merge hakyllHEADmaster

32 files changed, 814 insertions, 606 deletions

diff --git a/default.nix b/default.nix
index fbf95e4..235d4e5 100644
--- a/default.nix
+++ b/default.nix
@@ -1,11 +1,14 @@
 let
   lock = builtins.readFile ./flake.lock |> builtins.fromJSON;
 
-  defaultNixpkgs = builtins.fetchGit {
-    url = "https://github.com/NixOS/nixpkgs";
-    shallow = true;
-    inherit (lock.nodes.nixpkgs.locked) rev;
-    inherit (lock.nodes.nixpkgs.original) ref;
+  defaultNixpkgs = builtins.fetchTarball {
+    inherit (lock.nodes.nixpkgs.locked) url;
+    sha256 = lock.nodes.nixpkgs.locked.narHash;
+  };
+
+  disko = builtins.fetchTarball {
+    url = "https://github.com/nix-community/disko/archibe/${lock.nodes.disko.locked.rev}tar.gz";
+    sha256 = lock.nodes.disko.locked.narHash;
   };
 in
 {
@@ -22,6 +25,8 @@ let
     packagesFromDirectoryRecursive
     ;
 
+  importDir = import lib/importDir.nix { inherit lib; };
+
   overlay =
     final: _:
     let
@@ -32,6 +37,7 @@ let
     in
     {
       inherit depotPackages;
+      depot = depotPackages;
     };
 
   newPkgs = import defaultNixpkgs {
@@ -43,5 +49,38 @@ let
     overlays = [ overlay ];
   };
 
+  nixosModules = importDir ./modules (builtins.mapAttrs (_: { path, ... }: path));
+
+  machines = importDir ./machines (
+    entries:
+    let
+      defaultModule = { config, ... }: {
+        nixpkgs.overlays = [ overlay ];
+        system.stateVersion = lib.mkDefault config.system.nixos.release;
+      };
+
+      buildNixOS =
+        hostName: entry:
+        import (pkgs.path + "/nixos/lib/eval-config.nix") {
+          modules = [
+            defaultModule
+            entry.path
+            nixosModules.xnet
+            nixosModules.disk
+            nixosModules.desktop
+            nixosModules.network
+            nixosModules.sshd
+            nixosModules.users
+            ("${disko}/module.nix")
+          ];
+        };
+    in
+    builtins.mapAttrs buildNixOS entries
+  );
+
 in
-newPkgs.depotPackages
+{
+  pkgs = newPkgs;
+  inherit (newPkgs) depotPackages;
+  inherit machines;
+}
diff --git a/flake.lock b/flake.lock
index 30e0aa2..62d1fb2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -23,18 +23,15 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1781074563,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
-        "type": "github"
+        "lastModified": 1791048980,
+        "narHash": "sha256-u3KCLxsnf1622GdFccg8hmkEIutOZ1h4pvia5ERjIuI=",
+        "rev": "a7868a727837f3c09cee2ce0ca671c76b1589fed",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1084968.a7868a727837/nixexprs.tar.zst"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst"
       }
     },
     "root": {
diff --git a/flake.nix b/flake.nix
index 31c498a..7a33482 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,7 +1,7 @@
 {
   description = "Personal monorepo";
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
 
     disko.url = "github:nix-community/disko/latest";
     disko.inputs.nixpkgs.follows = "nixpkgs";
diff --git a/lib/depot-tools.nix b/lib/depot-tools.nix
index 7c2fc6b..8e5a16e 100644
--- a/lib/depot-tools.nix
+++ b/lib/depot-tools.nix
@@ -1,7 +1,8 @@
-{ inputs
-, systems
-, nixpkgs ? inputs.nixpkgs
-, ...
+{
+  inputs,
+  systems,
+  nixpkgs ? inputs.nixpkgs,
+  ...
 }:
 
 let
@@ -27,30 +28,25 @@ let
 
       # Get paths to directories
       onlyDirs = filterAttrs (_name: type: type == "directory") entries;
-      dirPaths = mapAttrs
-        (name: type: {
-          path = path + "/${name}";
-          inherit type;
-        })
-        onlyDirs;
+      dirPaths = mapAttrs (name: type: {
+        path = path + "/${name}";
+        inherit type;
+      }) onlyDirs;
 
       # Get paths to nix files, where the name is the basename of the file without the .nix extension
-      nixPaths = removeAttrs
-        (mapAttrs'
-          (
-            name: type:
-              let
-                nixName = match "(.*)\\.nix" name;
-              in
-              {
-                name = if type == "directory" || nixName == null then "__junk" else (head nixName);
-                value = {
-                  path = path + "/${name}";
-                  type = type;
-                };
-              }
-          )
-          entries) [ "__junk" ];
+      nixPaths = removeAttrs (mapAttrs' (
+        name: type:
+        let
+          nixName = match "(.*)\\.nix" name;
+        in
+        {
+          name = if type == "directory" || nixName == null then "__junk" else (head nixName);
+          value = {
+            path = path + "/${name}";
+            type = type;
+          };
+        }
+      ) entries) [ "__junk" ];
 
       combined = dirPaths // nixPaths;
     in
@@ -61,9 +57,9 @@ let
     system:
     let
       # Resolve the packages for each input.
-      perSystem = mapAttrs
-        (_: flake: flake.legacyPackages.${system} or { } // flake.packages.${system} or { })
-        inputs;
+      perSystem = mapAttrs (
+        _: flake: flake.legacyPackages.${system} or { } // flake.packages.${system} or { }
+      ) inputs;
 
       # Handle nixpkgs specially.
       pkgs =
@@ -78,7 +74,17 @@ let
 
       flake = inputs.self;
     in
-    makeScope callPackageWith (_: { inherit inputs perSystem flake pkgs system; })
+    makeScope callPackageWith (_: {
+      inherit
+        inputs
+        perSystem
+        flake
+        pkgs
+        system
+        ;
+    })
   );
 in
-{ inherit importDir systemArgs; }
+{
+  inherit importDir systemArgs;
+}
diff --git a/lib/importDir.nix b/lib/importDir.nix
new file mode 100644
index 0000000..794d3e7
--- /dev/null
+++ b/lib/importDir.nix
@@ -0,0 +1,44 @@
+{ lib, ... }:
+let
+  inherit (builtins)
+    head
+    mapAttrs
+    match
+    readDir
+    ;
+
+  inherit (lib)
+    mapAttrs'
+    filterAttrs
+    ;
+in
+
+path: fn:
+let
+  entries = readDir path;
+
+  # Get paths to directories
+  onlyDirs = filterAttrs (_name: type: type == "directory") entries;
+  dirPaths = mapAttrs (name: type: {
+    path = path + "/${name}";
+    inherit type;
+  }) onlyDirs;
+
+  # Get paths to nix files, where the name is the basename of the file without the .nix extension
+  nixPaths = removeAttrs (mapAttrs' (
+    name: type:
+    let
+      nixName = match "(.*)\\.nix" name;
+    in
+    {
+      name = if type == "directory" || nixName == null then "__junk" else (head nixName);
+      value = {
+        path = path + "/${name}";
+        type = type;
+      };
+    }
+  ) entries) [ "__junk" ];
+
+  combined = dirPaths // nixPaths;
+in
+fn combined
diff --git a/machines/feneri.nix b/machines/feneri.nix
index 2f3878b..edd0922 100644
--- a/machines/feneri.nix
+++ b/machines/feneri.nix
@@ -1,12 +1,12 @@
-{ flake, modulesPath, ... }:
+{ config, modulesPath, ... }:
 
