22 files changed, 399 insertions, 328 deletions

diff --git a/devShells/c.nix b/devShells/c.nix
index c28eafb..f1b98a3 100644
--- a/devShells/c.nix
+++ b/devShells/c.nix
@@ -7,6 +7,10 @@ pkgs.mkShell {
     gdb
     pkg-config
 
+    autoconf
+    automake
+    libtool
+
     gnumake
     bear
     meson
@@ -40,6 +44,14 @@ pkgs.mkShell {
     # LVGL
     SDL2
     libffi.dev
+
+    # Qt
+    libsForQt5.qtbase
+    libsForQt5.qttranslations
+    libsForQt5.qtserialport
+    libsForQt5.qtwebsockets
+    libsForQt5.qtcharts
+    libsForQt5.qtwayland
   ];
   meta.platforms = pkgs.lib.platforms.linux;
 }
diff --git a/flake.lock b/flake.lock
index cdc7593..0774e52 100644
--- a/flake.lock
+++ b/flake.lock
@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1712079060,
-        "narHash": "sha256-/JdiT9t+zzjChc5qQiF+jhrVhRt8figYH29rZO7pFe4=",
+        "lastModified": 1714136352,
+        "narHash": "sha256-BtWQ2Th/jamO1SlD+2ASSW5Jaf7JhA/JLpQHk0Goqpg=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "1381a759b205dff7a6818733118d02253340fd5e",
+        "rev": "24a7ea390564ccd5b39b7884f597cfc8d7f6f44e",
         "type": "github"
       },
       "original": {
@@ -259,26 +259,26 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1713117084,
-        "narHash": "sha256-uxmw58V8HyjKcDNfQi2QDL1WqhCvOxadR+aOwMSlH+0=",
+        "lastModified": 1715089065,
+        "narHash": "sha256-TKPO7SsLY29wJjuyMUrei8XA57WFboneSCE8AplTDvg=",
         "owner": "cynerd",
-        "repo": "nixdeploy",
-        "rev": "6a74fdf370b1a6d3b9636ea4c8c5a61f9e20f3ca",
+        "repo": "nixosdeploy",
+        "rev": "a5b8a06f5bab1d1a5cbd0f732bcddfac914b1448",
         "type": "gitlab"
       },
       "original": {
         "owner": "cynerd",
-        "repo": "nixdeploy",
+        "repo": "nixosdeploy",
         "type": "gitlab"
       }
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1712909959,
-        "narHash": "sha256-7/5ubuwdEbQ7Z+Vqd4u0mM5L2VMNDsBh54visp27CtQ=",
+        "lastModified": 1715010655,
+        "narHash": "sha256-FmdhvR/hgBkPDvIv/HOEIQsSMaVXh8wvTrnep8dF3Jc=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "f58b25254be441cd2a9b4b444ed83f1e51244f1f",
+        "rev": "d1659c9eb8af718118fb4bbe2c86797c8b8623eb",
         "type": "github"
       },
       "original": {
@@ -332,11 +332,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1712963716,
-        "narHash": "sha256-WKm9CvgCldeIVvRz87iOMi8CFVB1apJlkUT4GGvA0iM=",
+        "lastModified": 1714906307,
+        "narHash": "sha256-UlRZtrCnhPFSJlDQE7M0eyhgvuuHBTe1eJ9N9AQlJQ0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "cfd6b5fc90b15709b780a5a1619695a88505a176",
+        "rev": "25865a40d14b3f9cf19f19b924e2ab4069b09588",
         "type": "github"
       },
       "original": {
@@ -450,11 +450,11 @@
     },
     "personal-secret": {
       "locked": {
-        "lastModified": 1712662959,
-        "narHash": "sha256-Ksch1uGwLgvONf6a6BVBKca7/nhTtS6f9/idS4rKZkA=",
+        "lastModified": 1713645853,
+        "narHash": "sha256-K88bkJyfgCW27ezj+i/FCxiHcVbN8bQt56xiFiyoglU=",
         "ref": "refs/heads/master",
-        "rev": "bda29b5fccbfd107934caf9196c4504f727d92dd",
-        "revCount": 105,
+        "rev": "c3a42c56249c26f67916fe332de1f59ec634679b",
+        "revCount": 106,
         "type": "git",
         "url": "ssh://git@cynerd.cz/nixos-personal-secret"
       },
@@ -693,11 +693,11 @@
     },
     "vpsadminos": {
       "locked": {
-        "lastModified": 1712585342,
-        "narHash": "sha256-sFZw5Ksqd/3kVAl5EiQaRf3hQEoiOW5g+SUqzBGdynY=",
+        "lastModified": 1714936999,
+        "narHash": "sha256-8qk2EwvAjpkYaJYo5Sm7CK4jmr+aF7gXog+B4cCXHsc=",
         "owner": "vpsfreecz",
         "repo": "vpsadminos",
-        "rev": "92229aa2581bfb4a5239230a81a42f7ed4b4fbb8",
+        "rev": "70d5aec44b907a50c5a5fdcd234fc7891f130478",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index a3b18ad..daf69b4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,7 +4,7 @@
   inputs = {
     nixpkgs.url = "nixpkgs/nixos-unstable";
     nixos-hardware.url = "nixos-hardware";
-    nixdeploy.url = "gitlab:cynerd/nixdeploy";
+    nixdeploy.url = "gitlab:cynerd/nixosdeploy";
     personal-secret.url = "git+ssh://git@cynerd.cz/nixos-personal-secret";
     shellrc.url = "git+https://git.cynerd.cz/shellrc";
 
