stockholm -> hrm

199 files changed, 642 insertions, 725 deletions

diff --git a/tv/2configs/autotether.nix b/configs/autotether.nix
index 43b5575..43b5575 100644
--- a/tv/2configs/autotether.nix
+++ b/configs/autotether.nix
diff --git a/tv/2configs/backup.nix b/configs/backup.nix
index 56c04c4..30d6011 100644
--- a/tv/2configs/backup.nix
+++ b/configs/backup.nix
@@ -1,7 +1,6 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, mylib, pkgs, ... }: {
   krebs.backup.plans = {
-  } // mapAttrs (_: recursiveUpdate {
+  } // lib.mapAttrs (_: lib.recursiveUpdate {
     snapshots = {
       daily    = { format = "%Y-%m-%d"; retain =  7; };
       weekly   = { format = "%YW%W";    retain =  4; };
@@ -87,7 +86,7 @@ with import ./lib;
       dst = { host = config.krebs.hosts.zu; path = "/bku/ni-home"; };
       startAt = "06:30";
     };
-  } // mapAttrs (_: recursiveUpdate {
+  } // lib.mapAttrs (_: lib.recursiveUpdate {
     snapshots = {
       minutely = { format = "%Y-%m-%dT%H:%M"; retain = 3; };
       hourly   = { format = "%Y-%m-%dT%H";    retain = 3; };
diff --git a/tv/2configs/bash/default.nix b/configs/bash/default.nix
index 57801d9..2e18d5b 100644
--- a/tv/2configs/bash/default.nix
+++ b/configs/bash/default.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, mylib, pkgs, ... }: {
   programs.bash = {
     interactiveShellInit = /* sh */ ''
       HISTCONTROL='erasedups:ignorespace'
@@ -13,7 +12,7 @@ with import ./lib;
       complete -d cd
 
       case $UID in
-        ${shell.escape (toString config.krebs.users.tv.uid)})
+        ${mylib.shell.escape (toString config.krebs.users.tv.uid)})
           if test ''${SHLVL-1} = 1 && test -n "''${DISPLAY-}"; then
             _CURRENT_DESKTOP_NAME=''${_CURRENT_DESKTOP_NAME-$(
               ${pkgs.xorg.xprop}/bin/xprop -notype -root \
diff --git a/tv/2configs/binary-cache/default.nix b/configs/binary-cache/default.nix
index 66d7407..d9e87c7 100644
--- a/tv/2configs/binary-cache/default.nix
+++ b/configs/binary-cache/default.nix
@@ -1,5 +1,4 @@
-{ config, lib, pkgs, ... }: with import ./lib;
-{
+{ config, pkgs, ... }: {
   environment.etc."binary-cache.pubkey".text =
     config.krebs.build.host.binary-cache.pubkey;
 
@@ -11,7 +10,7 @@
 
   services.nix-serve = {
     enable = true;
-    secretKeyFile = toString <secrets> + "/nix-serve.key";
+    secretKeyFile = "${config.krebs.secret.directory}/nix-serve.key";
   };
 
   services.nginx = {
diff --git a/tv/2configs/br.nix b/configs/br.nix
index 47d657c..b9bc70b 100644
--- a/tv/2configs/br.nix
+++ b/configs/br.nix
@@ -1,16 +1,16 @@
-with import ./lib;
-{ config, modulesPath, pkgs, ... }: {
+{ config, lib, modulesPath, mylib, pkgs, ... }: {
 
   imports = [
     (modulesPath + "/services/hardware/sane_extra_backends/brscan4.nix")
   ];
 
-  krebs.nixpkgs.allowUnfreePredicate = pkg: any (eq (packageName pkg)) [
-    "brother-udev-rule-type1"
-    "brscan4"
-    "brscan4-etc-files"
-    "mfcl2700dnlpr"
-  ];
+  krebs.nixpkgs.allowUnfreePredicate =
+    pkg: lib.any (mylib.eq (mylib.packageName pkg)) [
+      "brother-udev-rule-type1"
+      "brscan4"
+      "brscan4-etc-files"
+      "mfcl2700dnlpr"
+    ];
 
   hardware.sane = {
     enable = true;
diff --git a/tv/2configs/default.nix b/configs/default.nix
index a8d840c..5d74d96 100644
--- a/tv/2configs/default.nix
+++ b/configs/default.nix
@@ -1,16 +1,14 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, inputs, lib, mylib, pkgs, ... }: {
   boot.tmpOnTmpfs = true;
 
   krebs.enable = true;
 
   krebs.build.user = config.krebs.users.tv;
 
-  networking.hostId = mkDefault (hashToLength 8 config.networking.hostName);
+  networking.hostId = lib.mkDefault (mylib.hashToLength 8 config.networking.hostName);
   networking.hostName = config.krebs.build.host.name;
 
   imports = [
-    <secrets>
     ./backup.nix
     ./bash
     ./htop.nix
@@ -37,7 +35,7 @@ with import ./lib;
       };
     }
     {
-      i18n.defaultLocale = mkDefault "C.UTF-8";
+      i18n.defaultLocale = lib.mkDefault "C.UTF-8";
       security.sudo.extraConfig = ''
         Defaults env_keep+="SSH_CLIENT _CURRENT_DESKTOP_NAME"
         Defaults mailto="${config.krebs.users.tv.mail}"
@@ -52,13 +50,13 @@ with import ./lib;
     {
       environment.homeBinInPath = true;
 
-      environment.profileRelativeEnvVars.PATH = mkForce [ "/bin" ];
+      environment.profileRelativeEnvVars.PATH = lib.mkForce [ "/bin" ];
 
       environment.systemPackages = with pkgs; [
         rxvt_unicode.terminfo
       ];
 
-      environment.shellAliases = mkForce {
+      environment.shellAliases = lib.mkForce {
         gp = "${pkgs.pari}/bin/gp -q";
         df = "df -h";
         du = "du -h";
@@ -72,7 +70,7 @@ with import ./lib;
       };
 
       environment.variables = {
-        NIX_PATH = mkForce (concatStringsSep ":" [
+        NIX_PATH = lib.mkForce (lib.concatStringsSep ":" [
           "secrets=/var/src/stockholm/null"
           "/var/src"
         ]);
@@ -97,8 +95,8 @@ with import ./lib;
         # https://tldp.org/HOWTO/Linux+IPv6-HOWTO/ch06s05.html
         # TODO check if that is really necessary, otherwise we can rely solely
         # on networking.tempAddresses in the future (when nothing is <21.11)
-        "net.ipv6.conf.all.use_tempaddr" = mkForce 2;
-        "net.ipv6.conf.default.use_tempaddr" = mkForce 2;
+        "net.ipv6.conf.all.use_tempaddr" = lib.mkForce 2;
+        "net.ipv6.conf.default.use_tempaddr" = lib.mkForce 2;
       };
     }
 
diff --git a/tv/2configs/elm-packages-proxy.nix b/configs/elm-packages-proxy.nix
index caea188..caea188 100644
--- a/tv/2configs/elm-packages-proxy.nix
+++ b/configs/elm-packages-proxy.nix
diff --git a/tv/2configs/exim-retiolum.nix b/configs/exim-retiolum.nix
index fefc6dd..7903ac3 100644
--- a/tv/2configs/exim-retiolum.nix
+++ b/configs/exim-retiolum.nix
@@ -1,9 +1,8 @@
-with import ./lib;
 { config, pkgs, ... }: {
   environment.systemPackages = [
     pkgs.eximlog
   ];
   krebs.exim-retiolum.enable = true;
   krebs.exim-retiolum.rspamd.enable = config.krebs.build.host.name == "nomic";
-  tv.iptables.input-retiolum-accept-tcp = singleton "smtp";
+  tv.iptables.input-retiolum-accept-tcp = [ "smtp" ];
 }
diff --git a/tv/2configs/exim-smarthost.nix b/configs/exim-smarthost.nix
index 6750d9a..d983165 100644
--- a/tv/2configs/exim-smarthost.nix
+++ b/configs/exim-smarthost.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   environment.systemPackages = [
     pkgs.eximlog
   ];
@@ -13,7 +12,7 @@ with import ./lib;
       "shackspace.de"
       "viljetic.de"
     ];
-    relay_from_hosts = concatMap (host: host.nets.retiolum.addrs) [
+    relay_from_hosts = lib.concatMap (host: host.nets.retiolum.addrs) [
       config.krebs.hosts.nomic
       config.krebs.hosts.xu
     ];
@@ -42,5 +41,5 @@ with import ./lib;
       { from = "mirko"; to = "mv"; }
     ];
   };
-  tv.iptables.input-internet-accept-tcp = singleton "smtp";
+  tv.iptables.input-internet-accept-tcp = lib.singleton "smtp";
 }
diff --git a/tv/2configs/fs/CAC-CentOS-7-64bit.nix b/configs/fs/CAC-CentOS-7-64bit.nix
index c9eb97f..c9eb97f 100644
--- a/tv/2configs/fs/CAC-CentOS-7-64bit.nix
+++ b/configs/fs/CAC-CentOS-7-64bit.nix
diff --git a/tv/2configs/gitconfig.nix b/configs/gitconfig.nix
index fb9b78e..c4111ed 100644
--- a/tv/2configs/gitconfig.nix
+++ b/configs/gitconfig.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ pkgs, ... }: {
   environment.etc.gitconfig.text = ''
     [alias]
       patch = !${pkgs.git}/bin/git --no-pager diff --no-color
diff --git a/tv/2configs/gitrepos.nix b/configs/gitrepos.nix
index 58dffe6..c69ffa4 100644
--- a/tv/2configs/gitrepos.nix
+++ b/configs/gitrepos.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: let {
+{ config, lib, mylib, pkgs, ... }: let {
 
   body = {
 
@@ -56,12 +55,12 @@ with import ./lib;
 
   repos =
     public-repos //
-    optionalAttrs config.krebs.build.host.secure restricted-repos;
+    lib.optionalAttrs config.krebs.build.host.secure restricted-repos;
 
-  rules = concatMap make-rules (attrValues repos);
+  rules = lib.concatMap make-rules (builtins.attrValues repos);
 
-  public-repos = mapAttrs make-public-repo ({
-  } // mapAttrs (_: recursiveUpdate { cgit.section = "1. miscellaneous"; }) {
+  public-repos = lib.mapAttrs make-public-repo ({
+  } // lib.mapAttrs (_: lib.recursiveUpdate { cgit.section = "1. miscellaneous"; }) {
     couchfs = {
       cgit.desc = "filesystem (in userspace) on top of CouchDB";
     };
@@ -116,10 +115,10 @@ with import ./lib;
       cgit.desc = "TeX live environment generator";
     };
     with-ssh = {};
-  } // mapAttrs (_: recursiveUpdate { cgit.section = "2. Host configurations"; }) {
+  } // lib.mapAttrs (_: lib.recursiveUpdate { cgit.section = "2. Host configurations"; }) {
     ni = {
     };
-  } // mapAttrs (_: recursiveUpdate { cgit.section = "3. Haskell libraries"; }) {
+  } // lib.mapAttrs (_: lib.recursiveUpdate { cgit.section = "3. Haskell libraries"; }) {
     X11-aeson = {};
     blessings = {};
     hack = {};
@@ -132,7 +131,7 @@ with import ./lib;
     xintmap = {};
     xmonad-aeson = {};
     xmonad-web = {};
-  } // mapAttrs (_: recursiveUpdate { cgit.section = "4. museum"; }) {
+  } // lib.mapAttrs (_: lib.recursiveUpdate { cgit.section = "4. museum"; }) {
     cac-api = {
       cgit.desc = "CloudAtCost API command line interface";
     };
@@ -167,7 +166,7 @@ with import ./lib;
     xmonad-stockholm = {};
   });
 
-  restricted-repos = mapAttrs make-restricted-repo (
+  restricted-repos = lib.mapAttrs make-restricted-repo (
     {
       brain = {
         collaborators = with config.krebs.users; [ lass makefu ];
@@ -180,10 +179,10 @@ with import ./lib;
       };
     } //
     # TODO don't put secrets/repos.nix into the store
-    import <secrets/repos.nix> { inherit config lib pkgs; }
+    mylib.importSecret "repos.nix" { inherit config lib pkgs; }
   );
 
-  irc-announce = args: pkgs.git-hooks.irc-announce (recursiveUpdate {
+  irc-announce = args: pkgs.git-hooks.irc-announce (lib.recursiveUpdate {
     channel = "#xxx";
     # TODO make nick = config.krebs.build.host.name the default
     nick = config.krebs.build.host.name;
@@ -200,8 +199,8 @@ with import ./lib;
     public = true;
     hooks = {
       post-receive = /* sh */ ''
-        (${optionalString (config.krebs.build.host.name == "ni")
-                          (irc-announce {})})
+        (${lib.optionalString (config.krebs.build.host.name == "ni")
+                              (irc-announce {})})
         ${cgit-clear-cache}/bin/cgit-clear-cache
       '';
     };
@@ -219,14 +218,17 @@ with import ./lib;
   };
 
   make-rules =
-    with git // config.krebs.users;
+    with mylib.git // config.krebs.users;
     repo:
-      singleton {
-        user = [ tv tv-xu ];
-        repo = [ repo ];
-        perm = push "refs/*" [ non-fast-forward create delete merge ];
-      } ++
-      optional (repo.collaborators or [] != []) {
+      [
+        {
+          user = [ tv tv-xu ];
+          repo = [ repo ];
+          perm = push "refs/*" [ non-fast-forward create delete merge ];
+        }
+      ]
+      ++
+      lib.optional (repo.collaborators or [] != []) {
         user = repo.collaborators;
         repo = [ repo ];
         perm = fetch;
diff --git a/tv/2configs/htop.nix b/configs/htop.nix
index 0937298..e60cc51 100644
--- a/tv/2configs/htop.nix
+++ b/configs/htop.nix
@@ -1,4 +1,3 @@
-with import ./lib;
 { pkgs, ... }: {
   nixpkgs.config.packageOverrides = super: {
     htop = pkgs.symlinkJoin {
diff --git a/tv/2configs/hw/AO753.nix b/configs/hw/AO753.nix
index f2268a9..ea58c01 100644
--- a/tv/2configs/hw/AO753.nix
+++ b/configs/hw/AO753.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, ... }: {
   imports = [
     ../smartd.nix
 
diff --git a/tv/2configs/hw/winmax2.nix b/configs/hw/winmax2.nix
index 7b28466..7b28466 100644
--- a/tv/2configs/hw/winmax2.nix
+++ b/configs/hw/winmax2.nix
diff --git a/tv/2configs/hw/x220.nix b/configs/hw/x220.nix
index ee3c7dc..6993413 100644
--- a/tv/2configs/hw/x220.nix
+++ b/configs/hw/x220.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   imports = [
     ../smartd.nix
     {
diff --git a/tv/2configs/imgur.nix b/configs/imgur.nix
index e221227..ece4749 100644
--- a/tv/2configs/imgur.nix
+++ b/configs/imgur.nix
@@ -1,4 +1,3 @@
-with import ./lib;
 { config, pkgs, ... }: {
   services.nginx.virtualHosts."ni.r" = {
     locations."/image" = {
diff --git a/tv/2configs/initrd/sshd.nix b/configs/initrd/sshd.nix
index eff8480..eff8480 100644
--- a/tv/2configs/initrd/sshd.nix
+++ b/configs/initrd/sshd.nix
diff --git a/tv/2configs/mail-client.nix b/configs/mail-client.nix
index fc8fc81..fc8fc81 100644
--- a/tv/2configs/mail-client.nix
+++ b/configs/mail-client.nix
diff --git a/tv/2configs/man.nix b/configs/man.nix
index c723138..c723138 100644
--- a/tv/2configs/man.nix
+++ b/configs/man.nix
diff --git a/tv/2configs/nets/hkw.nix b/configs/nets/hkw.nix
index 51a8a73..51a8a73 100644
--- a/tv/2configs/nets/hkw.nix
+++ b/configs/nets/hkw.nix
diff --git a/tv/2configs/networkd.nix b/configs/networkd.nix
index da0d9ce..da0d9ce 100644
--- a/tv/2configs/networkd.nix
+++ b/configs/networkd.nix
diff --git a/tv/2configs/nginx/default.nix b/configs/nginx/default.nix
index 6844df9..e288c52 100644
--- a/tv/2configs/nginx/default.nix
+++ b/configs/nginx/default.nix
@@ -1,4 +1,3 @@
-with import ./lib;
 { config, ... }: {
   services.nginx = {
     enableReload = true;
@@ -7,7 +6,7 @@ with import ./lib;
     recommendedOptimisation = true;
     recommendedTlsSettings = true;
 
