22 files changed, 584 insertions, 113 deletions
diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix
index 9303a81fb..9c2f53cbe 100644
--- a/krebs/3modules/default.nix
+++ b/krebs/3modules/default.nix
@@ -45,7 +45,6 @@ let
       ./reaktor2.nix
       ./realwallpaper.nix
       ./retiolum-bootstrap.nix
-      ./retiolum-hosts.nix
       ./rtorrent.nix
       ./secret.nix
       ./setuid.nix
@@ -101,6 +100,7 @@ let
     { krebs = import ./krebs  { inherit config; }; }
     { krebs = import ./lass   { inherit config; }; }
     { krebs = import ./makefu { inherit config; }; }
+    { krebs = import ./external/palo.nix { inherit config; }; }
     { krebs = import ./tv     { inherit config; }; }
     {
       krebs.dns.providers = {
diff --git a/krebs/3modules/hosts.nix b/krebs/3modules/hosts.nix
index 0985bb539..7fe01a769 100644
--- a/krebs/3modules/hosts.nix
+++ b/krebs/3modules/hosts.nix
@@ -1,6 +1,5 @@
 with import <stockholm/lib>;
 { config, ... }: let
-  # TODO dedup functions with ./retiolum-hosts.nix
   check = hostname: any (domain: hasSuffix ".${domain}" hostname) domains;
   domains = attrNames (filterAttrs (_: eq "hosts") config.krebs.dns.providers);
 in {
@@ -30,6 +29,66 @@ in {
                   map (addr: { ${addr} = aliases; }) net.addrs)
                 (attrValues host.nets))
             (attrValues config.krebs.hosts)));
+
+    nixpkgs.config.packageOverrides = super: let
+      # nameValuePair name value : { "name" : name, "value" : value }
+
+      # addr : str
+      # aliase : str
+      # hostname : str
+      # netname : str
+
+      # addrAliases : nameValuePair addr [alias]
+
+      # hostNetAliases : host -> { ${netname} : [addrAliases] }
+      hostNetAliases = host:
+        mapAttrs (_: net: filter (x: x.name != null && x.value != []) [
+          { name = net.ip4.addr or null; value = net.aliases; }
+          { name = net.ip6.addr or null; value = net.aliases; }
+        ]) host.nets;
+
+      # netAliases : { ${netname} : [addrAliases] }
+      netAliases =
+        foldl'
+          (result: host:
+            foldl'
+              # λ netAliases -> [addrAliases] -> netAliases
+              (result: { name, value }: result // {
+                ${name} = result.${name} or [] ++ value;
+              })
+              result
+              (mapAttrsToList nameValuePair (hostNetAliases host))
+          )
+          {}
+          (attrValues config.krebs.hosts);
+
+      # writeHosts : str -> [addrAliases] -> package
+      writeHosts = name: addrAliases: super.writeText name ''
+        ${concatMapStringsSep
+            "\n"
+            ({ name, value }: "${name} ${toString value}")
+            addrAliases}
+      '';
+    in
+      {
+        # hosts file for all krebs networks
+        krebs-hosts =
+          writeHosts "krebs-hosts" (concatLists [
+            netAliases.internet
+            netAliases.retiolum
+            netAliases.wiregrill
+          ]);
+
+        # combined hosts file for all networks (even custom ones)
+        krebs-hosts_combined =
+          writeHosts "krebs-hosts_combined"
+            (concatLists (attrValues netAliases));
+      }
+      //
+      genAttrs' (attrNames netAliases) (netname: rec {
+        name = "krebs-hosts-${netname}";
+        value = writeHosts name netAliases.${netname};
+      });
   };
 