 {
   imports = [
-    flake.outputs.nixosModules.disk
-    flake.outputs.nixosModules.network
     (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/virtualisation/qemu-guest-agent.nix")
   ];
 
+  services.qemuGuest.enable = true;
   nixpkgs.hostPlatform.system = "x86_64-linux";
 
   depot.disk = {
@@ -14,11 +14,77 @@
     # device = "/dev/vda";
   };
 
+  xnet = {
+    nginx.enable = true;
+    gitServer = {
+      enable = true;
+      path = "/var/lib/gitsrv";
+      gitweb.enable = true;
+    };
+  };
+
   depot.net = {
     sshd.enable = true;
   };
 
-  services.getty.autologinUser = "root";
+  systemd.network = {
+    enable = true;
+    networks."30-wan" = {
+      matchConfig = {
+        Type = "ether";
+        MACAddress = "8a:33:83:f4:b1:80";
+      };
+      linkConfig.RequiredForOnline = true;
+      networkConfig.Description = "WAN";
+      address = [ "152.53.193.118/22" "2a0a:4cc0:2000:bfbf::1/64" ];
+      routes = [
+        { Gateway = "152.53.192.1"; }
+        { Gateway = "fe80::1"; }
+      ];
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "certs@4kb.net";
+    certs."4kb.net" = {
+      dnsProvider = "porkbun";
+      environmentFile = "/var/secrets/porkbun";
+      extraDomainNames = [
+        "*.4kb.net"
+        "*.web.4kb.net"
+      ];
+      group = "nginx";
+      reloadServices = [ "nginx.service" ];
+    };
+  };
+
+  services.hydra = {
+    enable = true;
+    hydraURL = "https://hydra.web.4kb.net";
+    notificationSender = "hydra@localhost";
+    buildMachinesFiles = [];
+    useSubstitutes = true;
+  };
+
+  services.nginx.virtualHosts."hydra.web.4kb.net" = {
+    useACMEHost = "4kb.net";
+    forceSSL = true;
+
+    locations."/".proxyPass = "http://localhost:${toString config.services.hydra.port}";
+  };
+
+  nix.settings.allowed-uris = [
+    "git+https://github.com/NixOS/nixpkgs/"
+    "https://channels.nixos.org/"
+    "https://releases.nixos.org/nixos/"
+  ];
+
+  systemd.services.hydra-notify.enable = false;
 
-  networking.hostName = "feneri";
+  networking = {
+    hostName = "feneri";
+    domain = "4kb.net";
+    useDHCP = false;
+  };
 }
diff --git a/machines/iso.nix b/machines/iso.nix
index d3ca992..5550841 100644
--- a/machines/iso.nix
+++ b/machines/iso.nix
@@ -6,7 +6,10 @@
 
   nixpkgs.hostPlatform.system = "x86_64-linux";
   nix.settings = {
-    experimental-features = [ "nix-command" "flakes" ];
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
   };
 
   environment.systemPackages = with pkgs; [
diff --git a/machines/natest.nix b/machines/natest.nix
index fa8f1d5..c4937d6 100644
--- a/machines/natest.nix
+++ b/machines/natest.nix
@@ -1,4 +1,10 @@
-{ config, modulesPath, pkgs, lib, ... }:
+{
+  config,
+  modulesPath,
+  pkgs,
+  lib,
+  ...
+}:
 
 {
   imports = [
@@ -19,7 +25,11 @@
   fileSystems = {
     "/" = {
       fsType = "tmpfs";
-      options = [ "defaults" "mode=755" "size=2G" ];
+      options = [
+        "defaults"
+        "mode=755"
+        "size=2G"
+      ];
     };
     "/boot" = {
       device = "/dev/disk/by-partlabel/boot";
@@ -43,54 +53,52 @@
     let
       inherit (pkgs.stdenv.hostPlatform) efiArch;
     in
-      {
-        name = "image";
-        partitions.esp = {
-          repartConfig = {
-            Format = "vfat";
-            Label = "boot";
-            SizeMinBytes = "256M";
-            Type = "esp";
-          };
-          contents = {
-            "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
-              "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+    {
+      name = "image";
+      partitions.esp = {
+        repartConfig = {
+          Format = "vfat";
+          Label = "boot";
+          SizeMinBytes = "256M";
+          Type = "esp";
+        };
+        contents = {
+          "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
+            "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
 
-            # "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
-            #   "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
+          # "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
+          #   "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
 
-            "/EFI/nixos/${config.system.boot.loader.kernelFile}.efi".source =
-              "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}";
+          "/EFI/nixos/${config.system.boot.loader.kernelFile}.efi".source =
+            "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}";
 
-            "/EFI/nixos/${config.system.boot.loader.initrdFile}.efi".source =
-              "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
+          "/EFI/nixos/${config.system.boot.loader.initrdFile}.efi".source =
+            "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
 
-            "/loader/entries/nixos.conf".source =
-              pkgs.writeText "default-entry.conf" ''
-                title Coolio
-                linux /EFI/nixos/${config.system.boot.loader.kernelFile}.efi
-                initrd /EFI/nixos/${config.system.boot.loader.initrdFile}.efi
-                options init=${config.system.build.toplevel}/init root=fstab loglevel=4
-              '';
+          "/loader/entries/nixos.conf".source = pkgs.writeText "default-entry.conf" ''
+            title Coolio
+            linux /EFI/nixos/${config.system.boot.loader.kernelFile}.efi
+            initrd /EFI/nixos/${config.system.boot.loader.initrdFile}.efi
+            options init=${config.system.build.toplevel}/init root=fstab loglevel=4
+          '';
 
-            "/loader/loader.conf".source =
-              pkgs.writeText "loader.conf" ''
-                timeout 5
-                console-mode keep
-              '';
-          };
+          "/loader/loader.conf".source = pkgs.writeText "loader.conf" ''
+            timeout 5
+            console-mode keep
+          '';
         };
-        partitions.nix-store = {
-          storePaths = [ config.system.build.toplevel ];
-          nixStorePrefix = "/";
-          repartConfig = {
-            Format = "ext4";
-            Label = "nix-store";
-            SizeMinBytes = "4G";
-            Type = "linux-generic";
-          };
+      };
+      partitions.nix-store = {
+        storePaths = [ config.system.build.toplevel ];
+        nixStorePrefix = "/";
+        repartConfig = {
+          Format = "ext4";
+          Label = "nix-store";
+          SizeMinBytes = "4G";
+          Type = "linux-generic";
         };
       };
+    };
 
   boot.loader.systemd-boot = {
     enable = true;
diff --git a/machines/radon/default.nix b/machines/radon/default.nix
index c77db03..f3e4ff0 100644
--- a/machines/radon/default.nix
+++ b/machines/radon/default.nix
@@ -1,4 +1,10 @@
-{ inputs, flake, pkgs, config, ... }:
+{
+  inputs,
+  flake,
+  pkgs,
+  config,
+  ...
+}:
 let
   interfaces = {
     bottom = "enp1s0";
diff --git a/machines/radon/pxeboot.nix b/machines/radon/pxeboot.nix
index 4655990..0b5df13 100644
--- a/machines/radon/pxeboot.nix
+++ b/machines/radon/pxeboot.nix
@@ -3,30 +3,42 @@ let
   installer = lib.nixosSystem {
     system = "x86_64-linux";
     modules = [
-      ({ config, pkgs, lib, modulesPath, ... }: {
-        imports = [
-          (modulesPath + "/installer/netboot/netboot-minimal.nix")
-          (modulesPath + "/installer/cd-dvd/channel.nix")
-        ];
+      (
+        {
+          config,
+          pkgs,
+          lib,
+          modulesPath,
+          ...
+        }:
+        {
+          imports = [
+            (modulesPath + "/installer/netboot/netboot-minimal.nix")
+            (modulesPath + "/installer/cd-dvd/channel.nix")
+          ];
 