@@ -35,7 +35,7 @@
   in
     {
       overlays = {
-        lib = final: prev: import ./lib prev;
+        lib = _: prev: import ./lib prev;
         pkgs = final: prev: import ./pkgs final prev;
         default = nixpkgs.lib.composeManyExtensions [
           agenix.overlays.default
diff --git a/lib/default.nix b/lib/default.nix
index 036af97..3f14de0 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -7,7 +7,7 @@ nixpkgslib: let
     pow = base: e:
       if e == 0
       then 1
-      else foldl (a: b: a * base) 1 (genList id (e - 1));
+      else foldl (x: _: x * base) 1 (genList id (e - 1));
     # Power of 2
     pow2 = pow 2;
 
diff --git a/nixos/configurations/dean.nix b/nixos/configurations/dean.nix
index adc9e87..187e148 100644
--- a/nixos/configurations/dean.nix
+++ b/nixos/configurations/dean.nix
@@ -1,16 +1,13 @@
-{
-  lib,
-  pkgs,
-  ...
-}: let
-  inherit (lib) mkForce;
-in {
+{pkgs, ...}: {
   turris.board = "mox";
   deploy.enable = true;
 
   cynerd = {
     wireguard = true;
-    monitoring.speedtest = true;
+    monitoring = {
+      speedtest = true;
+      drives = false;
+    };
   };
 
   networking = {
diff --git a/nixos/configurations/default.nix b/nixos/configurations/default.nix
index c653c2d..974d9d9 100644
--- a/nixos/configurations/default.nix
+++ b/nixos/configurations/default.nix
@@ -29,7 +29,7 @@ in
         ];
         specialArgs = {
           inputModules =
-            mapAttrs (n: v: v.nixosModules) (filterAttrs (n: v: v ? nixosModules) self.inputs)
+            mapAttrs (_: v: v.nixosModules) (filterAttrs (_: v: v ? nixosModules) self.inputs)
             // {
               vpsadminos = self.inputs.vpsadminos.nixosConfigurations.container;
             };
diff --git a/nixos/configurations/lipwig.nix b/nixos/configurations/lipwig.nix
index 090e8f5..8b1f3ee 100644
--- a/nixos/configurations/lipwig.nix
+++ b/nixos/configurations/lipwig.nix
@@ -15,6 +15,10 @@
     };
 
     cynerd = {
+      monitoring = {
+        hw = false;
+        drives = false;
+      };
       syncthing = {
         enable = false;
         baseDir = "/nas";
@@ -35,6 +39,21 @@
         fsType = "fuse.bindfs";
         options = ["map=syncthing/nextcloud:@syncthing/@nextcloud"];
       };
+      "/nas/spt" = {
+        device = "nas@omnia.spt:/data/nas";
+        fsType = "fuse.sshfs";
+        options = [
+          "noauto"
+          "x-systemd.automount"
+          "_netdev"
+          "reconnect"
+          "identityfile=/run/secrets/nas.ssh.priv"
+          "allow_other"
+          "idmap=user"
+          "uid=nextcloud"
+          "gid=nextcloud"
+        ];
+      };
     };
 
     networking = {
@@ -85,8 +104,8 @@
           root = "${pkgs.cgit}/cgit";
           locations."/".tryFiles = "$uri @cgit";
           locations."@cgit".extraConfig = ''
-            fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
             fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
+            fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
             fastcgi_param PATH_INFO    $uri;
             fastcgi_param QUERY_STRING $args;
             fastcgi_param HTTP_HOST    $server_name;
diff --git a/nixos/configurations/spt-mox.nix b/nixos/configurations/spt-mox.nix
index c5ad7fb..4e29bca 100644
--- a/nixos/configurations/spt-mox.nix
+++ b/nixos/configurations/spt-mox.nix
@@ -7,6 +7,7 @@
 