 }
diff --git a/krebs/3modules/retiolum-hosts.nix b/krebs/3modules/retiolum-hosts.nix
deleted file mode 100644
index ddf85ead7..000000000
--- a/krebs/3modules/retiolum-hosts.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-with import <stockholm/lib>;
-{ config, ... }: let
-  # TODO dedup functions with ./hosts.nix
-  check = hostname: any (domain: hasSuffix ".${domain}" hostname) domains;
-  domains = attrNames (filterAttrs (_: eq "hosts") config.krebs.dns.providers);
-in {
-  nixpkgs.config.packageOverrides = super: {
-    retiolum-hosts =
-      super.writeText "retiolum-hosts" ''
-        ${
-          concatStringsSep
-            "\n"
-            (flatten
-              (map
-                (host: let
-                  net = host.nets.retiolum;
-                  aliases = longs;
-                  longs = filter check net.aliases;
-                in
-                  optionals
-                    (aliases != [])
-                    (map (addr: "${addr} ${toString aliases}") net.addrs))
-                (filter (host: hasAttr "retiolum" host.nets)
-                        (attrValues config.krebs.hosts))))
-        }
-      '';
-  };
-}
diff --git a/krebs/5pkgs/haskell/blessings.nix b/krebs/5pkgs/haskell/blessings.nix
index 97e4a717c..f730cc72b 100644
--- a/krebs/5pkgs/haskell/blessings.nix
+++ b/krebs/5pkgs/haskell/blessings.nix
@@ -1,5 +1,5 @@
 with import <stockholm/lib>;
-{ mkDerivation, base, fetchgit, stdenv }: let
+{ mkDerivation, base, fetchgit, hspec, QuickCheck, stdenv, text }: let
 
   cfg = {
     "18.03" = {
@@ -7,8 +7,8 @@ with import <stockholm/lib>;
       sha256 = "1k908zap3694fcxdk4bb29s54b0lhdh557y10ybjskfwnym7szn1";
     };
     "18.09" = {
-      version = "2.1.0";
-      sha256 = "0wc8v48bb0bkvypc0j6imvnf8xc8572hykk9sgjhzf2w0ggqxv5d";
+      version = "2.2.0";
+      sha256 = "1pb56dgf3jj2kq3cbbppwzyg3ccgqy9xara62hkjwyxzdx20clk1";
     };
   }.${versions.majorMinor nixpkgsVersion};
 