-    virtualHosts.${toJSON ""} = {
+    virtualHosts.${builtins.toJSON ""} = {
       default = true;
       extraConfig = ''
         error_page 400 =444 /;
@@ -17,6 +16,6 @@ with import ./lib;
     };
   };
   tv.iptables = {
-    input-retiolum-accept-tcp = singleton "http";
+    input-retiolum-accept-tcp = [ "http" ];
   };
 }
diff --git a/tv/2configs/nginx/public_html.nix b/configs/nginx/public_html.nix
index c2403cd..cd8e3c4 100644
--- a/tv/2configs/nginx/public_html.nix
+++ b/configs/nginx/public_html.nix
@@ -1,4 +1,3 @@
-with import ./lib;
 { config, ... }: {
   services.nginx = {
     enable = true;
@@ -14,5 +13,5 @@ with import ./lib;
       };
     };
   };
-  tv.iptables.input-internet-accept-tcp = singleton "http";
+  tv.iptables.input-internet-accept-tcp = [ "http" ];
 }
diff --git a/tv/2configs/nix.nix b/configs/nix.nix
index fa96d45..fa96d45 100644
--- a/tv/2configs/nix.nix
+++ b/configs/nix.nix
diff --git a/tv/2configs/pki/certs/tv.crt b/configs/pki/certs/tv.crt
index ccb2623..ccb2623 100644
--- a/tv/2configs/pki/certs/tv.crt
+++ b/configs/pki/certs/tv.crt
diff --git a/tv/2configs/pki/default.nix b/configs/pki/default.nix
index 415755b..05a608d 100644
--- a/tv/2configs/pki/default.nix
+++ b/configs/pki/default.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: let
+{ config, lib, mylib, pkgs, ... }: let
 
   certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source;
 
@@ -13,7 +12,7 @@ in {
         pkgs.nssTools
       ];
       parseInfoScript = /* jq */ ''
-        ${toJSON certFile} as $certFile |
+        ${builtins.toJSON certFile} as $certFile |
 
         split("\t-----END CERTIFICATE-----\n")[] |
         select(test("\t-----BEGIN CERTIFICATE-----\n")) |
@@ -53,16 +52,16 @@ in {
       mv nssdb "$out"
     '';
 
-  environment.variables = flip genAttrs (_: toString certFile) [
+  environment.variables = lib.flip lib.genAttrs (_: toString certFile) [
     "CURL_CA_BUNDLE"
     "GIT_SSL_CAINFO"
     "SSL_CERT_FILE"
   ];
 
   security.pki.certificateFiles =
-    mapAttrsToList
-      (name: const (./certs + "/${name}"))
-      (filterAttrs (const (eq "regular"))
-                   (readDir ./certs));
+    lib.mapAttrsToList
+      (name: _: (./certs + "/${name}"))
+      (lib.filterAttrs (_: (mylib.eq "regular"))
+                   (builtins.readDir ./certs));
 
 }
diff --git a/tv/2configs/ppp.nix b/configs/ppp.nix
index 24d2831..63e75af 100644
--- a/tv/2configs/ppp.nix
+++ b/configs/ppp.nix
@@ -1,7 +1,6 @@
-with import ./lib;
-{ config, pkgs, ... }: let
+{ config, mylib, pkgs, ... }: let
   cfg = {
-    pin = "@${toString <secrets/o2.pin>}";
+    pin = "@${config.krebs.secret.directory}/o2.pin";
     ttys.ppp = "/dev/ttyACM0";
     ttys.com = "/dev/ttyACM1";
   };
@@ -74,7 +73,7 @@ in {
     (pkgs.writeDashBin "modem-send" ''
       # usage: modem-send ATCOMMAND
       set -efu
-      tty=${lib.shell.escape cfg.ttys.com}
+      tty=${mylib.shell.escape cfg.ttys.com}
       exec <"$tty"
       printf '%s\r\n' "$1" >"$tty"
       ${pkgs.gnused}/bin/sed -E '
diff --git a/tv/2configs/pulse.nix b/configs/pulse.nix
index 7a07e81..17c203c 100644
--- a/tv/2configs/pulse.nix
+++ b/configs/pulse.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: let
+{ config, lib, mylib, pkgs, ... }: let
   pkg = pkgs.pulseaudio;
   runDir = "/run/pulse";
 
@@ -13,12 +12,12 @@ with import ./lib;
   alsaConf = pkgs.writeText "asound.conf" ''
     ctl_type.pulse {
       libs.native = ${pkgs.alsaPlugins}/lib/alsa-lib/libasound_module_ctl_pulse.so;
-      ${optionalString support32Bit
+      ${lib.optionalString support32Bit
         "libs.32Bit = ${pkgs_i686.alsaPlugins}/lib/alsa-lib/libasound_module_ctl_pulse.so;"}
     }
     pcm_type.pulse {
       libs.native = ${pkgs.alsaPlugins}/lib/alsa-lib/libasound_module_pcm_pulse.so;
-      ${optionalString support32Bit
+      ${lib.optionalString support32Bit
         "libs.32Bit = ${pkgs_i686.alsaPlugins}/lib/alsa-lib/libasound_module_pcm_pulse.so;"}
     }
     ctl.!default {
@@ -71,7 +70,7 @@ in
     };
     systemPackages = [
       pkg
-    ] ++ optionals config.services.xserver.enable [
+    ] ++ lib.optionals config.services.xserver.enable [
       pkgs.pavucontrol
     ];
   };
@@ -110,7 +109,7 @@ in
   users = {
     groups.pulse.gid = config.users.users.pulse.uid;
     users.pulse = {
-      uid = genid_uint31 "pulse";
+      uid = mylib.genid_uint31 "pulse";
       group = "pulse";
       extraGroups = [ "audio" ];
       home = "${runDir}/home";
diff --git a/tv/2configs/repo-sync/wiki.nix b/configs/repo-sync/wiki.nix
index 515e731..94f7e80 100644
--- a/tv/2configs/repo-sync/wiki.nix
+++ b/configs/repo-sync/wiki.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, mylib, pkgs, ... }: {
   krebs.repo-sync.enable = true;
   krebs.repo-sync.repos.wiki.branches.hotdog = {
     origin.url = "http://cgit.hotdog.r/wiki";
@@ -27,11 +26,11 @@ with import ./lib;
   krebs.git.rules = lib.singleton {
     user = lib.singleton config.krebs.users.repo-sync;
     repo = lib.singleton config.krebs.git.repos.wiki;
-    perm = lib.git.push "refs/*" [
-      lib.git.create
-      lib.git.delete
-      lib.git.merge
-      lib.git.non-fast-forward
+    perm = mylib.git.push "refs/*" [
+      mylib.git.create
+      mylib.git.delete
+      mylib.git.merge
+      mylib.git.non-fast-forward
     ];
   };
   krebs.users.${config.krebs.repo-sync.user.name}.pubkey = {
diff --git a/tv/2configs/retiolum.nix b/configs/retiolum.nix
index 1b176e0..632cc97 100644
--- a/tv/2configs/retiolum.nix
+++ b/configs/retiolum.nix
@@ -1,8 +1,7 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, mylib, pkgs, ... }: {
   krebs.tinc.retiolum = {
     enable = true;
-    connectTo = filter (ne config.krebs.build.host.name) [
+    connectTo = builtins.filter (mylib.ne config.krebs.build.host.name) [
       "ni"
       "prism"
       "eve"
@@ -22,6 +21,6 @@ with import ./lib;
       "${ip6.addr}/${toString ip6.prefixLength}"
     ];
   };
-  tv.iptables.input-internet-accept-tcp = singleton "tinc";
-  tv.iptables.input-internet-accept-udp = singleton "tinc";
+  tv.iptables.input-internet-accept-tcp = [ "tinc" ];
+  tv.iptables.input-internet-accept-udp = [ "tinc" ];
 }
diff --git a/tv/2configs/smartd.nix b/configs/smartd.nix
index 9c4d8b2..9c4d8b2 100644
--- a/tv/2configs/smartd.nix
+++ b/configs/smartd.nix
diff --git a/tv/2configs/ssh.nix b/configs/ssh.nix
index ad82881..0dda6e5 100644
--- a/tv/2configs/ssh.nix
+++ b/configs/ssh.nix
@@ -1,10 +1,9 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   # Override NixOS's "Allow DSA keys for now."
-  environment.etc."ssh/ssh_config".text = mkForce ''
+  environment.etc."ssh/ssh_config".text = lib.mkForce ''
     AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
 
-    ${optionalString config.programs.ssh.setXAuthLocation ''
+    ${lib.optionalString config.programs.ssh.setXAuthLocation ''
       XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
     ''}
 
diff --git a/tv/2configs/sshd.nix b/configs/sshd.nix
index 59c95cc..281d498 100644
--- a/tv/2configs/sshd.nix
+++ b/configs/sshd.nix
@@ -1,25 +1,24 @@
-with import ./lib;
-{ config, ... }: let
+{ config, lib, ... }: let
   cfg.host = config.krebs.build.host;
   nets =
-    optional (cfg.host.nets?retiolum) cfg.host.nets.retiolum ++
-    optional (cfg.host.nets?wiregrill) cfg.host.nets.wiregrill;
+    lib.optional (cfg.host.nets?retiolum) cfg.host.nets.retiolum ++
+    lib.optional (cfg.host.nets?wiregrill) cfg.host.nets.wiregrill;
 in {
   services.openssh = {
     enable = true;
   };
-  tv.iptables.input-internet-accept-tcp = singleton "ssh";
+  tv.iptables.input-internet-accept-tcp = [ "ssh" ];
   tv.iptables.extra.nat.OUTPUT = [
     "-o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22"
   ];
   tv.iptables.extra4.nat.PREROUTING =
     map
       (net: "-d ${net.ip4.addr} -p tcp --dport 22 -j ACCEPT")
-      (filter (net: net.ip4 != null) nets);
+      (builtins.filter (net: net.ip4 != null) nets);
   tv.iptables.extra6.nat.PREROUTING =
     map
       (net: "-d ${net.ip6.addr} -p tcp --dport 22 -j ACCEPT")
-      (filter (net: net.ip6 != null) nets);
+      (builtins.filter (net: net.ip6 != null) nets);
   tv.iptables.extra.nat.PREROUTING = [
     "-p tcp --dport 22 -j REDIRECT --to-ports 0"
     "-p tcp --dport 11423 -j REDIRECT --to-ports 22"
diff --git a/tv/2configs/urlwatch.nix b/configs/urlwatch.nix
index f5260ee..19f28b1 100644
--- a/tv/2configs/urlwatch.nix
+++ b/configs/urlwatch.nix
@@ -1,11 +1,12 @@
-with import ./lib;
-{ config, pkgs, ... }: let
+{ config, lib, mylib, pkgs, ... }: let
   exec = filename: args: url: {
     inherit url;
-    filter = singleton {
-      system =
-        concatMapStringsSep " " shell.escape ([filename] ++ toList args);
-    };
+    filter = [
+      {
+        system =
+          lib.concatMapStringsSep " " mylib.shell.escape ([filename] ++ lib.toList args);
+      }
+    ];
   };
   json = json' ["."];
   json' = exec "${pkgs.jq}/bin/jq";
@@ -75,7 +76,7 @@ in {
 
       (urigrep' ["software-resources"] https://semiconductor.samsung.com/consumer-storage/support/tools/)
     ];
-    hooksFile = toFile "hooks.py" ''
+    hooksFile = builtins.toFile "hooks.py" ''
       import subprocess
       import urlwatch
 
diff --git a/tv/2configs/vim.nix b/configs/vim.nix
index 8aee310..b06b196 100644
--- a/tv/2configs/vim.nix
+++ b/configs/vim.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: let {
+{ config, lib, mylib, pkgs, ... }: let {
   body = {
     environment.systemPackages = [
       vim-wrapper
@@ -7,7 +6,7 @@ with import ./lib;
 
     environment.etc.vimrc.source = vimrc;
 
-    environment.variables.EDITOR = mkForce "vim";
+    environment.variables.EDITOR = lib.mkForce "vim";
     environment.variables.VIMINIT = ":so /etc/vimrc";
   };
 
@@ -49,10 +48,12 @@ with import ./lib;
   };
 
   need-dirs = let
-    dirOf = s: let out = concatStringsSep "/" (init (splitString "/" s));
-               in assert out != ""; out;
-    alldirs = attrValues dirs ++ map dirOf (attrValues files);
-  in unique (sort lessThan alldirs);
+    dirOf = s:
+      let
+        out = lib.concatStringsSep "/" (lib.init (lib.splitString "/" s));
+      in assert out != ""; out;
+    alldirs = builtins.attrValues dirs ++ map dirOf (builtins.attrValues files);
+  in lib.unique (builtins.sort builtins.lessThan alldirs);
 
   vim-wrapper = pkgs.symlinkJoin {
     name = "vim";
@@ -60,7 +61,7 @@ with import ./lib;
       (pkgs.writeDashBin "vim" ''
         set -efu
         export FZF_DEFAULT_COMMAND='${pkgs.ripgrep}/bin/rg --files'
-        export PATH=$PATH:${makeBinPath [
+        export PATH=$PATH:${lib.makeBinPath [
           pkgs.fzf
           pkgs.ripgrep
         ]}
diff --git a/tv/2configs/weechat-server.nix b/configs/weechat-server.nix
index 41f157c..41f157c 100644
--- a/tv/2configs/weechat-server.nix
+++ b/configs/weechat-server.nix
diff --git a/configs/wiregrill.nix b/configs/wiregrill.nix
new file mode 100644
index 0000000..55bb6f5
--- /dev/null
+++ b/configs/wiregrill.nix
@@ -0,0 +1,36 @@
+{ config, lib, pkgs, ... }: let
+  cfg = {
+    enable = cfg.net != null;
+    net = config.krebs.build.host.nets.wiregrill or null;
+  };
+  toCidrNotation = ip: "${ip.addr}/${toString ip.prefixLength}";
+in
+  lib.mkIf cfg.enable {
+    networking.wireguard.interfaces.wiregrill = {
+      ips =
+        lib.optional (cfg.net.ip4 != null) cfg.net.ip4.addr ++
+        lib.optional (cfg.net.ip6 != null) cfg.net.ip6.addr;
+      listenPort = 51820;
+      privateKeyFile = "${config.krebs.secret.directory}/wiregrill.key";
+      allowedIPsAsRoutes = true;
+      peers = lib.mapAttrsToList
+        (_: host: {
+          allowedIPs = host.nets.wiregrill.wireguard.subnets;
+          endpoint =
+            lib.mkIf (host.nets.wiregrill.via != null) (host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}");
+          persistentKeepalive = lib.mkIf (host.nets.wiregrill.via != null) 61;
+          publicKey =
+            lib.replaceStrings ["\n"] [""] host.nets.wiregrill.wireguard.pubkey;
+        })
+        (lib.filterAttrs (_: h: lib.hasAttr "wiregrill" h.nets) config.krebs.hosts);
+    };
+    systemd.network.networks.wiregrill = {
+      matchConfig.Name = "wiregrill";
+      address =
+        lib.optional (cfg.net.ip4 != null) (toCidrNotation cfg.net.ip4) ++
+        lib.optional (cfg.net.ip6 != null) (toCidrNotation cfg.net.ip6);
+    };
+    tv.iptables.extra.filter.INPUT = [
+      "-p udp --dport ${toString cfg.net.wireguard.port} -j ACCEPT"
+    ];
+  }
diff --git a/tv/2configs/xdg.nix b/configs/xdg.nix
index b7c14af..33f35f0 100644
--- a/tv/2configs/xdg.nix
+++ b/configs/xdg.nix
@@ -1,11 +1,10 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, ... }: {
   environment.variables.XDG_RUNTIME_DIR = "/run/xdg/$LOGNAME";
 