   cynerd = {
     home-assistant = true;
+    monitoring.drives = false;
     switch = {
       enable = true;
       lanAddress = "${config.cynerd.hosts.spt.mox}/24";
diff --git a/nixos/configurations/spt-mox2.nix b/nixos/configurations/spt-mox2.nix
index c713477..9ffde96 100644
--- a/nixos/configurations/spt-mox2.nix
+++ b/nixos/configurations/spt-mox2.nix
@@ -6,6 +6,7 @@
   };
 
   cynerd = {
+    monitoring.drives = false;
     switch = {
       enable = true;
       lanAddress = "${config.cynerd.hosts.spt.mox2}/24";
diff --git a/nixos/configurations/spt-omnia.nix b/nixos/configurations/spt-omnia.nix
index 22d9ecc..e97f29f 100644
--- a/nixos/configurations/spt-omnia.nix
+++ b/nixos/configurations/spt-omnia.nix
@@ -88,7 +88,10 @@ in {
     users = {
       nas = {
         group = "nas";
-        openssh.authorizedKeys.keyFiles = [(config.personal-secrets + "/unencrypted/nas.pub")];
+        openssh.authorizedKeys.keyFiles = [
+          (config.personal-secrets + "/unencrypted/nas.pub")
+          (config.personal-secrets + "/unencrypted/nas-spt.pub")
+        ];
         isNormalUser = true;
         home = "/data/nas";
         homeMode = "770";
@@ -135,8 +138,12 @@ in {
           DHCP = "ipv6";
           IPv6AcceptRA = "no";
           DHCPPrefixDelegation = "yes";
+          DNS = "1.1.1.1";
+        };
+        dhcpV6Config = {
+          PrefixDelegationHint = "::/56";
+          UseDNS = "no";
         };
-        dhcpV6Config.PrefixDelegationHint = "::/56";
         dhcpPrefixDelegationConfig = {
           UplinkInterface = ":self";
           SubnetId = 0;
@@ -170,7 +177,7 @@ in {
       lcp-echo-adaptive
       defaultroute
       defaultroute6
-      usepeerdns
+      #usepeerdns
       maxfail 1
       user metronet
       password metronet
diff --git a/nixos/modules/bcg.nix b/nixos/modules/bcg.nix
index 626a67f..ea89e3a 100644
--- a/nixos/modules/bcg.nix
+++ b/nixos/modules/bcg.nix
@@ -4,13 +4,10 @@
   pkgs,
   ...
 }:
-
-with lib;
-
-let
+with lib; let
   cfg = config.services.bcg;
   configFile = (pkgs.formats.yaml {}).generate "bcg.conf.yaml" (
-    filterAttrsRecursive (n: v: v != null) {
+    filterAttrsRecursive (_: v: v != null) {
       inherit (cfg) device name mqtt;
       retain_node_messages = cfg.retainNodeMessages;
       qos_node_messages = cfg.qosNodeMessages;
@@ -21,16 +18,15 @@ let
       automatic_rename_nodes = cfg.automaticRenameNodes;
     }
   );
-in
-{
+in {
   options = {
     services.bcg = {
       enable = mkEnableOption "BigClown gateway";
-      package = mkPackageOption pkgs [ "python3Packages" "bcg" ] { };
+      package = mkPackageOption pkgs ["python3Packages" "bcg"] {};
       environmentFiles = mkOption {
         type = types.listOf types.path;
         default = [];
-        example = [ "/run/keys/bcg.env" ];
+        example = ["/run/keys/bcg.env"];
         description = ''
           File to load as environment file. Environment variables from this file
           will be interpolated into the config file using envsubst with this
@@ -148,21 +144,22 @@ in
 