-        services.openssh = {
-          enable = true;
-          openFirewall = true;
-          settings = {
-            PasswordAuthentication = false;
-            KbdInteractiveAuthentication = false;
+          services.openssh = {
+            enable = true;
+            openFirewall = true;
+            settings = {
+              PasswordAuthentication = false;
+              KbdInteractiveAuthentication = false;
+            };
           };
-        };
 
-        nix.settings = {
-          experimental-features = [ "nix-command" "flakes" ];
-        };
+          nix.settings = {
+            experimental-features = [
+              "nix-command"
+              "flakes"
+            ];
+          };
 
-        users.users.root.openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9"
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd"
-        ];
-      })
+          users.users.root.openssh.authorizedKeys.keys = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9"
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd"
+          ];
+        }
+      )
     ];
   };
 
diff --git a/machines/t1.nix b/machines/t1.nix
index b443da5..3a46494 100644
--- a/machines/t1.nix
+++ b/machines/t1.nix
@@ -1,22 +1,6 @@
-{
-  flake,
-  pkgs,
-  perSystem,
-  ...
-}:
+{ pkgs, ... }:
 
-let
-  inherit (import flake.outputs.nixosModules.users { inherit perSystem pkgs; })
-    kle
-    ;
-in
 {
-  imports = [
-    flake.outputs.nixosModules.disk
-    flake.outputs.nixosModules.desktop
-    flake.outputs.nixosModules.network
-  ];
-
   hardware = {
     cpu.amd.updateMicrocode = true;
     enableRedistributableFirmware = true;
@@ -31,9 +15,18 @@ in
     };
   };
 
-  nixpkgs.hostPlatform = "x86_64-linux";
+  depot = {
+    desktop.enable = true;
+    users.kle.enable = true;
+    net = {
+      enable = true;
+      v6Token = "::beef";
+      sshd.enable = true;
+      sshd.publish = true;
+    };
+  };
 
-  users.users.kle = kle;
+  nixpkgs.hostPlatform = "x86_64-linux";
 
   xnet = {
     disk = {
@@ -42,12 +35,6 @@ in
     };
   };
 
-  depot.net = {
-    v6Token = "::beef";
-    sshd.enable = true;
-    sshd.publish = true;
-  };
-
   # depot.disk = {
   #   enable = true;
   #   device = "/dev/nvme0n1";
@@ -80,7 +67,6 @@ in
   environment.shellAliases.b = "${pkgs.ddcutil}/bin/ddcutil setvcp 10";
   boot.kernelModules = [ "i2c-dev" ];
 
-
   environment.systemPackages = with pkgs; [
     ddcutil
     prismlauncher
diff --git a/modules/desktop.nix b/modules/desktop.nix
index 894a7db..b098020 100644
--- a/modules/desktop.nix
+++ b/modules/desktop.nix
@@ -1,283 +1,296 @@
-{ lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
-  inherit (lib) mkDefault;
+  cfg = config.depot.desktop;
+
+  inherit (lib) mkIf mkDefault mkEnableOption;
   inherit (builtins) listToAttrs;
 in
 {
-  environment.systemPackages = with pkgs; [
-    audacious
-    brightnessctl
-    foot
-    fuzzel
-    imv
-    man-pages
-    man-pages-posix
-    mpv
-    playerctl
-    pop-icon-theme
-    pwvucontrol
-    swaybg
-    swayidle
-    swaylock
-    tigervnc
-    wl-clipboard
-    xeyes
-    xwayland-satellite
-    zathura
+  options.depot.desktop.enable = mkEnableOption "depot desktop";
 
-    # Spell checking
-    aspell
-    aspellDicts.en
-    aspellDicts.en-science
-    aspellDicts.en-computers
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      audacious
+      brightnessctl
+      foot
+      fuzzel
+      imv
+      man-pages
+      man-pages-posix
+      mpv
+      playerctl
+      pop-icon-theme
+      pwvucontrol
+      swaybg
+      swayidle
+      swaylock
+      tigervnc
+      wl-clipboard
+      xeyes
+      xwayland-satellite
+      zathura
 
-    hunspell
-    hunspellDicts.en-us
-  ];
+      # Spell checking
+      aspell
+      aspellDicts.en
 
-  documentation = {
-    dev.enable = true;
-    doc.enable = true;
-    info.enable = true;
-    man.enable = true;
-  };
+      hunspell
+      hunspellDicts.en-us
+    ];
 
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    pulse.enable = true;
-    alsa.enable = true;
-  };
+    documentation = {
+      dev.enable = true;
+      doc.enable = true;
+      info.enable = true;
+      man.enable = true;
+    };
 
-  services.emacs = {
-    enable = true;
-    defaultEditor = true;
-    package = with pkgs; (emacsPackagesFor emacs).emacsWithPackages
-      (epkgs: [ epkgs.mu4e epkgs.treesit-grammars.with-all-grammars ]);
-  };
+    security.rtkit.enable = true;
+    services.pipewire = {
+      enable = true;
+      pulse.enable = true;
+      alsa.enable = true;
+    };
 
-  # Build nix derivations on disk rather than in /tmp which is mounted
-  # in RAM, otherwise large closures fail to build due to lack of
-  # space. Since desktops are used as dev machines, this option lives
-  # here rather than on a more general module.
-  systemd.services.nix-daemon.environment.TMPDIR = "/nix/tmp";
+    services.emacs = {
+      enable = true;
+      defaultEditor = true;
+      package =
+        with pkgs;
+        (emacsPackagesFor emacs).emacsWithPackages (epkgs: [
+          epkgs.mu4e
+          epkgs.treesit-grammars.with-all-grammars
+        ]);
+    };
 
-  # Make sure the directory for evaluating large closures exists for
-  # the nix daemon.
-  systemd.tmpfiles.rules = [ "d /nix/tmp 755 root root - -" ];
+    # Build nix derivations on disk rather than in /tmp which is mounted
+    # in RAM, otherwise large closures fail to build due to lack of
+    # space. Since desktops are used as dev machines, this option lives
+    # here rather than on a more general module.
+    systemd.services.nix-daemon.environment.TMPDIR = "/nix/tmp";
 