   systemd.tmpfiles.rules = let
-    forUsers = flip map users;
+    forUsers = lib.flip map users;
     isUser = { name, group, ... }:
-      name == "root" || hasSuffix "users" group;
-    users = filter isUser (mapAttrsToList (_: id) config.users.users);
+      name == "root" || lib.hasSuffix "users" group;
+    users = builtins.filter isUser (builtins.attrValues config.users.users);
   in forUsers (u: "d /run/xdg/${u.name} 0700 ${u.name} ${u.group} -");
 }
diff --git a/tv/2configs/xserver/Xmodmap.nix b/configs/xserver/Xmodmap.nix
index 8e555e9..8e555e9 100644
--- a/tv/2configs/xserver/Xmodmap.nix
+++ b/configs/xserver/Xmodmap.nix
diff --git a/tv/2configs/xserver/default.nix b/configs/xserver/default.nix
index 9b9d86f..df83ba5 100644
--- a/tv/2configs/xserver/default.nix
+++ b/configs/xserver/default.nix
@@ -1,4 +1,3 @@
-with import ./lib;
 { config, pkgs, ... }@args: let
   cfg = {
     cacheDir = cfg.dataDir;
diff --git a/tv/2configs/xserver/sxiv.nix b/configs/xserver/sxiv.nix
index eb862f8..13cfd65 100644
--- a/tv/2configs/xserver/sxiv.nix
+++ b/configs/xserver/sxiv.nix
@@ -1,4 +1,3 @@
-with import ./lib;
 { config, pkgs, ... }: let
   cfg.user = config.krebs.build.user;
 in {
diff --git a/tv/2configs/xserver/urxvt.nix b/configs/xserver/urxvt.nix
index 3502c63..c4e619d 100644
--- a/tv/2configs/xserver/urxvt.nix
+++ b/configs/xserver/urxvt.nix
@@ -1,4 +1,3 @@
-with import ./lib;
 { config, pkgs, ... }: let
   cfg.user = config.krebs.build.user;
 in {
diff --git a/tv/2configs/xserver/xkiller.nix b/configs/xserver/xkiller.nix
index 2f97630..2f97630 100644
--- a/tv/2configs/xserver/xkiller.nix
+++ b/configs/xserver/xkiller.nix
diff --git a/tv/2configs/xserver/xserver.conf.nix b/configs/xserver/xserver.conf.nix
index 3fdfebf..3a80567 100644
--- a/tv/2configs/xserver/xserver.conf.nix
+++ b/configs/xserver/xserver.conf.nix
@@ -1,4 +1,3 @@
-with import ./lib;
 { config, pkgs, ... }:
 
 let
diff --git a/tv/2configs/xsessions/default.nix b/configs/xsessions/default.nix
index 384c9c5..384c9c5 100644
--- a/tv/2configs/xsessions/default.nix
+++ b/configs/xsessions/default.nix
diff --git a/tv/2configs/xsessions/urxvtd.nix b/configs/xsessions/urxvtd.nix
index de16a63..de16a63 100644
--- a/tv/2configs/xsessions/urxvtd.nix
+++ b/configs/xsessions/urxvtd.nix
diff --git a/lib/default.nix b/lib/default.nix
deleted file mode 100644
index f9f2f15..0000000
--- a/lib/default.nix
+++ /dev/null
@@ -1 +0,0 @@
-import ./impure.nix
diff --git a/lib/impure.nix b/lib/impure.nix
deleted file mode 100644
index 3f95c37..0000000
--- a/lib/impure.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-import ./pure.nix {
-  lib = import <nixpkgs/lib>;
-}
diff --git a/tv/3modules/Xresources.nix b/modules/Xresources.nix
index 266531d..3f9bc11 100644
--- a/tv/3modules/Xresources.nix
+++ b/modules/Xresources.nix
@@ -1,22 +1,28 @@
-with import ./lib;
-{ config, pkgs, ... }: let
+{ config, lib, pkgs, ... }: let
   cfg = {
     enable = config.services.xserver.enable && config.tv.Xresources != {};
     user = config.krebs.build.user;
   };
+  local.types.Xresources = lib.types.attrsOf lib.types.str;
+
+  mapAttrNames = f: lib.mapAttrs' (name: lib.nameValuePair (f name));
+  mapAttrValues = f: lib.mapAttrs (_: f);
 in {
-  options.tv.Xresources = mkOption {
+  options.tv.Xresources = lib.mkOption {
     default = {};
-    type = types.attrsOf types.str;
+    type = lib.types.attrsOf lib.types.str;
   };
   config = {
-    nixpkgs.overlays = singleton (self: super: {
+    nixpkgs.overlays = lib.singleton (self: super: {
       tv = super.tv or {} // {
         Xresources =
           self.writeText "Xresources"
-            (concatStrings (mapAttrsToList (name: value: /* xdefaults */ ''
-              ${name}: ${value}
-            '') config.tv.Xresources));
+            (lib.concatStrings
+              (lib.mapAttrsToList
+                (name: value: /* xdefaults */ ''
+                  ${name}: ${value}
+                '')
+                config.tv.Xresources));
       };
     });
     systemd.services.${if cfg.enable then "Xresources" else null} = {
diff --git a/tv/3modules/charybdis/config.nix b/modules/charybdis/config.nix
index 4669345..a157ac2 100644
--- a/tv/3modules/charybdis/config.nix
+++ b/modules/charybdis/config.nix
@@ -1,6 +1,6 @@
-{ config, ... }: with import ./lib; let
+{ config, ... }: let
   cfg = config.tv.charybdis;
-in toFile "charybdis.conf" ''
+in builtins.toFile "charybdis.conf" ''
   /* doc/example.conf - brief example configuration file
    *
    * Copyright (C) 2000-2002 Hybrid Development Team
@@ -46,7 +46,7 @@ in toFile "charybdis.conf" ''
   #loadmodule "extensions/ip_cloaking.so";
 
   serverinfo {
-    name = ${toJSON (head config.krebs.build.host.nets.retiolum.aliases)};
+    name = ${builtins.toJSON (builtins.head config.krebs.build.host.nets.retiolum.aliases)};
     sid = "4z3";
     description = "miep!";
     network_name = "irc.r";
@@ -56,15 +56,15 @@ in toFile "charybdis.conf" ''
     /* On multi-homed hosts you may need the following. These define
      * the addresses we connect from to other servers. */
     /* for IPv4 */
-    vhost = ${toJSON config.krebs.build.host.nets.retiolum.ip4.addr};
+    vhost = ${builtins.toJSON config.krebs.build.host.nets.retiolum.ip4.addr};
     /* for IPv6 */
-    vhost6 = ${toJSON config.krebs.build.host.nets.retiolum.ip6.addr};
+    vhost6 = ${builtins.toJSON config.krebs.build.host.nets.retiolum.ip6.addr};
 
     /* ssl_private_key: our ssl private key */
     ssl_private_key = "/tmp/credentials/ssl_private_key";
 
     /* ssl_cert: certificate for our ssl server */
-    ssl_cert = ${toJSON cfg.ssl_cert};
+    ssl_cert = ${builtins.toJSON cfg.ssl_cert};
 
     /* ssl_dh_params: DH parameters, generate with openssl dhparam -out dh.pem 1024 */
     ssl_dh_params = "/tmp/credentials/ssl_dh_params";
@@ -160,7 +160,7 @@ in toFile "charybdis.conf" ''
     /* If you want to listen on a specific IP only, specify host.
      * host definitions apply only to the following port line.
      */
-    #host = ${toJSON config.krebs.build.host.nets.retiolum.ip4.addr};
+    #host = ${builtins.toJSON config.krebs.build.host.nets.retiolum.ip4.addr};
     port = ${toString cfg.port};
     sslport = ${toString cfg.sslport};
   };
diff --git a/tv/3modules/charybdis/default.nix b/modules/charybdis/default.nix
index 4a0f995..337ea13 100644
--- a/tv/3modules/charybdis/default.nix
+++ b/modules/charybdis/default.nix
@@ -1,34 +1,33 @@
-with import ./lib;
-{ config, pkgs, ... }@args: let
+{ config, lib, mylib, pkgs, ... }@args: let
   cfg = config.tv.charybdis;
 in {
   options.tv.charybdis = {
-    enable = mkEnableOption "tv.charybdis";
-    motd = mkOption {
-      type = types.str;
+    enable = lib.mkEnableOption "tv.charybdis";
+    motd = lib.mkOption {
+      type = lib.types.str;
       default = "/join #retiolum";
     };
-    port = mkOption {
-      type = types.int;
+    port = lib.mkOption {
+      type = lib.types.int;
       default = 6667;
     };
-    ssl_cert = mkOption {
-      type = types.path;
+    ssl_cert = lib.mkOption {
+      type = lib.types.path;
     };
-    ssl_dh_params = mkOption {
-      type = types.absolute-pathname;
-      default = toString <secrets> + "/charybdis.dh.pem";
+    ssl_dh_params = lib.mkOption {
+      type = mylib.types.absolute-pathname;
+      default = "${config.krebs.secret.directory}/charybdis.dh.pem";
     };
-    ssl_private_key = mkOption {
-      type = types.absolute-pathname;
-      default = toString <secrets> + "/charybdis.key.pem";
+    ssl_private_key = lib.mkOption {
+      type = mylib.types.absolute-pathname;
+      default = "${config.krebs.secret.directory}/charybdis.key.pem";
     };
-    sslport = mkOption {
-      type = types.int;
+    sslport = lib.mkOption {
+      type = lib.types.int;
       default = 6697;
     };
-    user = mkOption {
-      type = types.user;
+    user = lib.mkOption {
+      type = mylib.types.user;
       default = {
         name = "charybdis";
         home = "/var/lib/charybdis";
diff --git a/modules/default.nix b/modules/default.nix
new file mode 100644
index 0000000..efe9420
--- /dev/null
+++ b/modules/default.nix
@@ -0,0 +1,7 @@
+{ lib, mylib, ... }: {
+  imports =
+    map
+      (name: ./. + "/${name}")
+      (builtins.attrNames
+        (lib.filterAttrs mylib.isNixDirEntry (builtins.readDir ./.)));
+}
diff --git a/tv/3modules/dnsmasq.nix b/modules/dnsmasq.nix
index e1dfdea..b12cea3 100644
--- a/tv/3modules/dnsmasq.nix
+++ b/modules/dnsmasq.nix
@@ -1,33 +1,35 @@
-with import ./lib;
-{ config, ... }: let
+# TODO kill this in favor of unbound
+{ config, lib, mylib, ... }: let
   cfg = config.tv.dnsmasq;
 in {
 
   options.tv.dnsmasq = {
-    enable = mkEnableOption "tv.dnsmasq";
-    dhcp-range = mkOption {
-      type = types.str;
+    enable = lib.mkEnableOption "tv.dnsmasq";
+    dhcp-range = lib.mkOption {
+      type = lib.types.str;
     };
-    interface = mkOption {
-      type = types.str;
+    interface = lib.mkOption {
+      type = lib.types.str;
     };
-    address = mkOption {
-      type = types.str;
+    address = lib.mkOption {
+      type = lib.types.str;
     };
-    prefixLength = mkOption {
-      type = types.addCheck types.int (x: x >= 0 && x <= 32);
+    prefixLength = lib.mkOption {
+      type = lib.types.addCheck lib.types.int (x: x >= 0 && x <= 32);
     };
   };
 
-  config = mkIf cfg.enable (mkMerge [
+  config = lib.mkIf cfg.enable (lib.mkMerge [
     {
       networking.dhcpcd.denyInterfaces = [ cfg.interface ];
       services.dnsmasq.resolveLocalQueries = false;
       networking.interfaces.${cfg.interface} = {
-        ipv4.addresses = singleton {
-          address = cfg.address;
-          prefixLength = cfg.prefixLength;
-        };
+        ipv4.addresses = [
+          {
+            address = cfg.address;
+            prefixLength = cfg.prefixLength;
+          }
+        ];
       };
       services.dnsmasq.enable = true;
       services.dnsmasq.extraConfig = ''
diff --git a/tv/3modules/ejabberd/default.nix b/modules/ejabberd/default.nix
index 71a1a59..02c060d 100644
--- a/tv/3modules/ejabberd/default.nix
+++ b/modules/ejabberd/default.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: let
+{ config, lib, mylib, pkgs, ... }: let
   cfg = config.tv.ejabberd;
 
   gen-dhparam = pkgs.writeDash "gen-dhparam" ''
@@ -16,19 +15,19 @@ with import ./lib;
 
 in {
   options.tv.ejabberd = {
-    enable = mkEnableOption "tv.ejabberd";
-    certfiles = mkOption {
-      type = types.listOf types.absolute-pathname;
+    enable = lib.mkEnableOption "tv.ejabberd";
+    certfiles = lib.mkOption {
+      type = lib.types.listOf mylib.types.absolute-pathname;
       default = [
         (toString <secrets> + "/ejabberd.pem")
       ];
     };
-    configFile = mkOption {
-      type = types.either types.package types.absolute-pathname;
+    configFile = lib.mkOption {
+      type = lib.types.either lib.types.package mylib.types.absolute-pathname;
       default = settingsFormat.generate "ejabberd.yaml" cfg.settings;
     };
-    ciphers = mkOption {
-      type = types.listOf types.str;
+    ciphers = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [
         "ECDHE-ECDSA-AES256-GCM-SHA384"
         "ECDHE-RSA-AES256-GCM-SHA384"
@@ -42,19 +41,19 @@ in {
         "ECDHE-RSA-AES128-SHA256"
       ];
     };
-    credentials.certfiles = mkOption {
+    credentials.certfiles = lib.mkOption {
       internal = true;
       readOnly = true;
       default =
-        imap
-          (i: const "/tmp/credentials/certfile${toJSON i}")
+        lib.imap
+          (i: _: "/tmp/credentials/certfile${builtins.toJSON i}")
           cfg.certfiles;
     };
-    hosts = mkOption {
-      type = with types; listOf str;
+    hosts = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
     };
-    pkgs.ejabberd = mkOption {
-      type = types.package;
+    pkgs.ejabberd = lib.mkOption {
+      type = mylib.types.package;
       default = pkgs.symlinkJoin {
         name = "ejabberd-wrapper";
         paths = [
@@ -70,8 +69,8 @@ in {
         ];
       };
     };
-    protocol_options = mkOption {
-      type = types.listOf types.str;
+    protocol_options = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [
         "no_sslv2"
         "no_sslv3"
@@ -79,23 +78,23 @@ in {
         "no_tlsv1_10"
       ];
     };
-    registration_watchers = mkOption {
-      type = types.listOf types.str;
+    registration_watchers = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [
         config.krebs.users.tv.mail
       ];
     };
-    settings = mkOption {
+    settings = lib.mkOption {
       type = settingsFormat.type;
       default = {};
     };
-    stateDir = mkOption {
+    stateDir = lib.mkOption {
       type =
-        types.addCheck
-          types.absolute-pathname
+        lib.types.addCheck
+          mylib.types.absolute-pathname
           (path:
-            hasPrefix "/var/lib/" path &&
-            types.filename.check (removePrefix "/var/lib/" path)
+            lib.hasPrefix "/var/lib/" path &&
+            mylib.types.filename.check (lib.removePrefix "/var/lib/" path)
           );
       default = "/var/lib/ejabberd";
     };
@@ -148,7 +147,7 @@ in {
         ];
         ExecReload = "${cfg.pkgs.ejabberd}/bin/ejabberdctl reload_config";
         LoadCredential =
-          zipListsWith
+          lib.zipListsWith
             (dst: src: "${baseNameOf dst}:${src}")
             cfg.credentials.certfiles
             cfg.certfiles;
@@ -171,36 +170,36 @@ in {
     # preset config values
     tv.ejabberd.settings = {
       access_rules = {
-        announce = mkDefault [{ allow = "admin"; }];
-        local = mkDefault [{ allow = "local"; }];
-        configure = mkDefault [{ allow = "admin"; }];
-        register = mkDefault ["allow"];
-        s2s = mkDefault ["allow"];
-        trusted_network = mkDefault [{ allow = "loopback"; }];
+        announce = lib.mkDefault [{ allow = "admin"; }];
+        local = lib.mkDefault [{ allow = "local"; }];
+        configure = lib.mkDefault [{ allow = "admin"; }];
+        register = lib.mkDefault ["allow"];
+        s2s = lib.mkDefault ["allow"];
+        trusted_network = lib.mkDefault [{ allow = "loopback"; }];
       };
 
       acl = {
-        local.user_regexp = mkDefault "";
-        loopback.ip = mkDefault [
+        local.user_regexp = lib.mkDefault "";
+        loopback.ip = lib.mkDefault [
           "127.0.0.0/8"
           "::1/128"
           "::FFFF:127.0.0.1/128"
         ];
       };
 