     systemd.services.bcg = let
       envConfig = cfg.environmentFiles != [];
-      finalConfig = if envConfig
-                    then "$RUNTIME_DIRECTORY/bcg.config.yaml"
-                    else configFile;
+      finalConfig =
+        if envConfig
+        then "\${RUNTIME_DIRECTORY}/bcg.config.yaml"
+        else configFile;
     in {
       description = "BigClown Gateway";
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ] ++ lib.optional config.services.mosquitto.enable "mosquitto.service";
-      after = [ "network-online.target" ];
-      preStart = ''
+      wantedBy = ["multi-user.target"];
+      wants = ["network-online.target"] ++ lib.optional config.services.mosquitto.enable "mosquitto.service";
+      after = ["network-online.target"];
+      preStart = mkIf envConfig ''
         umask 077
         ${pkgs.envsubst}/bin/envsubst -i "${configFile}" -o "${finalConfig}"
-        '';
+      '';
       serviceConfig = {
         EnvironmentFile = cfg.environmentFiles;
-        ExecStart="${cfg.package}/bin/bcg -c ${finalConfig} -v ${cfg.verbose}";
+        ExecStart = "${cfg.package}/bin/bcg -c ${finalConfig} -v ${cfg.verbose}";
         RuntimeDirectory = "bcg";
       };
     };
diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix
index 90a4b58..6bc0d70 100644
--- a/nixos/modules/default.nix
+++ b/nixos/modules/default.nix
@@ -17,6 +17,6 @@ in
   // {
     default = {
       imports = attrValues modules ++ default_modules;
-      disabledModules = [ "services/misc/bcg.nix" ];
+      disabledModules = ["services/misc/bcg.nix"];
     };
   }
diff --git a/nixos/modules/desktop.nix b/nixos/modules/desktop.nix
index 2e67730..0c8f287 100644
--- a/nixos/modules/desktop.nix
+++ b/nixos/modules/desktop.nix
@@ -4,7 +4,7 @@
   pkgs,
   ...
 }: let
-  inherit (lib) mkOption mkIf mkDefault types optionals;
+  inherit (lib) mkOption mkIf types optionals;
   cnf = config.cynerd.desktop;
 in {
   options = {
@@ -23,6 +23,14 @@ in {
   };
 
   config = mkIf cnf.enable {
+    hardware = {
+      opengl = {
+        driSupport = true;
+        driSupport32Bit = true;
+      };
+      bluetooth.enable = mkIf cnf.laptop true;
+    };
+
     programs = {
       sway = {
         enable = true;
@@ -168,73 +176,115 @@ in {
             acpi
           ]);
       };
+
       firefox = {
         enable = true;
         languagePacks = ["en-US" "cs"];
         nativeMessagingHosts.packages = with pkgs; [browserpass];
       };
+
       light.enable = mkIf cnf.laptop true;
+
       nix-ld = {
         enable = true;
         libraries = with pkgs; [xorg.libXpm];
       };
-    };
-    xdg.portal = {
-      enable = true;
-      wlr.enable = true;
-      extraPortals = with pkgs; [xdg-desktop-portal-gtk];
-    };
-    xdg.mime.defaultApplications = {
-      "text/html" = ["firefox.desktop"];
-      "application/pdf" = ["org.pwmt.zathura.desktop"];
-      "image/jpeg" = ["feh.desktop"];
-      "image/png" = ["feh.desktop"];
-      "image/svg" = ["feh.desktop"];
-    };
 
-    programs.usbkey = {
-      enable = true;
-      devicesUUID = ["de269652-2070-46b2-84f8-409dc9dd50ee" "16a089d0-a663-4047-bd88-3885dd7fdee2"];
+      usbkey = {
+        enable = true;
+        devicesUUID = [
+          "de269652-2070-46b2-84f8-409dc9dd50ee"
+          "16a089d0-a663-4047-bd88-3885dd7fdee2"
+        ];
+      };
+
+      gnupg.agent = {
+        enable = true;
+        enableSSHSupport = true;
+        enableBrowserSocket = true;
+      };
     };
 
-    programs.gnupg.agent = {
-      enable = true;
-      enableSSHSupport = true;
-      enableBrowserSocket = true;
+    xdg = {
+      portal = {
+        enable = true;
+        wlr.enable = true;
+        extraPortals = with pkgs; [xdg-desktop-portal-gtk];
+      };
+      mime.defaultApplications = {
+        "text/html" = ["firefox.desktop"];
+        "application/pdf" = ["org.pwmt.zathura.desktop"];
+        "image/jpeg" = ["feh.desktop"];
+        "image/png" = ["feh.desktop"];
+        "image/svg" = ["feh.desktop"];
+      };
     };
-    services.dbus.packages = [pkgs.gcr];
 
-    programs.kdeconnect.enable = true;
+    services = {
+      # Autologin on the first TTY
+      getty = {
+        extraArgs = ["--skip-login"];
+        loginProgram = "${pkgs.bash}/bin/sh";
+        loginOptions = toString (pkgs.writeText "login-program.sh" ''
+          if [[ "$(tty)" == '/dev/tty1' ]]; then
+            ${pkgs.shadow}/bin/login -f cynerd;
+          else
+            ${pkgs.shadow}/bin/login;
+          fi
+        '');
+      };
 
