Merge remote-tracking branch 'cd/master'

181 files changed, 1478 insertions, 1192 deletions

diff --git a/Makefile b/Makefile
index e61d16b75..384c872ab 100644
--- a/Makefile
+++ b/Makefile
@@ -4,14 +4,16 @@ endif
 
 export target_host ?= $(system)
 export target_user ?= root
+export target_port ?= 22
 export target_path ?= /var/src
 
 evaluate = \
 	nix-instantiate \
-		--arg configuration "./$$LOGNAME/1systems/$$system.nix" \
 		--eval \
 		--readonly-mode \
 		--show-trace \
+		-I nixos-config=./$(LOGNAME)/1systems/$(system).nix \
+		-I stockholm=. \
 		$(1)
 
 execute = \
@@ -22,20 +24,20 @@ execute = \
 # usage: make deploy system=foo [target_host=bar]
 deploy:
 	$(call execute,populate)
-	@set -x; ssh "$$target_user@$$target_host" nixos-rebuild switch -I "$$target_path"
+	ssh $(target_user)@$(target_host) -p $(target_port) \
+		nixos-rebuild switch --show-trace -I $(target_path)
 
 # usage: make LOGNAME=shared system=wolf eval.config.krebs.build.host.name
 eval eval.:;@$(call evaluate)
 eval.%:;@$(call evaluate,-A $*)
 
-## usage: make install system=foo target=
-#.PHONY: install
-#install: ssh = ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
-#install:;@set -x
-#	$(ssh) "$$target_user@$$target_host" \
-#		env target_path="$target_path" \
-#			sh -s prepare < krebs/4lib/infest/prepare.sh
-#	make -s populate target_path=/mnt"$$target_path"
-#	$(ssh) "$$target_user@$$target_host" \
-#		env NIXOS_CONFIG=/var/src/nixos-config \
-#			nixos-install
+# usage: make install system=foo [target_host=bar]
+install: ssh ?= ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null
+install:
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
+		env target_path=$(target_path) \
+			sh -s prepare < krebs/4lib/infest/prepare.sh
+	target_path=/mnt$(target_path) $(call execute,populate)
+	$(ssh) $(target_user)@$(target_host) -p $(target_port) \
+		env NIXOS_CONFIG=$(target_path)/nixos-config \
+			nixos-install
diff --git a/default.nix b/default.nix
index b0ad60d8a..52e8924cd 100644
--- a/default.nix
+++ b/default.nix
@@ -1,88 +1,5 @@
-{ configuration ? import (nixpkgs-path + "/nixos/lib/from-env.nix") "NIXOS_CONFIG" <nixos-config>
-, system ? builtins.currentSystem
-, current-host-name ?
-    let v = builtins.getEnv "HOSTNAME"; in
-    if v != "" then v else builtins.readFile /proc/sys/kernel/hostname
-, current-user-name ?
-    let v = builtins.getEnv "LOGNAME"; in
-    if v != "" then v else abort "undefined variable: LOGNAME"
-, nixpkgs-path ?
-    if (builtins.tryEval <nixpkgs/krebs>).success
-      then <upstream-nixpkgs>
-      else <nixpkgs>
-, StrictHostKeyChecking ? "yes"
-}@args:
-
-let stockholm = {
-    inherit krebs;
-    inherit users;
-    inherit lib;
-    inherit config options pkgs;
-    system = config.system.build.toplevel;
-  };
-
-  krebs = import ./krebs (args // { inherit lib stockholm; });
-
-  lib = let
-    nlib = import (slib.npath "lib");
-    klib = import (slib.kpath "4lib") { lib = nlib; };
-    slib = rec {
-      nspath = ns: p: ./. + "/${ns}/${p}";
-      npath = p: nixpkgs-path + "/${p}";
-      kpath = nspath "krebs";
-      upath = nspath current-user-name;
-    };
-    ulib = let p = slib.upath "4lib"; in
-      nlib.optionalAttrs (klib.dir.has-default-nix p)
-                         (import p { lib = nlib // klib; });
-  in nlib // klib // slib // ulib // builtins;
-
-  inherit (eval configuration) config options pkgs;
-
-  base-module = { config, ... }: {
-    imports = builtins.filter lib.dir.has-default-nix (lib.concatLists [
-      (map (f: f "2configs") [ lib.upath ])
-      (map (f: f "3modules") [ lib.kpath lib.upath ])
-    ]);
-
-    krebs.current.enable = true;
-    krebs.current.host = config.krebs.hosts.${current-host-name};
-    krebs.current.user = config.krebs.users.${current-user-name};
-
-    nixpkgs.config.packageOverrides = pkgs: let
-      kpkgs = import (lib.kpath "5pkgs") { inherit lib pkgs; };
-      upkgs = import (lib.upath "5pkgs") { inherit lib; pkgs = pkgs // kpkgs; };
-    in kpkgs // upkgs;
-  };
-
-  eval = config: import (lib.npath "nixos/lib/eval-config.nix") {
-    inherit system;
-    specialArgs = {
-      inherit lib;
-    };
-    modules = [
-      base-module
-      config
-    ];
-  };
-
-  # TODO move user namespaces' to users/, so no exception for krebs/ is needed
-  users =
-    lib.mapAttrs
-      (name: _: eval-all-systems (lib.nspath name "1systems"))
-      (lib.filterAttrs
-        (n: t: !lib.hasPrefix "." n && t == "directory" && n != "krebs")
-        (builtins.readDir ./.));
-
-  eval-all-systems = path:
-    lib.mapAttrs'
-      (n: _: (lib.nameValuePair (lib.removeSuffix ".nix" n)
-                                (eval-system (path + "/${n}"))))
-      (builtins.readDir path);
-
-  eval-system = path: rec {
-    inherit (eval path) config options;
-    system = config.system.build.toplevel;
-  };
-
-in stockholm
+import <nixpkgs/nixos/lib/eval-config.nix> {
+  modules = [
+    (import <nixpkgs/nixos/lib/from-env.nix> "NIXOS_CONFIG" <nixos-config>)
+  ];
+}
diff --git a/krebs/3modules/Reaktor.nix b/krebs/3modules/Reaktor.nix
index 92400139c..d58661a28 100644
--- a/krebs/3modules/Reaktor.nix
+++ b/krebs/3modules/Reaktor.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
 
   ReaktorConfig = pkgs.writeText "config.py" ''
@@ -16,7 +16,7 @@ let
 
   out = {
     options.krebs.Reaktor = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/apt-cacher-ng.nix b/krebs/3modules/apt-cacher-ng.nix
index 371d39b6f..46b405842 100644
--- a/krebs/3modules/apt-cacher-ng.nix
+++ b/krebs/3modules/apt-cacher-ng.nix
@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   acng-config = pkgs.writeTextFile {
     name = "acng-configuration";
@@ -151,5 +151,5 @@ let
 in
 {
   options.krebs.apt-cacher-ng = api;
-  config = mkIf cfg.enable imp;
+  config = lib.mkIf cfg.enable imp;
 }
diff --git a/krebs/3modules/backup.nix b/krebs/3modules/backup.nix
index a1f335905..0aa86dec9 100644
--- a/krebs/3modules/backup.nix
+++ b/krebs/3modules/backup.nix
@@ -1,9 +1,9 @@
 { config, lib, pkgs, ... }:
-with lib;
+with config.krebs.lib;
 let
   out = {
     options.krebs.backup = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   cfg = config.krebs.backup;
@@ -12,14 +12,17 @@ let
     enable = mkEnableOption "krebs.backup" // { default = true; };
     plans = mkOption {
       default = {};
-      type = types.attrsOf (types.submodule ({
-        # TODO enable = mkEnableOption "TODO" // { default = true; };
+      type = types.attrsOf (types.submodule ({ config, ... }: {
         options = {
+          enable = mkEnableOption "krebs.backup.${config.name}" // {
+            default = true;
+          };
           method = mkOption {
             type = types.enum ["pull" "push"];
           };
           name = mkOption {
             type = types.str;
+            default = config._module.args.name;
           };
           src = mkOption {
             type = types.krebs.file-location;
@@ -29,7 +32,7 @@ let
           };
           startAt = mkOption {
             default = "hourly";
-            type = types.str; # TODO systemd.time(7)'s calendar event
+            type = with types; nullOr str; # TODO systemd.time(7)'s calendar event
           };
           snapshots = mkOption {
             default = {
@@ -57,239 +60,165 @@ let
   };
 
   imp = {
-    users.groups.backup.gid = genid "backup";
-    users.users = {}
-      // {
-        root.openssh.authorizedKeys.keys =
-          map (plan: plan.dst.host.ssh.pubkey)
-              (filter isPullSrc (attrValues cfg.plans))
-          ++
-          map (plan: plan.src.host.ssh.pubkey)
-              (filter isPushDst (attrValues cfg.plans))
-          ;
-      }
-      ;
     systemd.services =
-      flip mapAttrs' (filterAttrs (_:isPullDst) cfg.plans) (name: plan: {
-        name = "backup.${name}.pull";
-        value = makePullService plan;
-      })
-      //
-      flip mapAttrs' (filterAttrs (_:isPushSrc) cfg.plans) (name: plan: {
-        name = "backup.${name}.push";
-        value = makePushService plan;
-      })
-      ;
-  };
-
-  isPushSrc = plan:
-    plan.method == "push" &&
-    plan.src.host.name == config.krebs.build.host.name;
-
-  isPullSrc = plan:
-    plan.method == "pull" &&
-    plan.src.host.name == config.krebs.build.host.name;
-
-  isPushDst = plan:
-    plan.method == "push" &&
-    plan.dst.host.name == config.krebs.build.host.name;
-
-  isPullDst = plan:
-    plan.method == "pull" &&
-    plan.dst.host.name == config.krebs.build.host.name;
-
-  # TODO push destination needs this in the dst.user's PATH
-  service-path = [
-    pkgs.coreutils
-    pkgs.gnused
-    pkgs.openssh
-    pkgs.rsync
-    pkgs.utillinux
-  ];
-
-  # TODO if there is plan.user, then use its privkey
-  makePushService = plan: assert isPushSrc plan; {
-    path = service-path;
-    serviceConfig = {
-      ExecStart = push plan;
-      Type = "oneshot";
-    };
-    startAt = plan.startAt;
-  };
+      listToAttrs (map (plan: nameValuePair "backup.${plan.name}" {
+        # TODO if there is plan.user, then use its privkey
+        # TODO push destination users need a similar path
+        path = with pkgs; [
+          coreutils
+          gnused
+          openssh
+          rsync
+          utillinux
+        ];
+        serviceConfig = rec {
+          ExecStart = start plan;
+          SyslogIdentifier = ExecStart.name;
+          Type = "oneshot";
+        };
+        startAt = mkIf (plan.startAt != null) plan.startAt;
+      }) (filter (plan: build-host-is "pull" "dst" plan ||
+                        build-host-is "push" "src" plan)
+                 enabled-plans));
 
-  makePullService = plan: assert isPullDst plan; {
-    path = service-path;
-    serviceConfig = {
-      ExecStart = pull plan;
-      Type = "oneshot";
-    };
-    startAt = plan.startAt;
+    users.groups.backup.gid = genid "backup";
+    users.users.root.openssh.authorizedKeys.keys =
+      map (plan: getAttr plan.method {
+        push = plan.src.host.ssh.pubkey;
+        pull = plan.dst.host.ssh.pubkey;
+      }) (filter (plan: build-host-is "pull" "src" plan ||
+                        build-host-is "push" "dst" plan)
+                 enabled-plans);
   };
 
-  push = plan: let
-    # We use writeDashBin and return the absolute path so systemd will produce
-    # nice names in the log, i.e. without the Nix store hash.
-    out = "${main}/bin/${main.name}";
-
-    main = writeDashBin "backup.${plan.name}.push" ''
-      set -efu
-      dst=${shell.escape plan.dst.path}
-
-      mkdir -m 0700 -p "$dst"
-      exec flock -n "$dst" ${critical-section}
-    '';
-
-    critical-section = writeDash "backup.${plan.name}.push.critical-section" ''
-      # TODO check if there is a previous
-      set -efu
-      identity=${shell.escape plan.src.host.ssh.privkey.path}
-      src=${shell.escape plan.src.path}
-      dst_target=${shell.escape "root@${getFQDN plan.dst.host}"}
-      dst_path=${shell.escape plan.dst.path}
-      dst=$dst_target:$dst_path
-
-      # Export NOW so runtime of rsync doesn't influence snapshot naming.
-      export NOW
-      NOW=$(date +%s)
-
-      echo >&2 "update snapshot: current; $src -> $dst"
-      rsync >&2 \
-          -aAXF --delete \
-          -e "ssh -F /dev/null -i $identity" \
-          --rsync-path ${shell.escape
-            "mkdir -m 0700 -p ${shell.escape plan.dst.path} && rsync"} \
-          --link-dest="$dst_path/current" \
-          "$src/" \
-          "$dst/.partial"
+  enabled-plans = filter (getAttr "enable") (attrValues cfg.plans);
 
-      exec ssh -F /dev/null \
-          -i "$identity" \
-          "$dst_target" \
-          -T \
-          env NOW="$NOW" /bin/sh < ${remote-snapshot}
-      EOF
-    '';
+  build-host-is = method: side: plan:
+    plan.method == method &&
+    config.krebs.build.host.name == plan.${side}.host.name;
 
-    remote-snapshot = writeDash "backup.${plan.name}.push.remote-snapshot" ''
-      set -efu
-      dst=${shell.escape plan.dst.path}
-
-      if test -e "$dst/current"; then
-        mv "$dst/current" "$dst/.previous"
-      fi
-      mv "$dst/.partial" "$dst/current"
-      rm -fR "$dst/.previous"
-      echo >&2
-
-      (${(take-snapshots plan).text})
-    '';
-
-  in out;
-
-  # TODO admit plan.dst.user and its ssh identity
-  pull = plan: let
-    # We use writeDashBin and return the absolute path so systemd will produce
-    # nice names in the log, i.e. without the Nix store hash.
-    out = "${main}/bin/${main.name}";
-
-    main = writeDashBin "backup.${plan.name}.pull" ''
+  start = plan: pkgs.writeDash "backup.${plan.name}" ''
+    set -efu
+    ${getAttr plan.method {
+      push = ''
+        identity=${shell.escape plan.src.host.ssh.privkey.path}
+        src_path=${shell.escape plan.src.path}
+        src=$src_path
+        dst_user=root
+        dst_host=$(${fastest-address plan.dst.host})
+        dst_port=$(${network-ssh-port plan.dst.host "$dst_host"})
+        dst_path=${shell.escape plan.dst.path}
+        dst=$dst_user@$dst_host:$dst_path
+        echo "update snapshot: current; $src -> $dst" >&2
+        dst_shell() {
+          exec ssh -F /dev/null \
+              -i "$identity" \
+              ''${dst_port:+-p $dst_port} \
+              "$dst_user@$dst_host" \
+              -T "$with_dst_path_lock_script"
+        }
+      '';
+      pull = ''
+        identity=${shell.escape plan.dst.host.ssh.privkey.path}
+        src_user=root
+        src_host=$(${fastest-address plan.src.host})
+        src_port=$(${network-ssh-port plan.src.host "$src_host"})
+        src_path=${shell.escape plan.src.path}
+        src=$src_user@$src_host:$src_path
+        dst_path=${shell.escape plan.dst.path}
+        dst=$dst_path
+        echo "update snapshot: current; $dst <- $src" >&2
+        dst_shell() {
+          eval "$with_dst_path_lock_script"
+        }
+      '';
+    }}
+    # Note that this only works because we trust date +%s to produce output
+    # that doesn't need quoting when used to generate a command string.
+    # TODO relax this requirement by selectively allowing to inject variables
+    #   e.g.: ''${shell.quote "exec env NOW=''${shell.unquote "$NOW"} ..."}
+    with_dst_path_lock_script="exec env start_date=$(date +%s) "${shell.escape
+      "flock -n ${shell.escape plan.dst.path} /bin/sh"
+    }
+    rsync >&2 \
+        -aAXF --delete \
+        -e "ssh -F /dev/null -i $identity ''${dst_port:+-p $dst_port}" \
+        --rsync-path ${shell.escape (concatStringsSep " && " [
+          "mkdir -m 0700 -p ${shell.escape plan.dst.path}/current"
+          "exec flock -n ${shell.escape plan.dst.path} rsync"
+        ])} \
+        --link-dest="$dst_path/current" \
+        "$src/" \
+        "$dst/.partial"
+    dst_shell < ${toFile "backup.${plan.name}.take-snapshots" ''
       set -efu
-      dst=${shell.escape plan.dst.path}
-
-      mkdir -m 0700 -p "$dst"
-      exec flock -n "$dst" ${critical-section}
-    '';
+      : $start_date
 
-    critical-section = writeDash "backup.${plan.name}.pull.critical-section" ''
-      # TODO check if there is a previous
-      set -efu
-      identity=${shell.escape plan.dst.host.ssh.privkey.path}
-      src=${shell.escape "root@${getFQDN plan.src.host}:${plan.src.path}"}
       dst=${shell.escape plan.dst.path}
 
-      # Export NOW so runtime of rsync doesn't influence snapshot naming.
-      export NOW
-      NOW=$(date +%s)
-
-      echo >&2 "update snapshot: current; $dst <- $src"
-      mkdir -m 0700 -p ${shell.escape plan.dst.path}
-      rsync >&2 \
-          -aAXF --delete \
-          -e "ssh -F /dev/null -i $identity" \
-          --link-dest="$dst/current" \
-          "$src/" \
-          "$dst/.partial"
       mv "$dst/current" "$dst/.previous"
       mv "$dst/.partial" "$dst/current"
       rm -fR "$dst/.previous"
       echo >&2
 
-      exec ${take-snapshots plan}
-    '';
-  in out;
-
-  take-snapshots = plan: writeDash "backup.${plan.name}.take-snapshots" ''
-    set -efu
-    NOW=''${NOW-$(date +%s)}
-    dst=${shell.escape plan.dst.path}
-
-    snapshot() {(
-      : $ns $format $retain
-      name=$(date --date="@$NOW" +"$format")
-      if ! test -e "$dst/$ns/$name"; then
-        echo >&2 "create snapshot: $ns/$name"
-        mkdir -m 0700 -p "$dst/$ns"
-        rsync >&2 \
-            -aAXF --delete \
-            --link-dest="$dst/current" \
-            "$dst/current/" \
-            "$dst/$ns/.partial.$name"
-        mv "$dst/$ns/.partial.$name" "$dst/$ns/$name"
-        echo >&2
-      fi
-      case $retain in
-        ([0-9]*)
-          delete_from=$(($retain + 1))
-          ls -r "$dst/$ns" \
-            | sed -n "$delete_from,\$p" \
-            | while read old_name; do
-                echo >&2 "delete snapshot: $ns/$old_name"
-                rm -fR "$dst/$ns/$old_name"
-              done
-          ;;
-        (ALL)
-          :
-          ;;
-      esac
-    )}
-
-    ${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain ? null, ... }:
-      toString (map shell.escape [
-        "ns=${ns}"
-        "format=${format}"
-        "retain=${if retain == null then "ALL" else toString retain}"
-        "snapshot"
-      ]))
-      plan.snapshots)}
+      snapshot() {(
+        : $ns $format $retain
+        name=$(date --date="@$start_date" +"$format")
+        if ! test -e "$dst/$ns/$name"; then
+          echo >&2 "create snapshot: $ns/$name"
+          mkdir -m 0700 -p "$dst/$ns"
+          rsync >&2 \
+              -aAXF --delete \
+              --link-dest="$dst/current" \
+              "$dst/current/" \
+              "$dst/$ns/.partial.$name"
+          mv "$dst/$ns/.partial.$name" "$dst/$ns/$name"
+          echo >&2
+        fi
+        case $retain in
+          ([0-9]*)
+            delete_from=$(($retain + 1))
+            ls -r "$dst/$ns" \
+              | sed -n "$delete_from,\$p" \
+              | while read old_name; do
+                  echo >&2 "delete snapshot: $ns/$old_name"
+                  rm -fR "$dst/$ns/$old_name"
+                done
+            ;;
+          (ALL)
+            :
+            ;;
+        esac
+      )}
+
+      ${concatStringsSep "\n" (mapAttrsToList (ns: { format, retain, ... }:
+        toString (map shell.escape [
+          "ns=${ns}"
+          "format=${format}"
+          "retain=${if retain == null then "ALL" else toString retain}"
+          "snapshot"
+        ]))
+        plan.snapshots)}
+    ''}
   '';
 
-  # TODO getFQDN: admit hosts in other domains
-  getFQDN = host: "${host.name}.${config.krebs.search-domain}";
-
-  writeDash = name: text: pkgs.writeScript name ''
-    #! ${pkgs.dash}/bin/dash
-    ${text}
+  # XXX Is one ping enough to determine fastest address?
+  fastest-address = host: ''
+    { ${pkgs.fping}/bin/fping </dev/null -a \
+        ${concatMapStringsSep " " shell.escape
+          (mapAttrsToList (_: net: head net.aliases) host.nets)} \
+      | ${pkgs.coreutils}/bin/head -1; }
   '';
 
-  writeDashBin = name: text: pkgs.writeTextFile {
-    executable = true;
-    destination = "/bin/${name}";
-    name = name;
-    text = ''
-      #! ${pkgs.dash}/bin/dash
-      ${text}
-    '';
-  };
+  # Note that we don't escape word on purpose, so we can deref shell vars.
+  # TODO type word
+  network-ssh-port = host: word: ''
+    case ${word} in
+    ${concatStringsSep ";;\n" (mapAttrsToList
+      (_: net: "(${head net.aliases}) echo ${toString net.ssh.port}")
+      host.nets)};;
+    esac
+  '';
 
 in out
 # TODO ionice
diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix
index e74841205..9e777a5ef 100644
--- a/krebs/3modules/bepasty-server.nix
+++ b/krebs/3modules/bepasty-server.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   gunicorn = pkgs.pythonPackages.gunicorn;
   bepasty = pkgs.pythonPackages.bepasty-server;
@@ -10,8 +10,8 @@ let
 
   out = {
     options.krebs.bepasty = api;
-    config = mkIf cfg.enable (mkMerge [
-      (mkIf cfg.serveNginx nginx-imp)
+    config = lib.mkIf cfg.enable (lib.mkMerge [
+      (lib.mkIf cfg.serveNginx nginx-imp)
       imp
     ]);
   };
diff --git a/krebs/3modules/build.nix b/krebs/3modules/build.nix
index 0da5dd38a..a1f446188 100644
--- a/krebs/3modules/build.nix
+++ b/krebs/3modules/build.nix
@@ -1,10 +1,8 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
-  target = config.krebs.build // { user.name = "root"; };
-
   out = {
     # TODO deprecate krebs.build.host
     options.krebs.build.host = mkOption {
@@ -17,12 +15,6 @@ let
       default = "/nix/var/nix/profiles/system";
     };
 