@@ -20,7 +20,8 @@ in mkDerivation {
     rev = "refs/tags/v${cfg.version}";
     sha256 = cfg.sha256;
   };
-  libraryHaskellDepends = [ base ];
+  libraryHaskellDepends = [ base text ];
+  testHaskellDepends = [ base hspec QuickCheck ];
   doHaddock = false;
   # WTFPL is the true license, which is unknown to cabal.
   license = stdenv.lib.licenses.wtfpl;
diff --git a/krebs/5pkgs/haskell/flameshot-once.nix b/krebs/5pkgs/haskell/flameshot-once.nix
new file mode 100644
index 000000000..89b95ca07
--- /dev/null
+++ b/krebs/5pkgs/haskell/flameshot-once.nix
@@ -0,0 +1,21 @@
+{ mkDerivation, async, base, blessings, bytestring, dbus, fetchgit
+, iso8601-time, process, random, stdenv, text, time, unagi-chan
+, unix
+}:
+mkDerivation {
+  pname = "flameshot-once";
+  version = "1.1.0";
+  src = fetchgit {
+    url = "https://cgit.krebsco.de/flameshot-once";
+    sha256 = "158ha1yyj3p3mdjjga62j91ml83nhrsg34xbg3dir5cb399j8pxx";
+    rev = "9d688b6ffad14912bd1afe42555747cb3d213d95";
+    fetchSubmodules = true;
+  };
+  isLibrary = false;
+  isExecutable = true;
+  executableHaskellDepends = [
+    async base blessings bytestring dbus iso8601-time process random
+    text time unagi-chan unix
+  ];
+  license = stdenv.lib.licenses.mit;
+}
diff --git a/krebs/5pkgs/simple/flameshot-once/default.nix b/krebs/5pkgs/simple/flameshot-once/default.nix
new file mode 100644
index 000000000..c442a2e96
--- /dev/null
+++ b/krebs/5pkgs/simple/flameshot-once/default.nix
@@ -0,0 +1,27 @@
+with import <stockholm/lib>;
+{ pkgs, ... }@args:
+
+let
+  # config cannot be declared in the input attribute set because that would
+  # cause callPackage to inject the wrong config.  Instead, get it from ...
+  # via args.
+  config = args.config or {};
+in
+
+  pkgs.symlinkJoin {
+    name = "flameshot-once-wrapper";
+    paths = [
+      (pkgs.writeDashBin "flameshot-once" ''
+        export PATH=${makeBinPath [
+          pkgs.flameshot
+          pkgs.qt5.qtbase
+          pkgs.xclip
+        ]}
+        ${optionalString (config != null) /* sh */ ''
+          . ${import ./profile.nix { inherit config pkgs; }}
+        ''}
+        exec ${pkgs.haskellPackages.flameshot-once}/bin/flameshot-once "$@"
+      '')
+      pkgs.haskellPackages.flameshot-once
+    ];
+  }
diff --git a/krebs/5pkgs/simple/flameshot-once/profile.nix b/krebs/5pkgs/simple/flameshot-once/profile.nix
new file mode 100644
index 000000000..4fcbd62c0
--- /dev/null
+++ b/krebs/5pkgs/simple/flameshot-once/profile.nix
@@ -0,0 +1,129 @@
+with import <stockholm/lib>;
+{ config, pkgs }:
+let
+
+  # Refs https://github.com/lupoDharkael/flameshot/blob/master/src/widgets/capture/capturebutton.h
+  ButtonType = {
+    PENCIL             = 0;
+    DRAWER             = 1;
+    ARROW              = 2;
+    SELECTION          = 3;
+    RECTANGLE          = 4;
+    CIRCLE             = 5;
+    MARKER             = 6;
+    SELECTIONINDICATOR = 7;
+    MOVESELECTION      = 8;
+    UNDO               = 9;
+    COPY               = 10;
+    SAVE               = 11;
+    EXIT               = 12;
+    IMAGEUPLOADER      = 13;
+    OPEN_APP           = 14;
+    BLUR               = 15;
+    REDO               = 16;
+    PIN                = 17;
+    TEXT               = 18;
+  };
+
+  cfg = eval.config;
+
+  eval = evalModules {
+    modules = singleton {
+      _file = toString ./config.nix;
+      imports = singleton config;
+      options = {
+        buttons = mkOption {
+          apply = map (name: ButtonType.${name});
+          default = [
+            "PENCIL"
+            "DRAWER"
+            "ARROW"
+            "SELECTION"
+            "RECTANGLE"
+            "CIRCLE"
+            "MARKER"
+            "SELECTIONINDICATOR"
+            "MOVESELECTION"
+            "UNDO"