-  systemd.packages = with pkgs; [ mako ];
-  systemd.user.services =
-    let
-      afterGraphical = ExecStart: {
-        enable = true;
-        after = [ "graphical-session.target" ];
-        partOf = [ "graphical-session.target" ];
-        wantedBy = [ "graphical-session.target" ];
-        serviceConfig = {
-          inherit ExecStart;
-          Type = "simple";
+    # Make sure the directory for evaluating large closures exists for
+    # the nix daemon.
+    systemd.tmpfiles.rules = [ "d /nix/tmp 755 root root - -" ];
+
+    systemd.packages = with pkgs; [ mako ];
+    systemd.user.services =
+      let
+        afterGraphical = ExecStart: {
+          enable = true;
+          after = [ "graphical-session.target" ];
+          partOf = [ "graphical-session.target" ];
+          wantedBy = [ "graphical-session.target" ];
+          serviceConfig = {
+            inherit ExecStart;
+            Type = "simple";
+          };
         };
-      };
-    in
-    {
-      udiskie = afterGraphical "${pkgs.udiskie}/bin/udiskie";
-      swayidle =
-        let
-          swaylock = lib.concatStringsSep " " [
-            "${pkgs.swaylock}/bin/swaylock"
-            "--color 2b3328"
-            "--indicator-caps-lock"
-            "--ignore-empty-password"
-            "--daemonize"
-          ];
-        in
-        afterGraphical (
-          pkgs.writeShellScript "start-swayidle" ''
-            ${pkgs.swayidle}/bin/swayidle -w \
-            timeout 601 '${pkgs.niri}/bin/niri msg action power-off-monitors' \
-            timeout 600 '${swaylock}' \
-            before-sleep '${swaylock}'
-          ''
-        );
+      in
+      {
+        udiskie = afterGraphical "${pkgs.udiskie}/bin/udiskie";
+        swayidle =
+          let
+            swaylock = lib.concatStringsSep " " [
+              "${pkgs.swaylock}/bin/swaylock"
+              "--color 2b3328"
+              "--indicator-caps-lock"
+              "--ignore-empty-password"
+              "--daemonize"
+            ];
+          in
+          afterGraphical (
+            pkgs.writeShellScript "start-swayidle" ''
+              ${pkgs.swayidle}/bin/swayidle -w \
+              timeout 601 '${pkgs.niri}/bin/niri msg action power-off-monitors' \
+              timeout 600 '${swaylock}' \
+              before-sleep '${swaylock}'
+            ''
+          );
 
-      waybar = {
-        partOf = [ "graphical-session.target" ];
-        wantedBy = [ "graphical-session.target" ];
-        after = [ "graphical-session.target" ];
+        waybar = {
+          partOf = [ "graphical-session.target" ];
+          wantedBy = [ "graphical-session.target" ];
+          after = [ "graphical-session.target" ];
 
-        path = with pkgs; [
-          pwvucontrol
-        ];
+          path = with pkgs; [
+            pwvucontrol
+          ];
 
-        serviceConfig = {
-          Type = "exec";
-          ExecStart = "${pkgs.waybar}/bin/waybar";
-          ExecReload = "kill -SIGUSR2 $MAINPID";
-          Restart = "on-failure";
+          serviceConfig = {
+            Type = "exec";
+            ExecStart = "${pkgs.waybar}/bin/waybar";
+            ExecReload = "kill -SIGUSR2 $MAINPID";
+            Restart = "on-failure";
+          };
         };
       };
-    };
 
-  qt = {
-    enable = true;
-    style = "adwaita-dark";
-    platformTheme = "gnome";
-  };
+    qt = {
+      enable = true;
+      style = "adwaita-dark";
+      platformTheme = "gnome";
+    };
 
-  fonts = {
-    # Expose system fonts in case something non-standard needs them
-    fontDir.enable = true;
-    packages = with pkgs; [
-      ibm-plex
-      iosevka
-      nerd-fonts.symbols-only
-    ];
+    fonts = {
+      # Expose system fonts in case something non-standard needs them
+      fontDir.enable = true;
+      packages = with pkgs; [
+        ibm-plex
+        iosevka
+        nerd-fonts.symbols-only
+      ];
 
-    fontconfig.defaultFonts = {
-      serif = [ "IBM Plex Serif" ];
-      sansSerif = [ "IBM Plex Sans" ];
-      monospace = [ "IBM Plex Mono" ];
+      fontconfig.defaultFonts = {
+        serif = [ "IBM Plex Serif" ];
+        sansSerif = [ "IBM Plex Sans" ];
+        monospace = [ "IBM Plex Mono" ];
+      };
     };
-  };
-
-  environment.etc."xdg/user-dirs.defaults".text = ''
-    DOWNLOAD=/tmp/downloads
-  '';
 
-  environment.sessionVariables = {
-    MOZ_ENABLE_WAYLAND = 1;
-    MOZ_USE_XINPUT2 = 1;
-    MOZ_WEBRENDER = 1;
-    QT_QPA_PLATFORM = "wayland;xcb";
-  };
+    environment.etc."xdg/user-dirs.defaults".text = ''
+      DOWNLOAD=/tmp/downloads
+    '';
 
-  programs = {
-    niri.enable = true;
-    direnv.enable = true;
-    fish = {
-      enable = true;
-      interactiveShellInit = ''
-        # disable greeting
-        set fish_greeting
-      '';
+    environment.sessionVariables = {
+      MOZ_ENABLE_WAYLAND = 1;
+      MOZ_USE_XINPUT2 = 1;
+      MOZ_WEBRENDER = 1;
+      QT_QPA_PLATFORM = "wayland;xcb";
     };
 
-    # GTK settings
-    dconf = {
-      enable = true;
-      profiles.user.databases = [
-        {
-          lockAll = true;
-          settings = {
-            "org/gnome/desktop/interface" = {
-              color-scheme = "prefer-dark";
-              gtk-font-name = "Sans Serif 10";
-              icon-theme = "Pop";
-              theme-name = "Adwaita";
+    programs = {
+      niri.enable = true;
+      direnv.enable = true;
+      fish = {
+        enable = true;
+        interactiveShellInit = ''
+          # disable greeting
+          set fish_greeting
+        '';
+      };
+
+      # GTK settings
+      dconf = {
+        enable = true;
+        profiles.user.databases = [
+          {
+            lockAll = true;
+            settings = {
+              "org/gnome/desktop/interface" = {
+                color-scheme = "prefer-dark";
+                gtk-font-name = "Sans Serif 10";
+                icon-theme = "Pop";
+                theme-name = "Adwaita";
+              };
             };
-          };
-        }
-      ];
+          }
+        ];
+      };
     };
-  };
 
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = true;
-    settings = {
-      General = {
-        Experimental = true;
-      };
-      Policy = {
-        AutoEnable = true;
+    hardware.bluetooth = {
+      enable = true;
+      powerOnBoot = true;
+      settings = {
+        General = {
+          Experimental = true;
+        };
+        Policy = {
+          AutoEnable = true;
+        };
       };
     };
-  };
 
-  services.blueman.enable = true;
+    services.blueman.enable = true;
 
-  # Helper for managing dotfiles
-  environment.shellAliases.dots = "git --git-dir=$HOME/.local/cfg/ --work-tree=$HOME";
+    # Helper for managing dotfiles
+    environment.shellAliases.dots = "git --git-dir=$HOME/.local/cfg/ --work-tree=$HOME";
 
-  # Enable modifying keyboard firmware
-  hardware.keyboard.qmk.enable = true;
+    # Enable modifying keyboard firmware
+    hardware.keyboard.qmk.enable = true;
 
-  security.polkit.enable = true;
+    security.polkit.enable = true;
 
-  services = {
-    gnome.gnome-keyring.enable = true;
-    upower.enable = true;
-    pcscd.enable = true;
-    udev.packages = with pkgs; [ yubikey-personalization ];
-    udisks2 = {
-      enable = true;
-      mountOnMedia = true;
+    services = {
+      gnome.gnome-keyring.enable = true;
+      upower.enable = true;
+      pcscd.enable = true;
+      udev.packages = with pkgs; [ yubikey-personalization ];
+      udisks2 = {
+        enable = true;
+        mountOnMedia = true;
+      };
     };
-  };
 
-  programs.firefox = {
-    enable = true;
-    preferences = {
-      # Enable hardware transcoding
-      "media.ffmpeg.vaapi.enabled" = true;
+    programs.firefox = {
+      enable = true;
+      preferences = {
+        # Enable hardware transcoding
+        "media.ffmpeg.vaapi.enabled" = true;
 