-      certfiles = mkDefault cfg.credentials.certfiles;
+      certfiles = lib.mkDefault cfg.credentials.certfiles;
 
-      hosts = mkDefault cfg.hosts;
+      hosts = lib.mkDefault cfg.hosts;
 
-      language = mkDefault "en";
+      language = lib.mkDefault "en";
 
-      listen = mkDefault [
+      listen = lib.mkDefault [
         {
           port = 5222;
           ip = "::";
           module = "ejabberd_c2s";
           shaper = "c2s_shaper";
-          ciphers = concatStringsSep ":" cfg.ciphers;
+          ciphers = lib.concatStringsSep ":" cfg.ciphers;
           protocol_options = cfg.protocol_options;
           starttls = true;
           starttls_required = true;
@@ -218,57 +217,57 @@ in {
         }
       ];
 
-      loglevel = mkDefault "4";
+      loglevel = lib.mkDefault "4";
 
       modules = {
-        mod_adhoc = mkDefault {};
-        mod_admin_extra = mkDefault {};
-        mod_announce.access = mkDefault "announce";
-        mod_caps = mkDefault {};
-        mod_carboncopy = mkDefault {};
-        mod_client_state = mkDefault {};
-        mod_configure = mkDefault {};
-        mod_disco = mkDefault {};
-        mod_echo = mkDefault {};
-        mod_bosh = mkDefault {};
-        mod_last = mkDefault {};
-        mod_offline.access_max_user_messages = mkDefault "max_user_offline_messages";
-        mod_ping = mkDefault {};
-        mod_privacy = mkDefault {};
-        mod_private = mkDefault {};
+        mod_adhoc = lib.mkDefault {};
+        mod_admin_extra = lib.mkDefault {};
+        mod_announce.access = lib.mkDefault "announce";
+        mod_caps = lib.mkDefault {};
+        mod_carboncopy = lib.mkDefault {};
+        mod_client_state = lib.mkDefault {};
+        mod_configure = lib.mkDefault {};
+        mod_disco = lib.mkDefault {};
+        mod_echo = lib.mkDefault {};
+        mod_bosh = lib.mkDefault {};
+        mod_last = lib.mkDefault {};
+        mod_offline.access_max_user_messages = lib.mkDefault "max_user_offline_messages";
+        mod_ping = lib.mkDefault {};
+        mod_privacy = lib.mkDefault {};
+        mod_private = lib.mkDefault {};
         mod_register = {
-          access_from = mkDefault "deny";
-          access = mkDefault "register";
-          ip_access = mkDefault "trusted_network";
-          registration_watchers = mkDefault cfg.registration_watchers;
+          access_from = lib.mkDefault "deny";
+          access = lib.mkDefault "register";
+          ip_access = lib.mkDefault "trusted_network";
+          registration_watchers = lib.mkDefault cfg.registration_watchers;
         };
-        mod_roster = mkDefault {};
-        mod_shared_roster = mkDefault {};
-        mod_stats = mkDefault {};
-        mod_time = mkDefault {};
-        mod_vcard.search = mkDefault false;
-        mod_version = mkDefault {};
-        mod_http_api = mkDefault {};
+        mod_roster = lib.mkDefault {};
+        mod_shared_roster = lib.mkDefault {};
+        mod_stats = lib.mkDefault {};
+        mod_time = lib.mkDefault {};
+        mod_vcard.search = lib.mkDefault false;
+        mod_version = lib.mkDefault {};
+        mod_http_api = lib.mkDefault {};
       };
 
-      s2s_access = mkDefault "s2s";
-      s2s_ciphers = concatStringsSep ":" cfg.ciphers;
-      s2s_dhfile = mkDefault "${cfg.stateDir}/dhfile";
-      s2s_protocol_options = mkDefault cfg.protocol_options;
-      s2s_tls_compression = mkDefault false;
-      s2s_use_starttls = mkDefault "required";
+      s2s_access = lib.mkDefault "s2s";
+      s2s_ciphers = lib.concatStringsSep ":" cfg.ciphers;
+      s2s_dhfile = lib.mkDefault "${cfg.stateDir}/dhfile";
+      s2s_protocol_options = lib.mkDefault cfg.protocol_options;
+      s2s_tls_compression = lib.mkDefault false;
+      s2s_use_starttls = lib.mkDefault "required";
 
       shaper_rules = {
-        max_user_offline_messages = mkDefault [
+        max_user_offline_messages = lib.mkDefault [
           { "5000" = "admin"; }
           100
         ];
-        max_user_sessions = mkDefault 10;
-        c2s_shaper = mkDefault [
+        max_user_sessions = lib.mkDefault 10;
+        c2s_shaper = lib.mkDefault [
           { "none" = "admin"; }
           "normal"
         ];
-        s2s_shaper = mkDefault "fast";
+        s2s_shaper = lib.mkDefault "fast";
       };
     };
   };
diff --git a/modules/focus.nix b/modules/focus.nix
new file mode 100644
index 0000000..0468489
--- /dev/null
+++ b/modules/focus.nix
@@ -0,0 +1,3 @@
+{ lib, ... }: {
+  options.tv.focus.enable = lib.mkEnableOption "tv.focus";
+}
diff --git a/modules/hosts.nix b/modules/hosts.nix
new file mode 100644
index 0000000..ba7ffe3
--- /dev/null
+++ b/modules/hosts.nix
@@ -0,0 +1,8 @@
+{ config, lib, mylib, ... }: {
+  options.tv.hosts = lib.mkOption {
+    type = lib.types.attrsOf mylib.types.host;
+    default =
+      lib.filterAttrs (_: host: host.owner.name == "tv")
+      config.krebs.hosts;
+  };
+}
diff --git a/tv/3modules/hw.nix b/modules/hw.nix
index db1a77c..653b04f 100644
--- a/tv/3modules/hw.nix
+++ b/modules/hw.nix
@@ -1,11 +1,10 @@
-with import ./lib;
-let
+{ lib, mylib, ... }: let
   local.types.screen = lib.types.submodule {
     options.width = lib.mkOption {
-      type = lib.types.uint;
+      type = mylib.types.uint;
     };
     options.height = lib.mkOption {
-      type = lib.types.uint;
+      type = mylib.types.uint;
     };
   };
 in {
diff --git a/tv/3modules/im.nix b/modules/im.nix
index 76a61b1..d3c5158 100644
--- a/tv/3modules/im.nix
+++ b/modules/im.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: let
+{ config, lib, mylib, pkgs, ... }: let
   im = config.tv.im;
 in {
   options = {
@@ -8,18 +7,18 @@ in {
     };
     tv.im.client.term = lib.mkOption {
       default = "rxvt-unicode-256color";
-      type = lib.types.filename;
+      type = mylib.types.filename;
     };
     tv.im.client.useIPv6 = lib.mkEnableOption "tv.im.client.useIPv6" // {
       default = true;
     };
     tv.im.client.host = lib.mkOption {
       default = config.krebs.hosts.xu;
-      type = lib.types.host;
+      type = mylib.types.host;
     };
     tv.im.client.user = lib.mkOption {
       default = config.krebs.users.tv;
-      type = lib.types.user;
+      type = mylib.types.user;
     };
 
     tv.im.server.enable = lib.mkEnableOption "tv.im.server" // {
@@ -27,7 +26,7 @@ in {
     };
     tv.im.server.host = lib.mkOption {
       default = config.krebs.hosts.nomic;
-      type = lib.types.host;
+      type = mylib.types.host;
     };
     tv.im.server.mosh.enable = lib.mkEnableOption "tv.im.server.mosh" // {
       default = true;
@@ -36,7 +35,7 @@ in {
       lib.mkEnableOption "tv.im.server.weechat.relay";
     tv.im.server.user = lib.mkOption {
       default = config.krebs.users.tv;
-      type = lib.types.user;
+      type = mylib.types.user;
     };
   };
   imports = [
diff --git a/tv/3modules/iptables.nix b/modules/iptables.nix
index 5b36c5a..e2fdcbc 100644
--- a/tv/3modules/iptables.nix
+++ b/modules/iptables.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, pkgs, ... }: let {
+{ config, lib, pkgs, ... }: let {
   cfg = config.tv.iptables;
 
   body = {
@@ -8,34 +7,34 @@ with import ./lib;
   };
 
   extraTypes = {
-    rules = types.submodule {
+    rules = lib.types.submodule {
       options = {
-        nat.OUTPUT = mkOption {
-          type = with types; listOf str;
+        nat.OUTPUT = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [];
         };
-        nat.PREROUTING = mkOption {
-          type = with types; listOf str;
+        nat.PREROUTING = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [];
         };
-        nat.POSTROUTING = mkOption {
-          type = with types; listOf str;
+        nat.POSTROUTING = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [];
         };
-        filter.FORWARD = mkOption {
-          type = with types; listOf str;
+        filter.FORWARD = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [];
         };
-        filter.INPUT = mkOption {
-          type = with types; listOf str;
+        filter.INPUT = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [];
         };
-        filter.Retiolum = mkOption {
-          type = with types; listOf str;
+        filter.Retiolum = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [];
         };
-        filter.Wiregrill = mkOption {
-          type = with types; listOf str;
+        filter.Wiregrill = lib.mkOption {
+          type = with lib.types; listOf str;
           default = [];
         };
       };
@@ -43,54 +42,54 @@ with import ./lib;
   };
 
   api = {
-    enable = mkEnableOption "tv.iptables";
+    enable = lib.mkEnableOption "tv.iptables";
 
-    accept-echo-request = mkOption {
-      type = with types; nullOr (enum ["internet" "retiolum"]);
+    accept-echo-request = lib.mkOption {
+      type = with lib.types; nullOr (enum ["internet" "retiolum"]);
       default = "retiolum";
     };
 
-    input-internet-accept-tcp = mkOption {
-      type = with types; listOf (either int str);
+    input-internet-accept-tcp = lib.mkOption {
+      type = with lib.types; listOf (either int str);
       default = [];
     };
 
-    input-internet-accept-udp = mkOption {
-      type = with types; listOf (either int str);
+    input-internet-accept-udp = lib.mkOption {
+      type = with lib.types; listOf (either int str);
       default = [];
     };
 
-    input-retiolum-accept-tcp = mkOption {
-      type = with types; listOf (either int str);
+    input-retiolum-accept-tcp = lib.mkOption {
+      type = with lib.types; listOf (either int str);
       default = [];
     };
 
-    input-retiolum-accept-udp = mkOption {
-      type = with types; listOf (either int str);
+    input-retiolum-accept-udp = lib.mkOption {
+      type = with lib.types; listOf (either int str);
       default = [];
     };
 
-    input-wiregrill-accept-tcp = mkOption {
-      type = with types; listOf (either int str);
+    input-wiregrill-accept-tcp = lib.mkOption {
+      type = with lib.types; listOf (either int str);
       default = [];
     };
 
-    input-wiregrill-accept-udp = mkOption {
-      type = with types; listOf (either int str);
+    input-wiregrill-accept-udp = lib.mkOption {
+      type = with lib.types; listOf (either int str);
       default = [];
     };
 
-    extra = mkOption {
+    extra = lib.mkOption {
       default = {};
       type = extraTypes.rules;
     };
 
-    extra4 = mkOption {
+    extra4 = lib.mkOption {
       default = {};
       type = extraTypes.rules;
     };
 
-    extra6 = mkOption {
+    extra6 = lib.mkOption {
       default = {};
       type = extraTypes.rules;
     };
@@ -128,9 +127,9 @@ with import ./lib;
   };
 
   formatTable = table:
-    (concatStringsSep "\n"
-      (mapAttrsToList
-        (chain: concatMapStringsSep "\n" (rule: "-A ${chain} ${rule}"))
+    (lib.concatStringsSep "\n"
+      (lib.mapAttrsToList
+        (chain: lib.concatMapStringsSep "\n" (rule: "-A ${chain} ${rule}"))
         table));
 
