  services.logind = {
+  services.logind.settings.Login = {
    lidSwitch = "suspend";
    lidSwitchExternalPower = "lock";
    # 'Docked' means: more than one display is connected or the system is inserted in a docking station
@@ -50,7 +77,7 @@
  # After adding this snippet, you need to restart the system for the touchbar to work.
  hardware.apple.touchBar = {
    enable = true;
-    package = pkgs-unstable.tiny-dfr;
+    package = pkgs.tiny-dfr;
    # https://github.com/WhatAmISupposedToPutHere/tiny-dfr/blob/master/share/tiny-dfr/config.toml
    settings = {
      # F{number} keys are shown when Fn is not pressed by default.
@@ -10,12 +10,14 @@
 #############################################################
 let
  hostName = "shoukei"; # Define your hostname.
-in {
+in
+{
  imports = [
    ./hardware-configuration.nix
    ../idols-ai/preservation.nix
  ];

+  # disable sunshine for securrity
  services.sunshine.enable = lib.mkForce false;

  networking = {
@@ -28,6 +28,30 @@ in
    "x86_64-linux"
    "riscv64-linux"
  ];
+  # This enables the kernel to preload the emulator binaries when the binfmt registrations are added,
+  # obviating the need to make the emulator binaries available inside chroots and chroot-like sandboxes.
+  boot.binfmt.preferStaticEmulators = true; # required to work with podman
+  nixpkgs.overlays = [
+    (final: previous: {
+      # https://github.com/NixOS/nixpkgs/issues/392673
+      # aarch64-unknown-linux-musl-ld: (.text+0x484): warning: too many GOT entries for -fpic, please recompile with -fPIC
+      nettle = previous.nettle.overrideAttrs (
+        lib.optionalAttrs final.stdenv.hostPlatform.isStatic {
+          CCPIC = "-fPIC";
+        }
+      );
+    })
+    # https://github.com/NixOS/nixpkgs/issues/366902
+    (final: prev: {
+      qemu-user = prev.qemu-user.overrideAttrs (
+        old:
+        lib.optionalAttrs final.stdenv.hostPlatform.isStatic {
+          configureFlags = old.configureFlags ++ [ "--disable-pie" ];
+        }
+      );
+    })
+  ];
+
  # supported file systems, so we can mount any removable disks with these filesystems
  boot.supportedFilesystems = lib.mkForce [
    "ext4"
@@ -1,6 +1,7 @@
-{ config, niri, ... }:
+{ config, ... }:
 let
  hostName = "shoukei"; # Define your hostname.
+  mkSymlink = config.lib.file.mkOutOfStoreSymlink;
 in
 {
  programs.ssh.matchBlocks."github.com".identityFile =
@@ -11,44 +12,6 @@ in
    "${config.home.homeDirectory}/nix-config/hosts/12kingdoms-shoukei/hypr-hardware.conf"
  ];

-  modules.desktop.niri = {
-    settings =
-      let
-        inherit (niri.lib.kdl)
-          node
-          plain
-          leaf
-          flag
-          ;
-      in
-      [
-        (node "output" "eDP-1" [
-          (leaf "scale" 1.5)
-          (leaf "transform" "normal")
-          (leaf "mode" "2560x1600@60")
-          (leaf "position" {
-            x = 0;
-            y = 0;
-          })
-        ])
-
-        # ============= Named Workspaces =============
-        (node "workspace" "1terminal" [ (leaf "open-on-output" "eDP-1") ])
-        (node "workspace" "2browser" [ (leaf "open-on-output" "eDP-1") ])
-        (node "workspace" "3chat" [ (leaf "open-on-output" "eDP-1") ])
-        (node "workspace" "4music" [ (leaf "open-on-output" "eDP-1") ])
-        (node "workspace" "5mail" [ (leaf "open-on-output" "eDP-1") ])
-        (node "workspace" "6file" [ (leaf "open-on-output" "eDP-1") ])
-        (node "workspace" "0other" [ (leaf "open-on-output" "eDP-1") ])
-
-        # Settings for debugging. Not meant for normal use.
-        # These can change or stop working at any point with little notice.
-        (plain "debug" [
-          # Override the DRM device that niri will use for all rendering.
-          # Fix: niri fails to correctly detect the primary render device
-          (leaf "render-drm-device" "/dev/dri/renderD128")
-        ])
-      ];
-  };
-
+  xdg.configFile."niri/niri-hardware.kdl".source =
+    mkSymlink "${config.home.homeDirectory}/nix-config/hosts/12kingdoms-shoukei/niri-hardware.kdl";
 }
@@ -0,0 +1,15 @@
+output "eDP-1" {
+    scale 1.500000
+    transform "normal"
+    mode "2560x1600@60"
+    position x=0 y=0
+}
+workspace "1terminal" { open-on-output "eDP-1"; }
+workspace "2browser" { open-on-output "eDP-1"; }
+workspace "3chat" { open-on-output "eDP-1"; }
+workspace "4music" { open-on-output "eDP-1"; }
+workspace "5mail" { open-on-output "eDP-1"; }
+workspace "6file" { open-on-output "eDP-1"; }
+workspace "0other" { open-on-output "eDP-1"; }
+debug { render-drm-device "/dev/dri/renderD128"; }
+
@@ -1,22 +1,79 @@
 # Hosts