+            "SAVE"
+            "EXIT"
+            "BLUR"
+          ];
+          type = types.listOf (types.enum (attrNames ButtonType));
+        };
+        disabledTrayIcon = mkOption {
+          default = true;
+          type = types.bool;
+        };
+        drawThickness = mkOption {
+          default = 8;
+          type = types.positive;
+        };
+        filenamePattern = mkOption {
+          default = "%FT%T%z_flameshot.png";
+          type =
+            # This is types.filename extended by [%:][%:+]*
+            types.addCheck types.str (test "[%:0-9A-Za-z._][%:+0-9A-Za-z._-]*");
+        };
+        savePath = mkOption {
+          default = "/tmp";
+          type = types.absolute-pathname;
+        };
+        showDesktopNotification = mkOption {
+          default = false;
+          type = types.bool;
+        };
+        showHelp = mkOption {
+          default = false;
+          type = types.bool;
+        };
+      };
+    };
+  };
+
+  hexchars = stringToCharacters "0123456789abcdef";
+
+  # Encode integer to C-escaped string of bytes, little endian / LSB 0
+  le = rec {
+    x1 = i: let
+      i0 = mod i 16;
+      i1 = i / 16;
+    in
+      "\\x${elemAt hexchars i1}${elemAt hexchars i0}";
+
+    x2 = i: let
+      i0 = mod i 256;
+      i1 = i / 256;
+    in
+      "${x1 i0}${x1 i1}";
+
+    x4 = i: let
+      i0 = mod i 65536;
+      i1 = i / 65536;
+    in
+      "${x2 i0}${x2 i1}";
+  };
+
+  toQList = t: xs:
+    assert t == "int";
+    "QList<${t}>${le.x4 0}${le.x4 (length xs)}${concatMapStrings le.x4 xs}";
+
+  XDG_CONFIG_HOME = pkgs.write "flameshot-config" {
+    "/Dharkael/flameshot.ini".text = ''
+      [General]
+      buttons=@Variant(\0\0\0\x7f\0\0\0\v${toQList "int" cfg.buttons})
+      disabledTrayIcon=${toJSON cfg.disabledTrayIcon}
+      drawThickness=${toJSON cfg.drawThickness}
+      filenamePattern=${toJSON cfg.filenamePattern}
+      savePath=${toJSON cfg.savePath}
+      showDesktopNotification=${toJSON cfg.showDesktopNotification}
+      showHelp=${toJSON cfg.showHelp}
+    '';
+  };
+
+in
+
+  pkgs.writeDash "flameshot.profile" ''
+    export FLAMESHOT_CAPTURE_PATH=${cfg.savePath}
+    export XDG_CONFIG_HOME=${XDG_CONFIG_HOME}
+  ''
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
index 614d5bccf..b6124ad41 100644
--- a/krebs/nixpkgs.json
+++ b/krebs/nixpkgs.json
@@ -1,7 +1,7 @@
 {
   "url": "https://github.com/NixOS/nixpkgs-channels",
-  "rev": "97e0d53d669cd07f0750a42fd535524b3cdd46d1",
-  "date": "2019-01-15T00:11:44+01:00",
-  "sha256": "111xa7qn9142dar29cil4br2mvn8f1rbiy310lkhwl73126fq8dw",
+  "rev": "9bd45dddf8171e2fd4288d684f4f70a2025ded19",
+  "date": "2019-02-15T12:11:24-05:00",
+  "sha256": "1idrxrymwqfsfysav3yl8lya1jhgg8xzgq9hy7dpdd63770vn8c1",
   "fetchSubmodules": false
 }
diff --git a/lass/2configs/websites/lassulus.nix b/lass/2configs/websites/lassulus.nix
index 27cadd100..526909e8a 100644
--- a/lass/2configs/websites/lassulus.nix
+++ b/lass/2configs/websites/lassulus.nix
@@ -61,7 +61,7 @@ in {
       alias ${config.krebs.tinc.retiolum.hostsArchive};
     '';
     locations."= /retiolum.hosts".extraConfig = ''
-      alias ${pkgs.retiolum-hosts};
+      alias ${pkgs.krebs-hosts-retiolum};
     '';
     locations."= /wireguard-key".extraConfig = ''
       alias ${pkgs.writeText "prism.wg" config.krebs.hosts.prism.nets.wiregrill.wireguard.pubkey};
diff --git a/lib/default.nix b/lib/default.nix
index 347830e8c..8ba55b571 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -9,6 +9,7 @@ let
     krops = import ../submodules/krops/lib;
     shell = import ./shell.nix { inherit lib; };
     types = nixpkgs-lib.types // import ./types.nix { inherit lib; };
+    xml = import ./xml.nix { inherit lib; };
 