   rules = iptables-version: let
@@ -156,23 +155,23 @@ with import ./lib;
       :OUTPUT ACCEPT [0:0]
       :Retiolum - [0:0]
       :Wiregrill - [0:0]
-      ${concatMapStringsSep "\n" (rule: "-A INPUT ${rule}") ([]
+      ${lib.concatMapStringsSep "\n" (rule: "-A INPUT ${rule}") ([]
         ++ [
           "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
           "-i lo -j ACCEPT"
         ]
-        ++ optional (cfg.accept-echo-request == "internet") accept-echo-request
-        ++ map accept-tcp (unique (map toString cfg.input-internet-accept-tcp))
-        ++ map accept-udp (unique (map toString cfg.input-internet-accept-udp))
+        ++ lib.optional (cfg.accept-echo-request == "internet") accept-echo-request
+        ++ map accept-tcp (lib.unique (map toString cfg.input-internet-accept-tcp))
+        ++ map accept-udp (lib.unique (map toString cfg.input-internet-accept-udp))
         ++ ["-i retiolum -j Retiolum"]
         ++ ["-i wiregrill -j Wiregrill"]
       )}
       ${formatTable cfg.extra.filter}
       ${formatTable cfg."extra${toString iptables-version}".filter}
-      ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
-        ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request
-        ++ map accept-tcp (unique (map toString cfg.input-retiolum-accept-tcp))
-        ++ map accept-udp (unique (map toString cfg.input-retiolum-accept-udp))
+      ${lib.concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
+        ++ lib.optional (cfg.accept-echo-request == "retiolum") accept-echo-request
+        ++ map accept-tcp (lib.unique (map toString cfg.input-retiolum-accept-tcp))
+        ++ map accept-udp (lib.unique (map toString cfg.input-retiolum-accept-udp))
         ++ {
           ip4tables = [
             "-p tcp -j REJECT --reject-with tcp-reset"
@@ -186,10 +185,10 @@ with import ./lib;
           ];
         }."ip${toString iptables-version}tables"
       )}
-      ${concatMapStringsSep "\n" (rule: "-A Wiregrill ${rule}") ([]
-        ++ optional (cfg.accept-echo-request == "wiregrill") accept-echo-request
-        ++ map accept-tcp (unique (map toString cfg.input-wiregrill-accept-tcp))
-        ++ map accept-udp (unique (map toString cfg.input-wiregrill-accept-udp))
+      ${lib.concatMapStringsSep "\n" (rule: "-A Wiregrill ${rule}") ([]
+        ++ lib.optional (cfg.accept-echo-request == "wiregrill") accept-echo-request
+        ++ map accept-tcp (lib.unique (map toString cfg.input-wiregrill-accept-tcp))
+        ++ map accept-udp (lib.unique (map toString cfg.input-wiregrill-accept-udp))
         ++ {
           ip4tables = [
             "-p tcp -j REJECT --reject-with tcp-reset"
diff --git a/tv/3modules/lidControl.nix b/modules/lidControl.nix
index 6a48da1..6beb032 100644
--- a/tv/3modules/lidControl.nix
+++ b/modules/lidControl.nix
@@ -1,11 +1,10 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   options = {
-    tv.lidControl.enable = mkEnableOption "tv.lidControl";
+    tv.lidControl.enable = lib.mkEnableOption "tv.lidControl";
   };
   config = let
     cfg = config.tv.lidControl;
-  in mkIf cfg.enable {
+  in lib.mkIf cfg.enable {
     services.acpid.enable = true;
     services.acpid.lidEventCommands = /* sh */ ''
       set -- $1
diff --git a/tv/3modules/org.freedesktop.machine1.host-shell.nix b/modules/org.freedesktop.machine1.host-shell.nix
index 7d31edf..b71799d 100644
--- a/tv/3modules/org.freedesktop.machine1.host-shell.nix
+++ b/modules/org.freedesktop.machine1.host-shell.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ config, ... }: {
+{ config, lib, mylib, ... }: {
   options.org.freedesktop.machine1.host-shell.access = lib.mkOption {
     default = {};
     type =
@@ -7,7 +6,7 @@ with import ./lib;
         (lib.types.attrsOf (lib.types.attrsOf lib.types.bool))
         (x:
           lib.all
-            lib.types.username.check
+            mylib.types.username.check
             (lib.concatLists
               (lib.mapAttrsToList
                 (name: value: [name] ++ lib.attrNames value)
@@ -18,7 +17,7 @@ with import ./lib;
     enable = cfg.access != {};
   in lib.optionalString enable /* js */ ''
     polkit.addRule(function () {
-      var access = ${lib.toJSON cfg.access};
+      var access = ${builtins.toJSON cfg.access};
       return function(action, subject) {
         if (action.id === "org.freedesktop.machine1.host-shell"
             && (access[subject.user]||{})[action.lookup("user")])
diff --git a/tv/3modules/slock.nix b/modules/slock.nix
index a083032..d96ae42 100644
--- a/tv/3modules/slock.nix
+++ b/modules/slock.nix
@@ -1,27 +1,26 @@
-with import ./lib;
-{ config, pkgs, ... }: let
+{ config, lib, mylib, pkgs, ... }: let
   cfg = config.tv.slock;
 in {
   options.tv.slock = {
-    enable = mkEnableOption "tv.slock";
-    package = mkOption {
+    enable = lib.mkEnableOption "tv.slock";
+    package = lib.mkOption {
       default = pkgs.writeDashBin "slock" ''
         set -efu
         display=''${DISPLAY#:}
         service=slock-$LOGNAME@$display.service
         exec ${pkgs.systemd}/bin/systemctl start "$service"
       '';
-      type = types.package;
+      type = lib.types.package;
     };
-    user = mkOption {
-      type = types.user;
+    user = lib.mkOption {
+      type = mylib.types.user;
     };
   };
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     security.polkit.extraConfig = /* js */ ''
       polkit.addRule(function(action, subject) {
         if (action.id === "org.freedesktop.systemd1.manage-units" &&
-            subject.user === ${toJSON cfg.user.name} &&
+            subject.user === ${builtins.toJSON cfg.user.name} &&
             /^slock-${cfg.user.name}@[0-9]+\.service$/.test(action.lookup("unit")) ) {
           return polkit.Result.YES;
         }
@@ -42,7 +41,7 @@ in {
             static struct spwd entry = {
               .sp_namp = "",
               .sp_pwdp =
-                ${toC config.users.users.${cfg.user.name}.hashedPassword},
+                ${mylib.toC config.users.users.${cfg.user.name}.hashedPassword},
               .sp_lstchg = 0,
               .sp_min = 0,
               .sp_max = 0,
diff --git a/tv/3modules/systemd.nix b/modules/systemd.nix
index db8a519..20b1d73 100644
--- a/tv/3modules/systemd.nix
+++ b/modules/systemd.nix
@@ -1,13 +1,15 @@
-with import ./lib;
-{ config, ... }: let
-  normalUsers = filterAttrs (_: getAttr "isNormalUser") config.users.users;
+{ config, lib, ... }: let
+  normalUsers =
+    lib.filterAttrs (_: builtins.getAttr "isNormalUser") config.users.users;
 in {
   options = {
-    tv.systemd.services = mkOption {
-      type = types.attrsOf (types.submodule (self: {
+    tv.systemd.services = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule (self: {
         options = {
-          operators = mkOption {
-            type = with types; listOf (enum (attrNames normalUsers));
+          operators = lib.mkOption {
+            type =
+              lib.types.listOf
+                (lib.types.enum (builtins.attrNames normalUsers));
             default = [];
           };
         };
@@ -18,15 +20,15 @@ in {
   config = {
     security.polkit.extraConfig = let
       access =
-        mapAttrs'
+        lib.mapAttrs'
           (name: cfg:
-            nameValuePair "${name}.service"
-                          (genAttrs cfg.operators (const true))
+            lib.nameValuePair "${name}.service"
+                              (lib.genAttrs cfg.operators (_: true))
           )
           config.tv.systemd.services;
-    in optionalString (access != {}) /* js */ ''
+    in lib.optionalString (access != {}) /* js */ ''
       polkit.addRule(function () {
-        const access = ${lib.toJSON access};
+        const access = ${builtins.toJSON access};
         return function (action, subject) {
           if (action.id === "org.freedesktop.systemd1.manage-units") {
             const unit = action.lookup("unit");
diff --git a/tv/3modules/unbound.nix b/modules/unbound.nix
index 6a51027..6a51027 100644
--- a/tv/3modules/unbound.nix
+++ b/modules/unbound.nix
diff --git a/tv/3modules/wwan.nix b/modules/wwan.nix
index 382f5a5..1ce51ab 100644
--- a/tv/3modules/wwan.nix
+++ b/modules/wwan.nix
@@ -1,32 +1,31 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, mylib, pkgs, ... }: {
   options = {
-    tv.wwan.enable = mkEnableOption "tv.wwan";
-    tv.wwan.apn = mkOption {
-      type = with types; filename;
+    tv.wwan.enable = lib.mkEnableOption "tv.wwan";
+    tv.wwan.apn = lib.mkOption {
+      type = mylib.types.filename;
     };
-    tv.wwan.device = mkOption {
-      type = with types; pathname;
+    tv.wwan.device = lib.mkOption {
+      type = mylib.types.pathname;
       default = "/dev/cdc-wdm0";
     };
-    tv.wwan.interface = mkOption {
-      type = with types; nullOr filename;
+    tv.wwan.interface = lib.mkOption {
+      type = lib.types.nullOr mylib.types.filename;
       default = null;
     };
-    tv.wwan.operators = mkOption {
-      type = with types; listOf username;
+    tv.wwan.operators = lib.mkOption {
+      type = lib.types.listOf mylib.types.username;
       default = [];
     };
-    tv.wwan.secrets = mkOption {
-      type = with types; pathname;
+    tv.wwan.secrets = lib.mkOption {
+      type = mylib.types.pathname;
       default = toString <secrets/wwan.json>;
       # format: {"pin1":number}
     };
   };
   config = let
     cfg = config.tv.wwan;
-  in mkIf cfg.enable {
-    nixpkgs.overlays = singleton (self: super: {
+  in lib.mkIf cfg.enable {
+    nixpkgs.overlays = lib.singleton (self: super: {
       uqmi-wrapper = pkgs.symlinkJoin {
         name = "uqmi-wrapper";
         paths = [
diff --git a/tv/3modules/x0vncserver.nix b/modules/x0vncserver.nix
index eb9b1ae..d24c2d0 100644
--- a/tv/3modules/x0vncserver.nix
+++ b/modules/x0vncserver.nix
@@ -1,31 +1,30 @@
-with import ./lib;
-{ config, pkgs, ... }: let
+{ config, lib, mylib, pkgs, ... }: let
   cfg = config.tv.x0vncserver;
 in {
   options.tv.x0vncserver = {
-    display = mkOption {
+    display = lib.mkOption {
       default = ":${toString config.services.xserver.display}";
-      type = types.str;
+      type = lib.types.str;
     };
-    enable = mkEnableOption "tv.x0vncserver";
-    pwfile = mkOption {
-      default = toString <secrets> + "/vncpasswd";
+    enable = lib.mkEnableOption "tv.x0vncserver";
+    pwfile = lib.mkOption {
+      default = "${config.krebs.secret.directory}/vncpasswd";
       description = ''
         Use vncpasswd to edit pwfile.
         See: nix-shell -p tigervnc --run 'man vncpasswd'
       '';
-      type = types.absolute-pathname;
+      type = mylib.types.absolute-pathname;
     };
-    rfbport = mkOption {
+    rfbport = lib.mkOption {
       default = 5900;
-      type = types.int;
+      type = lib.types.int;
     };
-    user = mkOption {
+    user = lib.mkOption {
       default = config.krebs.build.user;
-      type = types.user;
+      type = mylib.types.user;
     };
   };
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     krebs.systemd.services.x0vncserver.restartIfCredentialsChange = true;
     systemd.services.x0vncserver = {
       after = [ "graphical.target" ];
@@ -40,6 +39,6 @@ in {
         User = cfg.user.name;
       };
     };
-    tv.iptables.input-retiolum-accept-tcp = singleton (toString cfg.rfbport);
+    tv.iptables.input-retiolum-accept-tcp = [ (toString cfg.rfbport) ];
   };
 }
diff --git a/tv/5pkgs/compat/default.nix b/pkgs/compat/default.nix
index 0d1e61b..0d1e61b 100644
--- a/tv/5pkgs/compat/default.nix
+++ b/pkgs/compat/default.nix
diff --git a/pkgs/default.nix b/pkgs/default.nix
new file mode 100644
index 0000000..41e17c8
--- /dev/null
+++ b/pkgs/default.nix
@@ -0,0 +1,24 @@
+self: super:
+
+let
+  inherit (super) lib;
+
+  mylib = import ../lib/pure.nix {
+    inherit lib;
+  };
+
+  pushBack = x: xs:
+    if builtins.elem x xs then
+      lib.remove x xs ++ [ x ]
+    else
+      xs;
+in
+
+# Import files and subdirectories like they are overlays.
+lib.fix
+  (builtins.foldl' (lib.flip lib.extends) (_: super)
+    (map
+      (name: import (./. + "/${name}"))
+      (pushBack "override"
+        (builtins.attrNames
+          (lib.filterAttrs mylib.isNixDirEntry (builtins.readDir ./.))))))
diff --git a/pkgs/haskell/default.nix b/pkgs/haskell/default.nix
new file mode 100644
index 0000000..7baaa89
--- /dev/null
+++ b/pkgs/haskell/default.nix
@@ -0,0 +1,31 @@
+let
+  overrides = { lib, mylib }: self: super:
+    mylib.mapNixDir (path: self.callPackage path {}) [
+      ./.
+    ] // {
+      xmonad-tv = self.callPackage ./xmonad-tv {
+        pager = self.desktop-pager;
+      };
+    };
+in
+  self: super: let
+    inherit (super) lib;
+    mylib = import ../../lib/pure.nix {
+      inherit lib;
+    };
+  in {
+    haskell = super.haskell // {
+      packages = lib.mapAttrs (name: value:
+        if builtins.hasAttr "override" value
+          then value.override (old: {
+            overrides =
+              lib.composeExtensions (old.overrides or (_: _: { })) (overrides { inherit lib mylib; });
+          })
+          else value
+      ) super.haskell.packages;
+    };
+    haskellPackages = super.haskellPackages.override (old: {
+      overrides =
+        lib.composeExtensions (old.overrides or (_: _: { })) (overrides { inherit lib mylib; });
+    });
+  }
diff --git a/tv/5pkgs/haskell/th-env/default.nix b/pkgs/haskell/th-env/default.nix
index 158fb16..158fb16 100644
--- a/tv/5pkgs/haskell/th-env/default.nix
+++ b/pkgs/haskell/th-env/default.nix
diff --git a/tv/5pkgs/haskell/th-env/src/THEnv.hs b/pkgs/haskell/th-env/src/THEnv.hs
index b04f2ce..b04f2ce 100644
--- a/tv/5pkgs/haskell/th-env/src/THEnv.hs
+++ b/pkgs/haskell/th-env/src/THEnv.hs
diff --git a/tv/5pkgs/haskell/th-env/th-env.cabal b/pkgs/haskell/th-env/th-env.cabal
index b9a2cff..b9a2cff 100644
--- a/tv/5pkgs/haskell/th-env/th-env.cabal
+++ b/pkgs/haskell/th-env/th-env.cabal
diff --git a/tv/5pkgs/haskell/xmonad-tv/default.nix b/pkgs/haskell/xmonad-tv/default.nix
index f42f97c..f42f97c 100644
--- a/tv/5pkgs/haskell/xmonad-tv/default.nix
+++ b/pkgs/haskell/xmonad-tv/default.nix
diff --git a/tv/5pkgs/haskell/xmonad-tv/shell.nix b/pkgs/haskell/xmonad-tv/shell.nix
index 6ca00bc..6ca00bc 100644
--- a/tv/5pkgs/haskell/xmonad-tv/shell.nix
+++ b/pkgs/haskell/xmonad-tv/shell.nix
diff --git a/tv/5pkgs/haskell/xmonad-tv/src/Shutdown.hs b/pkgs/haskell/xmonad-tv/src/Shutdown.hs
index d4a4d93..d4a4d93 100644
--- a/tv/5pkgs/haskell/xmonad-tv/src/Shutdown.hs
+++ b/pkgs/haskell/xmonad-tv/src/Shutdown.hs
diff --git a/tv/5pkgs/haskell/xmonad-tv/src/XMonad/Extra.hs b/pkgs/haskell/xmonad-tv/src/XMonad/Extra.hs
index 7422271..7422271 100644
--- a/tv/5pkgs/haskell/xmonad-tv/src/XMonad/Extra.hs
+++ b/pkgs/haskell/xmonad-tv/src/XMonad/Extra.hs
diff --git a/tv/5pkgs/haskell/xmonad-tv/src/XMonad/Hooks/EwmhDesktops/Extra.hs b/pkgs/haskell/xmonad-tv/src/XMonad/Hooks/EwmhDesktops/Extra.hs
index bf84314..bf84314 100644
--- a/tv/5pkgs/haskell/xmonad-tv/src/XMonad/Hooks/EwmhDesktops/Extra.hs
+++ b/pkgs/haskell/xmonad-tv/src/XMonad/Hooks/EwmhDesktops/Extra.hs
diff --git a/tv/5pkgs/haskell/xmonad-tv/src/main.hs b/pkgs/haskell/xmonad-tv/src/main.hs
index 7256963..7256963 100644
--- a/tv/5pkgs/haskell/xmonad-tv/src/main.hs
+++ b/pkgs/haskell/xmonad-tv/src/main.hs
diff --git a/tv/5pkgs/haskell/xmonad-tv/src/xmonad-tv.cabal b/pkgs/haskell/xmonad-tv/src/xmonad-tv.cabal
index f211627..f211627 100644
--- a/tv/5pkgs/haskell/xmonad-tv/src/xmonad-tv.cabal
+++ b/pkgs/haskell/xmonad-tv/src/xmonad-tv.cabal
diff --git a/tv/5pkgs/override/alacritty.nix b/pkgs/override/alacritty.nix
index f864fff..f864fff 100644
--- a/tv/5pkgs/override/alacritty.nix
+++ b/pkgs/override/alacritty.nix
diff --git a/tv/5pkgs/override/anbox.nix b/pkgs/override/anbox.nix
index 3940617..3940617 100644
--- a/tv/5pkgs/override/anbox.nix
+++ b/pkgs/override/anbox.nix
diff --git a/pkgs/override/default.nix b/pkgs/override/default.nix
new file mode 100644
index 0000000..cf64142
--- /dev/null
+++ b/pkgs/override/default.nix
@@ -0,0 +1,11 @@
+self: super:
+
+let
+  inherit (super) lib;
+
+  mylib = import ../../lib/pure.nix {
+    inherit lib;
+  };
+in
+
+mylib.mapNixDir (path: import path self super) ./.
diff --git a/tv/5pkgs/override/fzf/complete1.patch b/pkgs/override/fzf/complete1.patch
index 3e3f2c4..3e3f2c4 100644
--- a/tv/5pkgs/override/fzf/complete1.patch
+++ b/pkgs/override/fzf/complete1.patch
diff --git a/tv/5pkgs/override/fzf/default.nix b/pkgs/override/fzf/default.nix
index 2254d45..2254d45 100644
--- a/tv/5pkgs/override/fzf/default.nix
+++ b/pkgs/override/fzf/default.nix
diff --git a/tv/5pkgs/override/gitAndTools.nix b/pkgs/override/gitAndTools.nix
index a460773..a460773 100644
--- a/tv/5pkgs/override/gitAndTools.nix
+++ b/pkgs/override/gitAndTools.nix
diff --git a/tv/5pkgs/override/input-fonts.nix b/pkgs/override/input-fonts.nix
index 6ee7afa..6ee7afa 100644
--- a/tv/5pkgs/override/input-fonts.nix
+++ b/pkgs/override/input-fonts.nix
diff --git a/tv/5pkgs/override/iosevka-tv-1.nix b/pkgs/override/iosevka-tv-1.nix
index 880160b..880160b 100644
--- a/tv/5pkgs/override/iosevka-tv-1.nix
+++ b/pkgs/override/iosevka-tv-1.nix
diff --git a/tv/5pkgs/override/iosevka-tv-2.nix b/pkgs/override/iosevka-tv-2.nix
index 2eecf3c..2eecf3c 100644
--- a/tv/5pkgs/override/iosevka-tv-2.nix
+++ b/pkgs/override/iosevka-tv-2.nix
diff --git a/tv/5pkgs/override/jc.nix b/pkgs/override/jc.nix
index 346dd3e..346dd3e 100644
--- a/tv/5pkgs/override/jc.nix
+++ b/pkgs/override/jc.nix
diff --git a/tv/5pkgs/override/uqmi.nix b/pkgs/override/uqmi.nix
index 1eaecbd..1eaecbd 100644
--- a/tv/5pkgs/override/uqmi.nix
+++ b/pkgs/override/uqmi.nix
diff --git a/tv/5pkgs/rpi/433Utils/RPi_utils.codesend.codestring.patch b/pkgs/rpi/433Utils/RPi_utils.codesend.codestring.patch
index 447e42f..447e42f 100644
--- a/tv/5pkgs/rpi/433Utils/RPi_utils.codesend.codestring.patch
+++ b/pkgs/rpi/433Utils/RPi_utils.codesend.codestring.patch
diff --git a/tv/5pkgs/rpi/433Utils/default.nix b/pkgs/rpi/433Utils/default.nix
index 136e3db..136e3db 100644
--- a/tv/5pkgs/rpi/433Utils/default.nix
+++ b/pkgs/rpi/433Utils/default.nix
diff --git a/tv/5pkgs/rpi/433Utils/rc-switch.protocols.patch b/pkgs/rpi/433Utils/rc-switch.protocols.patch
index 41304ef..41304ef 100644
--- a/tv/5pkgs/rpi/433Utils/rc-switch.protocols.patch
+++ b/pkgs/rpi/433Utils/rc-switch.protocols.patch
diff --git a/tv/5pkgs/rpi/433Utils/src.json b/pkgs/rpi/433Utils/src.json
index 3cf2327..3cf2327 100644
--- a/tv/5pkgs/rpi/433Utils/src.json
+++ b/pkgs/rpi/433Utils/src.json
diff --git a/tv/5pkgs/rpi/WiringPi/default.nix b/pkgs/rpi/WiringPi/default.nix
index 40fcaea..40fcaea 100644
--- a/tv/5pkgs/rpi/WiringPi/default.nix
+++ b/pkgs/rpi/WiringPi/default.nix
diff --git a/tv/5pkgs/rpi/WiringPi/src.json b/pkgs/rpi/WiringPi/src.json
index edf4e82..edf4e82 100644
--- a/tv/5pkgs/rpi/WiringPi/src.json
+++ b/pkgs/rpi/WiringPi/src.json
diff --git a/pkgs/rpi/default.nix b/pkgs/rpi/default.nix
new file mode 100644
index 0000000..50f8aad
--- /dev/null
+++ b/pkgs/rpi/default.nix
@@ -0,0 +1,11 @@
+self: super:
+
+let
+  mylib = import ../../lib/pure.nix {
+    inherit (super) lib;
+  };
+in
+
+{
+  rpiPackages = mylib.mapNixDir (path: self.callPackage path {}) ./.;
+}
diff --git a/tv/5pkgs/simple/alacritty-tv.nix b/pkgs/simple/alacritty-tv.nix
index ddf2ca8..efbcc6e 100644
--- a/tv/5pkgs/simple/alacritty-tv.nix
+++ b/pkgs/simple/alacritty-tv.nix
@@ -1,9 +1,12 @@
-{ pkgs
+{ lib
+, pkgs
 , variant ? "x220"
 }:
 