-    services.pipewire = {
-      enable = true;
-      alsa.enable = true;
-      alsa.support32Bit = true;
-      pulse.enable = true;
-      extraConfig.pipewire."10-zeroconf" = {
-        "context.modules" = [{name = "libpipewire-module-zeroconf-discover";}];
+      gpm.enable = true; # mouse in buffer
+      udev.extraRules = ''
+        ACTION=="add|change", KERNEL=="sd*[!0-9]", ATTR{queue/scheduler}="bfq"
+      '';
+      xserver.xkb.options = "grp:alt_shift_toggle,caps:escape";
+
+      # Gnome crypto services (GnuPG)
+      dbus.packages = [pkgs.gcr];
+
+      pipewire = {
+        enable = true;
+        alsa.enable = true;
+        alsa.support32Bit = true;
+        pulse.enable = true;
+        extraConfig.pipewire."10-zeroconf" = {
+          "context.modules" = [{name = "libpipewire-module-zeroconf-discover";}];
+        };
       };
-    };
-    security.rtkit.enable = true;
 
-    services.printing = {
-      enable = true;
-      drivers = with pkgs; [
-        gutenprint
-        gutenprintBin
-        cnijfilter2
-      ];
+      upower.enable = true;
+      hardware.openrgb = {
+        enable = true;
+        package = pkgs.openrgb-with-all-plugins;
+      };
+
+      printing = {
+        enable = true;
+        drivers = with pkgs; [
+          gutenprint
+          gutenprintBin
+          cnijfilter2
+        ];
+      };
+      avahi.enable = true;
+      samba-wsdd = {
+        enable = true;
+        discovery = true;
+      };
+      davfs2.enable = true;
+
+      locate.enable = true;
     };
 
-    services.upower.enable = mkDefault cnf.laptop;
+    # Beneficial for Pipewire
+    security.rtkit.enable = true;
 
-    services.avahi.enable = true;
-    services.samba-wsdd = {
-      enable = true;
-      discovery = true;
+    # Local share (avahi, samba)
+    networking.firewall = {
+      allowedTCPPorts = [5357];
+      allowedUDPPorts = [3702];
     };
-    networking.firewall.allowedTCPPorts = [5357];
-    networking.firewall.allowedUDPPorts = [3702];
 
     fonts.packages = with pkgs; [
       (nerdfonts.override {fonts = ["Hack"];})
@@ -253,52 +303,12 @@ in {
       unifont
     ];
 
-    services.udev.extraRules = ''
-      ACTION=="add|change", KERNEL=="sd*[!0-9]", ATTR{queue/scheduler}="bfq"
-    '';
-    hardware.opengl = {
-      driSupport = true;
-      driSupport32Bit = true;
-    };
-
-    hardware.bluetooth.enable = mkIf cnf.laptop true;
-
-    services.hardware.openrgb = {
-      enable = true;
-      package = pkgs.openrgb-with-all-plugins;
-    };
-
     documentation = {
       enable = true;
       man.enable = true;
       info.enable = true;
     };
 
-    services.snapper.configs = {
-      home = {
-        SUBVOLUME = "/home";
-        ALLOW_GROUPS = ["users"];
-        TIMELINE_CREATE = true;
-        TIMELINE_CLEANUP = true;
-      };
-    };
-
-    # Autologin on the first TTY
-    services.getty = {
-      extraArgs = ["--skip-login"];
-      loginProgram = "${pkgs.bash}/bin/sh";
-      loginOptions = toString (pkgs.writeText "login-program.sh" ''
-        if [[ "$(tty)" == '/dev/tty1' ]]; then
-          ${pkgs.shadow}/bin/login -f cynerd;
-        else
-          ${pkgs.shadow}/bin/login;
-        fi
-      '');
-    };
-
-    # Leds group is required for light
-    users.users.cynerd.extraGroups = ["leds"];
-
     # VTI settings
     console = {
       colors = [
@@ -322,12 +332,6 @@ in {
       earlySetup = true;
       useXkbConfig = true;
     };
-    services.xserver.xkb.options = "grp:alt_shift_toggle,caps:escape";
-    services.gpm.enable = true;
-
-    services.locate.enable = true;
-
-    services.davfs2.enable = true;
 
     # Support running app images
     boot.binfmt.registrations.appimage = {
diff --git a/nixos/modules/develop.nix b/nixos/modules/develop.nix
index 25c40c3..a18c7ac 100644
--- a/nixos/modules/develop.nix
+++ b/nixos/modules/develop.nix
@@ -22,8 +22,8 @@ in {
       gitlint
       tig
       gource
-      hub
-      github-cli # Git
+      glab
+      github-cli
       wlc # Weblate
       cloc
       openssl
@@ -47,6 +47,7 @@ in {
       statix
       deadnix
       agenix
+      nix-tree
 