     eq = x: y: x == y;
     ne = x: y: x != y;
@@ -145,6 +146,11 @@ let
     in
       filter (x: x != []) ([acc.chunk] ++ acc.chunks);
 
+    warnOldVersion = oldName: newName:
+      if compareVersions oldName newName != -1 then
+        trace "Upstream `${oldName}' gets overridden by `${newName}'." newName
+      else
+        newName;
   };
 in
 
diff --git a/lib/xml.nix b/lib/xml.nix
new file mode 100644
index 000000000..16052445b
--- /dev/null
+++ b/lib/xml.nix
@@ -0,0 +1,88 @@
+{ lib }:
+with lib;
+with builtins;
+rec {
+
+  # Use `term` to construct XML.
+  #
+  # Examples:
+  #
+  #   (term "bool" null null)
+  #   (term "cool" null [])
+  #   (term "fool" { hurr = "durr"; } null)
+  #   (term "hool" null [
+  #     (term "tool" null null)
+  #   ])
+  #
+  # See `render` for how these get transformed into actuall XML documents.
+  #
+  term = name: attrs: content: {
+    inherit name attrs content;
+  };
+
+  empty = term null null null;
+
+  # Ref http://www.w3.org/TR/xml/#syntax
+  #
+  # Example:
+  #
+  #   (quote "<cheez!>")                 #===>   &lt;cheez!&gt;
+  #
+  quote = let
+    sub = {
+      "&" = "&amp;";
+      "<" = "&lt;";
+      ">" = "&gt;";
+      "'" = "&apos;";
+      "\"" = "&quot;";
+    };
+  in
+    stringAsChars (c: sub.${c} or c);
+
+  # Turn an XML element to an XML document string.
+  doc = t:
+    "<?xml version='1.0' encoding='UTF-8'?>${render t}";
+
+  # Render an XML element to a string.
+  #
+  # Rendering `empty` yields the empty string.
+  #
+  # Examples:
+  #
+  #   (term "bool" null null)                 #===>   <bool/>
+  #   (term "cool" null [])                   #===>   <cool></cool>
+  #   (term "fool" { hurr = "durr"; } null)   #===>   <fool hurr="durr"/>
+  #   (term "hool" null [
+  #     (term "tool" null null)
+  #   ])                                      #===>   <hool><tool/></hool>
+  #
+  render = let
+    render-attrs = attrs:
+      getAttr (typeOf attrs) {
+        null = "";
+        set = concatStrings (mapAttrsToList (n: v: " ${n}=\"${v}\"") attrs);
+      };
+
+    render-content = content:
+      getAttr (typeOf content) {
+        bool = toJSON content;
+        int = toJSON content;
+        list = concatMapStrings render content;
+        string = quote content;
+      };
+  in
+    { name, attrs, content }:
+    # XXX we're currently encoding too much information with `null`..
+    if name == null
+      then
+        if content == null
+          then ""
+          else content
+      else let
+        attrs' = render-attrs attrs;
+        content' = render-content content;
+      in
+        if content == null
+          then "<${name}${attrs'}/>"
+          else "<${name}${attrs'}>${content'}</${name}>";
+}
diff --git a/tv/2configs/bash/default.nix b/tv/2configs/bash/default.nix
index d7673931c..42914e060 100644
--- a/tv/2configs/bash/default.nix
+++ b/tv/2configs/bash/default.nix
@@ -8,6 +8,7 @@ with import <stockholm/lib>;
       HISTCONTROL='erasedups:ignorespace'
       HISTSIZE=65536
       HISTFILESIZE=$HISTSIZE
+      HISTTIMEFORMAT=
 