-    # TODO make krebs.build.target.host :: host
-    options.krebs.build.target = mkOption {
-      type = with types; nullOr str;
-      default = null;
-    };
-
     # TODO deprecate krebs.build.user
     options.krebs.build.user = mkOption {
       type = types.user;
@@ -59,6 +51,7 @@ let
         source = config.krebs.build.source;
         target-user = maybeEnv "target_user" "root";
         target-host = maybeEnv "target_host" config.krebs.build.host.name;
+        target-port = maybeEnv "target_port" "22";
         target-path = maybeEnv "target_path" "/var/src";
         out = ''
           #! /bin/sh
@@ -70,7 +63,8 @@ let
           }
 
           echo ${shell.escape git-script} \
-            | ssh ${shell.escape "${target-user}@${target-host}"} -T
+            | ssh -p ${shell.escape target-port} \
+                  ${shell.escape "${target-user}@${target-host}"} -T
 
           unset tmpdir
           trap '
@@ -101,6 +95,7 @@ let
                     (attrNames file-specs)} \
                   --delete \
                   -vFrlptD \
+                  -e ${shell.escape "ssh -p ${target-port}"} \
                   ${shell.escape target-path}/ \
                   ${shell.escape "${target-user}@${target-host}:${target-path}"}
         '';
diff --git a/krebs/3modules/buildbot/master.nix b/krebs/3modules/buildbot/master.nix
index 74385a433..825cb3413 100644
--- a/krebs/3modules/buildbot/master.nix
+++ b/krebs/3modules/buildbot/master.nix
@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   buildbot = pkgs.buildbot;
   buildbot-master-config = pkgs.writeText "buildbot-master.cfg" ''
@@ -381,5 +381,5 @@ let
 in
 {
   options.krebs.buildbot.master = api;
-  config = mkIf cfg.enable imp;
+  config = lib.mkIf cfg.enable imp;
 }
diff --git a/krebs/3modules/buildbot/slave.nix b/krebs/3modules/buildbot/slave.nix
index 0e7796d8a..7705ac31c 100644
--- a/krebs/3modules/buildbot/slave.nix
+++ b/krebs/3modules/buildbot/slave.nix
@@ -1,6 +1,6 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   buildbot-slave-init = pkgs.writeText "buildbot-slave.tac" ''
     import os
@@ -182,5 +182,5 @@ let
 in
 {
   options.krebs.buildbot.slave = api;
-  config = mkIf cfg.enable imp;
+  config = lib.mkIf cfg.enable imp;
 }
diff --git a/krebs/3modules/current.nix b/krebs/3modules/current.nix
index 41941e289..9f63e33ac 100644
--- a/krebs/3modules/current.nix
+++ b/krebs/3modules/current.nix
@@ -1,13 +1,13 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.current;
 
   out = {
     options.krebs.current = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index b1e0ef156..16a74e7c1 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs;
 
@@ -9,9 +9,9 @@ let
       ./apt-cacher-ng.nix
       ./backup.nix
       ./bepasty-server.nix
-      ./build.nix
       ./buildbot/master.nix
       ./buildbot/slave.nix
+      ./build.nix
       ./current.nix
       ./exim-retiolum.nix
       ./exim-smarthost.nix
@@ -20,17 +20,20 @@ let
       ./git.nix
       ./go.nix
       ./iptables.nix
+      ./lib.nix
       ./nginx.nix
+      ./nixpkgs.nix
       ./per-user.nix
       ./Reaktor.nix
-      ./retiolum-bootstrap.nix
       ./realwallpaper.nix
+      ./retiolum-bootstrap.nix
       ./retiolum.nix
+      ./setuid.nix
       ./tinc_graphs.nix
       ./urlwatch.nix
     ];
     options.krebs = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
@@ -81,13 +84,13 @@ let
     };
   };
 
-  imp = mkMerge [
-    { krebs = import ./lass { inherit lib; }; }
-    { krebs = import ./makefu { inherit lib; }; }
-    { krebs = import ./miefda { inherit lib; }; }
-    { krebs = import ./mv { inherit lib; }; }
-    { krebs = import ./shared { inherit lib; }; }
-    { krebs = import ./tv { inherit lib; }; }
+  imp = lib.mkMerge [
+    { krebs = import ./lass   { inherit config lib; }; }
+    { krebs = import ./makefu { inherit config lib; }; }
+    { krebs = import ./miefda { inherit config lib; }; }
+    { krebs = import ./mv     { inherit config lib; }; }
+    { krebs = import ./shared { inherit config lib; }; }
+    { krebs = import ./tv     { inherit config lib; }; }
     {
       krebs.dns.providers = {
         de.krebsco = "zones";
@@ -156,7 +159,16 @@ let
         let inherit (config.krebs.build.host.ssh) privkey; in
         mkIf (privkey != null) (mkForce [privkey]);
 
+      # TODO use imports for merging
       services.openssh.knownHosts =
+        (let inherit (config.krebs.build.host.ssh) pubkey; in
+          optionalAttrs (pubkey != null) {
+            localhost = {
+              hostNames = ["localhost" "127.0.0.1" "::1"];
+              publicKey = pubkey;
+            };
+          })
+        //
         # GitHub's IPv4 address range is 192.30.252.0/22
         # Refs https://help.github.com/articles/what-ip-addresses-does-github-use-that-i-should-whitelist/
         # 192.30.252.0/22 = 192.30.252.0-192.30.255.255 (1024 addresses)
@@ -180,7 +192,6 @@ let
                 (mapAttrsToList
                   (net-name: net:
                     let
-                      aliases = shorts ++ longs;
                       longs = net.aliases;
                       shorts =
                         map (removeSuffix ".${cfg.search-domain}")
@@ -191,7 +202,7 @@ let
                           then "[${a}]:${toString net.ssh.port}"
                           else a;
                     in
-                    aliases ++ map add-port net.addrs)
+                    map add-port (shorts ++ longs ++ net.addrs))
                   host.nets);
 
             publicKey = host.ssh.pubkey;
diff --git a/krebs/3modules/exim-retiolum.nix b/krebs/3modules/exim-retiolum.nix
index ea012c38c..1722eef1f 100644
--- a/krebs/3modules/exim-retiolum.nix
+++ b/krebs/3modules/exim-retiolum.nix
@@ -1,12 +1,12 @@
 { config, pkgs, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.exim-retiolum;
 
   out = {
     options.krebs.exim-retiolum = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/exim-smarthost.nix b/krebs/3modules/exim-smarthost.nix
index a564430ea..267ee2900 100644
--- a/krebs/3modules/exim-smarthost.nix
+++ b/krebs/3modules/exim-smarthost.nix
@@ -1,13 +1,12 @@
 { config, pkgs, lib, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.exim-smarthost;
 
   out = {
     options.krebs.exim-smarthost = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/fetchWallpaper.nix b/krebs/3modules/fetchWallpaper.nix
index f320c7505..53fe0839d 100644
--- a/krebs/3modules/fetchWallpaper.nix
+++ b/krebs/3modules/fetchWallpaper.nix
@@ -1,21 +1,17 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.fetchWallpaper;
 
   out = {
     options.krebs.fetchWallpaper = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
     enable = mkEnableOption "fetch wallpaper";
-    predicate = mkOption {
-      type = with types; nullOr path;
-      default = null;
-    };
     url = mkOption {
       type = types.str;
     };
@@ -33,16 +29,20 @@ let
       type = types.str;
       default = ":11";
     };
+    unitConfig = mkOption {
+      type = types.attrsOf types.str;
+      description = "Extra unit configuration for fetchWallpaper to define conditions and assertions for the unit";
+      example = literalExample ''
+        # do not start when running on umts
+        { ConditionPathExists = "!/var/run/ppp0.pid"; }
+      '';
+      default = {};
+    };
   };
 
   fetchWallpaperScript = pkgs.writeScript "fetchWallpaper" ''
     #! ${pkgs.bash}/bin/bash
-    ${optionalString (cfg.predicate != null) ''
-      if ! ${cfg.predicate}; then
-        echo "predicate failed - will not fetch from remote"
-        exit 0
-      fi
-    ''}
+
     mkdir -p ${shell.escape cfg.stateDir}
     curl -s -o ${shell.escape cfg.stateDir}/wallpaper -z ${shell.escape cfg.stateDir}/wallpaper ${shell.escape cfg.url}
     feh --no-fehbg --bg-scale ${shell.escape cfg.stateDir}/wallpaper
@@ -76,7 +76,6 @@ let
         URL = cfg.url;
         DISPLAY = cfg.display;
       };
-
       restartIfChanged = true;
 
       serviceConfig = {
@@ -84,6 +83,8 @@ let
         ExecStart = fetchWallpaperScript;
         User = "fetchWallpaper";
       };
+
+      unitConfig = cfg.unitConfig;
     };
   };
 in out
diff --git a/krebs/3modules/git.nix b/krebs/3modules/git.nix
index 11cf21b5f..a9542718d 100644
--- a/krebs/3modules/git.nix
+++ b/krebs/3modules/git.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 # TODO unify logging of shell scripts to user and journal
 # TODO move all scripts to ${etcDir}, so ControlMaster connections
@@ -6,13 +6,13 @@
 # TODO when authorized_keys changes, then restart ssh
 #       (or kill already connected users somehow)
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.git;
 
   out = {
     options.krebs.git = api;
-    config = mkIf cfg.enable (mkMerge [
+    config = with lib; mkIf cfg.enable (mkMerge [
       (mkIf cfg.cgit cgit-imp)
       git-imp
     ]);
@@ -86,7 +86,7 @@ let
         singleton {
           user = [ config.krebs.users.tv ];
           repo = [ testing ]; # see literal example of repos
-          perm = push "refs/*" (with lib.git; [
+          perm = push "refs/*" (with config.krebs.lib.git; [
             non-fast-forward create delete merge
           ]);
         }
diff --git a/krebs/3modules/github-hosts-sync.nix b/krebs/3modules/github-hosts-sync.nix
index 2aa18d53a..1d3873232 100644
--- a/krebs/3modules/github-hosts-sync.nix
+++ b/krebs/3modules/github-hosts-sync.nix
@@ -1,12 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.github-hosts-sync;
 
   out = {
     options.krebs.github-hosts-sync = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/go.nix b/krebs/3modules/go.nix
index 08a93dab7..52a104bb9 100644
--- a/krebs/3modules/go.nix
+++ b/krebs/3modules/go.nix
@@ -1,13 +1,13 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.go;
 
   out = {
     options.krebs.go = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/lass/default.nix b/krebs/3modules/lass/default.nix
index 9f22018a8..41a609105 100644
--- a/krebs/3modules/lass/default.nix
+++ b/krebs/3modules/lass/default.nix
@@ -1,12 +1,11 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
-  hosts = addNames {
+  hosts = {
     dishfire = {
       cores = 4;
-      dc = "lass"; #dc = "cac";
       nets = rec {
         internet = {
           addrs4 = ["144.76.172.188"];
@@ -38,7 +37,6 @@ with lib;
     };
     echelon = {
       cores = 2;
-      dc = "lass"; #dc = "cac";
       nets = rec {
         internet = {
           addrs4 = ["162.252.241.33"];
@@ -72,7 +70,6 @@ with lib;
     };
     prism = {
       cores = 4;
-      dc = "lass"; #dc = "cac";
       nets = rec {
         internet = {
           addrs4 = ["213.239.205.240"];
@@ -104,7 +101,6 @@ with lib;
       ssh.pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQChm4sqQ2bUZj+2YnTf6G5HHRTpSe1jTUhJRnwcYPYZKF+CBqBncipRpuGlGXEsptNa+7ZMcQC0ySsz5SUOMt3Ih+NehVe/qt3VtRz0l0MgOWmH2qBwKK9Y4IuxrJQzUmP4UGlOGlFj9DORssSMOyFIG4eZ9k2qMn3xal0NVRfGTShKlouWsiUILZ8I+sDNE00z8DAYesgc1yazvRnjzvLkRxdNdpYiAFBbmXMpPKK95McRJaWsuNSeal9kd5p5PagWcgN4DZ6+ebzz3NKnmzk4j+vuHX0U9lTXBqKMlzzmM2YNLRtDPfrtJNyHqLpZUpFhJKqZCD+4/0zdrzRfC7Th+5czzUCSvHiKPVsqw5eOdiQX6EyzNAF5zpkpRp//QdUNNXC5/Ku6GKCO491+TuA8VCha0fOwBONccTLUI/hGNmCh88mLbukVoeGJrbYNCOA/6kEz7ZLEveU4i+TT7okhDElMsNk+AWCZ8/NdJQNX3/K6+JJ9qAn+/yC8LdjgYYJ2oU/aw5/HyOgiQ0z4n9UfQ7j+nHysY9CQb1b3guX7yjJoc3KpNXCXEztuIRHjFD1EP8NRTSmGjsa/VjLmTLSsqjD+7IE5mT0tO5RJvmagDgdJSr/iR5D9zjW7hx7ttvektrlp9g0v3CiCFVaW4l95hGYT0HaNBLJ5R0YHm0lD+Q==";
     };
     fastpoke = {
-      dc = "lass";
       nets = rec {
         internet = {
           addrs4 = ["193.22.164.36"];
@@ -135,7 +131,6 @@ with lib;
     };
     cloudkrebs = {
       cores = 1;
-      dc = "lass"; #dc = "cac";
       nets = rec {
         internet = {
           addrs4 = ["104.167.113.104"];
@@ -168,7 +163,6 @@ with lib;
     };
     uriel = {
       cores = 1;
-      dc = "lass";
       nets = {
         gg23 = {
           addrs4 = ["10.23.1.12"];
@@ -199,7 +193,6 @@ with lib;
     };
     mors = {
       cores = 2;
-      dc = "lass";
       nets = {
         gg23 = {
           addrs4 = ["10.23.1.11"];
@@ -230,7 +223,6 @@ with lib;
     };
     helios = {
       cores = 2;
-      dc = "lass";
       nets = {
         retiolum = {
           addrs4 = ["10.243.0.3"];
@@ -257,16 +249,16 @@ with lib;
     };
 
   };
-  users = addNames {
+  users = {
     lass = {
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAp83zynhIueJJsWlSEykVSBrrgBFKq38+vT8bRfa+csqyjZBl2SQFuCPo+Qbh49mwchpZRshBa9jQEIGqmXxv/PYdfBFQuOFgyUq9ZcTZUXqeynicg/SyOYFW86iiqYralIAkuGPfQ4howLPVyjTZtWeEeeEttom6p6LMY5Aumjz2em0FG0n9rRFY2fBzrdYAgk9C0N6ojCs/Gzknk9SGntA96MDqHJ1HXWFMfmwOLCnxtE5TY30MqSmkrJb7Fsejwjoqoe9Y/mCaR0LpG2cStC1+37GbHJNH0caCMaQCX8qdfgMVbWTVeFWtV6aWOaRgwLrPDYn4cHWQJqTfhtPrNQ== lass@mors";
       mail = "lass@mors.retiolum";
     };
-    lass_uriel = {
+    lass-uriel = {
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDExWuRcltGM2FqXO695nm6/QY3wU3r1bDTyCpMrLfUSym7TxcXDSmZSWcueexPXV6GENuUfjJPZswOdWqIo5u2AXw9t0aGvwEDmI6uJ7K5nzQOsXIneGMdYuoOaAzWI8pxZ4N+lIP1HsOYttIPDp8RwU6kyG+Ud8mnVHWSTO13C7xC9vePnDP6b+44nHS691Zj3X/Cq35Ls0ISC3EM17jreucdP62L3TKk2R4NCm3Sjqj+OYEv0LAqIpgqSw5FypTYQgNByxRcIcNDlri63Q1yVftUP1338UiUfxtraUu6cqa2CdsHQmtX5mTNWEluVWO3uUKTz9zla3rShC+d3qvr lass@uriel";
       mail = "lass@uriel.retiolum";
     };
-    lass_helios = {
+    lass-helios = {
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDBOnMtgy5GH6R6tHp2ugy5QTe3gAGxh2CKsstSNSNAJwvWGiaWJkbNmgM8KlCWeq1GJBGa95kU4I2BDO5fJd7J9vqyrTGF1+sx0Nwj/ELKSNVxDoKVYiU09pTqSB3pi46i+E8N49y4/8aRhu4/7O2dSTH7OS3YoZpt2Soas+cYJYhQdZtYQAgPX5LOkTfQvPhGR8AzrrTvOUrHyTWaSBEELVZ088LrFT6ibXHcPhwXX7A5+YMS8LLr3KRstySWzJEmfVOJxuMhQJSH1Xiq4bLilVn9V4AK5pCOnlALSYf48SexsCqzBUKgISuncurIBbXtW9EkNTMX3jSKlSQ7WniGRlmzrBAJCh4VXJUZgXDf8hAaPckIRbLosbTnEAauWcfnIXLfvI+bYkURhfYKsWelM+MS6ihk+P2yr8rNT9w5iUVJGVypOXUp45PrFuPn6ayCpNRJzqPwCCPE7fFagzLs7wibIXlrhCnRALT5HHyExFFcQoGvIq/8o+Oia8mrTimb55IDLwkiYrG6I5DPXFPKsTC0hium9T3I8dC+M7n9GbwnLTUK2kWnoklD3HTab21xJTtbF98nQ94df7doqPFxL/jongeZCGMB+PJ+BdQTtHr7tCY0kN2GXpoHxz/2w8YEWTKHhWIUsD+Utf8pDkKQfCqlm7iR7byxL51gHL9Z3Q== lass@helios";
       mail = "lass@helios.retiolum";
     };
diff --git a/krebs/3modules/lib.nix b/krebs/3modules/lib.nix
new file mode 100644
index 000000000..b19f275b5
--- /dev/null
+++ b/krebs/3modules/lib.nix
@@ -0,0 +1,15 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  out = {
+    options.krebs.lib = api;
+    config = imp;
+  };
+  api = mkOption {
+    default = {};
+    type = types.attrs;
+  };
+  imp = {
+    krebs.lib = lib // import ../4lib { inherit lib; } // builtins;
+  };
+in out
diff --git a/krebs/3modules/makefu/default.nix b/krebs/3modules/makefu/default.nix
index 38e773b53..ca83d6906 100644
--- a/krebs/3modules/makefu/default.nix
+++ b/krebs/3modules/makefu/default.nix
@@ -1,12 +1,11 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
-  hosts = addNames {
+  hosts = {
     pnp = {
       cores = 1;
-      dc = "makefu"; #vm on 'omo'
       nets = {
         retiolum = {
           addrs4 = ["10.243.0.210"];
@@ -30,7 +29,6 @@ with lib;
     };
     tsp = {
       cores = 1;
-      dc = "makefu"; #x200
       nets = {
         retiolum = {
           addrs4 = ["10.243.0.212"];
@@ -58,7 +56,6 @@ with lib;
     };
     pornocauster = {
       cores = 2;
-      dc = "makefu"; #x220
       nets = {
         retiolum = {
           addrs4 = ["10.243.0.91"];
@@ -90,7 +87,6 @@ with lib;
 
     vbob = {
       cores = 2;
-      dc = "makefu"; #vm local
       nets = {
         retiolum = {
           addrs4 = ["10.243.1.91"];
@@ -116,7 +112,6 @@ with lib;
     };
     flap = rec {
       cores = 1;
-      dc = "cac"; #vps
 
       extraZones = {
         "krebsco.de" = ''
@@ -152,7 +147,6 @@ with lib;
     };
     pigstarter = rec {
       cores = 1;
-      dc = "frontrange"; #vps
 
       extraZones = {
         "krebsco.de" = ''
@@ -191,7 +185,6 @@ with lib;
     };
     wry = rec {
       cores = 1;
-      dc = "makefu"; #dc = "cac";
       extraZones = {
         "krebsco.de" = ''
           euer           IN A  ${head nets.internet.addrs4}
@@ -248,7 +241,6 @@ with lib;
     };
     filepimp = rec {
       cores = 1;
-      dc = "makefu"; #nas
 
       nets = {
         retiolum = {
@@ -273,7 +265,6 @@ with lib;
 
     omo = rec {
       cores = 2;
-      dc = "makefu"; #AMD E350
 
       nets = {
         retiolum = {
@@ -299,11 +290,10 @@ with lib;
     };
     wbob = rec {
       cores = 1;
-      dc = "none";
       nets = {
         retiolm = {
-          addrs4 = ["10.243.214.15/32"];
-          addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732/128"];
+          addrs4 = ["10.243.214.15"];
+          addrs6 = ["42:5a02:2c30:c1b1:3f2e:7c19:2496:a732"];
           aliases = [
               "wbob.retiolum"
           ];
@@ -323,7 +313,6 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
 
     gum = rec {
       cores = 1;
-      dc = "online.net"; #root-server
 
       extraZones = {
         "krebsco.de" = ''
@@ -364,7 +353,7 @@ TNs2RYfwDy/r6H/hDeB/BSngPouedEVcPwIDAQAB
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcxWFEPzke/Sdd9qNX6rSJgXal8NmINYajpFCxXfYdj root@gum";
     };
   };
-  users = addNames rec {
+  users = rec {
     makefu = {
       mail = "makefu@pornocauster.retiolum";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCl3RTOHd5DLiVeUbUr/GSiKoRWknXQnbkIf+uNiFO+XxiqZVojPlumQUVhasY8UzDzj9tSDruUKXpjut50FhIO5UFAgsBeMJyoZbgY/+R+QKU00Q19+IiUtxeFol/9dCO+F4o937MC0OpAC10LbOXN/9SYIXueYk3pJxIycXwUqhYmyEqtDdVh9Rx32LBVqlBoXRHpNGPLiswV2qNe0b5p919IGcslzf1XoUzfE3a3yjk/XbWh/59xnl4V7Oe7+iQheFxOT6rFA30WYwEygs5As//ZYtxvnn0gA02gOnXJsNjOW9irlxOUeP7IOU6Ye3WRKFRR0+7PS+w8IJLag2xb makefu@pornocauster";
diff --git a/krebs/3modules/miefda/default.nix b/krebs/3modules/miefda/default.nix
index 8ecf898c5..6587ad92d 100644
--- a/krebs/3modules/miefda/default.nix
+++ b/krebs/3modules/miefda/default.nix
@@ -1,12 +1,11 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
-  hosts = addNames {
+  hosts = {
     bobby = {
       cores = 4;
-      dc = "miefda";
       nets = {
         retiolum = {
           addrs4 = ["10.243.111.112"];
@@ -31,7 +30,7 @@ with lib;
       #ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
     };
   };
-  users = addNames {
+  users = {
     miefda = {
       mail = "miefda@miefda.de";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCVdNCks6mrItKHYIwgW3s+NINFhHqZtLPj3l6TJUWd93ZSuuI6P+Z/0m0G9Z4tWWaXWsOCnzMA2WOKcitBbLcaQxVypJfvmfoA5CVlh4/nf8NfvbMFkVIYPehxR7YoejfKOxPOCNC3248RiD8kqa4/5IF8qdqE+mRQUIZJXvN0jZZ+rGnYo5Z544O9JqsV+VjjOgK0Fchpxf/lC8dnBucIce7gUwi5npwsGQZgSDmRobBRFVDZag1abLFNZN2faI8uqzSlU6KRRapYV266Of7j3kmDokMan4szjP1EexmTWm+arwRiz9p0M5oKs6zofez0mOyF5ux02NB3XIhbJc8CfMjeA7PmSg4ZhghjlSjIOR+1mMIDiDVi6PNLw5atzvpyfYtpf5sWpdIpXCS0lyzIgasqW4gbAiWoFPv5A0mw0QI6UqlxQ8Pdm6R7P6yQxyknrxnvFGMQPiqgl21ssSNA9A+YRd4j0nATntzOeD1bxTZkyU4FtW++0hg3Ph6HiHLfPd9w70wPr7b0RITVnBcN2ZqIO+5NIqQYU801FCNXsTuBh0ueTsVTGJYySUGkmkHyH5spLYdr1Z5w+4W+HgbxPk40pyZJ18S0umL49igxR9NsniucFy1/jqqi0TiDIsHx6vsawFT1F2rq9ZtGaRcJL6Yfz0p+uZC5rc/nI+mMlQ== miefda@nixos";
diff --git a/krebs/3modules/mv/default.nix b/krebs/3modules/mv/default.nix
index 6da2abc85..33f941aae 100644
--- a/krebs/3modules/mv/default.nix
+++ b/krebs/3modules/mv/default.nix
@@ -1,12 +1,11 @@
-{ lib, ... }:
+{ config, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
-  hosts = addNames {
+  hosts = {
     stro = {
       cores = 4;
-      dc = "mv";
       nets = {
         retiolum = {
           addrs4 = ["10.243.111.111"];
@@ -31,8 +30,8 @@ with lib;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM+7Qa51l0NSkBiaK2s8vQEoeObV3UPZyEzMxfUK/ZAO root@stro";
     };
   };
-  users = addNames {
-    mv_stro = {
+  users = {
+    mv-stro = {
       mail = "mv@stro.retiolum";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxM34g1GUm5EtU00DAOlGSx8MsCWunhGTrozurj460QT7EdUbZvj0AcrQC0lP9kaZyhX+KueTjmLC+ICsnlHYeg4zoSEnSAUkccuyZxfgynVc4wrpfNAc1nHjDhDb/ulnC+8wNxvxUpI0XlBgu/Y7AbbChZj3ofv6uGGHJKfG3uSyCkt9VTCi1KwydHpe9P252N8NbopnbnkT0EMkRHruh7ICEKr4/ivmUL/IUrbFicEeCy4SeRAl8+00x4WqqvbBPzgdXn0AIjKLvus3dBoQubJNpUoXnyXJbElnit5a7QcgZJNLMbV0kf9zzCGduxkADzHkAFB9D4PuSMYt62iy12QlGbm80A9ncuwaSyJf7hPTvNbU8VyCblyfRz/SCaudUrfk5Xbxxu26FHi4hZqr3IUQt4T8pD8JWYGl4n2ZKnD8hHz/jrmNBK8h9d+VFafU9t1hRxlFsW1AhMEM+kfWClyhfTcKBKbml2a657lgUEVmlZt+18kwwsivM1QhHNTgxn5urRXRkh1VQ40UQroVuV1OUmvAngyAthF441VPGc5z7kEI+D4qjmUjSy6k4dvEy/RGfsAgJCf63zilRuUbL68f2OpxE8aeZZUXPvgdLml284pry7+C5sjlnCDoJfCj/yhdVx6mU9pWUd/Q97CLQewbsYhMzsqlBlIkXuipkDQ== mv@stro";
     };
diff --git a/krebs/3modules/nginx.nix b/krebs/3modules/nginx.nix
index 921771033..7b7163071 100644
--- a/krebs/3modules/nginx.nix
+++ b/krebs/3modules/nginx.nix
@@ -1,13 +1,12 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.nginx;
 