       # Shell
       dash # Posix shell
diff --git a/nixos/modules/generic.nix b/nixos/modules/generic.nix
index 97391b8..02afd17 100644
--- a/nixos/modules/generic.nix
+++ b/nixos/modules/generic.nix
@@ -1,12 +1,9 @@
 {
-  config,
   lib,
   pkgs,
   ...
 }: let
-  inherit (lib) mkOverride mkDefault optionals;
-  isNative = config.nixpkgs.hostPlatform == config.nixpkgs.buildPlatform;
-  isArm = config.nixpkgs.hostPlatform.isAarch;
+  inherit (lib) mkOverride mkDefault;
 in {
   config = {
     system.stateVersion = "24.05";
@@ -43,153 +40,11 @@ in {
     services.fwupd.enable = mkDefault (pkgs.system == "x86_64-linux");
     systemd.oomd.enable = false;
 
-    nixpkgs = {
-      config.allowUnfree = true;
-      flake = {
-        setNixPath = false;
-        setFlakeRegistry = false;
-      };
-    };
-    environment.systemPackages = with pkgs;
-      [
-        git # We need git for this repository to even work
-        # Administration tools
-        coreutils
-        binutils
-        psmisc
-        progress
-        lshw
-        file
-        vde2
-        ldns
-        wget
-        gnumake
-        exfat
-        exfatprogs
-        ntfs3g
-        usbutils
-        pciutils
-        smartmontools
-        parted
-
-        # NCurses tools
-        htop
-        btop
-        iotop
-        mc
-        screen
-        tmux
-        pv
-
-        # ls tools
-        tree
-        lsof
-        strace
-
-        sourceHighlight # Colors for less
-        unrar
-        p7zip
-        zip
-        unzip
-
-        # Network
-        netcat
-        traceroute
-        iftop
-        nethogs
-        sshfs
-        wakeonlan
-        speedtest-cli
-        librespeed-cli
-        termshark
-
-        lm_sensors
-      ]
-      ++ optionals (system == "x86_64-linux") [
-        nmap
-        ltrace
-      ]
-      ++ optionals (!isNative) [
-        ncdu_1
-      ]
-      ++ optionals isNative [
-        moreutils
-        glances
-        ncdu
-        mlocate
-      ];
-
-    users = {
-      mutableUsers = false;
-      groups.cynerd.gid = 1000;
-      users = {
-        root = {
-          hashedPasswordFile = "/run/secrets/root.pass";
-        };
-        cynerd = {
-          group = "cynerd";
-          extraGroups = ["users" "wheel" "dialout" "kvm" "uucp" "wireshark"];
-          uid = 1000;
-          subUidRanges = [
-            {
-              count = 65534;
-              startUid = 10000;
-            }
-          ];
-          subGidRanges = [
-            {
-              count = 65534;
-              startGid = 10000;
-            }
-          ];
-          isNormalUser = true;
-          createHome = true;
-          shell =
-            if isNative
-            then pkgs.zsh.out
-            else pkgs.bash.out;
-          hashedPasswordFile = "/run/secrets/cynerd.pass";
-          openssh.authorizedKeys.keyFiles = [
-            (config.personal-secrets + "/unencrypted/git-private.pub")
-          ];
-        };
-      };
-    };
-    programs = {
-      zsh = {
-        enable = isNative;
-        syntaxHighlighting.enable = isNative;
-      };
-      shellrc = true;
-      vim.defaultEditor = isArm;
-      neovim = {
-        enable = !isArm;
-        defaultEditor = true;
-        withNodeJs = true;
-      };
-
-      wireshark.enable = true;
-    };
-
-    security.sudo.extraRules = [
-      {
-        groups = ["wheel"];
-        commands = ["ALL"];
-      }
-    ];
     networking = {
       nftables.enable = true;
       dhcpcd.extraConfig = "controlgroup wheel";
     };
 
-    services.openssh = {
-      enable = true;
-      settings = {
-        PasswordAuthentication = false;
-        PermitRootLogin = "no";
-      };
-    };
-
     time.timeZone = "Europe/Prague";
     i18n.defaultLocale = "en_US.UTF-8";
 
@@ -209,8 +64,6 @@ in {
       chmod +x $out/bin/nixos-system
     '';
 