-1. `idols`
-   1. `ai`: My main computer, with NixOS + I5-13600KF + RTX 4090 GPU, for gaming & daily use.
-   2. `aquamarine`: Kubevirt Virtual Machine.
-      - Monitoring(prometheus, grafana, exporters), CI/CD(gitea, runner), homepage, file browser,
-        and other services.
-   3. `ruby`: Not used now.
-   4. `kana`: Not used now.
-1. `k8s`: My Kubevirt & Kubernetes Clusters
-1. `darwin`(macOS)
-   1. `fern`: MacBook Pro 2022 13-inch M2 16G, mainly for personal use.
-   1. `frieren`: MacBook Pro 2024 14-inch M4Pro 48G, mainly for work.
-1. `12kingdoms`:
-   1. `shoukei`: NixOS on MacBook Pro 2022 M2.
-1. Other aarch64/riscv64 SBCs:
-   [ryan4yin/nixos-config-sbc](https://github.com/ryan4yin/nixos-config-sbc)
+This directory contains all host-specific configurations for my NixOS and macOS systems.

-## How to add a new host
+## Current Host Inventory
+
+### Physical Machines
+
+#### `idols` - Main Workstations
+
+Named after characters from "Oshi no Ko":
+
+| Host         | Platform    | Hardware              | Purpose               | Status      |
+| ------------ | ----------- | --------------------- | --------------------- | ----------- |
+| `ai`         | NixOS       | i5-13600KF + RTX 4090 | Gaming & Daily Use    | ✅ Active   |
+| `aquamarine` | KubeVirt VM | Virtual               | Monitoring & Services | ✅ Active   |
+| `kana`       | NixOS       | Virtual               | Reserved              | ⚪ Not Used |
+| `ruby`       | NixOS       | Virtual               | Reserved              | ⚪ Not Used |
+
+#### `darwin` - macOS Systems
+
+Named after characters from "Frieren: Beyond Journey's End":
+
+| Host      | Platform | Hardware                   | Purpose      | Status    |
+| --------- | -------- | -------------------------- | ------------ | --------- |
+| `fern`    | macOS    | MacBook Pro M2 13" 16GB    | Personal Use | ✅ Active |
+| `frieren` | macOS    | MacBook Pro M4Pro 14" 48GB | Work Use     | ✅ Active |
+
+#### `12kingdoms` - Homelab Servers & Apple Silicon Linux
+
+Named after "Twelve Kingdoms":
+
+| Host      | Platform | Hardware                               | Purpose                    | Status    |
+| --------- | -------- | -------------------------------------- | -------------------------- | --------- |
+| `shoukei` | NixOS    | MacBook Pro M2                         | NixOS on Apple Silicon     | ✅ Active |
+| `shoryu`  | NixOS    | MoreFine S500Plus (AMD Ryzen 9 5900HX) | KubeVirt Host & K3s Master | ✅ Active |
+| `shushou` | NixOS    | MinisForum UM560 (AMD Ryzen 5 5625U)   | KubeVirt Host & K3s Master | ✅ Active |
+| `youko`   | NixOS    | MinisForum HX99G (AMD Ryzen 9 6900HX)  | KubeVirt Host & K3s Master | ✅ Active |
+
+### Virtual Machines & Clusters
+
+#### `k8s` - Kubernetes Infrastructure
+
+- **KubeVirt Cluster**: 3 physical mini PCs (shoryu, shushou, youko) running all VMs
+- **K3s Production**: 3 masters + 3 workers for production workloads
+- **K3s Testing**: 3 masters for testing and development
+
+### External Systems
+
+- **SBCs**: aarch64/riscv64 single-board computers managed in
+  [ryan4yin/nixos-config-sbc](https://github.com/ryan4yin/nixos-config-sbc)
+
+All my riscv64 hosts:
+
+![](/_img/nixos-riscv-cluster.webp)
+
+## Naming Conventions
+
+- **idols**: Characters from "Oshi no Ko" anime/manga
+- **12kingdoms**: Characters from "Twelve Kingdoms" anime/novel series
+- **darwin**: Characters from "Frieren: Beyond Journey's End" anime/manga
+- **k8s**: Kubernetes-related systems follow standard naming patterns
+
+## How to Add a New Host
+
+The easiest way to add a new host is to copy and adapt an existing similar configuration. All host
+configurations follow similar patterns but are customized for specific hardware and use cases.
+
+### General Process
+
+1. **Identify a similar existing host** from the directory structure above
+2. **Copy the entire directory** and rename it for your new host
+3. **Adapt the configuration files** for your specific hardware and requirements
+4. **Update references** in the flake outputs and networking configuration
+
+### Essential Steps