   out = {
     options.krebs.nginx = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
@@ -34,6 +33,7 @@ let
         };
         locations = mkOption {
           type = with types; listOf (attrsOf str);
+          default = [];
         };
         extraConfig = mkOption {
           type = with types; string;
@@ -76,8 +76,8 @@ let
     server {
       ${concatMapStringsSep "\n" (x: "listen ${x};") listen}
       server_name ${toString server-names};
-      ${extraConfig}
-      ${indent (concatStrings (map to-location locations))}
+      ${indent extraConfig}
+      ${indent (concatMapStrings to-location locations)}
     }
   '';
 
diff --git a/krebs/3modules/nixpkgs.nix b/krebs/3modules/nixpkgs.nix
new file mode 100644
index 000000000..5816b8a30
--- /dev/null
+++ b/krebs/3modules/nixpkgs.nix
@@ -0,0 +1,43 @@
+{ config, lib, pkgs, ... }:
+with config.krebs.lib;
+let
+  cfg = config.krebs.nixpkgs;
+
+  out = {
+    options.krebs.nixpkgs = api;
+    config = lib.mkIf cfg.enable imp;
+  };
+
+  api = {
+    enable = mkEnableOption "krebs.nixpkgs" // { default = true; };
+
+    allowUnfreePredicate = mkOption {
+      description = ''
+        This option is similar to `nixpkgs.config.allowUnfreePredicate'
+        but can be defined in several modules.  An unfree package will be
+        allowed if any of the defined predicates returns true.
+      '';
+      type = types.nullOr (mkOptionType {
+        name = "Predicate";
+        check = isFunction;
+        merge = _locs: defs: pkg: let
+          evalPredicateDef = def: let
+            allow = def.value pkg;
+          in if cfg.verbose && allow
+            then trace "unfree ‘${pkg.name}’ allowed in ${def.file}" allow
+            else allow;
+        in any evalPredicateDef defs;
+      });
+      default = null;
+    };
+
+    verbose = mkOption {
+      type = types.bool;
+      default = false;
+    };
+  };
+
+  imp = lib.mkIf (cfg.allowUnfreePredicate != null) {
+    nixpkgs.config.allowUnfreePredicate = cfg.allowUnfreePredicate;
+  };
+in out
diff --git a/krebs/3modules/per-user.nix b/krebs/3modules/per-user.nix
index ee213deda..13da5c4c3 100644
--- a/krebs/3modules/per-user.nix
+++ b/krebs/3modules/per-user.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.krebs.per-user;
diff --git a/krebs/3modules/realwallpaper.nix b/krebs/3modules/realwallpaper.nix
index b377368f7..df374e184 100644
--- a/krebs/3modules/realwallpaper.nix
+++ b/krebs/3modules/realwallpaper.nix
@@ -1,12 +1,12 @@
-arg@{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.realwallpaper;
 
   out = {
     options.krebs.realwallpaper = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix
index 65bb51193..40382d098 100644
--- a/krebs/3modules/retiolum-bootstrap.nix
+++ b/krebs/3modules/retiolum-bootstrap.nix
@@ -1,12 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.retiolum-bootstrap;
 
   out = {
     options.krebs.retiolum-bootstrap = api;
-    config = mkIf cfg.enable imp ;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/3modules/retiolum.nix b/krebs/3modules/retiolum.nix
index 2bf8aa5db..d0162eae9 100644
--- a/krebs/3modules/retiolum.nix
+++ b/krebs/3modules/retiolum.nix
@@ -1,11 +1,11 @@
 { config, pkgs, lib, ... }:
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.retiolum;
 
   out = {
     options.krebs.retiolum = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
@@ -58,9 +58,38 @@ let
       default =
         filterAttrs (_: h: hasAttr cfg.netname h.nets) config.krebs.hosts;
       description = ''
-        Hosts which should be part of the tinc configuration.
-        Note that these hosts must have a correspondingly named network
-        configured, see <literal>config.krebs.retiolum.netname</literal>.
+        Hosts to generate <literal>config.krebs.retiolum.hostsPackage</literal>.
+        Note that these hosts must have a network named
+        <literal>config.krebs.retiolum.netname</literal>.
+      '';
+    };
+
+    hostsPackage = mkOption {
+      type = types.package;
+      default = pkgs.stdenv.mkDerivation {
+        name = "${cfg.netname}-tinc-hosts";
+        phases = [ "installPhase" ];
+        installPhase = ''
+          mkdir $out
+          ${concatStrings (mapAttrsToList (_: host: ''
+            echo ${shell.escape host.nets.${cfg.netname}.tinc.config} \
+              > $out/${shell.escape host.name}
+          '') cfg.hosts)}
+        '';
+      };
+      description = ''
+        Package of tinc host configuration files.  By default, a package will
+        be generated from <literal>config.krebs.retiolum.hosts</literal>.  This
+        option's main purpose is to expose the generated hosts package to other
+        modules, like <literal>config.krebs.tinc_graphs</literal>.  But it can
+        also be used to provide a custom hosts directory.
+      '';
+      example = literalExample ''
+        (pkgs.stdenv.mkDerivation {
+          name = "my-tinc-hosts";
+          src = /home/tv/my-tinc-hosts;
+          installPhase = "cp -R . $out";
+        })
       '';
     };
 
@@ -130,18 +159,6 @@ let
 
   tinc = cfg.tincPackage;
 
-  tinc-hosts = pkgs.stdenv.mkDerivation {
-    name = "${cfg.netname}-tinc-hosts";
-    phases = [ "installPhase" ];
-    installPhase = ''
-      mkdir $out
-      ${concatStrings (mapAttrsToList (_: host: ''
-        echo ${shell.escape host.nets.${cfg.netname}.tinc.config} \
-          > $out/${shell.escape host.name}
-      '') cfg.hosts)}
-    '';
-  };
-
   iproute = cfg.iproutePackage;
 
   confDir = pkgs.runCommand "retiolum" {
@@ -153,7 +170,7 @@ let
 
     mkdir -p $out
 
-    ln -s ${tinc-hosts} $out/hosts
+    ln -s ${cfg.hostsPackage} $out/hosts
 
     cat > $out/tinc.conf <<EOF
     Name = ${cfg.name}
diff --git a/krebs/3modules/setuid.nix b/krebs/3modules/setuid.nix
new file mode 100644
index 000000000..1137788d8
--- /dev/null
+++ b/krebs/3modules/setuid.nix
@@ -0,0 +1,75 @@
+{ config, pkgs, lib, ... }:
+with config.krebs.lib;
+let
+  cfg = config.krebs.setuid;
+
+  out = {
+    options.krebs.setuid = api;
+    config = imp;
+  };
+
+  api = mkOption {
+    default = {};
+    type = let
+      # TODO make wrapperDir configurable
+      inherit (config.security) wrapperDir;
+      inherit (config.users) groups users;
+    in types.attrsOf (types.submodule ({ config, ... }: {
+      options = {
+        name = mkOption {
+          type = types.filename;
+          default = config._module.args.name;
+        };
+        filename = mkOption {
+          type = mkOptionType {
+            # TODO unyuck string and merge with toC
+            name = "derivation or string";
+            check = x:
+              isDerivation x ||
+              isString x;
+          };
+          apply = toString;
+        };
+        owner = mkOption {
+          default = "root";
+          type = types.enum (attrNames users);
+        };
+        group = mkOption {
+          default = "root";
+          type = types.enum (attrNames groups);
+        };
+        mode = mkOption {
+          default = "4710";
+          type = mkOptionType {
+            # TODO admit symbolic mode
+            name = "octal mode";
+            check = x:
+              isString x &&
+              match "[0-7][0-7][0-7][0-7]" x != null;
+          };
+        };
+        activate = mkOption {
+          type = types.str;
+          visible = false;
+          readOnly = true;
+        };
+      };
+      config.activate = let
+        src = pkgs.execve config.name {
+          inherit (config) filename;
+        };
+        dst = "${wrapperDir}/${config.name}";
+      in ''
+        cp ${src} ${dst}
+        chown ${config.owner}.${config.group} ${dst}
+        chmod ${config.mode} ${dst}
+      '';
+    }));
+  };
+
+  imp = {
+    system.activationScripts."krebs.setuid" = stringAfter [ "setuid" ]
+      (concatMapStringsSep "\n" (getAttr "activate") (attrValues cfg));
+  };
+
+in out
diff --git a/krebs/3modules/shared/default.nix b/krebs/3modules/shared/default.nix
index 91d92857b..208b596f8 100644
--- a/krebs/3modules/shared/default.nix
+++ b/krebs/3modules/shared/default.nix
@@ -1,9 +1,8 @@
-{ lib, ... }:
-
-with lib;
+{ config, ... }:
 
+with config.krebs.lib;
 let
-  testHosts = lib.genAttrs [
+  testHosts = genAttrs [
     "test-arch"
     "test-centos6"
     "test-centos7"
@@ -32,9 +31,8 @@ let
     };
   });
 in {
-  hosts = addNames {
+  hosts = {
     wolf = {
-      dc = "shack";
       nets = {
         shack = {
           addrs4 = [ "10.42.2.150" ];
@@ -68,7 +66,7 @@ in {
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKYMXMWZIK0jjnZDM9INiYAKcwjXs2241vew54K8veCR";
     };
   } // testHosts;
-  users = addNames {
+  users = {
     shared = {
       mail = "spam@krebsco.de";
       pubkey = "lol"; # TODO krebs.users.shared.pubkey should be unnecessary
diff --git a/krebs/3modules/tinc_graphs.nix b/krebs/3modules/tinc_graphs.nix
index 1f32c2e59..2692de982 100644
--- a/krebs/3modules/tinc_graphs.nix
+++ b/krebs/3modules/tinc_graphs.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.tinc_graphs;
   internal_dir = "${cfg.workingDir}/internal";
@@ -8,7 +8,7 @@ let
 
   out = {
     options.krebs.tinc_graphs = api;
-    config = mkIf cfg.enable imp ;
+    config = lib.mkIf cfg.enable imp ;
   };
 
   api = {
@@ -85,7 +85,7 @@ let
         EXTERNAL_FOLDER = external_dir;
         INTERNAL_FOLDER = internal_dir;
         GEODB = cfg.geodbPath;
-        TINC_HOSTPATH=config.krebs.retiolum.hosts;
+        TINC_HOSTPATH = config.krebs.retiolum.hostsPackage;
       };
 
       restartIfChanged = true;
diff --git a/krebs/3modules/tv/default.nix b/krebs/3modules/tv/default.nix
index 9adb0ce11..f8d3d8671 100644
--- a/krebs/3modules/tv/default.nix
+++ b/krebs/3modules/tv/default.nix
@@ -1,15 +1,14 @@
-{ lib, ... }:
+{ config, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   dns.providers = {
     de.viljetic = "regfish";
   };
-  hosts = addNames {
+  hosts = {
     cd = rec {
       cores = 2;
-      dc = "tv"; #dc = "cac";
       extraZones = {
         # TODO generate krebsco.de zone from nets and don't use extraZones at all
         "krebsco.de" = ''
@@ -65,7 +64,6 @@ with lib;
     };
     mkdir = rec {
       cores = 1;
-      dc = "tv"; #dc = "cac";
       nets = rec {
         internet = {
           addrs4 = ["104.167.114.142"];
@@ -172,7 +170,7 @@ with lib;
     mu = {
       nets = {
         retiolum = {
-          addrs4 = ["10.243.20.01"];
+          addrs4 = ["10.243.20.1"];
           addrs6 = ["42:0:0:0:0:0:0:2001"];
           aliases = [
             "mu.r"
@@ -193,11 +191,11 @@ with lib;
     };
     nomic = {
       cores = 2;
-      dc = "tv"; #dc = "gg23";
       nets = rec {
         gg23 = {
           addrs4 = ["10.23.1.110"];
           aliases = ["nomic.gg23"];
+          ssh.port = 11423;
         };
         retiolum = {
           addrs4 = ["10.243.0.110"];
@@ -234,7 +232,6 @@ with lib;
     };
     rmdir = rec {
       cores = 1;
-      dc = "tv"; #dc = "cac";
       nets = rec {
         internet = {
           addrs4 = ["167.88.34.182"];
@@ -286,12 +283,11 @@ with lib;
     };
     wu = {
       cores = 4;
-      # TODO wu is mobile, so dc means "home data center"
-      dc = "tv"; #dc = "gg23";
       nets = {
         gg23 = {
           addrs4 = ["10.23.1.37"];
           aliases = ["wu.gg23"];
+          ssh.port = 11423;
         };
         retiolum = {
           addrs4 = ["10.243.13.37"];
@@ -320,12 +316,11 @@ with lib;
     };
     xu = {
       cores = 4;
-      # TODO xu is mobile, so dc means "home data center"
-      dc = "tv"; #dc = "gg23";
       nets = {
         gg23 = {
           addrs4 = ["10.23.1.38"];
           aliases = ["xu.gg23"];
+          ssh.port = 11423;
         };
         retiolum = {
           addrs4 = ["10.243.13.38"];
@@ -351,7 +346,7 @@ with lib;
       ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnjfceKuHNQu7S4eYFN1FqgzMqiL7haNZMh2ZLhvuhK root@xu";
     };
   };
-  users = addNames rec {
+  users = rec {
     mv = {
       mail = "mv@cd.retiolum";
       pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod";
@@ -360,11 +355,11 @@ with lib;
       mail = "tv@wu.retiolum";
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDFR//RnCvEZAt0F6ExDsatKZ/DDdifanuSL360mqOhaFieKI34RoOwfQT9T+Ga52Vh5V2La6esvlph686EdgzeKLvDoxEwFM9ZYFBcMrNzu4bMTlgE7YUYw5JiORyXNfznBGnme6qpuvx9ibYhUyiZo99kM8ys5YrUHrP2JXQJMezDFZHxT4GFMOuSdh/1daGoKKD6hYL/jEHX8CI4E3BSmKK6ygYr1fVX0K0Tv77lIi5mLXucjR7CytWYWYnhM6DC3Hxpv2zRkPgf3k0x/Y1hrw3V/r0Me5h90pd2C8pFaWA2ZoUT/fmyVqvx1tZPYToU/O2dMItY0zgx2kR0yD+6g7Aahz3R+KlXkV8k5c8bbTbfGnZWDR1ZlbLRM9Yt5vosfwapUD90MmVkpmR3wUkO2sUKi80QfC7b4KvSDXQ+MImbGxMaU5Bnsq1PqLN95q+uat3nlAVBAELkcx51FlE9CaIS65y4J7FEDg8BE5JeuCNshh62VSYRXVSFt8bk3f/TFGgzC8OIo14BhVmiRQQ503Z1sROyf5xLX2a/EJavMm1i2Bs2TH6ROKY9z5Pz8hT5US0r381V8oG7TZyLF9HTtoy3wCYsgWA5EmLanjAsVU2YEeAA0rxzdtYP8Y2okFiJ6u+M4HQZ3Wg3peSodyp3vxdYce2vk4EKeqEFuuS82850DYb7Et7fmp+wQQUT8Q/bMO0DreWjHoMM5lE4LJ4ME6AxksmMiFtfo/4Fe2q9D+LAqZ+ANOcv9M+8Rn6ngiYmuRNd0l/a02q1PEvO6vTfXgcl4f7Z1IULHPEaDNZHCJS1K5RXYFqYQ6OHsTmOm7hnwaRAS97+VFMo1i5uvTx9nYaAcY7yzq3Ckfb67dMBKApGOpJpkvPgfrP7bgBO5rOZXM1opXqVPb09nljAhhAhyCTh1e/8+mJrBo0cLQ/LupQzVxGDgm3awSMPxsZAN45PSWz76zzxdDa1MMo51do+VJHfs7Wl0NcXAQrniOBYL9Wqt0qNkn1gY5smkkISGeQ/vxNap4MmzeZE7b5fpOy+2fpcRVQLpc4nooQzJvSVTFz+25lgZ6iHf45K87gQFMIAri1Pf/EDDpL87az+bRWvWi+BA2kMe1kf+Ay1LyMz8r+g51H0ma0bNFh6+fbWMfUiD9JCepIObclnUJ4NlWfcgHxTf17d/4tl6z4DTcLpCCk8Da77JouSHgvtcRbRlFV1OfhWZLXUsrlfpaQTiItv6TGIr3k7+7b66o3Qw/GQVs5GmYifaIZIz8n8my4XjkaMBd0SZfBzzvFjHMq6YUP9+SbjvReqofuoO+5tW1wTYZXitFFBfwuHlXm6w77K5QDBW6olT7pat41/F5eGxLcz tv@wu";
     };
-    tv_nomic = {
+    tv-nomic = {
       inherit (tv) mail;
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3dYR/n4Yw8OsYmfR2rSUG7o10G6AqOlSJHuHSEmANbMkqjiWl1TnpORtt5bAktyAGI4vWf9vhNEnxuIqGXWSV+3yCd7yfBHR1m0Y9QSw6blQ0xc1venl3JU0kpEyJfUn8a9cdXlnRiS0MP1gcsN7Zk8cqBELJYJajkSEnsT4eVaU5/wdnyzUO1fk8D8tFBJbF/tsWDLJPu4P18rpxq4wZgA2qmyHoVDEVlrz2OYcziXT6gpG0JGnToteaNg9ok5QavEYFpp8P+k1AacrBjc1PAb4MaMX1nfkSyaZwSqLdH35XkNRgPhVVmqZ5PlG3VeNpPSwpdcKi8P3zH1xG9g6Usx1SAyvcoAyGHdOwmFuA2tc1HgYEiQ+OsPrHZHujBOOZsKTN9+IZHScCAe+UmUcK413WEZKPs8PeFjf1gQAoDXb55JpksxLAnC/SQOl4FhkctIAXxr12ALlyt9UFPzIoj/Nj2MpFzGSlf653fTFmnMbQ8+GICc4TUpqx5GELZhfQuprBTv/55a9zKvM4B8XT3Bn9olQzMQIXEjXb3WUVFDDNWeNydToorYn1wG3ZWQ+3f0IlqRicWO7Q9BRj1Lp5rcUCb+naJ48tGY6HFUZ1Kz/0x458GDFvUd8mCJjqqmeSkUEeZd0xet5tVFg/bYoSslEqPF6pz7V3ruJMSdYxnQ== tv@nomic #2";
     };
-    tv_xu = {
+    tv-xu = {
       inherit (tv) mail;
       pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/3nkqxe8YrDVt615n96A7iC3vvwsiqgpsBYC/bhwfBHu1bAtBmTWVqSKDIdwg7p8TQpIKtAgZ3IJT3BlrnVTeR4RIviLjHjYWW1NBhm+nXi+heThgi5fLciE3lVLVsy5X9Kc1ZPLgLa1In0REOanwbueOD0ESN1yKIDwUUdczw/o3dLDMzanqFHKuSSN4o9Ex2x+MRj9eLsb706s4VSYMo3lirRCJeAOGv1C7Xg1cuepdhIeJsq9aF7vSy15c0nCkWwr8zdY7pbMPYCe5zvIEymZ0UowZ5HQ3NmIZnYDxa4E1PFjDczHdQbVmmGMI80grNwMsHzQ6bynHSPXDoLf4WodXlhS0+9Ju5QavDT6uqZ9uhDBuWC8QNgWUMIJnEaTBFyA0OI1akl8Q2RLC+qnNf5IwItSq+GDwEsB2ZJNW3kOk1kNiCUrBafRYpPaFeP97wzzP4uYlBKAr2SOLrrkf7NFEdw2ihxhDMNnps/ErRJ8U0zdpmalw8mItGyqRULpHjk/wN00rYOdBIhW3G3QJuVgtGnWtGCBG5x70EfMiSEXPD3YSsVVsgKD+v8qr+YiilRRD+N3gaHhiOWA6HgxRNul/P4llk0ktTpb9LoHk2+oooTH5ZuuT/8yF8J4stZt7EIOH+mSOAXG1z0BwnEkQu7pVKwu/oOZpGJTvBrGwww== tv@xu";
     };
diff --git a/krebs/3modules/urlwatch.nix b/krebs/3modules/urlwatch.nix
index 7a9fb55fd..cd4976a21 100644
--- a/krebs/3modules/urlwatch.nix
+++ b/krebs/3modules/urlwatch.nix
@@ -5,14 +5,14 @@
 # cache = url: "${cfg.dataDir}/.urlwatch/cache/${hashString "sha1" url}"
 # TODO hooks.py
 
-with lib;
+with config.krebs.lib;
 let
   cfg = config.krebs.urlwatch;
 
   # TODO assert sendmail's existence
   out = {
     options.krebs.urlwatch = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index 4d7e0b549..d5b6d03ac 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -26,11 +26,15 @@ let out = rec {
   shell = import ./shell.nix { inherit lib; };
   tree = import ./tree.nix { inherit lib; };
 