-    programs.fuse.userAllowOther = true;
-
     documentation = {
       enable = mkDefault false;
       doc.enable = mkDefault false;
diff --git a/nixos/modules/monitoring.nix b/nixos/modules/monitoring.nix
index 44d0cbb..394915a 100644
--- a/nixos/modules/monitoring.nix
+++ b/nixos/modules/monitoring.nix
@@ -18,6 +18,11 @@ in {
       default = true;
       description = "If hardware should be reported";
     };
+    drives = mkOption {
+      type = types.bool;
+      default = true;
+      description = "If S.M.A.R.T. should be enabled";
+    };
     speedtest = mkOption {
       type = types.bool;
       default = false;
@@ -30,6 +35,9 @@ in {
       # Telegraf configuration
       services.telegraf = {
         enable = true;
+        package = pkgs.writeShellScriptBin "telegraf" ''
+          exec /run/wrappers/bin/telegraf "$@"
+        '';
         environmentFiles = ["/run/secrets/telegraf.env"];
         extraConfig = {
           agent = {};
@@ -66,20 +74,23 @@ in {
                 }
               ];
               diskio = [{}];
-              net = [{}];
+              net = [{ignore_protocol_stats = false;}];
+              nstat = [{}];
               system = [{}];
               processes = [{}];
               systemd_units = [{}];
               wireguard = [{}];
             }
-            // (optionalAttrs cnf.hw {
-              sensors = [{}];
+            // (optionalAttrs cnf.drives {
               smart = [
                 {
                   path_smartctl = "${pkgs.smartmontools}/bin/smartctl";
                   use_sudo = true;
                 }
               ];
+            })
+            // (optionalAttrs cnf.hw {
+              sensors = [{}];
               wireless = [{}];
             })
             // (optionalAttrs cnf.speedtest {
@@ -115,26 +126,35 @@ in {
           ];
         }
       ];
+
+      security.wrappers.telegraf = {
+        owner = "root";
+        group = "root";
+        capabilities = "CAP_NET_ADMIN+epi";
+        source = "${pkgs.telegraf}/bin/telegraf";
+      };
     })
 
     (mkIf (config.networking.hostName == "lipwig") {
       # InfluxDB
-      services.influxdb2.enable = true;
-      services.telegraf.extraConfig.inputs.prometheus = {
-        urls = ["http://localhost:8086/metrics"];
-      };
-      # Grafana
-      services.grafana = {
-        enable = true;
-        settings = {
-          users.allow_sign_up = false;
-          security = {
-            admin_user = "cynerd";
-            admin_password = "$__file{/run/secrets/grafana.admin.pass}";
-          };
-          server = {
-            http_addr = "";
-            http_port = 3000;
+      services = {
+        influxdb2.enable = true;
+        telegraf.extraConfig.inputs.prometheus = {
+          urls = ["http://localhost:8086/metrics"];
+        };
+        # Grafana
+        grafana = {
+          enable = true;
+          settings = {
+            users.allow_sign_up = false;
+            security = {
+              admin_user = "cynerd";
+              admin_password = "$__file{/run/secrets/grafana.admin.pass}";
+            };
+            server = {
+              http_addr = "";
+              http_port = 3000;
+            };
           };
         };
       };
diff --git a/nixos/modules/packages.nix b/nixos/modules/packages.nix
new file mode 100644
index 0000000..d321901
--- /dev/null
+++ b/nixos/modules/packages.nix
@@ -0,0 +1,83 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (lib) optionals;
+  isNative = config.nixpkgs.hostPlatform == config.nixpkgs.buildPlatform;
+in {
+  nixpkgs = {
+    config.allowUnfree = true;
+    flake = {
+      setNixPath = false;
+      setFlakeRegistry = false;
+    };
+  };
+  environment.systemPackages = with pkgs;
+    [
+      git # We need git for this repository to even work
+      # Administration tools
+      coreutils
+      binutils
+      psmisc
+      progress
+      lshw
+      file
+      vde2
+      ldns
+      wget
+      gnumake
+      exfat
+      exfatprogs
+      ntfs3g
+      usbutils
+      pciutils
+      smartmontools
+      parted
+
+      # NCurses tools
+      htop
+      btop
+      iotop
+      mc
+      screen
+      tmux
+      pv
+
+      # ls tools
+      tree
+      lsof
+      strace
+
+      sourceHighlight # Colors for less
+      unrar
+      p7zip
+      zip
+      unzip
+
+      # Network
+      netcat
+      traceroute
+      iftop
+      nethogs
+      sshfs
+      wakeonlan
+      speedtest-cli
+      librespeed-cli
+      termshark
+
+      lm_sensors
+    ]
+    ++ optionals (system == "x86_64-linux") [
+      nmap
+      ltrace
+    ]
+    ++ optionals (!isNative) [
+      ncdu_1
+    ]
+    ++ optionals isNative [
+      ncdu
+      moreutils
+    ];
+}
diff --git a/nixos/modules/syncthing.nix b/nixos/modules/syncthing.nix
index d6b65e6..91736ca 100644
--- a/nixos/modules/syncthing.nix
+++ b/nixos/modules/syncthing.nix
@@ -26,7 +26,7 @@
     "ridcully"
     "spt-omnia"
   ];
-  filterDevice = filterAttrs (n: v: any (d: d == hostName) v.devices);
+  filterDevice = filterAttrs (_: v: any (d: d == hostName) v.devices);
 in {
   options = {
     cynerd.syncthing = {
diff --git a/nixos/modules/users.nix b/nixos/modules/users.nix
new file mode 100644
index 0000000..d098ec7
--- /dev/null
+++ b/nixos/modules/users.nix
@@ -0,0 +1,78 @@
+{
+  pkgs,
+  config,
+  ...
+}: let
+  isNative = config.nixpkgs.hostPlatform == config.nixpkgs.buildPlatform;
+  isArm = config.nixpkgs.hostPlatform.isAarch;
+in {
+  users = {
+    mutableUsers = false;
+    groups.cynerd.gid = 1000;
+    users = {
+      root = {
+        hashedPasswordFile = "/run/secrets/root.pass";
+      };
+      cynerd = {
+        group = "cynerd";
+        extraGroups = ["users" "wheel" "video" "dialout" "kvm" "uucp" "wireshark" "leds"];
+        uid = 1000;
+        subUidRanges = [
+          {
+            count = 65534;
+            startUid = 10000;
+          }
+        ];
+        subGidRanges = [
+          {
+            count = 65534;
+            startGid = 10000;
+          }
+        ];
+        isNormalUser = true;
+        createHome = true;
+        shell =
+          if isNative
+          then pkgs.zsh.out
+          else pkgs.bash.out;
+        hashedPasswordFile = "/run/secrets/cynerd.pass";
+        openssh.authorizedKeys.keyFiles = [
+          (config.personal-secrets + "/unencrypted/git-private.pub")
+        ];
+      };
+    };
+  };
+
+  security.sudo.extraRules = [
+    {
+      groups = ["wheel"];
+      commands = ["ALL"];
+    }
+  ];
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+      PermitRootLogin = "no";
+    };
+  };
+
+  programs = {
+    zsh = {
+      enable = isNative;
+      syntaxHighlighting.enable = isNative;
+    };
+    shellrc = true;
+    vim.defaultEditor = isArm;
+    neovim = {
+      enable = !isArm;
+      defaultEditor = true;
+      withNodeJs = true;
+    };
+
+    wireshark.enable = true;
+  };
+
+  programs.fuse.userAllowOther = true;
+}
diff --git a/pkgs/dev/default.nix b/pkgs/dev/default.nix
index dfc0cd7..959be0c 100644
--- a/pkgs/dev/default.nix
+++ b/pkgs/dev/default.nix
@@ -12,7 +12,7 @@ with lib; let
     )
     devShells);
 in
-  stdenvNoCC.mkDerivation rec {
+  stdenvNoCC.mkDerivation {
     name = "personal-devshells";
     src = ./.;
 