 1. Under `hosts/`
   1. Create a new folder under `hosts/` with the name of the new host.
@@ -36,15 +93,20 @@
   1. Add the new host's static IP address.
   1. Skip this step if the new host is not in the local network or is a mobile device.

-## idols - Oshi no Ko
+### File Templates

-These four servers are named after the four main characters of the mange/anime Oshi no Ko.
+Use existing hosts as templates. The key files typically include:

-## rolling girls
+- `default.nix` - Main host configuration
+- `hardware-configuration.nix` - Auto-generated hardware settings
+- Platform-specific files (e.g., `nvidia.nix`, `apple-silicon.nix`, etc.)

-My All RISCV64 hosts.
+### Examples to Reference

-![](/_img/nixos-riscv-cluster.webp)
+- **Desktop systems**: See `idols-ai/` for gaming/workstation setup
+- **Server systems**: See `kubevirt-shoryu/` for K8s/KubeVirt hosts
+- **macOS systems**: See `darwin-fern/` for macOS configurations
+- **Apple Silicon**: See `12kingdoms-shoukei/` for ARM Linux setup

 ## Distributed Building

@@ -1,19 +1,14 @@
 {
  pkgs,
-  nixpkgs-ollama,
  ...
 }:
 let
-  pkgs-ollama = import nixpkgs-ollama {
-    inherit (pkgs) system;
-    # To use cuda, we need to allow the installation of non-free software
-    config.allowUnfree = true;
-  };
+
 in
 {
  services.ollama = rec {
    enable = true;
-    package = pkgs-ollama.ollama;
+    package = pkgs.ollama;
    acceleration = "cuda";
    host = "0.0.0.0";
    port = 11434;
@@ -1,4 +1,4 @@
-{myvars, ...}:
+{ myvars, lib, ... }:
 #############################################################
 #
 #  Ai - my main computer, with NixOS + I5-13600KF + RTX 4090 GPU, for gaming & daily use.
@@ -11,7 +11,8 @@ let
  inherit (myvars.networking.hostsAddr.${hostName}) iface ipv4 ipv6;
  ipv4WithMask = "${ipv4}/24";
  ipv6WithMask = "${ipv6}/64";
-in {
+in
+{
  imports = [
    ./netdev-mount.nix
    # Include the results of the hardware scan.
@@ -23,6 +24,8 @@ in {
    ./secureboot.nix
  ];

+  services.sunshine.enable = lib.mkForce true;
+
  networking = {
    inherit hostName;