 let
-  lib = import ./lib;
+  mylib = import ../../lib/pure.nix {
+    inherit lib;
+  };
   font-size = arg: {
     program = "${pkgs.font-size-alacritty}/bin/font-size-alacritty";
     args = [arg];
@@ -78,7 +81,7 @@ let
   };
   writeProfile = name: config: let
     config-file =
-      assert lib.types.filename.check name;
+      assert mylib.types.filename.check name;
       pkgs.writeJSON "alacritty-tv-${name}.json" config;
   in pkgs.writeText "alacritty-tv-${name}.profile" /* sh */ ''
     # Use home so Alacritty can find the configuration without arguments.
@@ -116,17 +119,17 @@ pkgs.symlinkJoin {
       # usage:
       #   alacritty [--profile=PROFILE] [--singleton] [ARGS...]
       # where
-      #   PROFILE one of ${lib.toJSON (lib.attrNames configs)}
+      #   PROFILE one of ${builtins.toJSON (builtins.attrNames configs)}
 
       set -efu
 
       case ''${1-} in
       ${lib.concatMapStringsSep "\n" (name: /* sh */ ''
-        --${lib.shell.escape name}|--profile=${lib.shell.escape name})
+        --${mylib.shell.escape name}|--profile=${mylib.shell.escape name})
           shift
           profile=${writeProfile name configs.${name}}
           ;;
-      '') (lib.attrNames configs)}
+      '') (builtins.attrNames configs)}
         *)
           profile=${writeProfile "default" configs.default}
           ;;
diff --git a/tv/5pkgs/simple/bash-fzf-history.nix b/pkgs/simple/bash-fzf-history.nix
index 1166ec7..f35d5e8 100644
--- a/tv/5pkgs/simple/bash-fzf-history.nix
+++ b/pkgs/simple/bash-fzf-history.nix
@@ -1,5 +1,5 @@
-with import ./lib;
-{ pkgs
+{ lib
+, pkgs
 
 , edit-key ? "ctrl-e"
 , exec-key ? "enter"
@@ -14,6 +14,11 @@ with import ./lib;
 , start-keyseq ? "\\C-f"
 , load-keyseq ? start-keyseq
 }: let
+
+  mylib = import ../../lib/pure.nix {
+    inherit lib;
+  };
+
   script = pkgs.writeBash "bash-fzf-history.sh" ''
     if ! command -v fzf >/dev/null; then
       # Alternatively rewrite ${pkgs.fzf}/share/fzf/* to use absolute paths.
diff --git a/tv/5pkgs/simple/cr.nix b/pkgs/simple/cr.nix
index 048d779..048d779 100644
--- a/tv/5pkgs/simple/cr.nix
+++ b/pkgs/simple/cr.nix
diff --git a/pkgs/simple/default.nix b/pkgs/simple/default.nix
new file mode 100644
index 0000000..1c4a53b
--- /dev/null
+++ b/pkgs/simple/default.nix
@@ -0,0 +1,22 @@
+self: super:
+
+let
+  inherit (super) lib;
+
+  mylib = import ../../lib/pure.nix {
+    inherit lib;
+  };
+
+  # This callPackage will try to detect obsolete overrides.
+  callPackage = path: args: let
+    override = self.callPackage path args;
+    upstream = lib.optionalAttrs (override ? "name")
+      (super.${(builtins.parseDrvName override.name).name} or {});
+  in if upstream ? "name" &&
+        override ? "name" &&
+        builtins.compareVersions upstream.name override.name != -1
+    then builtins.trace "Upstream `${upstream.name}' gets overridden by `${override.name}'." override
+    else override;
+in
+
+  mylib.mapNixDir (path: callPackage path {}) ./.
diff --git a/tv/5pkgs/simple/diff-so-fancy.nix b/pkgs/simple/diff-so-fancy.nix
index d57e6e7..d57e6e7 100644
--- a/tv/5pkgs/simple/diff-so-fancy.nix
+++ b/pkgs/simple/diff-so-fancy.nix
diff --git a/tv/5pkgs/simple/disko.nix b/pkgs/simple/disko.nix
index de8f1df..de8f1df 100644
--- a/tv/5pkgs/simple/disko.nix
+++ b/pkgs/simple/disko.nix
diff --git a/tv/5pkgs/simple/editor-input.nix b/pkgs/simple/editor-input.nix
index 931179a..931179a 100644
--- a/tv/5pkgs/simple/editor-input.nix
+++ b/pkgs/simple/editor-input.nix
diff --git a/tv/5pkgs/simple/ff.nix b/pkgs/simple/ff.nix
index b6022c6..b6022c6 100644
--- a/tv/5pkgs/simple/ff.nix
+++ b/pkgs/simple/ff.nix
diff --git a/tv/5pkgs/simple/field.nix b/pkgs/simple/field.nix
index 7136239..7136239 100644
--- a/tv/5pkgs/simple/field.nix
+++ b/pkgs/simple/field.nix
diff --git a/tv/5pkgs/simple/flameshot-once-tv.nix b/pkgs/simple/flameshot-once-tv.nix
index e3a9f9a..e3a9f9a 100644
--- a/tv/5pkgs/simple/flameshot-once-tv.nix
+++ b/pkgs/simple/flameshot-once-tv.nix
diff --git a/tv/5pkgs/simple/font-size-alacritty.nix b/pkgs/simple/font-size-alacritty.nix
index d37f0f0..d37f0f0 100644
--- a/tv/5pkgs/simple/font-size-alacritty.nix
+++ b/pkgs/simple/font-size-alacritty.nix
diff --git a/tv/5pkgs/simple/fzmenu/bin/otpmenu b/pkgs/simple/fzmenu/bin/otpmenu
index 273a408..273a408 100755
--- a/tv/5pkgs/simple/fzmenu/bin/otpmenu
+++ b/pkgs/simple/fzmenu/bin/otpmenu
diff --git a/tv/5pkgs/simple/fzmenu/bin/passmenu b/pkgs/simple/fzmenu/bin/passmenu
index 76153f5..76153f5 100755
--- a/tv/5pkgs/simple/fzmenu/bin/passmenu
+++ b/pkgs/simple/fzmenu/bin/passmenu
diff --git a/tv/5pkgs/simple/fzmenu/default.nix b/pkgs/simple/fzmenu/default.nix
index 1a285ee..1a285ee 100644
--- a/tv/5pkgs/simple/fzmenu/default.nix
+++ b/pkgs/simple/fzmenu/default.nix
diff --git a/tv/5pkgs/simple/hc.nix b/pkgs/simple/hc.nix
index 086445e..086445e 100644
--- a/tv/5pkgs/simple/hc.nix
+++ b/pkgs/simple/hc.nix
diff --git a/tv/5pkgs/simple/iosevka-tv-1.nix b/pkgs/simple/iosevka-tv-1.nix
index 0f8b4d4..0f8b4d4 100644
--- a/tv/5pkgs/simple/iosevka-tv-1.nix
+++ b/pkgs/simple/iosevka-tv-1.nix
diff --git a/tv/5pkgs/simple/iosevka-tv-2.nix b/pkgs/simple/iosevka-tv-2.nix
index 888ba6a..888ba6a 100644
--- a/tv/5pkgs/simple/iosevka-tv-2.nix
+++ b/pkgs/simple/iosevka-tv-2.nix
diff --git a/tv/5pkgs/simple/libinput-tv.nix b/pkgs/simple/libinput-tv.nix
index 6f08689..6f08689 100644
--- a/tv/5pkgs/simple/libinput-tv.nix
+++ b/pkgs/simple/libinput-tv.nix
diff --git a/tv/5pkgs/simple/mpvterm/default.nix b/pkgs/simple/mpvterm/default.nix
index 66ad08a..66ad08a 100644
--- a/tv/5pkgs/simple/mpvterm/default.nix
+++ b/pkgs/simple/mpvterm/default.nix
diff --git a/tv/5pkgs/simple/mpvterm/mpvterm.patch b/pkgs/simple/mpvterm/mpvterm.patch
index 1263688..1263688 100644
--- a/tv/5pkgs/simple/mpvterm/mpvterm.patch
+++ b/pkgs/simple/mpvterm/mpvterm.patch
diff --git a/tv/5pkgs/simple/pinentry-urxvt/default.nix b/pkgs/simple/pinentry-urxvt/default.nix
index ad8039f..7363f26 100644
--- a/tv/5pkgs/simple/pinentry-urxvt/default.nix
+++ b/pkgs/simple/pinentry-urxvt/default.nix
@@ -1,7 +1,10 @@
-with import ./lib;
-{ pkgs, ... }@args:
+{ lib, pkgs, ... }@args:
 
 let
+  mylib = import ../../../lib/pure.nix {
+    inherit lib;
+  };
+
   # config cannot be declared in the input attribute set because that would
   # cause callPackage to inject the wrong config.  Instead, get it from ...
   # via args.
@@ -86,7 +89,7 @@ in
           read -r _
         then
           until ${pkgs.xdotool}/bin/xdotool search \
-                    --classname ${lib.shell.escape cfg.xwud.className}
+                    --classname ${mylib.shell.escape cfg.xwud.className}
           do
             ${pkgs.coreutils}/bin/sleep 0.1
           done
@@ -96,15 +99,15 @@ in
       display_screenshot
 
       ${lib.optionalString (cfg.display != null) /* sh */ ''
-        if test "$DISPLAY" != ${lib.shell.escape cfg.display}; then
-          export DISPLAY=${lib.shell.escape cfg.display}
+        if test "$DISPLAY" != ${mylib.shell.escape cfg.display}; then
+          export DISPLAY=${mylib.shell.escape cfg.display}
           display_screenshot
         fi
       ''}
 
       exec 3<&0 4>&1 5>&2
       ${pkgs.rxvt_unicode}/bin/urxvt \
-        -name ${lib.shell.escape cfg.appName} \
+        -name ${mylib.shell.escape cfg.appName} \
         -e ${pkgs.writeDash "pinentry-urxvt-tty" ''
           set -efu
           exec 2>&5
diff --git a/tv/5pkgs/simple/q/default.nix b/pkgs/simple/q/default.nix
index 1aea80b..03e924e 100644
--- a/tv/5pkgs/simple/q/default.nix
+++ b/pkgs/simple/q/default.nix
@@ -1,6 +1,11 @@
-with import ./lib;
-{ pkgs }:
+{ lib
+, pkgs
+}:
 let
+  mylib = import ../../../lib/pure.nix {
+    inherit lib;
+  };
+
   q-cal = let
 