-  toC = x: {
+  toC = x: let
+    type = typeOf x;
+    reject = throw "cannot convert ${type}";
+  in {
     list = "{ ${concatStringsSep ", " (map toC x)} }";
     null = "NULL";
+    set = if isDerivation x then toJSON x else reject;
     string = toJSON x; # close enough
-  }.${typeOf x};
+  }.${type} or reject;
 
   subdirsOf = path:
     mapAttrs (name: _: path + "/${name}")
diff --git a/krebs/4lib/infest/install-nix.sh b/krebs/4lib/infest/install-nix.sh
deleted file mode 100644
index af1a8bd16..000000000
--- a/krebs/4lib/infest/install-nix.sh
+++ /dev/null
@@ -1,50 +0,0 @@
-#! /bin/sh
-set -efu
-
-nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
-nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
-
-install_nix() {(
-
-  # install nix on host (cf. https://nixos.org/nix/install)
-  if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
-    (
-      verify() {
-        printf '%s  %s\n' $nix_sha256  $(basename $nix_url) | sha256sum -c
-      }
-      if ! verify; then
-        curl -C - -O "$nix_url"
-        verify
-      fi
-    )
-    nix_src_dir=$(basename $nix_url .tar.bz2)
-    tar jxf $nix_src_dir.tar.bz2
-    $nix_src_dir/install
-  fi
-
-  . /root/.nix-profile/etc/profile.d/nix.sh
-
-  for i in \
-    bash \
-    coreutils \
-    # This line intentionally left blank.
-  do
-    if ! nix-env -q $i | grep -q .; then
-      nix-env -iA nixpkgs.pkgs.$i
-    fi
-  done
-
-  # install nixos-install
-  if ! type nixos-install 2>/dev/null; then
-    nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
-    nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
-    nix-env \
-      --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
-      --arg pkgs "$nixpkgs_expr" \
-      --arg modulesPath 'throw "no modulesPath"' \
-      -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
-      -iA config.system.build.nixos-install
-  fi
-)}
-
-install_nix "$@"
diff --git a/krebs/4lib/infest/prepare.sh b/krebs/4lib/infest/prepare.sh
index 0bfc49380..b3824c7d4 100644
--- a/krebs/4lib/infest/prepare.sh
+++ b/krebs/4lib/infest/prepare.sh
@@ -1,6 +1,9 @@
 #! /bin/sh
 set -efu
 
+nix_url=https://nixos.org/releases/nix/nix-1.10/nix-1.10-x86_64-linux.tar.bz2
+nix_sha256=504f7a3a85fceffb8766ae5e1005de9e02e489742f5a63cc3e7552120b138bf4
+
 prepare() {(
   if test -e /etc/os-release; then
     . /etc/os-release
@@ -33,6 +36,13 @@ prepare() {(
             ;;
         esac
         ;;
+      nixos)
+        case $(cat /proc/cmdline) in
+          *' root=LABEL=NIXOS_ISO '*)
+            prepare_nixos_iso "$@"
+            exit
+        esac
+        ;;
     esac
   elif test -e /etc/centos-release; then
     case $(cat /etc/centos-release) in
@@ -70,7 +80,25 @@ prepare_debian() {
   prepare_common
 }
 
-prepare_common() {
+prepare_nixos_iso() {
+  mountpoint /mnt
+
+  type git 2>/dev/null || nix-env -iA nixos.git
+
+  mkdir -p /mnt/"$target_path"
+  mkdir -p "$target_path"
+
+  if ! mountpoint "$target_path"; then
+    mount --rbind /mnt/"$target_path" "$target_path"
+  fi
+
+  mkdir -p bin
+  rm -f bin/nixos-install
+  cp "$(type -p nixos-install)" bin/nixos-install
+  sed -i "s@^NIX_PATH=\"[^\"]*\"@NIX_PATH=$target_path@" bin/nixos-install
+}
+
+prepare_common() {(
 
   if ! getent group nixbld >/dev/null; then
     groupadd -g 30000 -r nixbld
@@ -133,6 +161,50 @@ prepare_common() {
     mkdir -p /mnt/nix
     mount --bind /nix /mnt/nix
   fi
-}
+
+  #
+  # install nix
+  #
+
+  # install nix on host (cf. https://nixos.org/nix/install)
+  if ! test -e /root/.nix-profile/etc/profile.d/nix.sh; then
+    (
+      verify() {
+        printf '%s  %s\n' $nix_sha256  $(basename $nix_url) | sha256sum -c
+      }
+      if ! verify; then
+        curl -C - -O "$nix_url"
+        verify
+      fi
+    )
+    nix_src_dir=$(basename $nix_url .tar.bz2)
+    tar jxf $nix_src_dir.tar.bz2
+    $nix_src_dir/install
+  fi
+
+  . /root/.nix-profile/etc/profile.d/nix.sh
+
+  for i in \
+    bash \
+    coreutils \
+    # This line intentionally left blank.
+  do
+    if ! nix-env -q $i | grep -q .; then
+      nix-env -iA nixpkgs.pkgs.$i
+    fi
+  done
+
+  # install nixos-install
+  if ! type nixos-install 2>/dev/null; then
+    nixpkgs_expr='import <nixpkgs> { system = builtins.currentSystem; }'
+    nixpkgs_path=$(find /nix/store -mindepth 1 -maxdepth 1 -name *-nixpkgs-* -type d)
+    nix-env \
+      --arg config "{ nix.package = ($nixpkgs_expr).nix; }" \
+      --arg pkgs "$nixpkgs_expr" \
+      --arg modulesPath 'throw "no modulesPath"' \
+      -f $nixpkgs_path/nixpkgs/nixos/modules/installer/tools/tools.nix \
+      -iA config.system.build.nixos-install
+  fi
+)}
 
 prepare "$@"
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 6c396a132..d0a537467 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -10,15 +10,14 @@ types // rec {
     options = {
       name = mkOption {
         type = label;
-      };
-      dc = mkOption {
-        type = label;
+        default = config._module.args.name;
       };
       cores = mkOption {
         type = positive;
       };
       nets = mkOption {
         type = attrsOf net;
+        default = {};
       };
 
       extraZones = mkOption {
@@ -155,26 +154,25 @@ types // rec {
       merge = mergeOneOption;
     };
 
-  user = submodule {
+  user = submodule ({ config, ... }: {
     options = {
       mail = mkOption {
         type = str; # TODO retiolum mail address
       };
       name = mkOption {
-        type = str; # TODO
+        type = username;
+        default = config._module.args.name;
       };
       pubkey = mkOption {
         type = str;
       };
     };
-  };
+  });
 
   # TODO
   addr = str;
   addr4 = str;
   addr6 = str;
-  hostname = str;
-  label = str;
 
   krebs.file-location = types.submodule {
     options = {
@@ -192,4 +190,36 @@ types // rec {
       };
     };
   };
+
+  # RFC952, B. Lexical grammar, <hname>
+  hostname = mkOptionType {
+    name = "hostname";
+    check = x: all label.check (splitString "." x);
+    merge = mergeOneOption;
+  };
+
+  # RFC952, B. Lexical grammar, <name>
+  # RFC1123, 2.1  Host Names and Numbers
+  label = mkOptionType {
+    name = "label";
+    # TODO case-insensitive labels
+    check = x: match "[0-9A-Za-z]([0-9A-Za-z-]*[0-9A-Za-z])?" x != null;
+    merge = mergeOneOption;
+  };
+
+  # POSIX.1‐2013, 3.278 Portable Filename Character Set
+  filename = mkOptionType {
+    name = "POSIX filename";
+    check = let
+      filename-chars = stringToCharacters
+        "-.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    in s: all (flip elem filename-chars) (stringToCharacters s);
+    merge = mergeOneOption;
+  };
+
+  # POSIX.1-2013, 3.431 User Name
+  username = mkOptionType {
+    name = "POSIX username";
+    check = s: filename.check s && substring 0 1 s != "-";
+  };
 }
diff --git a/krebs/5pkgs/builders.nix b/krebs/5pkgs/builders.nix
new file mode 100644
index 000000000..fa51857ba
--- /dev/null
+++ b/krebs/5pkgs/builders.nix
@@ -0,0 +1,62 @@
+{ config, lib, pkgs, ... }:
+with config.krebs.lib;
+rec {
+  execve = name: { filename, argv ? null, envp ? {}, destination ? "" }: let
+  in writeC name { inherit destination; } ''
+    #include <unistd.h>
+
+    static char *const filename = ${toC filename};
+
+    ${if argv == null
+      then /* Propagate arguments */ ''
+        #define MAIN_ARGS int argc, char **argv
+      ''
+      else /* Provide fixed arguments */ ''
+        #define MAIN_ARGS void
+        static char *const argv[] = ${toC (argv ++ [null])};
+      ''}
+
+    static char *const envp[] = ${toC (
+      mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
+    )};
+
+    int main (MAIN_ARGS) {
+      execve(filename, argv, envp);
+      return -1;
+    }
+  '';
+
+  execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; });
+
+  writeC = name: { destination ? "" }: src: pkgs.runCommand name {} ''
+    PATH=${makeSearchPath "bin" (with pkgs; [
+      binutils
+      coreutils
+      gcc
+    ])}
+    src=${pkgs.writeText "${name}.c" src}
+    exe=$out${destination}
+    mkdir -p "$(dirname "$exe")"
+    gcc -O -Wall -o "$exe" $src
+    strip --strip-unneeded "$exe"
+  '';
+
+  writeDash = name: text: pkgs.writeScript name ''
+    #! ${pkgs.dash}/bin/dash
+    ${text}
+  '';
+
+  writeDashBin = name: text: pkgs.writeTextFile {
+    executable = true;
+    destination = "/bin/${name}";
+    name = name;
+    text = ''
+      #! ${pkgs.dash}/bin/dash
+      ${text}
+    '';
+  };
+
+  writeNixFromCabal = name: path: pkgs.runCommand name {} ''
+    ${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out
+  '';
+}
diff --git a/krebs/5pkgs/cac-api/default.nix b/krebs/5pkgs/cac-api/default.nix
index 9ab6ac8b2..30c0168f3 100644
--- a/krebs/5pkgs/cac-api/default.nix
+++ b/krebs/5pkgs/cac-api/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, bc, cac-cert, coreutils, curl, dash, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }:
+{ stdenv, fetchgit, bc, cac-cert, coreutils, curl, dash, gnugrep, gnused, inotifyTools, jq, ncurses, openssh, sshpass, ... }:
 
 stdenv.mkDerivation {
   name = "cac-api-1.1.0";
@@ -22,6 +22,7 @@ stdenv.mkDerivation {
       bc
       coreutils
       curl
+      gnugrep
       gnused
       inotifyTools
       jq
diff --git a/krebs/5pkgs/default.nix b/krebs/5pkgs/default.nix
index c4b1dafe4..d395fe00a 100644
--- a/krebs/5pkgs/default.nix
+++ b/krebs/5pkgs/default.nix
@@ -1,67 +1,33 @@
-{ lib, pkgs, ... }:
-
-with lib;
-let
-  subdirs = mapAttrs (_: flip pkgs.callPackage {}) (subdirsOf ./.);
-  pkgs' = pkgs // subdirs;
-in
-
-subdirs // rec {
-
-  haskellPackages = pkgs.haskellPackages.override {
-    overrides = self: super:
-      mapAttrs (name: path: self.callPackage path {})
-        (mapAttrs'
-          (name: type:
-            if hasSuffix ".nix" name
-              then {
-                name = removeSuffix ".nix" name;
-                value = ./haskell-overrides + "/${name}";
-              }
-              else null)
-          (builtins.readDir ./haskell-overrides));
-  };
-
-  push = pkgs'.callPackage ./push {
-    inherit (subdirs) get jq;
-  };
-
-  ReaktorPlugins = pkgs.callPackage ./Reaktor/plugins.nix {};
-
-  execve = name: { filename, argv, envp ? {}, destination ? "" }:
-    writeC name { inherit destination; } ''
-      #include <unistd.h>
-      int main () {
-        const char *filename = ${toC filename};
-        char *const argv[] = ${toC (argv ++ [null])};
-        char *const envp[] = ${toC (
-          mapAttrsToList (k: v: "${k}=${v}") envp ++ [null]
-        )};
-        execve(filename, argv, envp);
-        return -1;
-      }
-    '';
-
-  test = {
-    infest-cac-centos7 = pkgs.callPackage ./test/infest-cac-centos7 {};
-  };
-
-  execveBin = name: cfg: execve name (cfg // { destination = "/bin/${name}"; });
-
-  writeC = name: { destination ? "" }: src: pkgs.runCommand name {} ''
-    PATH=${makeSearchPath "bin" (with pkgs; [
-      binutils
-      coreutils
-      gcc
-    ])}
-    src=${pkgs.writeText "${name}.c" src}
-    exe=$out${destination}
-    mkdir -p "$(dirname "$exe")"
-    gcc -O -Wall -o "$exe" $src
-    strip --strip-unneeded "$exe"
-  '';
-
-  writeNixFromCabal = name: path: pkgs.runCommand name {} ''
-    ${pkgs.cabal2nix}/bin/cabal2nix ${path} > $out
-  '';
+{ config, lib, pkgs, ... }@args:
+with config.krebs.lib;
+{
+  nixpkgs.config.packageOverrides = pkgs: {
+    haskellPackages = pkgs.haskellPackages.override {
+      overrides = self: super:
+        mapAttrs (name: path: self.callPackage path {})
+          (mapAttrs'
+            (name: type:
+              if hasSuffix ".nix" name
+                then {
+                  name = removeSuffix ".nix" name;
+                  value = ./haskell-overrides + "/${name}";
+                }
+                else null)
+            (builtins.readDir ./haskell-overrides));
+    };
+
+    push = pkgs.callPackage ./push {
+      inherit (subdirs) get jq;
+    };
+
+    ReaktorPlugins = pkgs.callPackage ./Reaktor/plugins.nix {};
+
+    test = {
+      infest-cac-centos7 = pkgs.callPackage ./test/infest-cac-centos7 {};
+    };
+  }
+  // import ./builders.nix args
+  // mapAttrs (_: flip pkgs.callPackage {})
+              (filterAttrs (_: dir.has-default-nix)
+                           (subdirsOf ./.));
 }
diff --git a/krebs/5pkgs/haskell-overrides/xmonad-stockholm.nix b/krebs/5pkgs/haskell-overrides/xmonad-stockholm.nix
index 096597808..12eab943d 100644
--- a/krebs/5pkgs/haskell-overrides/xmonad-stockholm.nix
+++ b/krebs/5pkgs/haskell-overrides/xmonad-stockholm.nix
@@ -3,11 +3,11 @@
 }:
 mkDerivation {
   pname = "xmonad-stockholm";
-  version = "1.0.0";
+  version = "1.1.0";
   src = fetchgit {
-    url = "http://cgit.cd.krebsco.de/xmonad-stockholm";
-    sha256 = "35dda5d16acc90af94ae2fae10ab5cc2d5b450c3f1ff2e7f515ac53877269abf";
-    rev = "2dbefe42fc5cfe9093465bf3e22ba8f82feeef6e";
+    url = http://cgit.cd.krebsco.de/xmonad-stockholm;
+    rev = "179d29fd4c765dee698058ef63295331ac603639";
+    sha256 = "0c6mj68xsxxr4j8adkzhjszi7bg6cpisrsmqn587a16sblpbrnkj";
   };
   libraryHaskellDepends = [
     base containers X11 X11-xshape xmonad xmonad-contrib
diff --git a/krebs/5pkgs/noVNC/default.nix b/krebs/5pkgs/noVNC/default.nix
new file mode 100644
index 000000000..629d288ae
--- /dev/null
+++ b/krebs/5pkgs/noVNC/default.nix
@@ -0,0 +1,21 @@
+{ fetchgit, lib, stdenv, ... }:
+with builtins;
+with lib;
+stdenv.mkDerivation rec {
+  name = "${baseNameOf src.name}-${removePrefix "refs/tags/v" src.rev}";
+
+  src = fetchgit {
+    url = https://github.com/kanaka/noVNC;
+    rev = "refs/tags/v0.5.1";
+    sha256 = "1azsnppwnrsv3axj0r5bw8lfarkibgz5vhgcyj8dzn4afn98f55w";
+  };
+
+  phases = [
+    "unpackPhase"
+    "installPhase"
+  ];
+
+  installPhase = ''
+    cp -R . $out
+  '';
+}
diff --git a/krebs/5pkgs/posix-array/default.nix b/krebs/5pkgs/posix-array/default.nix
index 456a3cc11..cfcdb29a7 100644
--- a/krebs/5pkgs/posix-array/default.nix
+++ b/krebs/5pkgs/posix-array/default.nix
@@ -1,7 +1,7 @@
-{ stdenv, fetchgit, ... }:
+{ fetchgit, lib, stdenv, ... }:
 
-with stdenv; stdenv.mkDerivation rec {
-  name = "posix-array";
+stdenv.mkDerivation rec {
+  name = "posix-array-${version}";
   version = "1.0.0";
 
   src = fetchgit {
@@ -16,16 +16,15 @@ with stdenv; stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
-    mkdir -p "$out/bin"
+    mkdir -p $out/bin
     cp -a ./array $out/bin
-    rm *
   '';
 
   meta = {
-    description = "Posix-compliant array implementation";
+    description = "POSIX-compliant array implementation";
     url = https://github.com/makefu/array;
-    license = licenses.wtfpl;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ makefu ];
+    license = lib.licenses.wtfpl;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ makefu ];
   };
 }
diff --git a/krebs/5pkgs/repo-sync/default.nix b/krebs/5pkgs/repo-sync/default.nix
new file mode 100644
index 000000000..90f838de9
--- /dev/null
+++ b/krebs/5pkgs/repo-sync/default.nix
@@ -0,0 +1,19 @@
+{ lib, pkgs, python3Packages, fetchurl, ... }:
+with python3Packages; buildPythonPackage rec {
+  name = "repo-sync-${version}";
+  version = "0.1.1";
+  disabled = isPy26 || isPy27;
+  propagatedBuildInputs = [
+    docopt
+    GitPython
+  ];
+  src = fetchurl {
+    url = "https://pypi.python.org/packages/source/r/repo-sync/repo-sync-${version}.tar.gz";
+    sha256 = "01r30l2bbsld90ps13ip0zi2a41b53dv4q6fxrzvkfrprr64c0vv";
+  };
+  meta = {
+    homepage = http://github.com/makefu/repo-sync;
+    description = "Sync remotes to other remotes.";
+    license = lib.licenses.mit;
+  };
+}
diff --git a/krebs/5pkgs/test/infest-cac-centos7/notes b/krebs/5pkgs/test/infest-cac-centos7/notes
index b3beb392f..db80c0c6c 100755
--- a/krebs/5pkgs/test/infest-cac-centos7/notes
+++ b/krebs/5pkgs/test/infest-cac-centos7/notes
@@ -115,7 +115,6 @@ _: {
   users.extraUsers.root.openssh.authorizedKeys.keys = [
     "$(cat ${krebs_ssh}.pub)"
   ];
-  krebs.build.target = "$ip";
 }
 EOF
 