@@ -35,7 +38,7 @@ in {
  systemd.network.enable = true;

  systemd.network.networks."10-${iface}" = {
-    matchConfig.Name = [iface];
+    matchConfig.Name = [ iface ];
    networkConfig = {
      Address = [
        ipv4WithMask
@@ -66,5 +69,5 @@ in {
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "25.05"; # Did you read the comment?
+  system.stateVersion = "25.11"; # Did you read the comment?
 }
@@ -1,62 +0,0 @@
-# https://github.com/fufexan/dotfiles/blob/483680e121b73db8ed24173ac9adbcc718cbbc6e/system/programs/gamemode.nix
-{
-  config,
-  pkgs,
-  nix-gaming,
-  lib,
-  ...
-}:
-let
-  programs = lib.makeBinPath [
-    config.programs.hyprland.package
-    pkgs.coreutils
-    pkgs.power-profiles-daemon
-  ];
-
-  startscript = pkgs.writeShellScript "gamemode-start" ''
-    export PATH=$PATH:${programs}
-    export HYPRLAND_INSTANCE_SIGNATURE=$(ls -1 /tmp/hypr | tail -1)
-    hyprctl --batch 'keyword decoration:blur 0 ; keyword animations:enabled 0 ; keyword misc:vfr 0'
-    powerprofilesctl set performance
-  '';
-
-  endscript = pkgs.writeShellScript "gamemode-end" ''
-    export PATH=$PATH:${programs}
-    export HYPRLAND_INSTANCE_SIGNATURE=$(ls -1 /tmp/hypr | tail -1)
-    hyprctl --batch 'keyword decoration:blur 1 ; keyword animations:enabled 1 ; keyword misc:vfr 1'
-    powerprofilesctl set power-saver
-  '';
-in
-{
-  # Optimise Linux system performance on demand
-  # https://github.com/FeralInteractive/GameMode
-  # https://wiki.archlinux.org/title/Gamemode
-  #
-  # Usage:
-  #   1. For games/launchers which integrate GameMode support:
-  #      https://github.com/FeralInteractive/GameMode#apps-with-gamemode-integration
-  #      simply running the game will automatically activate GameMode.
-  #   2. For others, launching the game through gamemoderun: `gamemoderun ./game`
-  #   3. For steam: `gamemoderun steam-runtime`
-  programs.gamemode = {
-    enable = pkgs.stdenv.isx86_64;
-    settings = {
-      general = {
-        softrealtime = "auto";
-        renice = 15;
-      };
-      custom = {
-        start = startscript.outPath;
-        end = endscript.outPath;
-      };
-    };
-  };
-
-  # see https://github.com/fufexan/nix-gaming/#pipewire-low-latency
-  services.pipewire.lowLatency.enable = true;
-  programs.steam.platformOptimizations.enable = true;
-  imports = with nix-gaming.nixosModules; [
-    pipewireLowLatency
-    platformOptimizations
-  ];
-}
@@ -1,58 +0,0 @@
-# https://github.com/fufexan/dotfiles/blob/483680e/system/programs/steam.nix
-{ pkgs, ... }:
-{
-  # https://wiki.archlinux.org/title/steam
-  # Games installed by Steam works fine on NixOS, no other configuration needed.
-  programs.steam = {
-    # Some location that should be persistent:
-    #   ~/.local/share/Steam - The default Steam install location
-    #   ~/.local/share/Steam/steamapps/common - The default Game install location
-    #   ~/.steam/root        - A symlink to ~/.local/share/Steam
-    #   ~/.steam             - Some Symlinks & user info
-    enable = pkgs.stdenv.isx86_64;
-    # https://github.com/ValveSoftware/gamescope
-    # enables features such as resolution upscaling and stretched aspect ratios (such as 4:3)
-    gamescopeSession.enable = true;
-
-    # fix gamescope inside steam
-    package = pkgs.steam.override {
-      extraPkgs =
-        pkgs: with pkgs; [
-          xorg.libXcursor
-          xorg.libXi
-          xorg.libXinerama
-          xorg.libXScrnSaver
-          libpng
-          libpulseaudio
-          libvorbis
-          stdenv.cc.cc.lib
-          libkrb5
-          keyutils
-
-          # fix CJK fonts
-          source-sans
-          source-serif
-          source-han-sans
-          source-han-serif
-
-          # audio
-          pipewire
-
-          # other common
-          udev
-          alsa-lib
-          vulkan-loader
-          xorg.libX11
-          xorg.libXcursor
-          xorg.libXi
-          xorg.libXrandr # To use the x11 feature
-          libxkbcommon
-          wayland # To use the wayland feature
-        ];
-    };
-  };
-
-  fonts.packages = with pkgs; [
-    wqy_zenhei # Need by steam for Chinese
-  ];
-}
@@ -43,6 +43,10 @@
    "aarch64-linux"
    "riscv64-linux"
  ];
+  # This enables the kernel to preload the emulator binaries when the binfmt registrations are added,
+  # obviating the need to make the emulator binaries available inside chroots and chroot-like sandboxes.
+  boot.binfmt.preferStaticEmulators = true; # required to work with podman
+
  # supported file systems, so we can mount any removable disks with these filesystems
  boot.supportedFilesystems = [
    "ext4"
@@ -1,4 +1,7 @@
-{ config, niri, ... }:
+{ config, ... }:
+let
+  mkSymlink = config.lib.file.mkOutOfStoreSymlink;
+in
 {
  programs.ssh.matchBlocks."github.com".identityFile = "${config.home.homeDirectory}/.ssh/idols-ai";