     # Maximum width of cal's output.
@@ -35,9 +40,9 @@ let
   '';
 
   q-isodate = TZ: color: /* sh */ ''
-    TZ=${shell.escape TZ} \
+    TZ=${mylib.shell.escape TZ} \
     ${pkgs.coreutils}/bin/date \
-        '+%Y-%m-%dT[;'${shell.escape color}'m%H:%M:%S%:z'
+        '+%Y-%m-%dT[;'${mylib.shell.escape color}'m%H:%M:%S%:z'
   '';
 
   q-deudate = q-isodate "Europe/Berlin" "38;5;085";
diff --git a/tv/5pkgs/simple/rox-filer.nix b/pkgs/simple/rox-filer.nix
index b380bdf..b380bdf 100644
--- a/tv/5pkgs/simple/rox-filer.nix
+++ b/pkgs/simple/rox-filer.nix
diff --git a/tv/5pkgs/simple/rxvt-unicode-256color-terminfo/default.nix b/pkgs/simple/rxvt-unicode-256color-terminfo/default.nix
index d2f6f46..d2f6f46 100644
--- a/tv/5pkgs/simple/rxvt-unicode-256color-terminfo/default.nix
+++ b/pkgs/simple/rxvt-unicode-256color-terminfo/default.nix
diff --git a/tv/5pkgs/simple/rxvt-unicode-256color-terminfo/rxvt-unicode-256color.terminfo b/pkgs/simple/rxvt-unicode-256color-terminfo/rxvt-unicode-256color.terminfo
index 3f43d0d..3f43d0d 100644
--- a/tv/5pkgs/simple/rxvt-unicode-256color-terminfo/rxvt-unicode-256color.terminfo
+++ b/pkgs/simple/rxvt-unicode-256color-terminfo/rxvt-unicode-256color.terminfo
diff --git a/tv/5pkgs/simple/stardict/default.nix b/pkgs/simple/stardict/default.nix
index 2135cc0..2135cc0 100644
--- a/tv/5pkgs/simple/stardict/default.nix
+++ b/pkgs/simple/stardict/default.nix
diff --git a/tv/5pkgs/simple/viljetic-pages/default.nix b/pkgs/simple/viljetic-pages/default.nix
index ee07c92..ee07c92 100644
--- a/tv/5pkgs/simple/viljetic-pages/default.nix
+++ b/pkgs/simple/viljetic-pages/default.nix
diff --git a/tv/5pkgs/simple/viljetic-pages/index.html b/pkgs/simple/viljetic-pages/index.html
index c268cb9..c268cb9 100644
--- a/tv/5pkgs/simple/viljetic-pages/index.html
+++ b/pkgs/simple/viljetic-pages/index.html
diff --git a/tv/5pkgs/simple/viljetic-pages/logo.xpm b/pkgs/simple/viljetic-pages/logo.xpm
index bb263da..bb263da 100644
--- a/tv/5pkgs/simple/viljetic-pages/logo.xpm
+++ b/pkgs/simple/viljetic-pages/logo.xpm
diff --git a/tv/5pkgs/simple/weechat-tv.nix b/pkgs/simple/weechat-tv.nix
index 17d2863..17d2863 100644
--- a/tv/5pkgs/simple/weechat-tv.nix
+++ b/pkgs/simple/weechat-tv.nix
diff --git a/tv/5pkgs/simple/xdpytools/default.nix b/pkgs/simple/xdpytools/default.nix
index 7d1ee07..7d1ee07 100644
--- a/tv/5pkgs/simple/xdpytools/default.nix
+++ b/pkgs/simple/xdpytools/default.nix
diff --git a/tv/5pkgs/simple/xdpytools/src/xdpychvt b/pkgs/simple/xdpytools/src/xdpychvt
index 84c1907..84c1907 100755
--- a/tv/5pkgs/simple/xdpytools/src/xdpychvt
+++ b/pkgs/simple/xdpytools/src/xdpychvt
diff --git a/tv/5pkgs/simple/xdpytools/src/xdpysel b/pkgs/simple/xdpytools/src/xdpysel
index e080155..e080155 100755
--- a/tv/5pkgs/simple/xdpytools/src/xdpysel
+++ b/pkgs/simple/xdpytools/src/xdpysel
diff --git a/tv/5pkgs/simple/xkiller.nix b/pkgs/simple/xkiller.nix
index 8d8f016..8d8f016 100644
--- a/tv/5pkgs/simple/xkiller.nix
+++ b/pkgs/simple/xkiller.nix
diff --git a/tv/5pkgs/simple/xtoggledpms.nix b/pkgs/simple/xtoggledpms.nix
index d164ad7..d164ad7 100644
--- a/tv/5pkgs/simple/xtoggledpms.nix
+++ b/pkgs/simple/xtoggledpms.nix
diff --git a/pkgs/vim/default.nix b/pkgs/vim/default.nix
new file mode 100644
index 0000000..20e845a
--- /dev/null
+++ b/pkgs/vim/default.nix
@@ -0,0 +1,15 @@
+self: super: let
+  inherit (super) lib;
+  mylib = import ../../lib/pure.nix {
+    inherit lib;
+  };
+in {
+  tv = super.tv // {
+    vim = {
+      makePlugin = outPath: outPath // { inherit outPath; };
+      makeRuntimePath =
+        lib.concatMapStringsSep "," (builtins.getAttr "outPath");
+    };
+    vimPlugins = mylib.mapNixDir (path: self.callPackage path {}) ./.;
+  };
+}
diff --git a/tv/5pkgs/vim/elixir.nix b/pkgs/vim/elixir.nix
index 2ffbbc8..2ffbbc8 100644
--- a/tv/5pkgs/vim/elixir.nix
+++ b/pkgs/vim/elixir.nix
diff --git a/tv/5pkgs/vim/file-line.nix b/pkgs/vim/file-line.nix
index 0509cc4..0509cc4 100644
--- a/tv/5pkgs/vim/file-line.nix
+++ b/pkgs/vim/file-line.nix
diff --git a/tv/5pkgs/vim/fzf.nix b/pkgs/vim/fzf.nix
index e24bee5..e24bee5 100644
--- a/tv/5pkgs/vim/fzf.nix
+++ b/pkgs/vim/fzf.nix
diff --git a/tv/5pkgs/vim/hack.nix b/pkgs/vim/hack.nix
index d378f35..3844627 100644
--- a/tv/5pkgs/vim/hack.nix
+++ b/pkgs/vim/hack.nix
@@ -1,4 +1,3 @@
-with import ./lib;
 { pkgs }:
 
 pkgs.tv.vim.makePlugin (pkgs.writeTextFile (let
@@ -13,7 +12,7 @@ in {
       syntax clear
     endif
 
-    let colors_name = ${toJSON name}
+    let colors_name = ${builtins.toJSON name}
 
     hi Normal       ctermbg=235
     hi Comment      ctermfg=242
diff --git a/tv/5pkgs/vim/jq.nix b/pkgs/vim/jq.nix
index 523f49f..523f49f 100644
--- a/tv/5pkgs/vim/jq.nix
+++ b/pkgs/vim/jq.nix
diff --git a/tv/5pkgs/vim/nix.nix b/pkgs/vim/nix.nix
index 43caf46..26c4f1e 100644
--- a/tv/5pkgs/vim/nix.nix
+++ b/pkgs/vim/nix.nix
@@ -1,5 +1,4 @@
-with import ./lib;
-{ pkgs }:
+{ lib, pkgs }:
 
 pkgs.tv.vim.makePlugin (pkgs.write "vim-syntax-nix-nested" {
   "/syntax/haskell.vim".text = ''
@@ -63,24 +62,24 @@ pkgs.tv.vim.makePlugin (pkgs.write "vim-syntax-nix-nested" {
     syn cluster nix_ind_strings contains=NixIND_STRING
     syn cluster nix_strings contains=NixSTRING
 
-    ${concatStringsSep "\n" (let
-      alts = xs: ''\(${concatStringsSep ''\|'' xs}\)'';
+    ${lib.concatStringsSep "\n" (let
+      alts = xs: ''\(${lib.concatStringsSep ''\|'' xs}\)'';
       capitalize = s: let
-        xs = stringToCharacters s;
+        xs = lib.stringToCharacters s;
       in
-        toUpper (head xs) + concatStrings (tail xs);
+        lib.toUpper (builtins.head xs) + lib.concatStrings (builtins.tail xs);
       comment = k: ''/\* ${k} \*/'';
       def = k: ''${k}[ \t\r\n]*='';
       writer = k: ''write${k}[^ \t\r\n]*[ \t\r\n]*\("[^"]*"\|[a-z]\+\)'';
       writerExt = k: writerName ''[^"]*\.${k}'';
       writerName = k:
         ''${alts [''toFile'' ''write[^ \t\r\n]*'']}*[ \t\r\n]*"${k}"'';
-    in mapAttrsToList (name: {
+    in lib.mapAttrsToList (name: {
       extraStart ? null,
       lang ? name
     }:
     let
-      startAlts = filter isString [
+      startAlts = builtins.filter builtins.isString [
         (comment name)
         extraStart
       ];
@@ -92,7 +91,7 @@ pkgs.tv.vim.makePlugin (pkgs.write "vim-syntax-nix-nested" {
       endif
 
       syn match nix_${lang}_sigil
-        \ X${replaceStrings ["X"] ["\\X"] sigil}\ze\('''\|"\)X
+        \ X${lib.replaceStrings ["X"] ["\\X"] sigil}\ze\('''\|"\)X
         \ nextgroup=nix_${lang}_region_IND_STRING,nix_${lang}_region_STRING
         \ transparent
 
diff --git a/tv/5pkgs/vim/showsyntax.nix b/pkgs/vim/showsyntax.nix
index c27dd04..c27dd04 100644
--- a/tv/5pkgs/vim/showsyntax.nix
+++ b/pkgs/vim/showsyntax.nix
diff --git a/tv/5pkgs/vim/tv.nix b/pkgs/vim/tv.nix
index 10816ce..10816ce 100644
--- a/tv/5pkgs/vim/tv.nix
+++ b/pkgs/vim/tv.nix
diff --git a/tv/5pkgs/vim/vim.nix b/pkgs/vim/vim.nix
index c5693a2..e026f13 100644
--- a/tv/5pkgs/vim/vim.nix
+++ b/pkgs/vim/vim.nix
@@ -1,5 +1,10 @@
-with import ./lib;
-{ pkgs }:
+{ lib, pkgs }:
+
+let
+  mylib = import ../../lib/pure.nix {
+    inherit lib;
+  };
+in
 
 pkgs.tv.vim.makePlugin (pkgs.writeTextFile (let
   name = "vim";
@@ -7,10 +12,10 @@ in {
   name = "vim-syntax-${name}-1.0.0";
   destination = "/syntax/${name}.vim";
   text = /* vim */ ''
-    ${concatMapStringsSep "\n" (s: /* vim */ ''
+    ${lib.concatMapStringsSep "\n" (s: /* vim */ ''
       syn keyword vimColor${s} ${s}
         \ containedin=ALLBUT,vimComment,vimLineComment
       hi vimColor${s} ctermfg=${s}
-    '') (map (i: lpad 3 "0" (toString i)) (range 0 255))}
+    '') (map (i: mylib.lpad 3 "0" (toString i)) (lib.range 0 255))}
   '';
 }))
diff --git a/tv/1systems/alnus/config.nix b/systems/alnus/config.nix
index 90501d5..f8dd0b8 100644
--- a/tv/1systems/alnus/config.nix
+++ b/systems/alnus/config.nix
@@ -1,10 +1,8 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   imports = [
-    <stockholm/tv>
-    <stockholm/tv/2configs/hw/x220.nix>
-    <stockholm/tv/2configs/exim-retiolum.nix>
-    <stockholm/tv/2configs/retiolum.nix>
+    ../../configs/hw/x220.nix
+    ../../configs/exim-retiolum.nix
+    ../../configs/retiolum.nix
   ];
 
   boot = {
@@ -47,7 +45,7 @@ with import ./lib;
 
   krebs.build = {
     host = config.krebs.hosts.alnus;
-    user = mkForce config.krebs.users.dv;
+    user = lib.mkForce config.krebs.users.dv;
   };
 
   networking.networkmanager.enable = true;
diff --git a/tv/1systems/au/config.nix b/systems/au/config.nix
index 2521059..bd61f78 100644
--- a/tv/1systems/au/config.nix
+++ b/systems/au/config.nix
@@ -1,11 +1,10 @@
 { config, ... }: {
   imports = [
     ./disks.nix
-    <stockholm/tv>
-    <stockholm/tv/2configs/hw/x220.nix>
-    <stockholm/tv/2configs/ppp.nix>
-    <stockholm/tv/2configs/retiolum.nix>
-    <stockholm/tv/2configs/xsessions>
+    ../../configs/hw/x220.nix
+    ../../configs/ppp.nix
+    ../../configs/retiolum.nix
+    ../../configs/xsessions
   ];
 
   krebs.build.host = config.krebs.hosts.au;
diff --git a/tv/1systems/au/disks.nix b/systems/au/disks.nix
index 434de17..434de17 100644
--- a/tv/1systems/au/disks.nix
+++ b/systems/au/disks.nix
diff --git a/tv/1systems/bu/config.nix b/systems/bu/config.nix
index a3959cd..39d1007 100644
--- a/tv/1systems/bu/config.nix
+++ b/systems/bu/config.nix
@@ -1,14 +1,12 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, ... }: {
   imports = [
     ./disks.nix
-    <stockholm/tv>
-    <stockholm/tv/2configs/hw/x220.nix>
-    <stockholm/tv/2configs/exim-retiolum.nix>
-    <stockholm/tv/2configs/gitconfig.nix>
-    <stockholm/tv/2configs/pulse.nix>
-    <stockholm/tv/2configs/retiolum.nix>
-    <stockholm/tv/2configs/xsessions>
+    ../../configs/hw/x220.nix
+    ../../configs/exim-retiolum.nix
+    ../../configs/gitconfig.nix
+    ../../configs/pulse.nix
+    ../../configs/retiolum.nix
+    ../../configs/xsessions
   ];
 
   krebs.build.host = config.krebs.hosts.bu;
diff --git a/tv/1systems/bu/disks.nix b/systems/bu/disks.nix
index deabefa..deabefa 100644
--- a/tv/1systems/bu/disks.nix
+++ b/systems/bu/disks.nix
diff --git a/tv/1systems/mu/config.nix b/systems/mu/config.nix
index 00cdf84..dc9ea0f 100644
--- a/tv/1systems/mu/config.nix
+++ b/systems/mu/config.nix
@@ -1,15 +1,13 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   imports = [
-    <stockholm/tv>
-    <stockholm/tv/2configs/br.nix>
-    <stockholm/tv/2configs/exim-retiolum.nix>
-    <stockholm/tv/2configs/hw/x220.nix>
-    <stockholm/tv/2configs/retiolum.nix>
+    ../../configs/br.nix
+    ../../configs/exim-retiolum.nix
+    ../../configs/hw/x220.nix
+    ../../configs/retiolum.nix
   ];
 
   krebs.build.host = config.krebs.hosts.mu;
-  krebs.build.user = mkForce config.krebs.users.vv;
+  krebs.build.user = lib.mkForce config.krebs.users.vv;
 
   tv.x0vncserver.enable = true;
 
diff --git a/tv/1systems/nomic/config.nix b/systems/nomic/config.nix
index 5bc25fd..e8a5f9c 100644
--- a/tv/1systems/nomic/config.nix
+++ b/systems/nomic/config.nix
@@ -1,17 +1,15 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   krebs.build.host = config.krebs.hosts.nomic;
 
   imports = [
-    <stockholm/tv>
-    <stockholm/tv/2configs/hw/x220.nix>
-    <stockholm/tv/2configs/exim-retiolum.nix>
-    <stockholm/tv/2configs/gitrepos.nix>
-    <stockholm/tv/2configs/mail-client.nix>
-    <stockholm/tv/2configs/nginx/public_html.nix>
-    <stockholm/tv/2configs/pulse.nix>
-    <stockholm/tv/2configs/retiolum.nix>
-    <stockholm/tv/2configs/xserver>
+    ../../configs/hw/x220.nix
+    ../../configs/exim-retiolum.nix
+    ../../configs/gitrepos.nix
+    ../../configs/mail-client.nix
+    ../../configs/nginx/public_html.nix
+    ../../configs/pulse.nix
+    ../../configs/retiolum.nix
+    ../../configs/xserver
   ];
 
   boot.initrd.luks.devices.luks1.device = "/dev/sda2";
@@ -23,7 +21,7 @@ with import ./lib;
       device = "/dev/sda";
       splashImage = null;
     };
-    systemd-boot.enable = mkForce false;
+    systemd-boot.enable = lib.mkForce false;
   };
 
   fileSystems."/" =
diff --git a/tv/1systems/querel/config.nix b/systems/querel/config.nix
index 7ba7d16..1b99f12 100644
--- a/tv/1systems/querel/config.nix
+++ b/systems/querel/config.nix
@@ -1,12 +1,10 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   imports = [
-    <stockholm/tv>
-    <stockholm/tv/2configs/retiolum.nix>
+   ../../configs/retiolum.nix
   ];
 
   krebs.build.host = config.krebs.hosts.querel;
-  krebs.build.user = mkForce config.krebs.users.itak;
+  krebs.build.user = lib.mkForce config.krebs.users.itak;
 