diff --git a/krebs/5pkgs/vncdotool/default.nix b/krebs/5pkgs/vncdotool/default.nix
new file mode 100644
index 000000000..95e2ca706
--- /dev/null
+++ b/krebs/5pkgs/vncdotool/default.nix
@@ -0,0 +1,20 @@
+{ lib, pythonPackages, fetchurl, ... }:
+with pythonPackages; buildPythonPackage rec {
+  name = lib.removeSuffix ".tar.gz" (builtins.baseNameOf src.name);
+
+  src = fetchurl {
+    url = https://pypi.python.org/packages/source/v/vncdotool/vncdotool-0.9.0.tar.gz;
+    sha256 = "1hl44w4x9c8air0g6kp9h1af2vj4lmc50vnsxmca9g080740iyvi";
+  };
+
+  propagatedBuildInputs = [
+    twisted
+    pillow
+  ];
+
+  meta = {
+    homepage = https://github.com/sibson/vncdotool;
+    description = "A command line VNC client and python library";
+    license = lib.licenses.mit;
+  };
+}
diff --git a/krebs/Zhosts/dishfire b/krebs/Zhosts/dishfire
deleted file mode 100644
index c4cf68b6b..000000000
--- a/krebs/Zhosts/dishfire
+++ /dev/null
@@ -1,12 +0,0 @@
-Address = 144.76.172.188
-Subnet = 10.243.133.99
-Subnet = 42:0000:0000:0000:0000:0000:d15f:1233
-
------BEGIN RSA PUBLIC KEY-----
-MIIBCgKCAQEAwKi49fN+0s5Cze6JThM7f7lj4da27PSJ/3w3tDFPvtQco11ksNLs
-Xd3qPaQIgmcNVCR06aexae3bBeTx9y3qHvKqZVE1nCtRlRyqy1LVKSj15J1D7yz7
-uS6u/BSZiCzmdZwu3Fq5qqoK0nfzWe/NKEDWNa5l4Mz/BZQyI/hbOpn6UfFD0LpK
-R4jzc9Dbk/IFNAvwb5yrgEYtwBzlXzeDvHW2JcPq3qQjK2byQYNiIyV3g0GHppEd
-vDbIPDFhTn3Hv5zz/lX+/We8izzRge7MEd+Vn9Jwb5NAzwDsOHl6ExpqASv9H49U
-HwgPw5pstabyrsDWXybSYUb+8LcZf+unGwIDAQAB
------END RSA PUBLIC KEY-----
diff --git a/krebs/Zhosts/helios b/krebs/Zhosts/helios
deleted file mode 100644
index b34b7f180..000000000
--- a/krebs/Zhosts/helios
+++ /dev/null
@@ -1,10 +0,0 @@
-Subnet = 42:0:0:0:0:0:0:7105/128
-Subnet = 10.243.0.3/32
------BEGIN RSA PUBLIC KEY-----
-MIIBCgKCAQEA9SItL2mhQpTl95gjSWRstrDajUnI5YbrVCuaDKfw9gRwMyPNiO/y
-Xwv/w4Ri8NCJZLZGkj2vG3X0EfJFBEPTJPTCbF9fP7PqqVs38BD41txLp+NrFxEq
-5fmFk65/eg8ujrNQoOSUGmky/BKqQhWjvxdAWuwjN933wJCcNCxyaUwljHLYEK/I
-oIJX+spnFmPwmhW9hsOj8K06eHixT13+0W48GG/ZNcV3x5vWxcKUvZ4Qtzz2iMNB
-hud5kae7xMUfFAzCeKF/zsjuyt2d/xQg1WgR8MXGNgYhNJFSXz94r/bivNO6H4vP
-Pfjndnh8cD46ADo8woS1nQ19WId+sMbipwIDAQAB
------END RSA PUBLIC KEY-----
diff --git a/krebs/default.nix b/krebs/default.nix
index 17c035896..93e006f3d 100644
--- a/krebs/default.nix
+++ b/krebs/default.nix
@@ -1,193 +1,8 @@
-assert false;
-
-{ current-host-name
-, current-user-name
-, lib
-, stockholm
-, StrictHostKeyChecking ? "yes"
-}:
-
-let out = {
-    inherit infest;
-    inherit init;
-    inherit nixos-install;
-  };
-
-  infest =
-    { system ? current-host-name
-    , target ? system
-    }@args: let
-      config = get-config system;
-    in ''
-      #! /bin/sh
-      # krebs.infest
-      set -efu
-
-      ${rootssh target ''
-        ${builtins.readFile ./4lib/infest/prepare.sh}
-        ${builtins.readFile ./4lib/infest/install-nix.sh}
-      ''}
-
-      (${nixos-install args})
-
-      ${rootssh target ''
-        ${builtins.readFile ./4lib/infest/finalize.sh}
-      ''}
-    '';
-
-  init =
-    { system ? current-host-name
-    }@args: let
-      config = get-config system;
-    in ''
-      #! /bin/sh
-      # krebs.init
-      set -efu
-
-      system=${lib.shell.escape system}
-      secrets_dir=${config.krebs.build.source.dir.secrets.path}
-      key_type=ed25519
-      key_file=$secrets_dir/ssh.id_$key_type
-      key_comment=$system
-
-      if test -e "$key_file"; then
-        echo "Warning: privkey already exists: $key_file" >&2
-      else
-        ssh-keygen \
-            -C "$key_comment" \
-            -t "$key_type" \
-            -f "$key_file" \
-            -N ""
-        rm "$key_file.pub"
-      fi
-
-      pubkey=$(ssh-keygen -y -f "$key_file")
-
-      cat<<EOF
-      # put following into config.krebs.hosts.$system:
-      ssh.privkey.path = <secrets/ssh.$key_type>;
-      ssh.pubkey = $(echo $pubkey | jq -R .);
-      EOF
-    '';
-
-  nixos-install =
-    { system ? current-host-name
-    , target ? system
-    }@args: let
-    in ''
-      #! /bin/sh
-      # krebs.nixos-install
-      (${populate (args // { root = "/mnt"; })})
-
-      ${rootssh target ''
-        export PATH; PATH=/root/.nix-profile/bin:$PATH
-
-        src=$(type -p nixos-install)
-        cat_src() {
-          sed < "$src" "$(
-            { sed < "$src" -n '
-                  /^if ! test -e "\$mountPoint\/\$NIXOS_CONFIG/,/^fi$/=
-                  /^nixpkgs=/=
-                  /^NIX_PATH=/,/^$/{/./=}
-
-                  # Disable: Copy the NixOS/Nixpkgs sources to the target as
-                  # the initial contents of the NixOS channel.
-                  /^srcs=/,/^ln -sfn /=
-                '
-            } | sed 's:$:s/^/#krebs#/:'
-          )"
-        }
-
-        # Location to insert `nix-install`
-        i=$(sed -n '/^echo "building the system configuration/=' "$src")
-
-        {
-          cat_src | sed -n "1,$i{p}"
-          cat ${doc (nix-install args)}
-          cat_src | sed -n "$i,\''${$i!p}"
-        } > nixos-install
-        chmod +x nixos-install
-
-        # Wrap inserted nix-install into chroot.
-        nix_env=$(cat_src | sed -n '
-          s:.*\(/nix/store/[a-z0-9]*-nix-[0-9.]\+/bin/nix-env\).*:\1:p;T;q
-        ')
-        echo "nix-env is $nix_env" >&2
-        findpkg() {(
-          name=$1
-          path=$(find /nix/store \
-              -mindepth 1 -maxdepth 1 -type d -name '*-'"$name"'-*' \
-            | head -n 1 | sed s:^/mnt::)
-          if echo "$path" | grep .; then
-            echo "$name is $path" >&2
-          else
-            echo "Error: package not found: $name" >&2
-            exit 1
-          fi
-        )}
-        cacert=$(findpkg cacert)
-        coreutils=$(findpkg coreutils)
-        cp "$cacert"/etc/ssl/certs/ca-bundle.crt /mnt/root/SSL_CERT_FILE
-        env="$coreutils/bin/env SSL_CERT_FILE=/root/SSL_CERT_FILE"
-        sed -i '
-          s:^NIX_PATH=:chroot $mountPoint '"$env"' &:
-          s:^nix-env:'"$nix_env"':
-        ' nixos-install
-
-        ./nixos-install
-      ''}
-    '';
-
-  doc = s:
-    let b = "EOF${builtins.hashString "sha256" s}"; in
-    ''
-    <<\${b}
-    ${s}
-    ${b}
-    '';
-
-  get-config = system: let
-    config = stockholm.users.${current-user-name}.${system}.config
-      or (abort "unknown system: ${system}, user: ${current-user-name}");
-  in config;
-
-  nix-install =
-    { system ? current-host-name
-    , target ? system
-    }:
-    let
-      config = get-config system;
-
-      nix-path =
-        lib.concatStringsSep ":"
-          (lib.mapAttrsToList (name: src: "${name}=${src.target-path}")
-            (config.krebs.build.source.dir //
-             config.krebs.build.source.git));
-    in ''
-      set -efu
-      NIX_PATH=${lib.shell.escape nix-path} \
-      nix-env \
-        --show-trace \
-        -f '<stockholm>' \
-        --argstr current-host-name ${lib.shell.escape current-host-name} \
-        --argstr current-user-name ${lib.shell.escape current-user-name} \
-        --profile ${lib.shell.escape config.krebs.build.profile} \
-        --set \
-        -A ${lib.escapeShellArg (lib.concatStringsSep "." [
-              "users"
-              config.krebs.build.user.name
-              config.krebs.build.host.name
-              "system"
-            ])}
-    '';
-
-  rootssh = target: script:
-    let
-      flags = "-o StrictHostKeyChecking=${StrictHostKeyChecking}";
-    in
-    "ssh ${flags} root@${target} -T ${doc ''
-      set -efu
-      ${script}
-    ''}";
-
-in out
+{ config, lib, pkgs, ... }:
+with config.krebs.lib;
+{
+  imports = [
+    ./3modules
+    ./5pkgs
+  ];
+}
diff --git a/lass/1systems/cloudkrebs.nix b/lass/1systems/cloudkrebs.nix
index ab24b584b..98f509050 100644
--- a/lass/1systems/cloudkrebs.nix
+++ b/lass/1systems/cloudkrebs.nix
@@ -7,6 +7,7 @@ let
   ip = (head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
+    ../.
     ../2configs/os-templates/CAC-CentOS-7-64bit.nix
     ../2configs/base.nix
     ../2configs/retiolum.nix
diff --git a/lass/1systems/dishfire.nix b/lass/1systems/dishfire.nix
index cc9836dff..c7d016cd3 100644
--- a/lass/1systems/dishfire.nix
+++ b/lass/1systems/dishfire.nix
@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../.
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     ../2configs/base.nix
     ../2configs/git.nix
diff --git a/lass/1systems/echelon.nix b/lass/1systems/echelon.nix
index 39af4a96f..2ff6dba70 100644
--- a/lass/1systems/echelon.nix
+++ b/lass/1systems/echelon.nix
@@ -7,6 +7,7 @@ let
   ip = (head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
+    ../.
     ../2configs/os-templates/CAC-CentOS-7-64bit.nix
     ../2configs/base.nix
     ../2configs/retiolum.nix
diff --git a/lass/1systems/helios.nix b/lass/1systems/helios.nix
index 4b94e5fd5..0103b6ec0 100644
--- a/lass/1systems/helios.nix
+++ b/lass/1systems/helios.nix
@@ -3,6 +3,7 @@
 with builtins;
 {
   imports = [
+    ../.
     ../2configs/baseX.nix
     ../2configs/browsers.nix
     ../2configs/programs.nix
diff --git a/lass/1systems/mors.nix b/lass/1systems/mors.nix
index 4083e0c2f..e3bb4e487 100644
--- a/lass/1systems/mors.nix
+++ b/lass/1systems/mors.nix
@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../.
     ../2configs/baseX.nix
     ../2configs/programs.nix
     ../2configs/bitcoin.nix
diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix
index 95c55533c..05b3470e5 100644
--- a/lass/1systems/prism.nix
+++ b/lass/1systems/prism.nix
@@ -6,6 +6,7 @@ let
   ip = (head config.krebs.build.host.nets.internet.addrs4);
 in {
   imports = [
+    ../.
     ../2configs/base.nix
     ../2configs/downloading.nix
     ../2configs/git.nix
diff --git a/lass/1systems/uriel.nix b/lass/1systems/uriel.nix
index d53e783d0..0758164f0 100644
--- a/lass/1systems/uriel.nix
+++ b/lass/1systems/uriel.nix
@@ -3,6 +3,7 @@
 with builtins;
 {
   imports = [
+    ../.
     ../2configs/baseX.nix
     ../2configs/browsers.nix
     ../2configs/games.nix
diff --git a/lass/2configs/base.nix b/lass/2configs/base.nix
index 7212698bb..d2c96fdaa 100644
--- a/lass/2configs/base.nix
+++ b/lass/2configs/base.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   imports = [
     ../2configs/vim.nix
@@ -17,8 +17,8 @@ with lib;
         root = {
           openssh.authorizedKeys.keys = [
             config.krebs.users.lass.pubkey
-            config.krebs.users.lass_uriel.pubkey
-            config.krebs.users.lass_helios.pubkey
+            config.krebs.users.lass-uriel.pubkey
+            config.krebs.users.lass-helios.pubkey
           ];
         };
         mainUser = {
@@ -32,7 +32,7 @@ with lib;
           ];
           openssh.authorizedKeys.keys = [
             config.krebs.users.lass.pubkey
-            config.krebs.users.lass_uriel.pubkey
+            config.krebs.users.lass-uriel.pubkey
           ];
         };
       };
@@ -50,12 +50,10 @@ with lib;
       user = config.krebs.users.lass;
       source = mapAttrs (_: mkDefault) ({
         nixos-config = "symlink:stockholm/lass/1systems/${config.krebs.build.host.name}.nix";
-        nixpkgs = symlink:stockholm/nixpkgs;
         secrets = "/home/lass/secrets/${config.krebs.build.host.name}";
         #secrets-common = "/home/lass/secrets/common";
         stockholm = "/home/lass/stockholm";
-        stockholm-user = "symlink:stockholm/lass";
-        upstream-nixpkgs = {
+        nixpkgs = {
           url = https://github.com/Lassulus/nixpkgs;
           rev = "d0e3cca04edd5d1b3d61f188b4a5f61f35cdf1ce";
           dev = "/home/lass/src/nixpkgs";
diff --git a/lass/2configs/downloading.nix b/lass/2configs/downloading.nix
index e80b74007..115cb8b61 100644
--- a/lass/2configs/downloading.nix
+++ b/lass/2configs/downloading.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   rpc-password = import <secrets/transmission-pw.nix>;
diff --git a/lass/2configs/fastpoke-pages.nix b/lass/2configs/fastpoke-pages.nix
index 0470865b6..bf6ea8952 100644
--- a/lass/2configs/fastpoke-pages.nix
+++ b/lass/2configs/fastpoke-pages.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   createStaticPage = domain:
diff --git a/lass/2configs/git.nix b/lass/2configs/git.nix
index cfd1a9952..0aab298c7 100644
--- a/lass/2configs/git.nix
+++ b/lass/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
@@ -71,7 +71,7 @@ let
     with git // config.krebs.users;
     repo:
       singleton {
-        user = [ lass lass_helios lass_uriel ];
+        user = [ lass lass-helios lass-uriel ];
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
diff --git a/lass/2configs/go.nix b/lass/2configs/go.nix
index f4c2ac289..795ad7a26 100644
--- a/lass/2configs/go.nix
+++ b/lass/2configs/go.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   environment.systemPackages = [
     pkgs.go
diff --git a/lass/2configs/teamviewer.nix b/lass/2configs/teamviewer.nix
index 48053d7db..22bfb18d8 100644
--- a/lass/2configs/teamviewer.nix
+++ b/lass/2configs/teamviewer.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   services.teamviewer.enable = true;
 }
diff --git a/lass/2configs/xserver/Xresources.nix b/lass/2configs/xserver/Xresources.nix
index d52418897..e3b0f45dc 100644
--- a/lass/2configs/xserver/Xresources.nix
+++ b/lass/2configs/xserver/Xresources.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   URxvt*scrollBar:                      false
diff --git a/lass/2configs/xserver/default.nix b/lass/2configs/xserver/default.nix
index a7e77553f..203ed0b09 100644
--- a/lass/2configs/xserver/default.nix
+++ b/lass/2configs/xserver/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user
diff --git a/lass/2configs/xserver/xserver.conf.nix b/lass/2configs/xserver/xserver.conf.nix
index e8a997a99..c452b4226 100644
--- a/lass/2configs/xserver/xserver.conf.nix
+++ b/lass/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;
diff --git a/lass/3modules/owncloud_nginx.nix b/lass/3modules/owncloud_nginx.nix
index 79c9de1d4..a10df779e 100644
--- a/lass/3modules/owncloud_nginx.nix
+++ b/lass/3modules/owncloud_nginx.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.owncloud;
diff --git a/lass/3modules/per-user.nix b/lass/3modules/per-user.nix
index 98d6339db..f8d357ce2 100644
--- a/lass/3modules/per-user.nix
+++ b/lass/3modules/per-user.nix
@@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.lass.per-user;
 
diff --git a/lass/3modules/static_nginx.nix b/lass/3modules/static_nginx.nix
index fd5cfdfd7..93441cf0d 100644
--- a/lass/3modules/static_nginx.nix
+++ b/lass/3modules/static_nginx.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.staticPage;
diff --git a/lass/3modules/wordpress_nginx.nix b/lass/3modules/wordpress_nginx.nix
index bfed9e7c6..108054cb6 100644
--- a/lass/3modules/wordpress_nginx.nix
+++ b/lass/3modules/wordpress_nginx.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.lass.wordpress;
diff --git a/lass/5pkgs/default.nix b/lass/5pkgs/default.nix
index 2b9582912..fee4654ae 100644
--- a/lass/5pkgs/default.nix
+++ b/lass/5pkgs/default.nix
@@ -3,15 +3,16 @@
 let
   inherit (pkgs) callPackage;
 in
-
-rec {
-  firefoxPlugins = {
-    noscript = callPackage ./firefoxPlugins/noscript.nix {};
-    ublock = callPackage ./firefoxPlugins/ublock.nix {};
-    vimperator = callPackage ./firefoxPlugins/vimperator.nix {};
+{
+  nixpkgs.config.packageOverrides = rec {
+    firefoxPlugins = {
+      noscript = callPackage ./firefoxPlugins/noscript.nix {};
+      ublock = callPackage ./firefoxPlugins/ublock.nix {};
+      vimperator = callPackage ./firefoxPlugins/vimperator.nix {};
+    };
+    newsbot-js = callPackage ./newsbot-js/default.nix {};
+    xmonad-lass =
+      let src = pkgs.writeNixFromCabal "xmonad-lass.nix" ./xmonad-lass; in
+      pkgs.haskellPackages.callPackage src {};
   };
-  newsbot-js = callPackage ./newsbot-js/default.nix {};
-  xmonad-lass =
-    let src = pkgs.writeNixFromCabal "xmonad-lass.nix" ./xmonad-lass; in
-    pkgs.haskellPackages.callPackage src {};
 }
diff --git a/lass/default.nix b/lass/default.nix
new file mode 100644
index 000000000..69b4abaac
--- /dev/null
+++ b/lass/default.nix
@@ -0,0 +1,7 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./3modules
+  ];
+}
diff --git a/makefu/1systems/filepimp.nix b/makefu/1systems/filepimp.nix
index fb9324ee9..f2c592ea9 100644
--- a/makefu/1systems/filepimp.nix
+++ b/makefu/1systems/filepimp.nix
@@ -11,6 +11,7 @@ let
 in {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/fs/single-partition-ext4.nix
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/smart-monitor.nix
diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix
index c4dfbf4b7..04adc4941 100644
--- a/makefu/1systems/gum.nix
+++ b/makefu/1systems/gum.nix
@@ -1,11 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   external-ip = head config.krebs.build.host.nets.internet.addrs4;
   internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
 in {
   imports = [
+      ../.
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/headless.nix
       ../2configs/fs/simple-swap.nix
@@ -26,7 +27,6 @@ in {
   nixpkgs.config.packageOverrides = pkgs: { tinc = pkgs.tinc_pre; };
 
   ###### stable
-  krebs.build.target = "root@gum.krebsco.de";
   krebs.build.host = config.krebs.hosts.gum;
   krebs.retiolum.extraConfig = ''
     ListenAddress = ${external-ip} 53
diff --git a/makefu/1systems/omo.nix b/makefu/1systems/omo.nix
index 34d5a394d..6cff35e9d 100644
--- a/makefu/1systems/omo.nix
+++ b/makefu/1systems/omo.nix
@@ -20,6 +20,7 @@ let
 in {
   imports =
     [
+      ../.
       # TODO: unlock home partition via ssh
       ../2configs/fs/single-partition-ext4.nix
       ../2configs/tinc-basic-retiolum.nix
diff --git a/makefu/1systems/pnp.nix b/makefu/1systems/pnp.nix
index 51c124bbe..8791ad1d7 100644
--- a/makefu/1systems/pnp.nix
+++ b/makefu/1systems/pnp.nix
@@ -6,6 +6,7 @@
 {
   imports =
     [
+      ../.
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/headless.nix
       ../../krebs/3modules/Reaktor.nix
diff --git a/makefu/1systems/pornocauster.nix b/makefu/1systems/pornocauster.nix
index d7fa8edc5..b2cf0be79 100644
--- a/makefu/1systems/pornocauster.nix
+++ b/makefu/1systems/pornocauster.nix
@@ -6,6 +6,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/main-laptop.nix #< base-gui + zsh
 
       # Krebs
@@ -18,7 +19,6 @@
       ../2configs/exim-retiolum.nix
       ../2configs/mail-client.nix
       ../2configs/printer.nix
-      #../2configs/virtualization.nix
       ../2configs/virtualization.nix
       ../2configs/virtualization-virtualbox.nix
       ../2configs/wwan.nix
@@ -35,33 +35,13 @@
       # ../2configs/mediawiki.nix
       #../2configs/wordpress.nix
     ];
-  hardware.sane.enable = true;
-  hardware.sane.extraBackends = [ pkgs.samsungUnifiedLinuxDriver ];
+
   nixpkgs.config.packageOverrides = pkgs: {
     tinc = pkgs.tinc_pre;
   };
 
-  krebs.Reaktor = {
-    enable = false;
-    nickname = "makefu|r";
-    plugins = with pkgs.ReaktorPlugins; [ nixos-version random-emoji ];
-  };
-
-  # nix.binaryCaches = [ "http://acng.shack/nixos" "https://cache.nixos.org" ];
-
-  environment.systemPackages = with pkgs;[
-    get
-    virtmanager
-    gnome3.dconf
-    krebspaste
-    ];
-
-  services.logind.extraConfig = "HandleLidSwitch=ignore";
   # configure pulseAudio to provide a HDMI sink as well
-  hardware.pulseaudio.configFile = pkgs.writeText "pulse-default-pa" ''
-    ${builtins.readFile "${config.hardware.pulseaudio.package}/etc/pulse/default.pa"}
-    load-module module-alsa-sink device=hw:0,3 sink_properties=device.description="HDMIOutput" sink_name="HDMI"'';
-  networking.firewall.enable = false;
+  networking.firewall.enable = true;
   networking.firewall.allowedTCPPorts = [
     25
   ];
diff --git a/makefu/1systems/repunit.nix b/makefu/1systems/repunit.nix
index 0c6ba09fb..f9421cfa2 100644
--- a/makefu/1systems/repunit.nix
+++ b/makefu/1systems/repunit.nix
@@ -7,8 +7,9 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
-      ../2configs/cgit-retiolum.nix
+      ../2configs/git/cgit-retiolum.nix
     ];
   krebs.build.host = config.krebs.hosts.repunit;
 
diff --git a/makefu/1systems/tsp.nix b/makefu/1systems/tsp.nix
index 990db65d2..d5d44cce0 100644
--- a/makefu/1systems/tsp.nix
+++ b/makefu/1systems/tsp.nix
@@ -6,6 +6,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/base-gui.nix
       ../2configs/tinc-basic-retiolum.nix
       ../2configs/fs/sda-crypto-root.nix
diff --git a/makefu/1systems/vbob.nix b/makefu/1systems/vbob.nix
index 90b490802..e07525d0d 100644
--- a/makefu/1systems/vbob.nix
+++ b/makefu/1systems/vbob.nix
@@ -4,9 +4,9 @@
 { lib, config, pkgs, ... }:
 {
   krebs.build.host = config.krebs.hosts.vbob;
-  krebs.build.target = "root@10.10.10.220";
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       <nixpkgs/nixos/modules/virtualisation/virtualbox-image.nix>
       ../2configs/main-laptop.nix #< base-gui
 
@@ -18,8 +18,8 @@
     tinc = pkgs.tinc_pre;
   };
 
-  krebs.build.source.nixpkgs = {
-    # url = https://github.com/nixos/nixpkgs;
+  krebs.build.source.upstream-nixpkgs = {
+    url = https://github.com/makefu/nixpkgs;
     # HTTP Everywhere + libredir
     rev = "8239ac6";
   };
@@ -39,7 +39,6 @@
     buildbot
     buildbot-slave
     get
-    genid
     logstash
   ];
 
diff --git a/makefu/1systems/wbob.nix b/makefu/1systems/wbob.nix
index d6916f006..b4f7c9058 100644
--- a/makefu/1systems/wbob.nix
+++ b/makefu/1systems/wbob.nix
@@ -2,18 +2,60 @@
 {
   imports =
     [ # Include the results of the hardware scan.
+      ../.
       ../2configs/main-laptop.nix
     ];
-    krebs = {
-        enable = true;
-        retiolum.enable = true;
-        build.host = config.krebs.hosts.wbob;
-    };
-    boot.loader.grub.device = "/dev/sda";
-    boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" ];
-    boot.kernelModules = [ "kvm-intel" ];
-    fileSystems."/" = {
-        device = "/dev/sda1";
-        fsType = "ext4";
-    };
+  krebs = {
+      enable = true;
+      retiolum.enable = true;
+      build.host = config.krebs.hosts.wbob;
+  };
+
+  # rt2870.bin wifi card, part of linux-unfree
+  hardware.enableAllFirmware = true;
+  nixpkgs.config.allowUnfree = true;
+  networking.wireless.enable = true;
+  # rt2870 with nonfree creates wlp2s0 from wlp0s20u2
+  # not explicitly setting the interface results in wpa_supplicant to crash
+  networking.wireless.interfaces = [ "wlp2s0" ];
+
+
+  # nuc hardware
+  boot.loader.grub.device = "/dev/sda";
+  hardware.cpu.intel.updateMicrocode = true;
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  fileSystems."/" = {
+      device = "/dev/sda1";
+      fsType = "ext4";
+  };
+
+  # DualHead on NUC
+  services.xserver = {
+      # xrandrHeads = [ "HDMI1" "HDMI2" ];
+      # prevent screen from turning off, disable dpms
+      displayManager.sessionCommands = ''
+        xset s off -dpms
+        xrandr --output HDMI2 --right-of HDMI1
+      '';
+  };
+  ## TODO Awesomecfg + autostart chrome
+  #
+  #local current_screen = 1
+  #awful.rules.rules = {
+  #  { rule = { class = "chromium-browser" },
+  #    callback = function()
+  #      awful.client.movetotag(tags[current_screen][1],c)
+  #      if (current_screen == 1) then
+  #        current_screen = current_screen+1
+  #      else
+  #        current_screen = current_screen-1
+  #      end
+  #    end
+  #  },
+  #}
+  #awful.util.spawn_with_shell("chromium --new-window --kiosk http://wolf:3000/dashboard/db/soc-critical-values")
+  # prevent Race Condition
+  #awful.util.spawn_with_shell("sleep 0.5;chromium --new-window --kiosk http://wolf:3000/dashboard/db/aralast")
+
 }
diff --git a/makefu/1systems/wry.nix b/makefu/1systems/wry.nix
index f022311c9..747321968 100644
--- a/makefu/1systems/wry.nix
+++ b/makefu/1systems/wry.nix
@@ -1,12 +1,13 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
 
   external-ip = head config.krebs.build.host.nets.internet.addrs4;
   internal-ip = head config.krebs.build.host.nets.retiolum.addrs4;
 in {
   imports = [
+      ../.
       # TODO: copy this config or move to krebs
       ../../tv/2configs/hw/CAC.nix
       ../../tv/2configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/makefu/2configs/backup.nix b/makefu/2configs/backup.nix
index ed6d1f4a7..6f79ed4f4 100644
--- a/makefu/2configs/backup.nix
+++ b/makefu/2configs/backup.nix
@@ -1,5 +1,5 @@
 { config, lib, ... }:
-with lib;
+with config.krebs.lib;
 let
   startAt = "0,6,12,18:00";
   defaultBackupServer = config.krebs.hosts.omo;
@@ -24,7 +24,7 @@ let
     };
   };
 in {
-  krebs.backup.plans = addNames {
+  krebs.backup.plans = {
     wry-to-omo_var-www = defaultPull wry "/var/www";
   };
 }
diff --git a/makefu/2configs/base-gui.nix b/makefu/2configs/base-gui.nix
index 1d6750284..341a2ab20 100644
--- a/makefu/2configs/base-gui.nix
+++ b/makefu/2configs/base-gui.nix
@@ -21,7 +21,7 @@
 # URxvt.visualBell: false
 # URxvt.font : xft:Terminus
 