@@ -7,70 +10,6 @@
  modules.desktop.hyprland.settings.source = [
    "${config.home.homeDirectory}/nix-config/hosts/idols-ai/hypr-hardware.conf"
  ];
-
-  modules.desktop.niri = {
-    settings =
-      let
-        inherit (niri.lib.kdl)
-          node
-          plain
-          leaf
-          flag
-          ;
-      in
-      [
-        # running `niri msg outputs` to find outputs
-        (node "output" "DP-2" [
-          # Uncomment this line to disable this output.
-          # (flag "off")
-
-          # Scale is a floating-point number, but at the moment only integer values work.
-          (leaf "scale" 1.5)
-
-          # Transform allows to rotate the output counter-clockwise, valid values are:
-          # normal, 90, 180, 270, flipped, flipped-90, flipped-180 and flipped-270.
-          (leaf "transform" "normal")
-
-          # Resolution and, optionally, refresh rate of the output.
-          # The format is "<width>x<height>" or "<width>x<height>@<refresh rate>".
-          # If the refresh rate is omitted, niri will pick the highest refresh rate
-          # for the resolution.
-          # If the mode is omitted altogether or is invalid, niri will pick one automatically.
-          # Run `niri msg outputs` while inside a niri instance to list all outputs and their modes.
-          (leaf "mode" "3840x2160@144")
-
-          # Position of the output in the global coordinate space.
-          # This affects directional monitor actions like "focus-monitor-left", and cursor movement.
-          # The cursor can only move between directly adjacent outputs.
-          # Output scale has to be taken into account for positioning:
-          # outputs are sized in logical, or scaled, pixels.
-          # For example, a 3840×2160 output with scale 2.0 will have a logical size of 1920×1080,
-          # so to put another output directly adjacent to it on the right, set its x to 1920.
-          # It the position is unset or results in an overlap, the output is instead placed
-          # automatically.
-          (leaf "position" {
-            x = 0;
-            y = 0;
-          })
-        ])
-        (node "output" "HDMI-A-1" [
-          (leaf "scale" 1.5)
-          (leaf "transform" "normal")
-          (leaf "mode" "3840x2160@60")
-          (leaf "position" {
-            x = 2560; # on the right of DP-2
-            y = 0;
-          })
-        ])
-
-        # ============= Named Workspaces =============
-        (node "workspace" "1terminal" [ (leaf "open-on-output" "HDMI-A-1") ])
-        (node "workspace" "2browser" [ (leaf "open-on-output" "DP-2") ])
-        (node "workspace" "3chat" [ (leaf "open-on-output" "HDMI-A-1") ])
-        (node "workspace" "4music" [ (leaf "open-on-output" "DP-2") ])
-        (node "workspace" "5mail" [ (leaf "open-on-output" "DP-2") ])
-        (node "workspace" "6file" [ (leaf "open-on-output" "HDMI-A-1") ])
-        (node "workspace" "0other" [ (leaf "open-on-output" "HDMI-A-1") ])
-      ];
-  };
+  xdg.configFile."niri/niri-hardware.kdl".source =
+    mkSymlink "${config.home.homeDirectory}/nix-config/hosts/idols-ai/niri-hardware.kdl";
 }
@@ -0,0 +1,47 @@
+// running `niri msg outputs` to find outputs
+output "DP-2" {
+    // Uncomment this line to disable this output.
+    // off
+
+    // Scale is a floating-point number, but at the moment only integer values work.
+    scale 1.5
+
+    // Transform allows to rotate the output counter-clockwise, valid values are:
+    // normal, 90, 180, 270, flipped, flipped-90, flipped-180 and flipped-270.
+    transform "normal"
+
+    // Resolution and, optionally, refresh rate of the output.
+    // The format is "<width>x<height>" or "<width>x<height>@<refresh rate>".
+    // If the refresh rate is omitted, niri will pick the highest refresh rate
+    // for the resolution.
+    // If the mode is omitted altogether or is invalid, niri will pick one automatically.
+    // Run `niri msg outputs` while inside a niri instance to list all outputs and their modes.
+    mode "3840x2160@144"
+
+    // Position of the output in the global coordinate space.
+    // This affects directional monitor actions like "focus-monitor-left", and cursor movement.
+    // The cursor can only move between directly adjacent outputs.
+    // Output scale has to be taken into account for positioning:
+    // outputs are sized in logical, or scaled, pixels.
+    // For example, a 3840×2160 output with scale 2.0 will have a logical size of 1920×1080,
+    // so to put another output directly adjacent to it on the right, set its x to 1920.
+    // It the position is unset or results in an overlap, the output is instead placed
+    // automatically.
+    position x=0 y=0
+}
+output "HDMI-A-1" {
+    scale 1.5
+    transform "normal"
+    mode "3840x2160@60"
+    position x=2560 y=0 // on the right of DP-2
+}
+
+// ============= Named Workspaces =============
+workspace "2browser" { open-on-output "DP-2"; }
+workspace "4gaming" { open-on-output "DP-2"; }
+workspace "5music" { open-on-output "DP-2"; }
+
+workspace "1terminal" { open-on-output "HDMI-A-1"; }
+workspace "3chat" { open-on-output "HDMI-A-1"; }
+workspace "6file" { open-on-output "HDMI-A-1"; }
+workspace "0other" { open-on-output "HDMI-A-1"; }
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, lib, ... }:
 {
  # ===============================================================================================
  # for Nvidia GPU
@@ -17,7 +17,7 @@
    open = true;
    # Optionally, you may need to select the appropriate driver version for your specific GPU.
    # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/os-specific/linux/nvidia-x11/default.nix
-    package = config.boot.kernelPackages.nvidiaPackages.beta;
+    package = config.boot.kernelPackages.nvidiaPackages.production;