   boot.initrd.availableKernelModules = [ "ahci" ];
   boot.initrd.luks.devices.querel-luks1 = {
diff --git a/tv/1systems/ru/config.nix b/systems/ru/config.nix
index 0fc6216..a79a1a7 100644
--- a/tv/1systems/ru/config.nix
+++ b/systems/ru/config.nix
@@ -1,10 +1,8 @@
-with import ./lib;
 { config, ... }: {
   imports = [
-    ../..
-    ../../2configs/hw/winmax2.nix
-    ../../2configs/retiolum.nix
-    ../../2configs/wiregrill.nix
+    ../../configs/hw/winmax2.nix
+    ../../configs/retiolum.nix
+    ../../configs/wiregrill.nix
   ];
 
   boot.initrd.luks.devices.main.device = "/dev/nvme0n1p2";
diff --git a/tv/1systems/xu/config.nix b/systems/xu/config.nix
index 83e17e1..761a018 100644
--- a/tv/1systems/xu/config.nix
+++ b/systems/xu/config.nix
@@ -1,25 +1,23 @@
-with import ./lib;
 { config, pkgs, ... }: {
   krebs.build.host = config.krebs.hosts.xu;
 
   imports = [
-    <stockholm/tv>
-    ../../2configs/autotether.nix
-    <stockholm/tv/2configs/hw/x220.nix>
-    <stockholm/tv/2configs/exim-retiolum.nix>
-    <stockholm/tv/2configs/gitconfig.nix>
-    <stockholm/tv/2configs/gitrepos.nix>
-    <stockholm/tv/2configs/mail-client.nix>
-    <stockholm/tv/2configs/man.nix>
-    <stockholm/tv/2configs/nginx/public_html.nix>
-    <stockholm/tv/2configs/ppp.nix>
-    <stockholm/tv/2configs/pulse.nix>
-    <stockholm/tv/2configs/retiolum.nix>
-    <stockholm/tv/2configs/binary-cache>
-    <stockholm/tv/2configs/br.nix>
-    <stockholm/tv/2configs/xserver>
-    <stockholm/tv/2configs/xsessions>
-    <stockholm/tv/2configs/xserver/xkiller.nix>
+    ../../configs/autotether.nix
+    ../../configs/hw/x220.nix
+    ../../configs/exim-retiolum.nix
+    ../../configs/gitconfig.nix
+    ../../configs/gitrepos.nix
+    ../../configs/mail-client.nix
+    ../../configs/man.nix
+    ../../configs/nginx/public_html.nix
+    ../../configs/ppp.nix
+    ../../configs/pulse.nix
+    ../../configs/retiolum.nix
+    ../../configs/binary-cache
+    ../../configs/br.nix
+    ../../configs/xserver
+    ../../configs/xsessions
+    ../../configs/xserver/xkiller.nix
     {
       environment.systemPackages = with pkgs; [
 
diff --git a/tv/1systems/zu/config.nix b/systems/zu/config.nix
index 169fa6b..01e0441 100644
--- a/tv/1systems/zu/config.nix
+++ b/systems/zu/config.nix
@@ -1,18 +1,16 @@
-with import ./lib;
-{ config, pkgs, ... }: {
+{ config, ... }: {
   krebs.build.host = config.krebs.hosts.zu;
 
   imports = [
-    <stockholm/tv>
-    <stockholm/tv/2configs/hw/x220.nix>
-    <stockholm/tv/2configs/exim-retiolum.nix>
-    <stockholm/tv/2configs/gitrepos.nix>
-    <stockholm/tv/2configs/mail-client.nix>
-    <stockholm/tv/2configs/man.nix>
-    <stockholm/tv/2configs/nginx/public_html.nix>
-    <stockholm/tv/2configs/pulse.nix>
-    <stockholm/tv/2configs/retiolum.nix>
-    <stockholm/tv/2configs/xserver>
+    ../../configs/hw/x220.nix
+    ../../configs/exim-retiolum.nix
+    ../../configs/gitrepos.nix
+    ../../configs/mail-client.nix
+    ../../configs/man.nix
+    ../../configs/nginx/public_html.nix
+    ../../configs/pulse.nix
+    ../../configs/retiolum.nix
+    ../../configs/xserver
   ];
 
   boot.initrd.luks.devices.zuca.device = "/dev/sda2";
diff --git a/tv/1systems/alnus/lib b/tv/1systems/alnus/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/1systems/alnus/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/1systems/au/lib b/tv/1systems/au/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/1systems/au/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/1systems/bu/lib b/tv/1systems/bu/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/1systems/bu/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/1systems/lib b/tv/1systems/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/1systems/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/1systems/mu/lib b/tv/1systems/mu/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/1systems/mu/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/1systems/nomic/lib b/tv/1systems/nomic/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/1systems/nomic/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/1systems/querel/lib b/tv/1systems/querel/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/1systems/querel/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/1systems/xu/lib b/tv/1systems/xu/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/1systems/xu/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/2configs/bash/lib b/tv/2configs/bash/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/2configs/bash/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/2configs/binary-cache/lib b/tv/2configs/binary-cache/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/2configs/binary-cache/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/2configs/hw/lib b/tv/2configs/hw/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/2configs/hw/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/2configs/lib b/tv/2configs/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/2configs/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/2configs/nginx/lib b/tv/2configs/nginx/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/2configs/nginx/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/2configs/pki/lib b/tv/2configs/pki/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/2configs/pki/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/2configs/repo-sync/lib b/tv/2configs/repo-sync/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/2configs/repo-sync/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/2configs/wiregrill.nix b/tv/2configs/wiregrill.nix
deleted file mode 100644
index edf65e9..0000000
--- a/tv/2configs/wiregrill.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-with import ./lib;
-{ config, pkgs, ... }: let
-  cfg = {
-    enable = cfg.net != null;
-    net = config.krebs.build.host.nets.wiregrill or null;
-  };
-  toCidrNotation = ip: "${ip.addr}/${toString ip.prefixLength}";
-in
-  mkIf cfg.enable {
-    networking.wireguard.interfaces.wiregrill = {
-      ips =
-        optional (cfg.net.ip4 != null) cfg.net.ip4.addr ++
-        optional (cfg.net.ip6 != null) cfg.net.ip6.addr;
-      listenPort = 51820;
-      privateKeyFile = (toString <secrets>) + "/wiregrill.key";
-      allowedIPsAsRoutes = true;
-      peers = mapAttrsToList
-        (_: host: {
-          allowedIPs = host.nets.wiregrill.wireguard.subnets;
-          endpoint =
-            mkIf (host.nets.wiregrill.via != null) (host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}");
-          persistentKeepalive = mkIf (host.nets.wiregrill.via != null) 61;
-          publicKey =
-            replaceStrings ["\n"] [""] host.nets.wiregrill.wireguard.pubkey;
-        })
-        (filterAttrs (_: h: hasAttr "wiregrill" h.nets) config.krebs.hosts);
-    };
-    systemd.network.networks.wiregrill = {
-      matchConfig.Name = "wiregrill";
-      address =
-        optional (cfg.net.ip4 != null) (toCidrNotation cfg.net.ip4) ++
-        optional (cfg.net.ip6 != null) (toCidrNotation cfg.net.ip6);
-    };
-    tv.iptables.extra.filter.INPUT = [
-      "-p udp --dport ${toString cfg.net.wireguard.port} -j ACCEPT"
-    ];
-  }
diff --git a/tv/2configs/xserver/lib b/tv/2configs/xserver/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/2configs/xserver/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/3modules/charybdis/lib b/tv/3modules/charybdis/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/3modules/charybdis/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/3modules/default.nix b/tv/3modules/default.nix
deleted file mode 100644
index 1a0971e..0000000
--- a/tv/3modules/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-with import ./lib;
-{
-  imports =
-    map
-      (name: ./. + "/${name}")
-      (attrNames
-        (filterAttrs isNixDirEntry (readDir ./.)));
-}
diff --git a/tv/3modules/ejabberd/lib b/tv/3modules/ejabberd/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/3modules/ejabberd/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/3modules/focus.nix b/tv/3modules/focus.nix
deleted file mode 100644
index c16d442..0000000
--- a/tv/3modules/focus.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-with import ./lib;
-{
-  options.tv.focus.enable = mkEnableOption "tv.focus";
-}
diff --git a/tv/3modules/hosts.nix b/tv/3modules/hosts.nix
deleted file mode 100644
index 2d382e2..0000000
--- a/tv/3modules/hosts.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-with import ./lib;
-{ config, ... }: {
-  options.tv.hosts = mkOption {
-    type = types.attrsOf types.host;
-    default =
-      filterAttrs (_: host: host.owner.name == "tv")
-      config.krebs.hosts;
-  };
-}
diff --git a/tv/3modules/lib b/tv/3modules/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/3modules/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
deleted file mode 100644
index 245d054..0000000
--- a/tv/5pkgs/default.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-with import ./lib;
-let
-  pushBack = x: xs:
-    if elem x xs then
-      remove x xs ++ [ x ]
-    else
-      xs;
-in
-
-self: super:
-
-# Import files and subdirectories like they are overlays.
-fix
-  (foldl' (flip extends) (_: super)
-    (map
-      (name: import (./. + "/${name}"))
-      (pushBack "override"
-        (attrNames
-          (filterAttrs isNixDirEntry (readDir ./.))))))
diff --git a/tv/5pkgs/haskell/default.nix b/tv/5pkgs/haskell/default.nix
deleted file mode 100644
index 193a263..0000000
--- a/tv/5pkgs/haskell/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-with import ./lib;
-let
-  overrides = self: super:
-    mapNixDir (path: self.callPackage path {}) [
-      <stockholm/krebs/5pkgs/haskell>
-      ./.
-    ] // {
-      xmonad-tv = self.callPackage ./xmonad-tv {
-        pager = self.desktop-pager;
-      };
-    };
-in
-  self: super: {
-    haskell = super.haskell // {
-      packages = mapAttrs (name: value:
-        if hasAttr "override" value
-          then value.override (old: {
-            overrides =
-              composeExtensions (old.overrides or (_: _: { })) overrides;
-          })
-          else value
-      ) super.haskell.packages;
-    };
-    haskellPackages = super.haskellPackages.override (old: {
-      overrides =
-        composeExtensions (old.overrides or (_: _: { })) overrides;
-    });
-  }
diff --git a/tv/5pkgs/haskell/lib b/tv/5pkgs/haskell/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/5pkgs/haskell/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/5pkgs/lib b/tv/5pkgs/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/5pkgs/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/5pkgs/override/default.nix b/tv/5pkgs/override/default.nix
deleted file mode 100644
index 87b7ce9..0000000
--- a/tv/5pkgs/override/default.nix
+++ /dev/null
@@ -1,4 +0,0 @@
-with import ./lib;
-self: super:
-
-mapNixDir (path: import path self super) ./.
diff --git a/tv/5pkgs/override/lib b/tv/5pkgs/override/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/5pkgs/override/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/5pkgs/rpi/default.nix b/tv/5pkgs/rpi/default.nix
deleted file mode 100644
index e41d637..0000000
--- a/tv/5pkgs/rpi/default.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-with import ./lib;
-
-self: super:
-
-{
-  rpiPackages = lib.mapNixDir (path: self.callPackage path {}) ./.;
-}
diff --git a/tv/5pkgs/rpi/lib b/tv/5pkgs/rpi/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/5pkgs/rpi/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/5pkgs/simple/default.nix b/tv/5pkgs/simple/default.nix
deleted file mode 100644
index 82a19a9..0000000
--- a/tv/5pkgs/simple/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-with import ./lib;
-
-self: super:
-
-let
-  # This callPackage will try to detect obsolete overrides.
-  callPackage = path: args: let
-    override = self.callPackage path args;
-    upstream = optionalAttrs (override ? "name")
-      (super.${(parseDrvName override.name).name} or {});
-  in if upstream ? "name" &&
-        override ? "name" &&
-        compareVersions upstream.name override.name != -1
-    then trace "Upstream `${upstream.name}' gets overridden by `${override.name}'." override
-    else override;
-in
-
-  mapNixDir (path: callPackage path {}) ./.
diff --git a/tv/5pkgs/simple/lib b/tv/5pkgs/simple/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/5pkgs/simple/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/5pkgs/simple/pinentry-urxvt/lib b/tv/5pkgs/simple/pinentry-urxvt/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/5pkgs/simple/pinentry-urxvt/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/5pkgs/simple/q/lib b/tv/5pkgs/simple/q/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/5pkgs/simple/q/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/5pkgs/vim/default.nix b/tv/5pkgs/vim/default.nix
deleted file mode 100644
index c143592..0000000
--- a/tv/5pkgs/vim/default.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-with import ./lib;
-
-self: super: {
-  tv = super.tv // {
-    vim = {
-      makePlugin = outPath: outPath // { inherit outPath; };
-      makeRuntimePath = concatMapStringsSep "," (getAttr "outPath");
-    };
-    vimPlugins = mapNixDir (path: self.callPackage path {}) ./.;
-  };
-}
diff --git a/tv/5pkgs/vim/lib b/tv/5pkgs/vim/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/5pkgs/vim/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file
diff --git a/tv/default.nix b/tv/default.nix
deleted file mode 100644
index 10b09f2..0000000
--- a/tv/default.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-
-  imports = [
-    ../krebs
-    ./2configs
-    ./3modules
-  ];
-
-  nixpkgs = {
-    overlays = [
-      (import ./5pkgs)
-    ];
-  };
-
-}
diff --git a/tv/dummy_secrets/default.nix b/tv/dummy_secrets/default.nix
deleted file mode 100644
index ab90db5..0000000
--- a/tv/dummy_secrets/default.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ config, ... }:
-{
-  users.users.root = {
-    openssh.authorizedKeys.keys = [
-      config.krebs.users.tv.pubkey
-    ];
-  };
-}
diff --git a/tv/dummy_secrets/o2.pin b/tv/dummy_secrets/o2.pin
deleted file mode 100644
index 53a3137..0000000
--- a/tv/dummy_secrets/o2.pin
+++ /dev/null
@@ -1 +0,0 @@
-AT
diff --git a/tv/dummy_secrets/repos.nix b/tv/dummy_secrets/repos.nix
deleted file mode 100644
index eed7124..0000000
--- a/tv/dummy_secrets/repos.nix
+++ /dev/null
@@ -1 +0,0 @@
-_: {}
diff --git a/tv/dummy_secrets/ssh.id_ed25519 b/tv/dummy_secrets/ssh.id_ed25519
deleted file mode 100644
index a7d2ada..0000000
--- a/tv/dummy_secrets/ssh.id_ed25519
+++ /dev/null
@@ -1,3 +0,0 @@
------BEGIN OPENSSH PRIVATE KEY-----
-dummy
------END OPENSSH PRIVATE KEY-----
diff --git a/tv/dummy_secrets/ssh.id_rsa b/tv/dummy_secrets/ssh.id_rsa
deleted file mode 100644
index dd7209c..0000000
--- a/tv/dummy_secrets/ssh.id_rsa
+++ /dev/null
@@ -1,3 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-dummy
------END RSA PRIVATE KEY-----
diff --git a/tv/krops.nix b/tv/krops.nix
deleted file mode 100644
index af0e861..0000000
--- a/tv/krops.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ name }: rec {
-
-  inherit (import ../krebs/krops.nix { inherit name; })
-    krebs-source
-    lib
-    pkgs
-  ;
-
-  source = lib.evalSource [
-    (krebs-source { test = true; })
-    {
-      nixos-config.symlink = "stockholm/tv/1systems/${name}/config.nix";
-      secrets.file = toString ./dummy_secrets;
-    }
-  ];
-
-  # usage: $(nix-build --no-out-link --argstr name HOSTNAME --argstr target PATH -A test)
-  test = { target }: pkgs.krops.writeTest "tv-krops-${name}-ci" {
-    force = true;
-    inherit source target;
-  };
-
-}
diff --git a/tv/lib b/tv/lib
deleted file mode 120000
index dc598c5..0000000
--- a/tv/lib
+++ /dev/null
@@ -1 +0,0 @@
-../lib
\ No newline at end of file