-      # Disable controlling media with keyboard
-      "media.hardwaremediakeys.enabled" = false;
-      # Enable legacy compact mode
-      "browser.compactmode.show" = true;
-      "browser.uidensity" = 1;
+        # Disable controlling media with keyboard
+        "media.hardwaremediakeys.enabled" = false;
+        # Enable legacy compact mode
+        "browser.compactmode.show" = true;
+        "browser.uidensity" = 1;
 
-      # Disable ctrl+q closing browser
-      "browser.quitShortcut.disabled" = true;
+        # Disable ctrl+q closing browser
+        "browser.quitShortcut.disabled" = true;
 
-      # Hardcode theme to dark mode
-      "ui.systemUsesDarkTheme" = 1;
-    };
-    policies = {
-      DefaultDownloadDirectory = "/tmp/firefox";
-      DisableTelemetry = true;
-      DisableFirefoxStudies = true;
-      EnableTrackingProtection = {
-        Value = true;
-        Locked = true;
-        Cryptomining = true;
-        Fingerprinting = true;
+        # Hardcode theme to dark mode
+        "ui.systemUsesDarkTheme" = 1;
       };
-      DisableAccounts = true;
-      DisableFirefoxAccounts = true;
-      DisableFirefoxScreenshots = true;
-      DisablePocket = true;
-      DisplayBookmarksToolbar = "never";
-      DisplayMenuBar = "default-off";
-      DontCheckDefaultBrowser = true;
-      Homepage = {
-        URL = "about:blank";
-        StartPage = "homepage";
-      };
-      HttpsOnlyMode = "enabled";
-      DNSOverHTTPS = false;
-      NewTabPage = false;
-      OfferToSaveLogins = false;
-      PasswordManagerEnabled = false;
-      SearchBar = "unified";
-      SearchEngines.Default = "DuckDuckGo";
-      SearchSuggestEnabled = false;
-      ExtensionSettings =
-        let
-          extension = shortId: uuid: {
-            name = uuid;
-            value = {
-              install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
-              installation_mode = "force_installed";
+      policies = {
+        DefaultDownloadDirectory = "/tmp/firefox";
+        DisableTelemetry = true;
+        DisableFirefoxStudies = true;
+        EnableTrackingProtection = {
+          Value = true;
+          Locked = true;
+          Cryptomining = true;
+          Fingerprinting = true;
+        };
+        DisableAccounts = true;
+        DisableFirefoxAccounts = true;
+        DisableFirefoxScreenshots = true;
+        DisablePocket = true;
+        DisplayBookmarksToolbar = "never";
+        DisplayMenuBar = "default-off";
+        DontCheckDefaultBrowser = true;
+        Homepage = {
+          URL = "about:blank";
+          StartPage = "homepage";
+        };
+        HttpsOnlyMode = "enabled";
+        DNSOverHTTPS = false;
+        NewTabPage = false;
+        OfferToSaveLogins = false;
+        PasswordManagerEnabled = false;
+        SearchBar = "unified";
+        SearchEngines.Default = "DuckDuckGo";
+        SearchSuggestEnabled = false;
+        ExtensionSettings =
+          let
+            extension = shortId: uuid: {
+              name = uuid;
+              value = {
+                install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi";
+                installation_mode = "force_installed";
+              };
             };
-          };
-        in
-        listToAttrs [
-          (extension "ublock-origin" "uBlock0@raymondhill.net")
-          (extension "bitwarden-password-manager" "{446900e4-71c2-419f-a6a7-df9c091e268b}")
-          (extension "darkreader" "addon@darkreader.org")
-        ];
+          in
+          listToAttrs [
+            (extension "ublock-origin" "uBlock0@raymondhill.net")
+            (extension "bitwarden-password-manager" "{446900e4-71c2-419f-a6a7-df9c091e268b}")
+            (extension "darkreader" "addon@darkreader.org")
+          ];
+      };
     };
   };
 }
diff --git a/modules/disk.nix b/modules/disk.nix
index bf4a9a8..a8f7fbf 100644
--- a/modules/disk.nix
+++ b/modules/disk.nix
@@ -61,7 +61,6 @@ in
       kernelParams = [
         "nohibernate"
         "elevator=none"
-        "rd.systemd.unit=rescue.target"
       ];
       supportedFilesystems = [
         "vfat"
@@ -145,7 +144,6 @@ in
       '';
     };
 
-    boot.initrd.systemd.emergencyAccess = true;
     boot.initrd.systemd.initrdBin = [
       pkgs.cloud-utils
       pkgs.util-linux
diff --git a/modules/network.nix b/modules/network.nix
index 8264102..e9383c2 100644
--- a/modules/network.nix
+++ b/modules/network.nix
@@ -3,6 +3,8 @@ let
   cfg = config.depot.net;
   inherit (lib)
     mkOption
+    mkEnableOption
+    mkIf
     types
     ;
 
@@ -27,6 +29,7 @@ in
   ];
 
   options.depot.net = {
+    enable = mkEnableOption "depot networking";
     v6Token = mkOption {
       type = types.str;
       default = "eui64";
@@ -34,7 +37,7 @@ in
     };
   };
 
-  config = {
+  config = mkIf cfg.enable {
     # networkd handles this
     networking.useDHCP = false;
 
diff --git a/modules/sshd.nix b/modules/sshd.nix
index 6afec3f..421ab7f 100644
--- a/modules/sshd.nix
+++ b/modules/sshd.nix
@@ -33,7 +33,7 @@ in
       startWhenNeeded = true;
       openFirewall = true;
       hostKeys = lib.singleton {
-        path = "/persist/certs/ssh/ssh_host_ed25519_key";
+        path = "/var/lib/sshd/ssh_host_ed25519_key";
         type = "ed25519";
       };
       settings = {
@@ -41,6 +41,7 @@ in
         X11Forwarding = false;
         PermitRootLogin = "prohibit-password";
         PasswordAuthentication = mkDefault false;
+        KbdInteractiveAuthentication = false;
         # Ciphers = [ "chacha20-poly1305@openssh.com" ];
         # Macs = [ "hmac-sha2-512-etm@openssh.com" ];
         # KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
@@ -50,15 +51,14 @@ in
         "-f AUTHPRIV"
         "-l INFO"
       ];
-      # extraConfig =
-      #   let
-      #     pubkeyTypes = lib.strings.concatStringsSep "," [
-      #       "sk-ssh-ed25519-cert-v01@openssh.com"
-      #       "ssh-ed25519-cert-v01@openssh.com"
-      #       "ssh-ed25519"
-      #     ];
-      #   in
-      #   "PubkeyAcceptedKeyTypes ${pubkeyTypes}";
+      extraConfig =
+        let
+          pubkeyTypes = lib.strings.concatStringsSep "," [
+            "sk-ssh-ed25519@openssh.com"
+            "ssh-ed25519"
+          ];
+        in
+        "PubkeyAcceptedKeyTypes ${pubkeyTypes}";
     };
 
     users.users.root.openssh.authorizedKeys.keys = [
diff --git a/modules/users.nix b/modules/users.nix
index e21c085..d3e7cb4 100644
--- a/modules/users.nix
+++ b/modules/users.nix
@@ -1,7 +1,17 @@
-{ pkgs, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
+  cfg = config.depot.users;
+
   inherit (builtins)
-    attrValues;
+    attrValues
+    ;
+
+  inherit (lib) mkIf mkEnableOption;
 
   keys = {
     t480 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd";
@@ -9,13 +19,23 @@ let
   };
 in
 {
-  kle = {
+  options.depot.users.kle.enable = mkEnableOption "kle user";
+
+  config.users.users.kle = mkIf cfg.kle.enable {
     initialHashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/";
     isNormalUser = true;
     shell = pkgs.fish;
     home = "/persist/usr/kle";
     createHome = true;
-    extraGroups = [ "wheel" "users" "networkmanager" "video" "kvm" "i2c" "dialout" ];
+    extraGroups = [
+      "wheel"
+      "users"
+      "networkmanager"
+      "video"
+      "kvm"
+      "i2c"
+      "dialout"
+    ];
     packages = with pkgs; [
       btop
       curl
@@ -29,6 +49,7 @@ in
       rsync
       sshfs
       tree
+      watchman
       zip
 