    # required by most wayland compositors!
    modesetting.enable = true;
@@ -38,4 +38,11 @@
      # };
    })
  ];
+
+  services.sunshine.settings = {
+    max_bitrate = 20000; # in Kbps
+    # NVIDIA NVENC Encoder
+    nvenc_preset = 3; # 1(fastest + worst quality) - 7(slowest + best quality)
+    nvenc_twopass = "full_res"; # quarter_res / full_res.
+  };
 }
@@ -72,6 +72,7 @@ in

      # network
      "/var/lib/tailscale"
+      "/var/lib/netbird-homelab" # netbird's homelab client
      "/var/lib/bluetooth"
      "/var/lib/NetworkManager"
      "/var/lib/iwd"
@@ -148,6 +149,9 @@ in
        ".local/share/nvim"
        ".local/state/nvim"

+        # helix & steel
+        ".local/share/steel"
+
        # doom-emacs
        # "org" # org files
        # ".config/emacs"
@@ -231,32 +235,32 @@ in
        # Games / Media
        # ======================================

+        "Games"
        ".steam"
        ".config/blender"
        ".config/LDtk"
+        ".config/heroic"
+        ".config/lutris"
+        ".local/share/umu"

        ".local/share/Steam"
-        ".local/share/PrismLauncher"
+        ".local/state/Heroic"

+        ".local/share/lutris"
        ".local/share/tiled"
        ".local/share/GOG.com"
        ".local/share/StardewValley"
        ".local/share/feral-interactive"