@@ -22,4 +22,6 @@ in
         --prefix PATH : ${lib.makeBinPath [bash nix]} \
         --set DEV_SHELLS "${shells}"
     '';
+
+    meta.mainProgram = "dev";
   }
diff --git a/pkgs/dev/dev.sh b/pkgs/dev/dev.sh
index adf70f8..8546b85 100755
--- a/pkgs/dev/dev.sh
+++ b/pkgs/dev/dev.sh
@@ -1,18 +1,17 @@
 #!/usr/bin/env bash
 set -eu
 
-target="${1:-}"
-shift
+target="${1:-.}"
+[[ $# -eq 0 ]] || shift
 
 declare -a nixargs
-known_shells="$(tr ':' '\n' <<<"${DEV_SHELLS:-}")"
-while IFS='=' read name drv res; do
+while IFS='=' read -r name drv _; do
 	if [ "$target" == "$name" ]; then
-		target="$drv"
+		target="$drv^*"
 		# Note: no network should be needed as this should be available
 		nixargs+=("--offline")
 		break
 	fi
-done <<<"$known_shells"
+done < <(tr ':' '\n' <<<"${DEV_SHELLS:-}")
 
 exec nix "${nixargs[@]}" develop "$target" -c zsh "$@"
diff --git a/pkgs/stardict/default.nix b/pkgs/stardict/default.nix
index cca761a..0d7eb81 100644
--- a/pkgs/stardict/default.nix
+++ b/pkgs/stardict/default.nix
@@ -5,9 +5,6 @@
   autoreconfHook,
   wrapGAppsHook,
   pkg-config,
-  automake,
-  autoconf,
-  libtool,
   intltool,
   gnome-doc-utils,
   libxslt,