-with lib;
+with config.krebs.lib;
 let
   mainUser = config.krebs.build.user.name;
   awesomecfg = pkgs.awesomecfg.full;
@@ -44,6 +44,8 @@ in
     displayManager.auto.user = mainUser;
     desktopManager.xterm.enable = false;
   };
+  # lid switch is handled via button presses
+  services.logind.extraConfig = mkDefault "HandleLidSwitch=ignore";
   nixpkgs.config.packageOverrides = pkgs: rec {
     awesome = pkgs.stdenv.lib.overrideDerivation pkgs.awesome (oldAttrs : {
       postFixup = ''
diff --git a/makefu/2configs/bepasty-dual.nix b/makefu/2configs/bepasty-dual.nix
index 123ae3cf9..5682f5eb6 100644
--- a/makefu/2configs/bepasty-dual.nix
+++ b/makefu/2configs/bepasty-dual.nix
@@ -10,7 +10,7 @@
 #   wildcard.krebsco.de.key
 #   bepasty-secret.nix     <- contains single string
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   # secKey is nothing worth protecting on a local machine
diff --git a/makefu/2configs/collectd/collectd-base.nix b/makefu/2configs/collectd/collectd-base.nix
index 7909c1be5..c739368ca 100644
--- a/makefu/2configs/collectd/collectd-base.nix
+++ b/makefu/2configs/collectd/collectd-base.nix
@@ -2,7 +2,7 @@
 
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
-with lib;
+with config.krebs.lib;
 let
   connect-time-cfg = with pkgs; writeText "collectd-connect-time.cfg" ''
     LoadPlugin python
diff --git a/makefu/2configs/default.nix b/makefu/2configs/default.nix
index 2b4e31119..83018e9f8 100644
--- a/makefu/2configs/default.nix
+++ b/makefu/2configs/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   system.stateVersion = "15.09";
 
@@ -18,20 +18,17 @@ with lib;
     enable = true;
     search-domain = "retiolum";
     build =  {
-      target = mkDefault "root@${config.krebs.build.host.name}";
       user = config.krebs.users.makefu;
       source =  mapAttrs (_: mkDefault) {
-        upstream-nixpkgs = {
+        nixpkgs = {
           url = https://github.com/nixos/nixpkgs;
-          rev = "93d8671e2c6d1d25f126ed30e5e6f16764330119"; # unstable @ 2015-01-03, tested on filepimp
+          rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # unstable @ 2015-01-27, tested on wry
         };
         secrets = "/home/makefu/secrets/${config.krebs.build.host.name}/";
         stockholm = "/home/makefu/stockholm";
 
         # Defaults for all stockholm users?
         nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
-        nixpkgs = symlink:stockholm/nixpkgs;
-        stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
       };
     };
   };
@@ -87,6 +84,7 @@ with lib;
   environment.systemPackages = with pkgs; [
       jq
       git
+      get
       gnumake
       rxvt_unicode.terminfo
       htop
diff --git a/makefu/2configs/exim-retiolum.nix b/makefu/2configs/exim-retiolum.nix
index b8c5c5236..34943f593 100644
--- a/makefu/2configs/exim-retiolum.nix
+++ b/makefu/2configs/exim-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.exim-retiolum.enable = true;
   environment.systemPackages = with pkgs; [
diff --git a/makefu/2configs/fetchWallpaper.nix b/makefu/2configs/fetchWallpaper.nix
index b071a128d..786df6d40 100644
--- a/makefu/2configs/fetchWallpaper.nix
+++ b/makefu/2configs/fetchWallpaper.nix
@@ -1,24 +1,15 @@
 { config, pkgs, ... }:
 
-let
-  # check if laptop runs on umts
-  weaksauce-internet = with pkgs;writeScript "weaksauce-internet" ''
-    #! /bin/sh
-    if  ${iproute}/bin/ip addr show dev ppp0 2>/dev/null \
-      | ${gnugrep}/bin/grep -q inet;then
-      exit 1
-    fi
-  '';
-
-in {
+{
   krebs.fetchWallpaper = {
     enable = true;
     display = ":0";
-    predicate = weaksauce-internet;
+    unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
     timerConfig = {
       OnCalendar = "*:0/30";
     };
     url = "http://echelon/wallpaper.png";
   };
+
 }
 
diff --git a/makefu/2configs/fs/cac-boot-partition.nix b/makefu/2configs/fs/cac-boot-partition.nix
index cec004582..bf08504d5 100644
--- a/makefu/2configs/fs/cac-boot-partition.nix
+++ b/makefu/2configs/fs/cac-boot-partition.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # vda1 ext4 (label nixos) -> only root partition
-with lib;
+with config.krebs.lib;
 {
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;
diff --git a/makefu/2configs/fs/sda-crypto-root-home.nix b/makefu/2configs/fs/sda-crypto-root-home.nix
index cc2133a49..5214cf872 100644
--- a/makefu/2configs/fs/sda-crypto-root-home.nix
+++ b/makefu/2configs/fs/sda-crypto-root-home.nix
@@ -8,7 +8,7 @@
 #             /     (main-root)
 #             /home (main-home)
 
-with lib;
+with config.krebs.lib;
 {
 
   imports = [
diff --git a/makefu/2configs/fs/sda-crypto-root.nix b/makefu/2configs/fs/sda-crypto-root.nix
index 2bfe26960..e9d7b755a 100644
--- a/makefu/2configs/fs/sda-crypto-root.nix
+++ b/makefu/2configs/fs/sda-crypto-root.nix
@@ -3,7 +3,7 @@
 # sda:  bootloader grub2
 # sda1: boot ext4 (label nixboot)
 # sda2: cryptoluks -> ext4
-with lib;
+with config.krebs.lib;
 {
   boot = {
     loader.grub.enable = true;
diff --git a/makefu/2configs/fs/vm-single-partition.nix b/makefu/2configs/fs/vm-single-partition.nix
index 27e28cb68..88f209597 100644
--- a/makefu/2configs/fs/vm-single-partition.nix
+++ b/makefu/2configs/fs/vm-single-partition.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # vda1 ext4 (label nixos) -> only root partition
-with lib;
+with config.krebs.lib;
 {
   imports = [
     ./single-partition-ext4.nix
diff --git a/makefu/2configs/git/brain-retiolum.nix b/makefu/2configs/git/brain-retiolum.nix
index 25ef584bf..58fd250e5 100644
--- a/makefu/2configs/git/brain-retiolum.nix
+++ b/makefu/2configs/git/brain-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 # TODO: remove tv lib :)
-with lib;
+with config.krebs.lib;
 let
 
   repos = priv-repos // krebs-repos ;
diff --git a/makefu/2configs/git/cgit-retiolum.nix b/makefu/2configs/git/cgit-retiolum.nix
index 7d85eb8d1..a488d98f2 100644
--- a/makefu/2configs/git/cgit-retiolum.nix
+++ b/makefu/2configs/git/cgit-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 # TODO: remove tv lib :)
-with lib;
+with config.krebs.lib;
 let
 
   repos = priv-repos // krebs-repos // connector-repos ;
diff --git a/makefu/2configs/graphite-standalone.nix b/makefu/2configs/graphite-standalone.nix
index 8b70c11c8..dd5438e8d 100644
--- a/makefu/2configs/graphite-standalone.nix
+++ b/makefu/2configs/graphite-standalone.nix
@@ -2,7 +2,7 @@
 
 # graphite-web on port 8080
 # carbon cache on port 2003 (tcp/udp)
-with lib;
+with config.krebs.lib;
 {
   imports = [ ];
 
diff --git a/makefu/2configs/hw/tp-x200.nix b/makefu/2configs/hw/tp-x200.nix
index ed46875d8..f17ac74a6 100644
--- a/makefu/2configs/hw/tp-x200.nix
+++ b/makefu/2configs/hw/tp-x200.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
 
   imports = [ ./tp-x2x0.nix ];
diff --git a/makefu/2configs/hw/tp-x220.nix b/makefu/2configs/hw/tp-x220.nix
index f03922150..0a471bde0 100644
--- a/makefu/2configs/hw/tp-x220.nix
+++ b/makefu/2configs/hw/tp-x220.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
 
   imports = [ ./tp-x2x0.nix ];
@@ -16,10 +16,16 @@ with lib;
   };
 
   services.xserver.displayManager.sessionCommands =''
-  xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1
-  xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2
-  xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5
-  # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Timeout" 8 200
+    xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1
+    xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2
+    xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5
+    # xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Timeout" 8 200
+  '';
+
+  # enable HDMI output switching with pulseaudio
+  hardware.pulseaudio.configFile = pkgs.writeText "pulse-default-pa" ''
+    ${builtins.readFile "${config.hardware.pulseaudio.package}/etc/pulse/default.pa"}
+    load-module module-alsa-sink device=hw:0,3 sink_properties=device.description="HDMIOutput" sink_name="HDMI"
   '';
 
 }
diff --git a/makefu/2configs/hw/tp-x2x0.nix b/makefu/2configs/hw/tp-x2x0.nix
index ebc72a06e..892be07b8 100644
--- a/makefu/2configs/hw/tp-x2x0.nix
+++ b/makefu/2configs/hw/tp-x2x0.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   # TODO: put this somewhere else
   networking.wireless.enable = true;
@@ -18,18 +18,18 @@ with lib;
     sensitivity = 220;
     speed = 220;
     emulateWheel = true;
-    };
+  };
 
 
   services.tlp.enable = true;
   services.tlp.extraConfig = ''
-  START_CHARGE_THRESH_BAT0=80
-
-  CPU_SCALING_GOVERNOR_ON_AC=performance
-  CPU_SCALING_GOVERNOR_ON_BAT=ondemand
-  CPU_MIN_PERF_ON_AC=0
-  CPU_MAX_PERF_ON_AC=100
-  CPU_MIN_PERF_ON_BAT=0
-  CPU_MAX_PERF_ON_BAT=30
+    START_CHARGE_THRESH_BAT0=80
+
+    CPU_SCALING_GOVERNOR_ON_AC=performance
+    CPU_SCALING_GOVERNOR_ON_BAT=ondemand
+    CPU_MIN_PERF_ON_AC=0
+    CPU_MAX_PERF_ON_AC=100
+    CPU_MIN_PERF_ON_BAT=0
+    CPU_MAX_PERF_ON_BAT=30
   '';
 }
diff --git a/makefu/2configs/mail-client.nix b/makefu/2configs/mail-client.nix
index bda21e9d0..913cbf25b 100644
--- a/makefu/2configs/mail-client.nix
+++ b/makefu/2configs/mail-client.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   environment.systemPackages = with pkgs; [
     msmtp
diff --git a/makefu/2configs/main-laptop.nix b/makefu/2configs/main-laptop.nix
index b725f661d..c3e43723c 100644
--- a/makefu/2configs/main-laptop.nix
+++ b/makefu/2configs/main-laptop.nix
@@ -3,8 +3,9 @@
 # stuff for the main laptop
 # this is pretty much nice-to-have and does
 # not fit into base-gui
+# TODO split generic desktop stuff and laptop-specifics like lidswitching
 
-with lib;
+with config.krebs.lib;
 {
   imports = [
     ./base-gui.nix
@@ -17,8 +18,10 @@ with lib;
     chromium
     keepassx
     ntfs3g
+    at_spi2_core
+    gnome3.dconf
     virtmanager
-    at_spi2_core # dep for virtmanager?
+    krebspaste
   ];
 
   services.redshift = {
diff --git a/makefu/2configs/mattermost-docker.nix b/makefu/2configs/mattermost-docker.nix
index 20a93dff1..e679a3d91 100644
--- a/makefu/2configs/mattermost-docker.nix
+++ b/makefu/2configs/mattermost-docker.nix
@@ -1,6 +1,6 @@
 {config, lib, ...}:
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   ssl_cert = "${sec}/wildcard.krebsco.de.crt";
diff --git a/makefu/2configs/nginx/euer.blog.nix b/makefu/2configs/nginx/euer.blog.nix
index c6724c617..9d08f4b9a 100644
--- a/makefu/2configs/nginx/euer.blog.nix
+++ b/makefu/2configs/nginx/euer.blog.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   ssl_cert = "${sec}/wildcard.krebsco.de.crt";
diff --git a/makefu/2configs/nginx/euer.test.nix b/makefu/2configs/nginx/euer.test.nix
index ffdc0bc60..f7214e613 100644
--- a/makefu/2configs/nginx/euer.test.nix
+++ b/makefu/2configs/nginx/euer.test.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   hostname = config.krebs.build.host.name;
   user = config.services.nginx.user;
diff --git a/makefu/2configs/nginx/euer.wiki.nix b/makefu/2configs/nginx/euer.wiki.nix
index 2b5fa6ead..a5572a519 100644
--- a/makefu/2configs/nginx/euer.wiki.nix
+++ b/makefu/2configs/nginx/euer.wiki.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   sec = toString <secrets>;
   ssl_cert = "${sec}/wildcard.krebsco.de.crt";
diff --git a/makefu/2configs/nginx/update.connector.one.nix b/makefu/2configs/nginx/update.connector.one.nix
index eb39a1668..044a14075 100644
--- a/makefu/2configs/nginx/update.connector.one.nix
+++ b/makefu/2configs/nginx/update.connector.one.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   hostname = config.krebs.build.host.name;
   external-ip = head config.krebs.build.host.nets.internet.addrs4;
diff --git a/makefu/2configs/omo-share.nix b/makefu/2configs/omo-share.nix
index 1e0975e1d..a9640b38b 100644
--- a/makefu/2configs/omo-share.nix
+++ b/makefu/2configs/omo-share.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   hostname = config.krebs.build.host.name;
   # TODO local-ip from the nets config
diff --git a/makefu/2configs/printer.nix b/makefu/2configs/printer.nix
index 35ad54bd9..d288748f9 100644
--- a/makefu/2configs/printer.nix
+++ b/makefu/2configs/printer.nix
@@ -7,4 +7,8 @@
       pkgs.samsungUnifiedLinuxDriver
     ];
   };
+
+  # scanners are printers just in reverse anyway
+  hardware.sane.enable = true;
+  hardware.sane.extraBackends = [ pkgs.samsungUnifiedLinuxDriver ];
 }
diff --git a/makefu/2configs/tinc-basic-retiolum.nix b/makefu/2configs/tinc-basic-retiolum.nix
index f49c596fc..12d3b8b7c 100644
--- a/makefu/2configs/tinc-basic-retiolum.nix
+++ b/makefu/2configs/tinc-basic-retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.retiolum = {
     enable = true;
diff --git a/makefu/2configs/zsh-user.nix b/makefu/2configs/zsh-user.nix
index f79f258f3..9527ead1a 100644
--- a/makefu/2configs/zsh-user.nix
+++ b/makefu/2configs/zsh-user.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 ##
-with lib;
+with config.krebs.lib;
 let
   mainUser = config.krebs.build.user.name;
 in
diff --git a/makefu/3modules/snapraid.nix b/makefu/3modules/snapraid.nix
index fbdf50219..3d458bbbf 100644
--- a/makefu/3modules/snapraid.nix
+++ b/makefu/3modules/snapraid.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # returns dirname without / , used as disk name
@@ -28,7 +28,7 @@ let
 
   out = {
     options.makefu.snapraid = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/makefu/3modules/umts.nix b/makefu/3modules/umts.nix
index d7be45f62..e527a5cb7 100644
--- a/makefu/3modules/umts.nix
+++ b/makefu/3modules/umts.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO: currently it is only netzclub
@@ -32,7 +32,7 @@ let
 
   out = {
     options.makefu.umts = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
@@ -56,19 +56,12 @@ let
 
     environment.wvdial.dialerDefaults = wvdial-defaults;
 
-    systemd.targets.network-umts = {
-      description = "System is running on UMTS";
-      unitConfig.StopWhenUnneeded = true;
-    };
-
     systemd.services.umts = {
       description = "UMTS wvdial Service";
-      before = [ "network-umts.target" ];
-
       serviceConfig = {
         Type = "simple";
         Restart = "always";
-        RestartSec = "4s";
+        RestartSec = "10s";
         ExecStart = "${pkgs.wvdial}/bin/wvdial -n";
       };
     };
diff --git a/makefu/5pkgs/default.nix b/makefu/5pkgs/default.nix
index 436c52fcd..c4a7f498f 100644
--- a/makefu/5pkgs/default.nix
+++ b/makefu/5pkgs/default.nix
@@ -4,9 +4,11 @@ let
   inherit (pkgs) callPackage;
 in
 {
-  alsa-hdspmixer = callPackage ./alsa-tools { alsaToolTarget="hdspmixer";};
-  alsa-hdspconf = callPackage ./alsa-tools { alsaToolTarget="hdspconf";};
-  alsa-hdsploader = callPackage ./alsa-tools { alsaToolTarget="hdsploader";};
-  awesomecfg = callPackage ./awesomecfg {};
-  tw-upload-plugin = callPackage ./tw-upload-plugin {};
+  nixpkgs.config.packageOverrides = rec {
+    alsa-hdspmixer = callPackage ./alsa-tools { alsaToolTarget="hdspmixer";};
+    alsa-hdspconf = callPackage ./alsa-tools { alsaToolTarget="hdspconf";};
+    alsa-hdsploader = callPackage ./alsa-tools { alsaToolTarget="hdsploader";};
+    awesomecfg = callPackage ./awesomecfg {};
+    tw-upload-plugin = callPackage ./tw-upload-plugin {};
+  };
 }
diff --git a/makefu/default.nix b/makefu/default.nix
new file mode 100644
index 000000000..320e1a133
--- /dev/null
+++ b/makefu/default.nix
@@ -0,0 +1,8 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./2configs
+    ./3modules
+  ];
+}
diff --git a/miefda/1systems/bobby.nix b/miefda/1systems/bobby.nix
index d24595256..b85e686b5 100644
--- a/miefda/1systems/bobby.nix
+++ b/miefda/1systems/bobby.nix
@@ -7,7 +7,7 @@
 {
   imports =
     [ # Include the results of the hardware scan.
-
+      ../.
       ../2configs/miefda.nix
       ../2configs/tlp.nix
       ../2configs/x220t.nix
diff --git a/miefda/2configs/git.nix b/miefda/2configs/git.nix
index fec828f80..052cc4ab2 100644
--- a/miefda/2configs/git.nix
+++ b/miefda/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
diff --git a/miefda/2configs/miefda.nix b/miefda/2configs/miefda.nix
index 545987a68..f17e8aa34 100644
--- a/miefda/2configs/miefda.nix
+++ b/miefda/2configs/miefda.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   
   #networking.wicd.enable = true;
diff --git a/miefda/2configs/tinc-basic-retiolum.nix b/miefda/2configs/tinc-basic-retiolum.nix
index 153b41d78..f82fd6b03 100644
--- a/miefda/2configs/tinc-basic-retiolum.nix
+++ b/miefda/2configs/tinc-basic-retiolum.nix
@@ -1,10 +1,9 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.retiolum = {
     enable = true;
-    hosts = ../../krebs/Zhosts;
     connectTo = [
       "gum"
       "pigstarter"
diff --git a/miefda/2configs/tlp.nix b/miefda/2configs/tlp.nix
index 0e1bb0d6b..32f4f2ee7 100644
--- a/miefda/2configs/tlp.nix
+++ b/miefda/2configs/tlp.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   hardware.enableAllFirmware = true;
   nixpkgs.config.allowUnfree = true;
diff --git a/miefda/2configs/x220t.nix b/miefda/2configs/x220t.nix
index bea84f796..2d128e533 100644
--- a/miefda/2configs/x220t.nix
+++ b/miefda/2configs/x220t.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
 
   services.xserver = {
diff --git a/miefda/5pkgs/default.nix b/miefda/5pkgs/default.nix
deleted file mode 100644
index 2eb33a153..000000000
--- a/miefda/5pkgs/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-_:{}
diff --git a/miefda/default.nix b/miefda/default.nix
new file mode 100644
index 000000000..7f275c2eb
--- /dev/null
+++ b/miefda/default.nix
@@ -0,0 +1,6 @@
+_:
+{
+  imports = [
+    ../krebs
+  ];
+}
diff --git a/mv/1systems/stro.nix b/mv/1systems/stro.nix
index 38d4b4bc6..f251cb092 100644
--- a/mv/1systems/stro.nix
+++ b/mv/1systems/stro.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.stro;
@@ -8,9 +8,8 @@ with lib;
   krebs.build.source.git.nixpkgs.rev =
     "7ae05edcdd14f6ace83ead9bf0d114e97c89a83a";
 
-  krebs.build.target = "lolwat";
-
   imports = [
+    ../.
     ../2configs/hw/x220.nix
     ../2configs/git.nix
     ../2configs/mail-client.nix
diff --git a/mv/2configs/default.nix b/mv/2configs/default.nix
index 9c412099e..d93218a18 100644
--- a/mv/2configs/default.nix
+++ b/mv/2configs/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   HOME = getEnv "HOME";
 in
diff --git a/mv/2configs/git.nix b/mv/2configs/git.nix
index 991d0c410..933649f20 100644
--- a/mv/2configs/git.nix
+++ b/mv/2configs/git.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
@@ -45,7 +45,7 @@ let
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
       optional repo.public {
-        user = [ lass makefu uriel tv tv_xu ];
+        user = [ lass makefu uriel tv tv-xu ];
         repo = [ repo ];
         perm = fetch;
       } ++
diff --git a/mv/2configs/vim.nix b/mv/2configs/vim.nix
index a961b6b26..adf1da9db 100644
--- a/mv/2configs/vim.nix
+++ b/mv/2configs/vim.nix
@@ -1,6 +1,6 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   out = {
     environment.systemPackages = [
diff --git a/mv/2configs/xserver/Xresources.nix b/mv/2configs/xserver/Xresources.nix
index f287bf206..923572721 100644
--- a/mv/2configs/xserver/Xresources.nix
+++ b/mv/2configs/xserver/Xresources.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   !URxvt*background:	#050505
diff --git a/mv/2configs/xserver/default.nix b/mv/2configs/xserver/default.nix
index 44539c54b..3d4aa8847 100644
--- a/mv/2configs/xserver/default.nix
+++ b/mv/2configs/xserver/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user
diff --git a/mv/2configs/xserver/xserver.conf.nix b/mv/2configs/xserver/xserver.conf.nix
index e8a997a99..c452b4226 100644
--- a/mv/2configs/xserver/xserver.conf.nix
+++ b/mv/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;
diff --git a/mv/3modules/iptables.nix b/mv/3modules/iptables.nix
index cbf49f577..b2b41bf00 100644
--- a/mv/3modules/iptables.nix
+++ b/mv/3modules/iptables.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.iptables;
 
   out = {
     options.tv.iptables = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/mv/5pkgs/default.nix b/mv/5pkgs/default.nix
index 0c72c450e..882ac0413 100644
--- a/mv/5pkgs/default.nix
+++ b/mv/5pkgs/default.nix
@@ -1,23 +1,24 @@
 { pkgs, ... }:
 