        # ======================================
-        # Instant Messaging
+        # Meeting / Remote Desktop / Recording
        # ======================================
-        ".config/QQ"
-
-        ".local/share/TelegramDesktop"
-
-        # ======================================
-        # Meeting / Remote Desktop
-        # ======================================
-        ".config/remmina"
-        ".config/freerdp"
        ".zoom"
+        ".config/obs-studio"
+        ".config/sunshine"
+        ".config/freerdp"

+        ".config/remmina"
        ".local/share/remmina"

        # ======================================
@@ -282,7 +286,7 @@ in
        # ======================================
        ".local/share/containers"
        ".local/share/flatpak"
-        # flatpak app's data
+        # flatpak/nixpak app's data
        ".var"

        # ======================================
@@ -317,7 +321,7 @@ in
        }
        {
          file = ".claude.json";
-          how = "symlink";
+          how = "bindmount";
        }
      ];
    };
@@ -88,6 +88,11 @@ in
      encode zstd gzip
      reverse_proxy http://localhost:9093
    '';
+    virtualHosts."vmalert.writefor.fun".extraConfig = ''
+      ${hostCommonConfig}
+      encode zstd gzip
+      reverse_proxy http://localhost:8880
+    '';
    virtualHosts."minio.writefor.fun".extraConfig = ''
      ${hostCommonConfig}
      encode zstd gzip
@@ -1,6 +1,6 @@
 { pkgs, ... }:
 {
-  # https://github.com/NixOS/nixpkgs/blob/nixos-25.05/nixos/modules/services/misc/gitea.nix
+  # https://github.com/NixOS/nixpkgs/blob/nixos-25.11/nixos/modules/services/misc/gitea.nix
  services.gitea = {
    enable = true;
    user = "gitea";
@@ -49,7 +49,7 @@
        ENABLED = true;
        MAILER_TYPE = "sendmail";
        FROM = "do-not-reply@writefor.fun";
-        SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
+        SENDMAIL_PATH = "${pkgs.stdenv.hostPlatform.system-sendmail}/bin/sendmail";
      };
      other = {
        SHOW_FOOTER_VERSION = false;
@@ -0,0 +1,37 @@
+{
+
+  # Declaratively provision Grafana's data sources, dashboards, and alerting rules.
+  # Grafana's alerting rules is not recommended to use, we use Prometheus alertmanager instead.
+  # https://grafana.com/docs/grafana/latest/administration/provisioning/#data-sources
+  services.grafana.provision.dashboards.settings = {
+    apiVersion = 1;
+
+    providers = [
+      {
+        # <string> an unique provider name. Required
+        name = "Homelab";
+        # An organization is an entity that helps you isolate users and resources such as dashboards,
+        # annotations, and data sources from each other.
+        #
+        # <int> Org id. Default to 1
+        #
+        # If you want to customize this id, you need to create the organizations first.
+        orgId = 1;
+        # <string> provider type. Default to 'file'
+        type = "file";
+        # <bool> disable dashboard deletion
+        disableDeletion = true;
+        # <int> how often Grafana will scan for changed dashboards
+        updateIntervalSeconds = 20;
+        # <bool> allow updating provisioned dashboards from the UI
+        allowUiUpdates = false;
+        options = {
+          # <string, required> path to dashboard files on disk. Required when using the 'file' type
+          path = "/etc/grafana/dashboards/";
+          # <bool> use folder names from filesystem to create folders in Grafana
+          foldersFromFilesStructure = true;
+        };
+      }
+    ];
+  };
+}
@@ -1,26 +0,0 @@
-# https://grafana.com/docs/grafana/latest/administration/provisioning/#dashboards
-apiVersion: 1
-
-providers:
-  # <string> an unique provider name. Required
-  - name: "Homelab"
-    # An organization is an entity that helps you isolate users and resources such as dashboards,
-    # annotations, and data sources from each other.
-    #
-    # <int> Org id. Default to 1
-    #
-    # If you want to customize this id, you need to create the organizations first.
-    orgId: 1
-    # <string> provider type. Default to 'file'
-    type: file
-    # <bool> disable dashboard deletion
-    disableDeletion: true
-    # <int> how often Grafana will scan for changed dashboards