       shopt -s checkhash
       shopt -s histappend histreedit histverify
@@ -27,6 +28,8 @@ with import <stockholm/lib>;
           export NIX_PATH="stockholm=$HOME/stockholm:$NIX_PATH"
         ;;
       esac
+
+      ${pkgs.bash-fzf-history.bind}
     '';
     promptInit = /* sh */ ''
       case $UID in
diff --git a/tv/2configs/gitrepos.nix b/tv/2configs/gitrepos.nix
index 725ddefa8..95ab75b3d 100644
--- a/tv/2configs/gitrepos.nix
+++ b/tv/2configs/gitrepos.nix
@@ -47,6 +47,9 @@ let {
     disko = {
       cgit.desc = "declarative partitioning and formatting tool";
     };
+    flameshot-once = {
+      cgit.desc = "flameshot runner that automatically starts/stops the daemon";
+    };
     fswm = {
       cgit.desc = "simple full screen window manager";
     };
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index 3794628c1..9942ff65b 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -129,15 +129,65 @@ let {
         command! -n=0 -bar ShowSyntax :call ShowSyntax()
       '';
     })))
+    ((rtp: rtp // { inherit rtp; }) (pkgs.write "vim-tv" {
+      #
+      # Haskell
+      #
+      "/ftplugin/haskell.vim".text = ''
+        if exists("g:vim_tv_ftplugin_haskell_loaded")
+          finish
+        endif
+        let g:vim_tv_ftplugin_haskell_loaded = 1
+
+        setlocal iskeyword+='
+      '';
+      #
+      # TODO
+      #
+      "/ftdetect/todo.vim".text = ''
+        au BufRead,BufNewFile TODO set ft=todo
+      '';
+      "/ftplugin/todo.vim".text = ''
+        setlocal foldmethod=syntax
+      '';
+      "/syntax/todo.vim".text = ''
+        syn match Comment /#.*/
+
+        syn match todoDate /^[1-9]\S*/
+          \ nextgroup=todoSummary
+
+        syn region todoSummary
+          \ contained
+          \ contains=todoTag
+          \ start="." end="$\n"
+          \ nextgroup=todoBlock
+
+        syn match todoTag /\[[A-Za-z]\+\]/hs=s+1,he=e-1
+          \ contained
+
+        syn region todoBlock
+          \ contained
+          \ contains=Comment
+          \ fold
+          \ start="^[^1-9]" end="^[1-9]"re=s-1,he=s-1,me=s-1
+
+        syn sync minlines=1000
+
+        hi todoDate ctermfg=255
+        hi todoSummary ctermfg=229
+        hi todoBlock ctermfg=248
+        hi todoTag ctermfg=217
+      '';
+    }))
     ((rtp: rtp // { inherit rtp; }) (pkgs.write "vim-syntax-nix-nested" {
-      "/syntax/haskell.vim".text = /* vim */ ''
+      "/syntax/haskell.vim".text = ''
         syn region String start=+\[[[:alnum:]]*|+ end=+|]+
 
         hi link ConId Identifier
         hi link VarId Identifier
         hi link hsDelimiter Delimiter
       '';
-      "/syntax/nix.vim".text = /* vim */ ''
+      "/syntax/nix.vim".text = ''
         "" Quit when a (custom) syntax file was already loaded
         "if exists("b:current_syntax")
         "  finish
@@ -250,6 +300,9 @@ let {
           def = k: ''${k}[ \t\r\n]*='';
           writer = k: ''write${k}[^ \t\r\n]*[ \t\r\n]*\("[^"]*"\|[a-z]\+\)'';
 
+          writerExt = k: writerName ''[^"]*\.${k}'';
+          writerName = k: ''write[^ \t\r\n]*[ \t\r\n]*"${k}"'';
+
         in {
           c = {};
           cabal = {};
@@ -257,7 +310,7 @@ let {
           haskell = {};
           jq.extraStart = alts [
             (writer "Jq")
-            ''write[^ \t\r\n]*[ \t\r\n]*"[^"]*\.jq"''
+            (writerExt "jq")
           ];
           javascript.extraStart = ''/\* js \*/'';
           lua = {};
@@ -287,8 +340,11 @@ let {
             (writer (alts (map capitalize shells)))
           ];
           yaml = {};
-          vim.extraStart =
-            ''write[^ \t\r\n]*[ \t\r\n]*"\(\([^"]*\.\)\?vimrc\|[^"]*\.vim\)"'';
+          vim.extraStart = alts [
+            (def ''"[^"]*\.vim"\.text'')
+            (writerExt "vim")
+            (writerName ''\([^"]*\.\)\?vimrc'')
+          ];
           xdefaults = {};
         }))}
 