       # passwords
diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix
index 28edf60..020accb 100644
--- a/modules/xnet/default.nix
+++ b/modules/xnet/default.nix
@@ -2,8 +2,6 @@
   pkgs,
   lib,
   config,
-  flake,
-  inputs,
   ...
 }:
 let
@@ -47,14 +45,15 @@ in
     time.timeZone = mkDefault "US/Pacific";
 
     nix = {
-      nixPath = mkForce [ "nixpkgs=${inputs.nixpkgs}" ];
       settings = {
         auto-optimise-store = true;
+        nix-path = mkForce [ "nixpkgs=${pkgs.path}" ];
         experimental-features = [
           "nix-command"
           "flakes"
           "pipe-operators"
         ];
+
         warn-dirty = false;
 
         # timeout fast from binary cache
@@ -64,10 +63,7 @@ in
         automatic = true;
         options = mkDefault "--delete-older-than 30d";
       };
-      registry = {
-        nixpkgs.flake = inputs.nixpkgs;
-        depot.flake = flake;
-      };
+      registry.nixpkgs.flake.outPath = pkgs.path;
     };
 
     documentation = {
@@ -104,6 +100,9 @@ in
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
       };
       extraConfig = ''
+        Host *
+          SetEnv TERM=xterm-256color
+
         Host github
           HostName github.com
           User git
@@ -122,6 +121,11 @@ in
         Host ee
           HostName pascal.ee.ryerson.ca
           User kbujari
+
+        Host src
+          HostName src.web.4kb.net
+          User git
+          PreferredAuthentications publickey
       '';
     };
 
diff --git a/modules/xnet/disk.nix b/modules/xnet/disk.nix
index 82e9c87..e6835f4 100644
--- a/modules/xnet/disk.nix
+++ b/modules/xnet/disk.nix
@@ -1,4 +1,9 @@
-{ config, lib, modulesPath, inputs, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 let
   cfg = config.xnet.disk;
   commonOpts = {
@@ -11,12 +16,16 @@ let
     "com.sun:auto-snapshot" = "false";
   };
 
-  inherit (lib) mkOption mkDefault mkIf types;
+  inherit (lib)
+    mkOption
+    mkDefault
+    mkIf
+    types
+    ;
 in
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
-    inputs.disko.nixosModules.default
   ];
 
   options.xnet.disk = {
@@ -33,8 +42,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    networking.hostId = builtins.substring 0 8
-      (builtins.hashString "md5" config.networking.hostName);
+    networking.hostId = builtins.substring 0 8 (builtins.hashString "md5" config.networking.hostName);
 
     services.zfs = {
       autoScrub.enable = true;
@@ -46,8 +54,14 @@ in
     zramSwap.enable = mkDefault true;
 
     boot = {
-      kernelParams = [ "nohibernate" "elevator=none" ];
-      supportedFilesystems = [ "vfat" "zfs" ];
+      kernelParams = [
+        "nohibernate"
+        "elevator=none"
+      ];
+      supportedFilesystems = [
+        "vfat"
+        "zfs"
+      ];
       zfs.devNodes = mkDefault "/dev/disk/by-partuuid";
       loader = {
         systemd-boot.enable = true;
@@ -94,7 +108,11 @@ in
     disko.devices = {
       nodev."/" = {
         fsType = "tmpfs";
-        mountOptions = [ "defaults" "size=2G" "mode=755" ];
+        mountOptions = [
+          "defaults"
+          "size=2G"
+          "mode=755"
+        ];
       };
 
       zpool.zroot = {
diff --git a/modules/xnet/gitserver/default.nix b/modules/xnet/gitserver/default.nix
index 2152ebd..2bd471a 100644
--- a/modules/xnet/gitserver/default.nix
+++ b/modules/xnet/gitserver/default.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.xnet.gitServer;
   inherit (lib) mkOption mkIf types;
diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix
index a9ed7d9..6473183 100644
--- a/modules/xnet/gitserver/gitweb.nix
+++ b/modules/xnet/gitserver/gitweb.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.xnet.gitServer.gitweb;
   inherit (lib) mkOption mkIf types;
@@ -38,16 +43,11 @@ in
         mimetype.pdf=application/pdf
         mimetype.png=image/png
         mimetype.svg=image/svg+xml
-        readme=:readme
-        readme=:readme.md
-        readme=:readme.txt
-        readme=:README
-        readme=:README.md
-        readme=:README.txt
+        readme=master:README
       '';
       settings = {
-        # about-filter = "${pkgs.cgit-pink}/lib/cgit/filters/about-formatting.sh";
-        # source-filter = "${pkgs.cgit-pink}/lib/cgit/filters/syntax-highlighting.py";
+        about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
+        source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
         clone-url = "https://${cfg.hostName}/$CGIT_REPO_URL git@${cfg.hostName}:$CGIT_REPO_URL";
         enable-commit-graph = true;
         enable-http-clone = false;
@@ -58,13 +58,16 @@ in
         root-desc = "What I cannot create, I do not understand";
         root-title = cfg.hostName;
         section-from-path = true;
+        scan-hidden-path = true;
         snapshots = "tar.gz tar.bz2 zip";
       };
     };
 
-    # services.nginx.virtualHosts."${cfg.gitweb.hostName}" = {
-    #   useACMEHost = "4kb.net";
-    #   addSSL = true;
-    # };
+    services.nginx.virtualHosts."${cfg.hostName}" = {
+      useACMEHost = "4kb.net";
+      forceSSL = true;
+
+      locations."/robots.txt".return = "200 \"User-agent: *\nDisallow: /\n\"";
+    };
   };
 }
diff --git a/modules/xnet/monitoring/default.nix b/modules/xnet/monitoring/default.nix
index eed4963..20566d3 100644
--- a/modules/xnet/monitoring/default.nix
+++ b/modules/xnet/monitoring/default.nix
@@ -9,7 +9,6 @@ in
 {
   imports = [ ./grafana.nix ];
 
-
   config = {
     services.prometheus = {
       enable = config.xnet.monitoring.hostGrafana;
@@ -19,7 +18,10 @@ in
         node = {
           enable = true;
           openFirewall = true;
-          enabledCollectors = [ "processes" "systemd" ];
+          enabledCollectors = [
+            "processes"
+            "systemd"
+          ];
         };
 