-    updateIntervalSeconds: 20
-    # <bool> allow updating provisioned dashboards from the UI
-    allowUiUpdates: false
-    options:
-      # <string, required> path to dashboard files on disk. Required when using the 'file' type
-      path: /etc/grafana/dashboards/
-      # <bool> use folder names from filesystem to create folders in Grafana
-      foldersFromFilesStructure: true
@@ -32,3 +32,7 @@ mixin provides a comprehensive package for monitoring Loki in production.
   - Instance:
     https://github.com/cloudnative-pg/grafana-dashboards/blob/main/charts/cluster/grafana-dashboard.json
   - Pooler(PGBouncer): https://github.com/cloudnative-pg/grafana-dashboards/issues/7
+
+## VictoriaMetrics
+
+- https://grafana.com/orgs/victoriametrics/dashboards
@@ -73,11 +73,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": true,
-      "colors": [
-        "#299c46",
-        "#7eb26d",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "#7eb26d", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "none",
      "gauge": {
@@ -156,11 +152,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "description": "start time of the process",
      "format": "dateTimeFromNow",
@@ -239,11 +231,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "rgba(245, 54, 54, 0.9)",
-        "rgba(237, 129, 40, 0.89)",
-        "rgba(50, 172, 45, 0.97)"
-      ],
+      "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "decbytes",
      "gauge": {
@@ -322,11 +310,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "rgba(245, 54, 54, 0.9)",
-        "rgba(237, 129, 40, 0.89)",
-        "rgba(50, 172, 45, 0.97)"
-      ],
+      "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "decbytes",
      "gauge": {
@@ -405,11 +389,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "rgba(245, 54, 54, 0.9)",
-        "rgba(237, 129, 40, 0.89)",
-        "rgba(50, 172, 45, 0.97)"
-      ],
+      "colors": ["rgba(245, 54, 54, 0.9)", "rgba(237, 129, 40, 0.89)", "rgba(50, 172, 45, 0.97)"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "decbytes",
      "gauge": {
@@ -488,11 +468,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "none",
      "gauge": {
@@ -864,11 +840,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "bytes",
      "gauge": {
@@ -945,11 +917,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "bytes",
      "gauge": {
@@ -1026,11 +994,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "bytes",
      "gauge": {
@@ -1107,11 +1071,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "bytes",
      "gauge": {
@@ -1189,11 +1149,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "decimals": 1,
      "format": "bytes",
@@ -1271,11 +1227,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "none",
      "gauge": {
@@ -1352,11 +1304,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "none",
      "gauge": {
@@ -1433,11 +1381,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "none",
      "gauge": {
@@ -1514,11 +1458,7 @@
      "cacheTimeout": null,
      "colorBackground": false,
      "colorValue": false,
-      "colors": [
-        "#299c46",
-        "rgba(237, 129, 40, 0.89)",
-        "#d44a3a"
-      ],
+      "colors": ["#299c46", "rgba(237, 129, 40, 0.89)", "#d44a3a"],
      "datasource": "${DS_PROMETHEUS}",
      "format": "none",
      "gauge": {
@@ -2944,11 +2884,7 @@
  "refresh": "10s",
  "schemaVersion": 19,
  "style": "dark",
-  "tags": [
-    "postgres",
-    "db",
-    "stats"
-  ],
+  "tags": ["postgres", "db", "stats"],
  "templating": {
    "list": [
      {
@@ -3136,32 +3072,11 @@
    "to": "now"
  },
  "timepicker": {
-    "refresh_intervals": [
-      "5s",
-      "10s",
-      "30s",
-      "1m",
-      "5m",
-      "15m",
-      "30m",
-      "1h",
-      "2h",
-      "1d"
-    ],
-    "time_options": [
-      "5m",
-      "15m",
-      "1h",
-      "6h",
-      "12h",
-      "24h",
-      "2d",
-      "7d",
-      "30d"
-    ]
+    "refresh_intervals": ["5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d"],
+    "time_options": ["5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d"]
  },
  "timezone": "",
  "title": "PostgreSQL Database",
-  "uid": "000000039",
+  "uid": "postgresql-database",
  "version": 1
 }
--- a/Show More
+++ b/Show More