@@ -329,7 +385,7 @@ let {
 
         set isk=@,48-57,_,192-255,-,'
       '';
-      "/syntax/sed.vim".text = /* vim */ ''
+      "/syntax/sed.vim".text = ''
         syn region sedBranch
           \ matchgroup=sedFunction start="T"
           \ matchgroup=sedSemicolon end=";\|$"
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index f68e8e681..051e12ef0 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -48,10 +48,24 @@ in {
 
   systemd.services.xmonad = let
     xmonad = "${pkgs.haskellPackages.xmonad-tv}/bin/xmonad";
-    xmonad-prepare = pkgs.writeDash "xmonad-prepare" ''
+    xmonad-start = pkgs.writeDash "xmonad-start" ''
       ${pkgs.coreutils}/bin/mkdir -p "$XMONAD_CACHE_DIR"
       ${pkgs.coreutils}/bin/mkdir -p "$XMONAD_CONFIG_DIR"
       ${pkgs.coreutils}/bin/mkdir -p "$XMONAD_DATA_DIR"
+
+      f=$HOME/.dbus/session-bus/$(${pkgs.coreutils}/bin/cat /etc/machine-id)-${
+        toString config.services.xserver.display
+      }
+      if test -e "$f" &&
+          . "$f" &&
+          ${pkgs.coreutils}/bin/kill -0 "$DBUS_SESSION_BUS_PID"
+      then
+        export DBUS_SESSION_BUS_ADDRESS
+      else
+        eval "$(${pkgs.dbus.lib}/bin/dbus-launch --sh-syntax)"
+      fi
+
+      exec ${xmonad}
     '';
     xmonad-ready = pkgs.writeDash "xmonad-ready" ''
       {
@@ -97,8 +111,7 @@ in {
       "/run/wrappers" # for su
     ];
     serviceConfig = {
-      ExecStartPre = "@${xmonad-prepare} xmonad-prepare";
-      ExecStart = "@${xmonad} xmonad-${currentSystem}";
+      ExecStart = "@${xmonad-start} xmonad-${currentSystem}";
       ExecStop = "@${xmonad} xmonad-${currentSystem} --shutdown";
       SyslogIdentifier = "xmonad";
       User = cfg.user.name;
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
index 56861dc74..3974760d5 100644
--- a/tv/3modules/iptables.nix
+++ b/tv/3modules/iptables.nix
@@ -9,6 +9,37 @@ let {
     config = lib.mkIf cfg.enable imp;
   };
 
+  extraTypes = {
+    rules = types.submodule {
+      options = {
+        nat.OUTPUT = mkOption {
+          type = with types; listOf str;
+          default = [];
+        };
+        nat.PREROUTING = mkOption {
+          type = with types; listOf str;
+          default = [];
+        };
+        nat.POSTROUTING = mkOption {
+          type = with types; listOf str;
+          default = [];
+        };
+        filter.FORWARD = mkOption {
+          type = with types; listOf str;
+          default = [];
+        };
+        filter.INPUT = mkOption {
+          type = with types; listOf str;
+          default = [];
+        };
+        filter.Retiolum = mkOption {
+          type = with types; listOf str;
+          default = [];
+        };
+      };
+    };
+  };
+
   api = {
     enable = mkEnableOption "tv.iptables";
 
@@ -37,19 +68,19 @@ let {
       default = [];
     };
 
-    extra = {
-      nat.POSTROUTING = mkOption {
-        type = with types; listOf str;
-        default = [];
-      };
-      filter.FORWARD = mkOption {
-        type = with types; listOf str;
-        default = [];
-      };
-      filter.INPUT = mkOption {
-        type = with types; listOf str;
-        default = [];
-      };
+    extra = mkOption {
+      default = {};
+      type = extraTypes.rules;
+    };
+
+    extra4 = mkOption {
+      default = {};
+      type = extraTypes.rules;
+    };
+
+    extra6 = mkOption {
+      default = {};
+      type = extraTypes.rules;
     };
   };
 