         # systemd = {
@@ -39,20 +41,29 @@ in
 
       scrapeConfigs =
         let
-          hosts = [ "iridium" "radon" ];
+          hosts = [
+            "iridium"
+            "radon"
+          ];
         in
-        [{
-          job_name = "node";
-          static_configs = [{
-            targets = map (h: "${h}:${toString exporters.node.port}") hosts;
-          }];
-        }
+        [
+          {
+            job_name = "node";
+            static_configs = [
+              {
+                targets = map (h: "${h}:${toString exporters.node.port}") hosts;
+              }
+            ];
+          }
           {
             job_name = "smartctl";
-            static_configs = [{
-              targets = map (h: "${h}:${toString exporters.smartctl.port}") hosts;
-            }];
-          }];
+            static_configs = [
+              {
+                targets = map (h: "${h}:${toString exporters.smartctl.port}") hosts;
+              }
+            ];
+          }
+        ];
     };
   };
 }
diff --git a/modules/xnet/monitoring/grafana.nix b/modules/xnet/monitoring/grafana.nix
index e95318d..a8712f0 100644
--- a/modules/xnet/monitoring/grafana.nix
+++ b/modules/xnet/monitoring/grafana.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   inherit (lib) mkOption mkIf types;
 
@@ -18,18 +23,22 @@ in
   config = mkIf hostGrafana {
     services.grafana.provision = {
       enable = true;
-      datasources.settings.datasources = [{
-        name = "Prometheus";
-        type = "prometheus";
-        url = "http://localhost:9090";
-        access = "proxy";
-        editable = false;
-      }];
+      datasources.settings.datasources = [
+        {
+          name = "Prometheus";
+          type = "prometheus";
+          url = "http://localhost:9090";
+          access = "proxy";
+          editable = false;
+        }
+      ];
 
-      dashboards.settings.providers = [{
-        name = "Fetched Dashboards";
-        options.path = "/etc/grafana/dashboards";
-      }];
+      dashboards.settings.providers = [
+        {
+          name = "Fetched Dashboards";
+          options.path = "/etc/grafana/dashboards";
+        }
+      ];
     };
 
     environment.etc = {
diff --git a/modules/xnet/nginx.nix b/modules/xnet/nginx.nix
index eadd794..3e6ca7c 100644
--- a/modules/xnet/nginx.nix
+++ b/modules/xnet/nginx.nix
@@ -14,7 +14,10 @@ in
   };
 
   config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
 
     services.nginx = {
       enable = true;
diff --git a/modules/xnet/persist.nix b/modules/xnet/persist.nix
index 10eb883..5e69bae 100644
--- a/modules/xnet/persist.nix
+++ b/modules/xnet/persist.nix
@@ -10,39 +10,42 @@ let
 in
 {
   options.xnet.persist = mkOption {
-    type = types.listOf (types.either
-      types.str
-      (types.submodule {
-        options = {
-          path = mkOption {
-            type = types.str;
-            description = "Path to persist";
-          };
-          user = mkOption {
-            type = types.nullOr types.str;
-            default = null;
-            description = "User ID to set on the persisted directory";
-          };
-          group = mkOption {
-            type = types.nullOr types.str;
-            default = null;
-            description = "Group ID to set on the persisted directory";
-          };
+    type = types.listOf (
+      types.either types.str (
+        types.submodule {
+          options = {
+            path = mkOption {
+              type = types.str;
+              description = "Path to persist";
+            };
+            user = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = "User ID to set on the persisted directory";
+            };
+            group = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = "Group ID to set on the persisted directory";
+            };
 
-          mode = mkOption {
-            type = types.nullOr types.str;
-            default = null;
-            description = "Permissions to set";
+            mode = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = "Permissions to set";
+            };
           };
-        };
-      }));
+        }
+      )
+    );
     default = [ ];
     description = "Automatically persisted state.";
   };
 
   config.systemd.tmpfiles.rules =
     let
-      mkEntry = entry:
+      mkEntry =
+        entry:
         let
           path = if isString entry then entry else entry.path;
           user = if isString entry then "-" else entry.user;
@@ -53,7 +56,11 @@ in
           link = "L+ ${path} - - - - /persist${path}";
           perm = "Z ${mode} ${user} ${group} - -";
         in
-        [ dent link perm ];
+        [
+          dent
+          link
+          perm
+        ];
 
       entries = map mkEntry config.xnet.persist;
     in
diff --git a/packages/code/kleidi-ca/package.nix b/packages/code/kleidi-ca/package.nix
index 43f0de7..0f3efe9 100644
--- a/packages/code/kleidi-ca/package.nix
+++ b/packages/code/kleidi-ca/package.nix
@@ -8,7 +8,7 @@ let
       root = ./.;
       fileset = fileset.unions [
         ./kleidi-ca.cabal
-        ./src
+        # ./src
         ./app
       ];
     };
@@ -35,7 +35,7 @@ let
 
     installPhase = ''
       mv _site $out
-p
+
       mkdir $out/share
       cp -v ${depotPackages.misc.cv} $out/share/cv.pdf
     '';
diff --git a/packages/make-zfs-image.nix b/packages/make-zfs-image.nix
index 5a7500b..15d375f 100644
--- a/packages/make-zfs-image.nix
+++ b/packages/make-zfs-image.nix
@@ -34,6 +34,8 @@ let
 
   vmTools = pkgs.vmTools.override {
     rootModules = [
+      "9p"
+      "9pnet_virtio"
       "virtio_blk"
       "virtio_pci"
       "virtiofs"
diff --git a/packages/misc/cv/cv.typ b/packages/misc/cv/cv.typ
index c4ddba6..df70f67 100644
--- a/packages/misc/cv/cv.typ
+++ b/packages/misc/cv/cv.typ
@@ -1,156 +1,92 @@
 #set document(author: "Kleidi Bujari", title: "Kleidi's Resume!")
 #set text(size: 10pt, lang: "en", ligatures: false)
-#set page(margin: 1in, paper: "us-letter")
+#set page(paper: "us-letter")
 
-#show link: underline
 #set par(justify: true)
 
-#show heading.where(level: 1): it => [
-  #set text(weight: 700, size: 20pt)
-  #pad(it.body)
-]
-
 #show heading.where(level: 2): it => [
-  #pad(top: 5pt, bottom: -10pt, [#smallcaps(it.body)])
-  #line(length: 100%, stroke: 0.5pt)
+  #pad(top: 8pt, bottom: 5pt, [#smallcaps(it.body)])
 ]
 
-#let generic-headline(
-  left: "",
-  right: "",
-  description: "",
-) = [#strong(left), #description #h(1fr) #right]
+#let item(
+    place: "",
+    title: "",
+    dates: "",
+    descr: "",
+) = stack(
+    dir: ttb,
+    grid(
+        columns: (0.5fr, 1fr),
+        dates,
+        stack(dir: ttb, spacing: 6pt, place, title, descr)
+    ),
+    v(0.75em)
+)
 
 #let dates-helper(from: "", to: "") = from + " " + $dash.em$ + " " + to
 
-#let edu(
-  institution: "",
-  dates: "",
-  degree: "",
-) = generic-headline(
-  left: institution,
-  description: degree,
-  right: dates,
+#stack(
+    dir: ttb,
+    spacing: 1em,
+    [= Kleidi Bujari],
+    link("mailto:kleidi@4kb.net"),
 )
 
-#let work(
-  title: "",
-  dates: "",
-  company: "",
-) = generic-headline(
-  left: company,
-  description: title,
-  right: dates,
-)
-
-= Kleidi Bujari
-
-#(
-  link("mailto:kleidi@4kb.net"),
-  link("https://github.com/kbujari")[github.com/kbujari],
-  link("http://kleidi.ca")[kleidi.ca],
-).join("  |  ")
+== Work Experience
 