 {
-  # TODO use XDG_RUNTIME_DIR?
-  cr = pkgs.writeScriptBin "cr" ''
-    #! /bin/sh
-    set -efu
-    export LC_TIME=de_DE.utf8
-    exec ${pkgs.chromium}/bin/chromium \
-        --ssl-version-min=tls1 \
-        --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
-        --disk-cache-size=50000000 \
-        "%@"
-  '';
-  ff = pkgs.writeScriptBin "ff" ''
-    #! /bin/sh
-    set -efu
-    exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@")
-  '';
-  xmonad-tv =
-    let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in
-    pkgs.haskellPackages.callPackage src {};
+  nixpkgs.config.packageOverrides = rec {
+    cr = pkgs.writeScriptBin "cr" ''
+      #! /bin/sh
+      set -efu
+      export LC_TIME=de_DE.utf8
+      exec ${pkgs.chromium}/bin/chromium \
+          --ssl-version-min=tls1 \
+          --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
+          --disk-cache-size=50000000 \
+          "%@"
+    '';
+    ff = pkgs.writeScriptBin "ff" ''
+      #! /bin/sh
+      set -efu
+      exec ${pkgs.firefoxWrapper}/bin/firefox $(printf " %q" "$@")
+    '';
+    xmonad-tv =
+      let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in
+      pkgs.haskellPackages.callPackage src {};
+  };
 }
diff --git a/nixpkgs/default.nix b/nixpkgs/default.nix
deleted file mode 120000
index 74e9d7633..000000000
--- a/nixpkgs/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-../upstream-nixpkgs/default.nix
\ No newline at end of file
diff --git a/nixpkgs/krebs b/nixpkgs/krebs
deleted file mode 100644
index e69de29bb..000000000
--- a/nixpkgs/krebs
+++ /dev/null
diff --git a/nixpkgs/lib b/nixpkgs/lib
deleted file mode 120000
index 2284ef489..000000000
--- a/nixpkgs/lib
+++ /dev/null
@@ -1 +0,0 @@
-../upstream-nixpkgs/lib
\ No newline at end of file
diff --git a/nixpkgs/nixos/default.nix b/nixpkgs/nixos/default.nix
deleted file mode 100644
index 4fe08efd2..000000000
--- a/nixpkgs/nixos/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-import <stockholm>
diff --git a/nixpkgs/nixos/lib b/nixpkgs/nixos/lib
deleted file mode 120000
index 9e69d1a67..000000000
--- a/nixpkgs/nixos/lib
+++ /dev/null
@@ -1 +0,0 @@
-../../../upstream-nixpkgs/nixos/lib
\ No newline at end of file
diff --git a/nixpkgs/nixos/modules b/nixpkgs/nixos/modules
deleted file mode 120000
index 8aa24885c..000000000
--- a/nixpkgs/nixos/modules
+++ /dev/null
@@ -1 +0,0 @@
-../../../upstream-nixpkgs/nixos/modules
\ No newline at end of file
diff --git a/nixpkgs/pkgs b/nixpkgs/pkgs
deleted file mode 120000
index ce5f5448b..000000000
--- a/nixpkgs/pkgs
+++ /dev/null
@@ -1 +0,0 @@
-../upstream-nixpkgs/pkgs
\ No newline at end of file
diff --git a/root b/root
deleted file mode 120000
index 1cd18253d..000000000
--- a/root
+++ /dev/null
@@ -1 +0,0 @@
-../stockholm-user
\ No newline at end of file
diff --git a/shared/1systems/test-all-krebs-modules.nix b/shared/1systems/test-all-krebs-modules.nix
index b98004dfe..e1021c7e0 100644
--- a/shared/1systems/test-all-krebs-modules.nix
+++ b/shared/1systems/test-all-krebs-modules.nix
@@ -2,6 +2,9 @@
 let
   en = { enable = true;};
 in {
+  imports = [
+    ../.
+  ];
   krebs = {
     enable = true;
     build.user = config.krebs.users.shared;
diff --git a/shared/1systems/test-arch.nix b/shared/1systems/test-arch.nix
index ece209490..14fc0384b 100644
--- a/shared/1systems/test-arch.nix
+++ b/shared/1systems/test-arch.nix
@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../.
     ../2configs/base.nix
     {
       boot.loader.grub = {
diff --git a/shared/1systems/test-centos6.nix b/shared/1systems/test-centos6.nix
index a8b5f9b9c..8add0b7c1 100644
--- a/shared/1systems/test-centos6.nix
+++ b/shared/1systems/test-centos6.nix
@@ -7,6 +7,7 @@ let
   gw = "168.235.148.1";
 in {
   imports = [
+    ../.
     ../2configs/base.nix
     ../2configs/os-templates/CAC-CentOS-6.5-64bit.nix
     {
diff --git a/shared/1systems/test-centos7.nix b/shared/1systems/test-centos7.nix
index 48cecc877..65daff509 100644
--- a/shared/1systems/test-centos7.nix
+++ b/shared/1systems/test-centos7.nix
@@ -5,6 +5,7 @@ let
 
 in {
   imports = [
+    ../.
     ../2configs/base.nix
     ../2configs/os-templates/CAC-CentOS-7-64bit.nix
     ../2configs/temp/networking.nix
diff --git a/shared/1systems/test-failing.nix b/shared/1systems/test-failing.nix
index 81a9e48d6..fe1c2cb65 100644
--- a/shared/1systems/test-failing.nix
+++ b/shared/1systems/test-failing.nix
@@ -1,6 +1,9 @@
 { config, pkgs, ... }:
 
 {
+  imports = [
+    ../.
+  ];
   programs.ssh.startAgent = true;
   programs.ssh.startAgent = false;
 }
diff --git a/shared/1systems/test-minimal-deploy.nix b/shared/1systems/test-minimal-deploy.nix
index 309e28950..bec2b38d5 100644
--- a/shared/1systems/test-minimal-deploy.nix
+++ b/shared/1systems/test-minimal-deploy.nix
@@ -1,5 +1,8 @@
 { config, pkgs, lib, ... }:
 {
+  imports = [
+    ../.
+  ];
   krebs = {
     enable = true;
     build.user = config.krebs.users.shared;
diff --git a/shared/1systems/wolf.nix b/shared/1systems/wolf.nix
index bcfbd6810..317591433 100644
--- a/shared/1systems/wolf.nix
+++ b/shared/1systems/wolf.nix
@@ -6,6 +6,7 @@ let
 in
 {
   imports = [
+    ../.
     ../2configs/base.nix
     <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     ../2configs/collectd-base.nix
@@ -45,7 +46,6 @@ in
   # uninteresting stuff
   #####################
   krebs.build.host = config.krebs.hosts.wolf;
-  krebs.build.target = "wolf";
 
   boot.kernel.sysctl = {
     # Enable IPv6 Privacy Extensions
diff --git a/shared/2configs/base.nix b/shared/2configs/base.nix
index dd698ba97..9f998b554 100644
--- a/shared/2configs/base.nix
+++ b/shared/2configs/base.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 {
   krebs.enable = true;
   krebs.retiolum = {
@@ -16,16 +16,14 @@ with lib;
   # TODO rename shared user to "krebs"
   krebs.build.user = mkDefault config.krebs.users.shared;
   krebs.build.source = {
-    upstream-nixpkgs = mkDefault {
+    nixpkgs = mkDefault {
       url = https://github.com/NixOS/nixpkgs;
-      rev = "d0e3cca";
+      rev = "77f8f35d57618c1ba456d968524f2fb2c3448295"; # for urlwatch-minidb
     };
     secrets =  mkDefault "${getEnv "HOME"}/secrets/krebs/${config.krebs.build.host.name}";
     stockholm = mkDefault "${getEnv "HOME"}/stockholm";
 
     nixos-config = "symlink:stockholm/${config.krebs.build.user.name}/1systems/${config.krebs.build.host.name}.nix";
-    nixpkgs = symlink:stockholm/nixpkgs;
-    stockholm-user = "symlink:stockholm/${config.krebs.build.user.name}";
   };
 
   networking.hostName = config.krebs.build.host.name;
diff --git a/shared/2configs/cgit-mirror.nix b/shared/2configs/cgit-mirror.nix
index 4ff1902f9..d30f1444f 100644
--- a/shared/2configs/cgit-mirror.nix
+++ b/shared/2configs/cgit-mirror.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   rules = with git; singleton {
     user = [ git-sync ];
diff --git a/shared/2configs/collectd-base.nix b/shared/2configs/collectd-base.nix
index 3b792bf23..9c63dcd20 100644
--- a/shared/2configs/collectd-base.nix
+++ b/shared/2configs/collectd-base.nix
@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 # TODO: krebs.collectd.plugins
-with lib;
+with config.krebs.lib;
 let
   connect-time-cfg = with pkgs; writeText "collectd-connect-time.conf" ''
     LoadPlugin python
diff --git a/shared/2configs/graphite.nix b/shared/2configs/graphite.nix
index 707ec6e9a..37c6b09fd 100644
--- a/shared/2configs/graphite.nix
+++ b/shared/2configs/graphite.nix
@@ -5,7 +5,7 @@
 
 # TODO: krebs.graphite.minimal.enable
 # TODO: configure firewall
-with lib;
+with config.krebs.lib;
 {
   imports = [ ];
 
diff --git a/shared/2configs/shared-buildbot.nix b/shared/2configs/shared-buildbot.nix
index 50b279036..af877f5d8 100644
--- a/shared/2configs/shared-buildbot.nix
+++ b/shared/2configs/shared-buildbot.nix
@@ -12,10 +12,10 @@
       testslave =  "krebspass";
     };
     change_source.stockholm = ''
-  stockholm_repo = 'http://cgit.gum/stockholm'
+  stockholm_repo = 'http://cgit.wolf/stockholm-mirror'
   cs.append(changes.GitPoller(
           stockholm_repo,
-          workdir='stockholm-poller', branch='master',
+          workdir='stockholm-poller', branches=True,
           project='stockholm',
           pollinterval=120))
     '';
@@ -28,7 +28,9 @@
         fast-tests-scheduler = ''
   # test the master real quick
   sched.append(schedulers.SingleBranchScheduler(
-                              change_filter=util.ChangeFilter(branch="master"),
+                              ## all branches
+                              change_filter=util.ChangeFilter(branch_re=".*"),
+                              # change_filter=util.ChangeFilter(branch="master"),
                               treeStableTimer=10, #only test the latest push
                               name="fast-master-test",
                               builderNames=["fast-tests"]))
@@ -52,7 +54,6 @@
     };
     builder_pre = ''
   # prepare grab_repo step for stockholm
-  stockholm_repo = "http://cgit.gum.retiolum/stockholm"
   grab_repo = steps.Git(repourl=stockholm_repo, mode='incremental')
 
   env = {"LOGNAME": "shared", "NIX_REMOTE": "daemon"}
@@ -78,8 +79,11 @@
   f.addStep(grab_repo)
   for i in [ "test-centos7", "wolf", "test-failing" ]:
     addShell(f,name="populate-{}".format(i),env=env,
-            command=nixshell + ["set -o pipefail;{}( nix-instantiate --arg configuration shared/1systems/{}.nix --eval --readonly-mode --show-trace -A config.krebs.build.populate --strict | jq -r .)".format("!" if "failing" in i else "",i)])
+            command=nixshell + \
+                      ["{}( make system={} eval.config.krebs.build.populate \
+                         | jq -er .)".format("!" if "failing" in i else "",i)])
 
+  # XXX we must prepare ./retiolum.rsa_key.priv for secrets to work
   addShell(f,name="instantiate-test-all-modules",env=env,
             command=nixshell + \
                       ["touch retiolum.rsa_key.priv; \
diff --git a/shared/5pkgs/default.nix b/shared/5pkgs/default.nix
deleted file mode 100644
index fdcfbb209..000000000
--- a/shared/5pkgs/default.nix
+++ /dev/null
@@ -1,5 +0,0 @@
-# TODO don't require 5pkgs
-_:
-
-{
-}
diff --git a/shared/default.nix b/shared/default.nix
new file mode 100644
index 000000000..69b4abaac
--- /dev/null
+++ b/shared/default.nix
@@ -0,0 +1,7 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./3modules
+  ];
+}
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 8297a56df..9b6382607 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -1,12 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.cd;
-  krebs.build.target = "root@cd.internet";
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-2.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/mkdir.nix b/tv/1systems/mkdir.nix
index 79e5f73b9..58a8fdcb2 100644
--- a/tv/1systems/mkdir.nix
+++ b/tv/1systems/mkdir.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO merge with lass
@@ -17,9 +17,9 @@ in
 
 {
   krebs.build.host = config.krebs.hosts.mkdir;
-  krebs.build.target = "root@${primary-addr4}";
 
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/nomic.nix b/tv/1systems/nomic.nix
index 37ef204c7..2c9775da7 100644
--- a/tv/1systems/nomic.nix
+++ b/tv/1systems/nomic.nix
@@ -1,11 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.nomic;
 
   imports = [
+    ../.
     ../2configs/hw/AO753.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
diff --git a/tv/1systems/rmdir.nix b/tv/1systems/rmdir.nix
index 6fd79c596..c54caa649 100644
--- a/tv/1systems/rmdir.nix
+++ b/tv/1systems/rmdir.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO merge with lass
@@ -18,9 +18,8 @@ in
 {
   krebs.build.host = config.krebs.hosts.rmdir;
 
-  krebs.build.target = "root@rmdir.internet";
-
   imports = [
+    ../.
     ../2configs/hw/CAC-Developer-1.nix
     ../2configs/fs/CAC-CentOS-7-64bit.nix
     ../2configs/exim-smarthost.nix
diff --git a/tv/1systems/wu.nix b/tv/1systems/wu.nix
index 29e6de08b..6154e4df9 100644
--- a/tv/1systems/wu.nix
+++ b/tv/1systems/wu.nix
@@ -1,11 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.wu;
 
   imports = [
+    ../.
     ../2configs/hw/w110er.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
@@ -157,7 +158,7 @@ with lib;
 
   nixpkgs.config.chromium.enablePepperFlash = true;
 
-  nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name;
+  krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "nvidia-x11-" pkg.name;
   hardware.bumblebee.enable = true;
   hardware.bumblebee.group = "video";
   hardware.enableAllFirmware = true;
@@ -191,8 +192,6 @@ with lib;
     "d /tmp 1777 root root - -" # does this work with mounted /tmp?
   ];
 
-  virtualisation.libvirtd.enable = true;
-
   services.udev.extraRules = ''
     SUBSYSTEM=="net", ATTR{address}=="00:90:f5:da:aa:c3", NAME="en0"
     SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:1b:ae:6c", NAME="wl0"
@@ -211,5 +210,4 @@ with lib;
   services.tor.client.enable = true;
   services.tor.enable = true;
   services.virtualboxHost.enable = true;
-
 }
diff --git a/tv/1systems/xu-qemu0.nix b/tv/1systems/xu-qemu0.nix
new file mode 100644
index 000000000..8945c1907
--- /dev/null
+++ b/tv/1systems/xu-qemu0.nix
@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+{
+  krebs.hosts.xu-qemu0 = {
+    cores = 1;
+    ssh.privkey.path = <secrets/ssh.id_ed25519>;
+    # cannot define ssh.pubkey without at least one addr or alias
+    #ssh.pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFe51rD0ZqlMXNi/YpapnRzvdzCjI0icmxfCyBLSKG04";
+  };
+  krebs.build.host = config.krebs.hosts.xu-qemu0;
+
+  imports = [
+    ../.
+    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+  ];
+
+  boot.loader.grub.device = "/dev/sda";
+
+  fileSystems = {
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+    "/" = {
+      device = "/dev/sda2";
+      fsType = "btrfs";
+    };
+  };
+}
diff --git a/tv/1systems/xu.nix b/tv/1systems/xu.nix
index 8c4af2bd3..5ec1fe52b 100644
--- a/tv/1systems/xu.nix
+++ b/tv/1systems/xu.nix
@@ -1,11 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.build.host = config.krebs.hosts.xu;
 
   imports = [
+    ../.
     ../2configs/hw/x220.nix
     ../2configs/exim-retiolum.nix
     ../2configs/git.nix
@@ -14,6 +15,7 @@ with lib;
     ../2configs/pulse.nix
     ../2configs/retiolum.nix
     ../2configs/xserver
+    ../2configs/xu-qemu0.nix
     {
       environment.systemPackages = with pkgs; [
 
@@ -43,7 +45,7 @@ with lib;
         # tv
         bc
         bind # dig
-        #cac
+        cac-api
         dic
         file
         gnupg21
@@ -189,8 +191,6 @@ with lib;
     "d /tmp 1777 root root - -" # does this work with mounted /tmp?
   ];
 
-  #virtualisation.libvirtd.enable = true;
-
   #services.bitlbee.enable = true;
   #services.tor.client.enable = true;
   #services.tor.enable = true;
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index ce937a744..641e2d586 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
-with lib;
+with config.krebs.lib;
 {
-  krebs.backup.plans = addNames {
+  krebs.backup.plans = {
     wu-home-xu = {
       method = "push";
       src = { host = config.krebs.hosts.wu; path = "/home"; };
@@ -14,5 +14,40 @@ with lib;
         yearly   = { format = "%Y";                       };
       };
     };
+    xu-home-wu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/home"; };
+      dst = { host = config.krebs.hosts.wu; path = "/bku/xu-home"; };
+      startAt = "06:00";
+      snapshots = {
+        daily    = { format = "%Y-%m-%d";    retain =  7; };
+        weekly   = { format = "%YW%W";       retain =  4; };
+        monthly  = { format = "%Y-%m";       retain = 12; };
+        yearly   = { format = "%Y";                       };
+      };
+    };
+  } // mapAttrs (_: recursiveUpdate {
+    snapshots = {
+      minutely = { format = "%Y-%m-%dT%H:%M"; retain = 3; };
+      hourly   = { format = "%Y-%m-%dT%H";    retain = 3; };
+      daily    = { format = "%Y-%m-%d";       retain = 3; };
+    };
+    startAt = null;
+  }) {
+    xu-test-push-xu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-push"; };
+    };
+    xu-test-pull-xu = {
+      method = "pull";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.xu; path = "/bku/xu-test-pull"; };
+    };
+    xu-test-push-wu = {
+      method = "push";
+      src = { host = config.krebs.hosts.xu; path = "/tmp/xu-bku-test-data"; };
+      dst = { host = config.krebs.hosts.wu; path = "/bku/xu-test-push"; };
+    };
   };
 }
diff --git a/tv/2configs/charybdis.nix b/tv/2configs/charybdis.nix
index f9ab3da68..eefb2810b 100644
--- a/tv/2configs/charybdis.nix
+++ b/tv/2configs/charybdis.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.charybdis;
 
   out = {
     options.tv.charybdis = api;
-    config = mkIf cfg.enable (mkMerge [
+    config = lib.mkIf cfg.enable (lib.mkMerge [
       imp
       { tv.iptables.input-retiolum-accept-new-tcp = [ 6667 6697 ]; }
     ]);
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index 57c4620c4..c4a2d6baa 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -1,21 +1,18 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.enable = true;
 
   krebs.build = {
     user = config.krebs.users.tv;
-    target = mkDefault "root@${config.krebs.build.host.name}";
     source = mapAttrs (_: mkDefault) ({
       nixos-config = "symlink:stockholm/tv/1systems/${config.krebs.build.host.name}.nix";
-      nixpkgs = symlink:stockholm/nixpkgs;
       secrets = "/home/tv/secrets/${config.krebs.build.host.name}";
       secrets-common = "/home/tv/secrets/common";
       stockholm = "/home/tv/stockholm";
-      stockholm-user = "symlink:stockholm/tv";
-      upstream-nixpkgs = {
+      nixpkgs = {
         url = https://github.com/NixOS/nixpkgs;
         rev = "77f8f35d57618c1ba456d968524f2fb2c3448295";
         dev = "/home/tv/nixpkgs";
@@ -45,6 +42,7 @@ with lib;
           tv = {
             isNormalUser = true;
             uid = 1337;
+            extraGroups = [ "tv" ];
           };
         };
       };
@@ -165,6 +163,7 @@ with lib;
 
     {
       tv.iptables.enable = true;
+      tv.iptables.accept-echo-request = "internet";
     }
 
     {
@@ -184,6 +183,15 @@ with lib;
       ];
     }
     {
+      environment.systemPackages = [
+        pkgs.get
+        pkgs.krebszones
+        pkgs.nix-prefetch-scripts
+        pkgs.push
+      ];
+    }
+
+    {
       systemd.tmpfiles.rules = let
         forUsers = flip map users;
         isUser = { name, group, ... }:
diff --git a/tv/2configs/exim-retiolum.nix b/tv/2configs/exim-retiolum.nix
index aedf25823..9197a3c30 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/tv/2configs/exim-retiolum.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.exim-retiolum.enable = true;
diff --git a/tv/2configs/exim-smarthost.nix b/tv/2configs/exim-smarthost.nix
index bcfea7821..4b49e20b1 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/tv/2configs/exim-smarthost.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.exim-smarthost = {
diff --git a/tv/2configs/git.nix b/tv/2configs/git.nix
index b8180085f..7a42ca9fa 100644
--- a/tv/2configs/git.nix
+++ b/tv/2configs/git.nix
@@ -1,14 +1,14 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
 
   out = {
     krebs.git = {
       enable = true;
-      root-title = "public repositories at ${config.krebs.build.host.name}";
-      root-desc = "keep calm and engage";
+      root-title = "repositories at ${config.krebs.build.host.name}";
+      root-desc = "mostly krebs";
       repos = repos;
       rules = rules;
     };
@@ -21,7 +21,7 @@ let
   rules = concatMap make-rules (attrValues repos);
 
   public-repos = mapAttrs make-public-repo ({
-  } // mapAttrValues (setAttr "section" "1. Miscellaneous") {
+  } // mapAttrValues (setAttr "section" "1. miscellaneous") {
     cac-api = {
       desc = "CloudAtCost API command line interface";
     };
@@ -37,7 +37,7 @@ let
       desc = "SoundCloud command line interface";
     };
     stockholm = {
-      desc = "take all the computers hostage, they'll love you!";
+      desc = "NixOS configuration";
     };
     with-tmpdir = {};
   } // mapAttrValues (setAttr "section" "2. Haskell libraries") {
@@ -49,7 +49,7 @@ let
     web-routes-wai-custom = {};
     xintmap = {};
     xmonad-stockholm = {};
-  } // mapAttrValues (setAttr "section" "3. Museum") {
+  } // mapAttrValues (setAttr "section" "3. museum") {
     cgserver = {};
     crude-mail-setup = {};
     dot-xmonad = {};
@@ -90,12 +90,12 @@ let
     with git // config.krebs.users;
     repo:
       singleton {
-        user = [ tv tv_xu ];
+        user = [ tv tv-xu ];
         repo = [ repo ];
         perm = push "refs/*" [ non-fast-forward create delete merge ];
       } ++
       optional repo.public {
-        user = [ lass makefu uriel ];
+        user = [ lass makefu ];
         repo = [ repo ];
         perm = fetch;
       } ++
diff --git a/tv/2configs/hw/AO753.nix b/tv/2configs/hw/AO753.nix
index 72a40819f..b81b773be 100644
--- a/tv/2configs/hw/AO753.nix
+++ b/tv/2configs/hw/AO753.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   imports = [
@@ -41,5 +41,5 @@ with lib;
     HandleSuspendKey=ignore
   '';
 