-== Experience
-
-#work(
-  company: "Meta",
-  title: "Production Software Engineer",
-  dates: dates-helper(from: "Aug 2025", to: "Present"),
+#item(
+    place: [Tesla (#link("https://tesla.com")[tesla.com])],
+    title: "Senior Software Engineer, Distributed Systems",
+    dates: dates-helper(from: "Sep 2026", to: "present"),
+    descr: "Developer tooling and build infrastructure"
 )
 
-- Analyzed Linux schedulers for Erlang/BEAM workloads,
-  building kernel scheduler observability used across Meta.
-- Led team designing scalable AWS/EKS infrastructure fighting internet censorship and poor network conditions.
-- Built runtime type-checking for trillions of WhatsApp packets,
-  solving entire class of account ID problems.
-- Primary oncall for WhatsApp distributed system,
-  improving reliability and mentoring engineers in debugging.
-
-#work(
-  company: "Toronto Metropolitan University",
-  title: "Graduate Research Assistant",
-  dates: dates-helper(from: "May 2024", to: "Sep 2024"),
+#item(
+    place: [Meta (#link("https://meta.com")[meta.com])],
+    title: "Production Software Engineer",
+    dates: dates-helper(from: "Aug 2025", to: "Aug 2026"),
+    descr: "Type-checkers and distributed system reliability."
 )
 
-- Organized webhosting and data analytics for a film release,
-  with thousands of concurrent visitors.
-- Built transformation pipeline for hundreds of media files,
-  using unix primitives to parallelize workload.
-
-#work(
-  company: "Canadian Broadcasting Corporation",
-  title: "Systems Engineering Intern",
-  dates: dates-helper(from: "May 2023", to: "Apr 2024"),
+#item(
+    place: [Toronto Metropolitan University (#link("https://torontomu.ca")[torontomu.ca])],
+    title: "Graduate Research Assistant",
+    dates: dates-helper(from: "May 2024", to: "Sep 2024"),
+    descr: "Fast content delivery for documents and media."
 )
 
-- Built custom PXE-based provisioning for hundreds of devices on network,
-  eliminating manual configuration.
-- Architected VM cluster for 2024 Olympics handling all Canadian broadcasts,
-  saving \$250k+ with reused hardware.
-
-#work(
-  company: "WSP Canada",
-  title: "Student Engineer",
-  dates: dates-helper(from: "May", to: "Aug") + ", 2021, 2022",
+#item(
+    place: [Canadian Broadcasting Corporation (#link("https://cbc.ca")[cbc.ca])],
+    title: "Systems Engineering Intern",
+    dates: dates-helper(from: "May 2023", to: "May 2024"),
+    descr: "Datacenter bringup and SDN automation."
 )
 
-- Validated large scale electrical distribution for power consumption and cost efficiency.
-- Extended internal databases with compression and deduplication,
-  reclaiming terabytes of storage.
-
-== Selected Projects
-
-*Custom Linux Distribution* ---
-Designed entire Linux distribution used for hosting production servers,
-daily desktop use, and embedded programming on a Raspberry Pi.
-Using NixOS, it supports enabling only required functionality at build time.
-Features systemd,
-an in-memory root filesystem,
-ZFS persistent storage with backups,
-and extremely hardened networking.
-
-*Distributed Compute Cluster* ---
-Bare-metal Kubernetes cluster managed with GitOps to be completely reproducible.
-Uses Cilium CNI for fast eBPF networking and BGP load balancing,
-FluxCD for cluster management,
-and CEPH distributed storage for stateful workloads.
-Air-gapped, automated cluster provisioning with custom PXEBOOT images.
-
-*ICER Compressor* ---
-Image compression library written in Rust,
-designed for deep-space communication.
-Hand tuned for speed and portability by using only integer arithmetic,
-no heap allocations, and no standard library by default.
-Achieves practically instant compressions, even on microprocessors.
-
 == Education
 
-#edu(
-  institution: "Toronto Metropolitan University",
-  dates: dates-helper(from: "Sep 2020", to: "Apr 2025"),
-  degree: "B. Eng, Computer Engineering",
+#item(
+    place: "Toronto Metropolitan University",
+    dates: dates-helper(from: "2020", to: "2025"),
+    title: "Bachelors of Engineering, Computer Engineering",
 )
 
-- *Relevant Coursework*:
-  Data Structures, FPGA Programming, Compilers, Computer Networks
-- *Extracurriculars*:
-  Student-led robotics design team,
-  teaching assistant for micro-processor courses.
+== Selected Projects
+
+- *Depot*: Custom systemd-based Linux distribution built on nixpkgs.
+- *Hint*: Interpreted language and package manager written in Haskell.
 
 == Skills
 
 - *Languages*: #(
-    "Rust",
     "Haskell",
-    "C++",
+    "Rust",
     "Erlang",
-    "Nix",
-    "Scheme",
+    "C++",
+    "Python"
   ).join(", ")
 - *Technologies*: #(
-    "Distributed Systems",
     "Compilers",
+    "Distributed Systems",
+    "Build Systems",
     "Virtualization",
-    "Reproducible Builds",
   ).join(", ")
diff --git a/packages/randpass.nix b/packages/randpass.nix
index ef8fe91..4cb5128 100644
--- a/packages/randpass.nix
+++ b/packages/randpass.nix
@@ -4,5 +4,4 @@
 
 { writeShellScriptBin, ... }:
 
-writeShellScriptBin "randpass"
-  ''tr -dc '[:alnum:]' </dev/urandom | head -c "''${1:-14}"''
+writeShellScriptBin "randpass" ''tr -dc '[:alnum:]' </dev/urandom | head -c "''${1:-14}"''
diff --git a/packages/web/site/package.nix b/packages/web/site/package.nix
index aed7567..7e38162 100644
--- a/packages/web/site/package.nix
+++ b/packages/web/site/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
   zola,
+  cacert,
   depot,
   stdenvNoCC,
   ...
@@ -21,7 +22,7 @@ stdenvNoCC.mkDerivation {
     ];
   };
 
-  nativeBuildInputs = [ zola ];
+  nativeBuildInputs = [ zola cacert ];
   buildPhase = "zola build";
 
   installPhase = ''
diff --git a/packages/web/site/templates/index.html b/packages/web/site/templates/index.html
index bc2994a..41954b6 100644
--- a/packages/web/site/templates/index.html
+++ b/packages/web/site/templates/index.html
@@ -7,7 +7,7 @@
 <div style="margin-bottom: 3em">
   <h1>{{ section.title }}</h1>
   <ul style="list-style: none; padding-left: 0">
-    {% for page in section.pages | slice(end=3) %}
+    {% for page in section.pages[-3:] %}
     <li style="margin-bottom: 1em">
       <a href="{{ page.path }}">{{ page.title }}</a>
       <br />
diff --git a/packages/web/site/templates/page.html b/packages/web/site/templates/page.html
index 8189fe6..32e13f3 100644
--- a/packages/web/site/templates/page.html
+++ b/packages/web/site/templates/page.html
@@ -1,11 +1,10 @@
 {% extends "base.html" %}
 
-{% if page.title %}
 {% block title%}
+{% if page.title %}
 {{ page.title }} :: {{ super() }}
-{% endblock title %}
 {% endif %}
-
+{% endblock title %}
 {% block content %}
 
 <article>
diff --git a/release.nix b/release.nix
new file mode 100644
index 0000000..d7e15ab
--- /dev/null
+++ b/release.nix
@@ -0,0 +1,9 @@
+{ ... }:
+
+let
+  depot = import ./. { };
+in
+{
+  inherit (depot.depotPackages.misc) cv;
+  inherit (depot.depotPackages.web) site;
+}