-  nixpkgs.config.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name;
+  krebs.nixpkgs.allowUnfreePredicate = pkg: hasPrefix "broadcom-sta-" pkg.name;
 }
diff --git a/tv/2configs/hw/x220.nix b/tv/2configs/hw/x220.nix
index 7cec670fa..9b3dd122a 100644
--- a/tv/2configs/hw/x220.nix
+++ b/tv/2configs/hw/x220.nix
@@ -5,18 +5,11 @@
     ../smartd.nix
   ];
 
-  boot.initrd.availableKernelModules = [ "ahci" ];
-  boot.kernelModules = [ "kvm-intel" ];
-
   boot.loader.gummiboot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
   networking.wireless.enable = true;
 
-  #hardware.enableAllFirmware = true;
-  #zramSwap.enable = true;
-  #zramSwap.numDevices = 2;
-
   hardware.trackpoint = {
     enable = true;
     sensitivity = 220;
@@ -46,14 +39,5 @@
   services.xserver = {
     videoDriver = "intel";
     vaapiDrivers = [ pkgs.vaapiIntel pkgs.vaapiVdpau ];
-    deviceSection = ''
-      Option "AccelMethod" "sna"
-    '';
   };
-
-  #services.xserver.displayManager.sessionCommands =''
-  #  xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation" 8 1
-  #  xinput set-int-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Button" 8 2
-  #  xinput set-prop "TPPS/2 IBM TrackPoint" "Evdev Wheel Emulation Axes" 6 7 4 5
-  #'';
 }
diff --git a/tv/2configs/nginx-public_html.nix b/tv/2configs/nginx-public_html.nix
index dc74f7f8d..15a3b5482 100644
--- a/tv/2configs/nginx-public_html.nix
+++ b/tv/2configs/nginx-public_html.nix
@@ -1,6 +1,6 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.nginx = {
diff --git a/tv/2configs/pulse.nix b/tv/2configs/pulse.nix
index e1894ca64..8e611f21e 100644
--- a/tv/2configs/pulse.nix
+++ b/tv/2configs/pulse.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   pkg = pkgs.pulseaudioLight;
   runDir = "/run/pulse";
diff --git a/tv/2configs/retiolum.nix b/tv/2configs/retiolum.nix
index d2bb9e6cf..e1598d792 100644
--- a/tv/2configs/retiolum.nix
+++ b/tv/2configs/retiolum.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 
-with lib;
+with config.krebs.lib;
 
 {
   krebs.retiolum = {
diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index 8189f6345..0106cddf7 100644
--- a/tv/2configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
@@ -51,6 +51,9 @@
       # <stockholm/tv/2configs/xserver/xserver.conf.nix>
       # is derived from `configFile` in:
       https://raw.githubusercontent.com/NixOS/nixpkgs/master/nixos/modules/services/x11/xserver.nix
+
+      https://pypi.python.org/pypi/vncdotool
+      https://api.github.com/repos/kanaka/noVNC/tags
     ];
   };
 }
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 23f90af05..b0c26e50e 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -1,6 +1,6 @@
-{ lib, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 let
   out = {
     environment.systemPackages = [
@@ -13,9 +13,21 @@ let
     environment.variables.VIMINIT = ":so /etc/vimrc";
   };
 
-  extra-runtimepath = concatStringsSep "," [
-    "${pkgs.vimPlugins.undotree}/share/vim-plugins/undotree"
-  ];
+  extra-runtimepath = let
+    inherit (pkgs.vimUtils) buildVimPlugin rtpPath;
+    fromVimPlugins = pkgs: concatStringsSep ","
+      (mapAttrsToList (name: pkg: "${pkg}/${rtpPath}/${name}") pkgs);
+  in fromVimPlugins {
+    inherit (pkgs.vimPlugins) undotree;
+    file-line = buildVimPlugin {
+      name = "file-line-1.0";
+      src = pkgs.fetchgit {
+        url = git://github.com/bogado/file-line;
+        rev = "refs/tags/1.0";
+        sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0";
+      };
+    };
+  };
 
   dirs = {
     backupdir = "$HOME/.cache/vim/backup";
@@ -32,12 +44,9 @@ let
     alldirs = attrValues dirs ++ map dirOf (attrValues files);
   in unique (sort lessThan alldirs);
 
-  vim = pkgs.writeScriptBin "vim" ''
-    #! ${pkgs.dash}/bin/dash
-    set -f
-    umask 0077
-    ${concatStringsSep "\n" (map (x: "mkdir -p ${x}") mkdirs)}
-    umask 0022
+  vim = pkgs.writeDashBin "vim" ''
+    set -efu
+    (umask 0077; exec ${pkgs.coreutils}/bin/mkdir -p ${toString mkdirs})
     exec ${pkgs.vim}/bin/vim "$@"
   '';
 
diff --git a/tv/2configs/xserver/Xresources.nix b/tv/2configs/xserver/Xresources.nix
index f287bf206..923572721 100644
--- a/tv/2configs/xserver/Xresources.nix
+++ b/tv/2configs/xserver/Xresources.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 pkgs.writeText "Xresources" ''
   !URxvt*background:	#050505
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 5cd17aa1d..4b936f473 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }@args:
 
-with lib;
+with config.krebs.lib;
 
 let
   # TODO krebs.build.user
diff --git a/tv/2configs/xserver/xserver.conf.nix b/tv/2configs/xserver/xserver.conf.nix
index e8a997a99..c452b4226 100644
--- a/tv/2configs/xserver/xserver.conf.nix
+++ b/tv/2configs/xserver/xserver.conf.nix
@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 
-with lib;
+with config.krebs.lib;
 
 let
   cfg = config.services.xserver;
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
new file mode 100644
index 000000000..720a8acd8
--- /dev/null
+++ b/tv/2configs/xu-qemu0.nix
@@ -0,0 +1,243 @@
+{ config, lib, pkgs, ... }:
+
+let
+  # XXX cannot use config.build.host.name here because infinite recursion when
+  # defining  krebs.hosts.${host-name}.nets.retiolum.aliases  below.
+  host-name = "xu";
+in
+
+# usage:
+#   echo set_password vnc correcthorze | xu-qemu0-monitor
+#
+#   vncdo -s xu:1 type 'curl init.xu.r' key shift-\\ type sh key return
+#
+#   http://vnc.xu/vnc_auto.html?port=5701&host=xu&password=correcthorze
+#
+#   make [install] system=xu-qemu0 target_host=10.56.0.101
+
+# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+# TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT
+# TODO iptables -A POSTROUTING -t nat -j MASQUERADE
+# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT
+# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
+
+with config.krebs.lib;
+
+{
+  networking.dhcpcd.denyInterfaces = [ "qemubr0" ];
+
+  systemd.network.enable = true;
+  services.resolved.enable = mkForce false;
+
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+  systemd.network.networks.qemubr0 = {
+    matchConfig.Name = "qemubr0";
+    address = ["10.56.0.1/24"];
+    routes = [{
+      routeConfig = {
+        Gateway = "*";
+        Destination = "10.56.0.0";
+      };
+    }];
+  };
+  systemd.network.netdevs.qemubr0 = {
+    netdevConfig = {
+      Name = "qemubr0";
+      Kind = "bridge";
+    };
+  };
+
+  users.groups.qemu-users.gid = genid "qemu-users";
+
+  environment.etc."qemu/bridge.conf".text = ''
+    allow qemubr0
+  '';
+
+  krebs.per-user.tv.packages = [
+    pkgs.vncdotool
+  ];
+
+  users.users.xu-qemu0 = {
+    createHome = true;
+    group = "qemu-users";
+    home = "/home/xu-qemu0";
+    uid = genid "xu-qemu0";
+  };
+
+  systemd.services.xu-qemu0 = let
+  in {
+    after = [ "network.target" "systemd-resolved.service" ];
+    serviceConfig = {
+      User = "xu-qemu0";
+      SyslogIdentifier = "xu-qemu0";
+      ExecStart = pkgs.writeDash "xu-qemu0" ''
+        set -efu
+        ${pkgs.coreutils}/bin/mkdir -p "$HOME/tmp"
+        img=$HOME/tmp/xu-qemu0.raw
+        if ! test -e "$img"; then
+          ${pkgs.kvm}/bin/qemu-img create "$img" 10G
+        fi
+        exec ${pkgs.kvm}/bin/qemu-kvm \
+            -monitor unix:$HOME/tmp/xu-qemu0-monitor.sock,server,nowait \
+            -boot order=cd \
+            -cdrom ${pkgs.fetchurl {
+              url = https://nixos.org/releases/nixos/15.09/nixos-15.09.1012.9fe0c23/nixos-minimal-15.09.1012.9fe0c23-x86_64-linux.iso;
+              sha256 = "18bc9wrsrjnhj9rya75xliqkl99gxbsk4dmwqivhvwfzb5qb5yp9";
+            }} \
+            -m 1024 \
+            -netdev bridge,br=qemubr0,id=hn0,helper=/var/setuid-wrappers/qemu-bridge-helper \
+            -net nic,netdev=hn0,id=nic1,macaddr=52:54:00:12:34:56 \
+            -drive file="$img",format=raw \
+            -display vnc=:1,websocket=5701,password,lossy \
+            -name xu-qemu0 \
+      '';
+    };
+  };
+
+  krebs.setuid.xu-qemu0-monitor = {
+    filename = pkgs.writeDash "xu-qemu0-monitor" ''
+      exec ${pkgs.socat}/bin/socat \
+          stdio \
+          UNIX-CONNECT:${config.users.users.xu-qemu0.home}/tmp/xu-qemu0-monitor.sock \
+    '';
+    owner = "xu-qemu0";
+    group = "tv";
+  };
+
+  krebs.setuid.qemu-bridge-helper = {
+    filename = "${pkgs.qemu}/libexec/qemu-bridge-helper";
+    group = "qemu-users";
+  };
+
+  users.users.qemu-dnsmasq.uid = genid "qemu-dnsmasq";
+
+  # TODO need custom etc/dbus-1/system.d/dnsmasq.conf for different BusName
+  services.dbus.packages = [ pkgs.dnsmasq ];
+
+  systemd.services.qemu-dnsmasq = let
+    # bind-interfaces
+    conf = pkgs.writeText "qemu-dnsmasq.conf" ''
+      listen-address=10.56.0.1
+      interface=qemubr0
+      dhcp-range=10.56.0.200,10.56.0.250
+      dhcp-no-override
+      dhcp-leasefile=/tmp/qemu-dnsmasq.leases
+      domain=${host-name}.local
+      dhcp-host=52:54:00:12:34:56,xu-qemu0,10.56.0.101,1440m
+    '';
+  in {
+    after = [ "network.target" "systemd-resolved.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "dbus";
+      BusName = "uk.org.thekelleys.dnsmasq";
+      # -1 --enable-dbus[=uk.org.thekelleys.dnsmasq]
+      SyslogIdentifier = "qemu-dnsmasq";
+      ExecStart = "${pkgs.dnsmasq}/bin/dnsmasq -1k -u qemu-dnsmasq -C ${conf}";
+      ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+      PrivateTmp = "true";
+    };
+    restartTriggers = [ config.environment.etc.hosts.source ];
+  };
+
+
+  krebs.nginx.servers.init = {
+    server-names = [
+      "init.${host-name}"
+      "init.${host-name}.r"
+      "init.${host-name}.retiolum"
+    ];
+    extraConfig = ''
+      index init.txt;
+      root ${pkgs.writeTextFile {
+        name = "init-pages";
+        text = ''
+          #! /bin/sh
+          set -efu
+
+          dev=/dev/sda
+          pttype=dos # gpt
+
+          case $pttype in
+            dos)
+              if ! test "$(blkid -o value -s PTTYPE "$dev")" = dos; then
+                parted -s "$dev" mklabel msdos
+              fi
+              if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = primary; then
+                parted -s "$dev" mkpart primary ext4 1MiB 513MiB
+                parted -s "$dev" set 1 boot on
+              fi
+              ;;
+            gpt)
+              if ! test "$(blkid -o value -s PTTYPE "$dev")" = gpt; then
+                parted -s "$dev" mklabel gpt
+              fi
+              if ! test "$(blkid -o value -s PARTLABEL "$dev"1)" = ESP; then
+                parted -s "$dev" mkpart ESP fat32 1MiB 513MiB
+                parted -s "$dev" set 1 boot on
+              fi
+              ;;
+            *)
+              echo "Error: bad pttype: $pttype" >&2
+              exit -1
+          esac
+
+          if ! test "$(blkid -o value -s PARTLABEL "$dev"2)" = primary; then
+            parted -s "$dev" mkpart primary btrfs 513MiB 100%
+          fi
+          if ! test "$(blkid -o value -s TYPE "$dev"1)" = vfat; then
+            mkfs.vfat "$dev"1
+          fi
+          if ! test "$(blkid -o value -s TYPE "$dev"2)" = btrfs; then
+            mkfs.btrfs "$dev"2
+          fi
+
+          parted "$dev" print
+
+          if ! test "$(lsblk -n -o MOUNTPOINT "$dev"2)" = /mnt; then
+            mount "$dev"2 /mnt
+          fi
+          if ! test "$(lsblk -n -o MOUNTPOINT "$dev"1)" = /mnt/boot; then
+            mkdir -m 0000 -p /mnt/boot
+            mount "$dev"1 /mnt/boot
+          fi
+
+          lsblk "$dev"
+
+          key=${shell.escape config.krebs.users.tv-xu.pubkey}
+
+          if [ "$(cat /root/.ssh/authorized_keys 2>/dev/null)" != "$key" ]; then
+            mkdir -p /root/.ssh
+            echo "$key" > /root/.ssh/authorized_keys
+          fi
+          systemctl start sshd
+          ip route
+          echo READY.
+        '';
+        destination = "/init.txt";
+      }};
+    '';
+  };
+
+
+  krebs.hosts.${host-name}.nets.retiolum.aliases = [
+    "init.${host-name}.r"
+    "init.${host-name}.retiolum"
+    "vnc.${host-name}.r"
+    "vnc.${host-name}.retiolum"
+  ];
+
+  krebs.nginx.servers.noVNC = {
+    server-names = [
+      "vnc.${host-name}"
+      "vnc.${host-name}.r"
+      "vnc.${host-name}.retiolum"
+    ];
+    #rewrite ^([^.]*)$ /vnc_auto.html?host=localhost&port=5701;
+    locations = singleton (nameValuePair "/" ''
+      index vnc.html;
+      root ${pkgs.noVNC};
+    '');
+  };
+}
diff --git a/tv/3modules/ejabberd.nix b/tv/3modules/ejabberd.nix
index 581e10074..c9d9b48b1 100644
--- a/tv/3modules/ejabberd.nix
+++ b/tv/3modules/ejabberd.nix
@@ -1,13 +1,12 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.ejabberd;
 
   out = {
     options.tv.ejabberd = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
index cbf49f577..c0fd7ec12 100644
--- a/tv/3modules/iptables.nix
+++ b/tv/3modules/iptables.nix
@@ -1,18 +1,22 @@
 { config, lib, pkgs, ... }:
 
-with builtins;
-with lib;
+with config.krebs.lib;
 let
   cfg = config.tv.iptables;
 
   out = {
     options.tv.iptables = api;
-    config = mkIf cfg.enable imp;
+    config = lib.mkIf cfg.enable imp;
   };
 
   api = {
     enable = mkEnableOption "tv.iptables";
 
+    accept-echo-request = mkOption {
+      type = with types; nullOr (enum ["internet" "retiolum"]);
+      default = "retiolum";
+    };
+
     input-internet-accept-new-tcp = mkOption {
       type = with types; listOf (either int str);
       default = [];
@@ -43,28 +47,38 @@ let
         Type = "simple";
         RemainAfterExit = true;
         Restart = "always";
-        ExecStart = "@${startScript} tv-iptables_start";
+        SyslogIdentifier = "tv-iptables_start";
+        ExecStart = pkgs.writeDash "tv-iptables_start" ''
+          set -euf
+          iptables-restore < ${rules 4}
+          ip6tables-restore < ${rules 6}
+        '';
       };
     };
   };
 
 
-  accept-new-tcp = port:
-    "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT";
-
-  rules = iptables-version:
+  rules = iptables-version: let
+    accept-echo-request = {
+      ip4tables = "-p icmp -m icmp --icmp-type echo-request -j ACCEPT";
+      ip6tables = "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT";
+    }."ip${toString iptables-version}tables";
+    accept-new-tcp = port:
+      "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT";
+  in
     pkgs.writeText "tv-iptables-rules${toString iptables-version}" ''
       *nat
       :PREROUTING ACCEPT [0:0]
       :INPUT ACCEPT [0:0]
       :OUTPUT ACCEPT [0:0]
       :POSTROUTING ACCEPT [0:0]
-      ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") ([]
-        ++ [
-          "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0"
-          "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
-        ]
-      )}
+      ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") [
+        "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0"
+        "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
+      ]}
+      ${concatMapStringsSep "\n" (rule: "-A OUTPUT ${rule}") [
+        "-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
+      ]}
       COMMIT
       *filter
       :INPUT DROP [0:0]
@@ -76,18 +90,12 @@ let
           "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
           "-i lo -j ACCEPT"
         ]
+        ++ optional (cfg.accept-echo-request == "internet") accept-echo-request
         ++ map accept-new-tcp (unique (map toString cfg.input-internet-accept-new-tcp))
         ++ ["-i retiolum -j Retiolum"]
       )}
       ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
-        ++ {
-          ip4tables = [
-            "-p icmp -m icmp --icmp-type echo-request -j ACCEPT"
-          ];
-          ip6tables = [
-            "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT"
-          ];
-        }."ip${toString iptables-version}tables"
+        ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request
         ++ map accept-new-tcp (unique (map toString cfg.input-retiolum-accept-new-tcp))
         ++ {
           ip4tables = [
@@ -104,16 +112,7 @@ let
       )}
       COMMIT
     '';
-
-  startScript = pkgs.writeScript "tv-iptables_start" ''
-    #! /bin/sh
-    set -euf
-    iptables-restore < ${rules 4}
-    ip6tables-restore < ${rules 6}
-  '';
-
-in
-out
+in out
 
 #let
 #  cfg = config.tv.iptables;
diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index be10e91eb..b520e1a32 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -1,22 +1,25 @@
 { pkgs, ... }:
 
 {
-  cr = pkgs.writeScriptBin "cr" ''
-    #! /bin/sh
-    set -efu
-    export LC_TIME=de_DE.utf8
-    exec ${pkgs.chromium}/bin/chromium \
-        --ssl-version-min=tls1 \
-        --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
-        --disk-cache-size=50000000 \
-        "%@"
-  '';
-  ejabberd = pkgs.callPackage ./ejabberd {
-    erlang = pkgs.erlangR16;
+  nixpkgs.config.packageOverrides = {
+    # TODO use XDG_RUNTIME_DIR?
+    cr = pkgs.writeScriptBin "cr" ''
+      #! /bin/sh
+      set -efu
+      export LC_TIME=de_DE.utf8
+      exec ${pkgs.chromium}/bin/chromium \
+          --ssl-version-min=tls1 \
+          --disk-cache-dir=/tmp/chromium-disk-cache_"$LOGNAME" \
+          --disk-cache-size=50000000 \
+          "%@"
+    '';
+    ejabberd = pkgs.callPackage ./ejabberd {
+      erlang = pkgs.erlangR16;
+    };
+    ff = pkgs.callPackage ./ff {};
+    viljetic-pages = pkgs.callPackage ./viljetic-pages {};
+    xmonad-tv =
+      let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in
+      pkgs.haskellPackages.callPackage src {};
   };
-  ff = pkgs.callPackage ./ff {};
-  viljetic-pages = pkgs.callPackage ./viljetic-pages {};
-  xmonad-tv =
-    let src = pkgs.writeNixFromCabal "xmonad-tv.nix" ./xmonad-tv; in
-    pkgs.haskellPackages.callPackage src {};
 }
diff --git a/tv/5pkgs/xmonad-tv/Main.hs b/tv/5pkgs/xmonad-tv/Main.hs
index 6482d9cc8..817d0092e 100644
--- a/tv/5pkgs/xmonad-tv/Main.hs
+++ b/tv/5pkgs/xmonad-tv/Main.hs
@@ -13,7 +13,6 @@ import XMonad
 import System.IO (hPutStrLn, stderr)
 import System.Environment (getArgs, withArgs, getEnv, getEnvironment)
 import System.Posix.Process (executeFile)
-import XMonad.Prompt (defaultXPConfig)
 import XMonad.Actions.DynamicWorkspaces ( addWorkspacePrompt, renameWorkspace
                                         , removeEmptyWorkspace)
 import XMonad.Actions.GridSelect
@@ -64,7 +63,7 @@ mainNoArgs = do
         -- $ withUrgencyHook borderUrgencyHook "magenta"
         -- $ withUrgencyHookC BorderUrgencyHook { urgencyBorderColor = "magenta" } urgencyConfig { suppressWhen = Never }
         $ withUrgencyHook (SpawnUrgencyHook "echo emit Urgency ")
-        $ defaultConfig
+        $ def
             { terminal          = myTerm
             , modMask           = mod4Mask
             , keys              = myKeys
@@ -179,8 +178,8 @@ myKeys conf = Map.fromList $
     , ((_4  , xK_comma  ), sendMessage $ IncMasterN 1)
     , ((_4  , xK_period ), sendMessage $ IncMasterN (-1))
 
-    , ((_4  , xK_a      ), addWorkspacePrompt defaultXPConfig)
-    , ((_4  , xK_r      ), renameWorkspace defaultXPConfig)
+    , ((_4  , xK_a      ), addWorkspacePrompt def)
+    , ((_4  , xK_r      ), renameWorkspace def)
     , ((_4  , xK_Delete ), removeEmptyWorkspace)
 
     , ((_4  , xK_Return ), toggleWS)
@@ -205,7 +204,7 @@ myKeys conf = Map.fromList $
 
 
 pagerConfig :: PagerConfig
-pagerConfig = defaultPagerConfig
+pagerConfig = def
     { pc_font           = myFont
     , pc_cellwidth      = 64
     --, pc_cellheight     = 36 -- TODO automatically keep screen aspect
@@ -218,13 +217,13 @@ pagerConfig = defaultPagerConfig
     where
     windowColors _ _ _ True _ = ("#ef4242","#ff2323")
     windowColors wsf m c u wf = do
-        let def = defaultWindowColors wsf m c u wf
+        let y = defaultWindowColors wsf m c u wf
         if m == False && wf == True
-            then ("#402020", snd def)
-            else def
+            then ("#402020", snd y)
+            else y
 
 horseConfig :: RhombusConfig
-horseConfig = defaultRhombusConfig
+horseConfig = def
     { rc_font           = myFont
     , rc_cellwidth      = 64
     --, rc_cellheight     = 36 -- TODO automatically keep screen aspect
@@ -236,7 +235,7 @@ horseConfig = defaultRhombusConfig
     }
 
 wGSConfig :: GSConfig Window
-wGSConfig = defaultGSConfig
+wGSConfig = def
     { gs_cellheight = 20
     , gs_cellwidth = 192
     , gs_cellpadding = 5
@@ -244,7 +243,7 @@ wGSConfig = defaultGSConfig
     , gs_navigate = navNSearch
     }
 
--- wsGSConfig = defaultGSConfig
+-- wsGSConfig = def
 --     { gs_cellheight = 20
 --     , gs_cellwidth = 64
 --     , gs_cellpadding = 5
diff --git a/tv/default.nix b/tv/default.nix
new file mode 100644
index 000000000..b1c7c1be8
--- /dev/null
+++ b/tv/default.nix
@@ -0,0 +1,9 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./2configs
+    ./3modules
+    ./5pkgs
+  ];
+}