@@ -112,6 +143,7 @@ let {
         "-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
       ]}
       ${formatTable cfg.extra.nat}
+      ${formatTable cfg."extra${toString iptables-version}".nat}
       COMMIT
       *filter
       :INPUT DROP [0:0]
@@ -129,6 +161,7 @@ let {
         ++ ["-i retiolum -j Retiolum"]
       )}
       ${formatTable cfg.extra.filter}
+      ${formatTable cfg."extra${toString iptables-version}".filter}
       ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
         ++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request
         ++ map accept-tcp (unique (map toString cfg.input-retiolum-accept-tcp))
diff --git a/tv/5pkgs/haskell/xmonad-tv/src/main.hs b/tv/5pkgs/haskell/xmonad-tv/src/main.hs
index b7d4e9bca..c528017d7 100644
--- a/tv/5pkgs/haskell/xmonad-tv/src/main.hs
+++ b/tv/5pkgs/haskell/xmonad-tv/src/main.hs
@@ -1,8 +1,4 @@
-{-# LANGUAGE DeriveDataTypeable #-} -- for XS
-{-# LANGUAGE FlexibleContexts #-} -- for xmonad'
 {-# LANGUAGE LambdaCase #-}
-{-# LANGUAGE ScopedTypeVariables #-}
-
 
 module Main (main) where
 
@@ -51,7 +47,7 @@ mainNoArgs = do
     let width = 1366
     workspaces0 <- getWorkspaces0
     handleShutdownEvent <- newShutdownEventHandler
-    xmonad
+    launch
         $ withUrgencyHook (SpawnUrgencyHook "echo emit Urgency ")
         $ def
             { terminal          = Paths.urxvtc
diff --git a/tv/5pkgs/override/default.nix b/tv/5pkgs/override/default.nix
index cd7c5645b..99c1b3ec9 100644
--- a/tv/5pkgs/override/default.nix
+++ b/tv/5pkgs/override/default.nix
@@ -1,6 +1,6 @@
 with import <stockholm/lib>;
 self: super: {
-  rxvt_unicode = self.callPackage ./rxvt_unicode {
+  rxvt_unicode = self.callPackage ./rxvt_unicode.nix {
     rxvt_unicode = super.rxvt_unicode;
   };
 }
diff --git a/tv/5pkgs/override/rxvt_unicode.nix b/tv/5pkgs/override/rxvt_unicode.nix
new file mode 100644
index 000000000..da657fb20
--- /dev/null
+++ b/tv/5pkgs/override/rxvt_unicode.nix
@@ -0,0 +1,9 @@
+{ fetchurl, rxvt_unicode }:
+rxvt_unicode.overrideAttrs (old: {
+  patches = old.patches ++ [
+    (fetchurl {
+      url = https://cgit.krebsco.de/rxvt-unicode/patch/?id=15f3f94;
+      sha256 = "12vldwsds27c9l15ffc6svk9mj17jhypcz736pvpmpqbsymlkz2p";
+    })
+  ];
+})
diff --git a/tv/5pkgs/override/rxvt_unicode/default.nix b/tv/5pkgs/override/rxvt_unicode/default.nix
deleted file mode 100644
index 858a46be6..000000000
--- a/tv/5pkgs/override/rxvt_unicode/default.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ rxvt_unicode }:
-rxvt_unicode.overrideAttrs (old: {
-  patches = old.patches ++ [
-    ./finish-running-selection.patch
-  ];
-})
diff --git a/tv/5pkgs/override/rxvt_unicode/finish-running-selection.patch b/tv/5pkgs/override/rxvt_unicode/finish-running-selection.patch
deleted file mode 100644
index a342ccf5c..000000000
--- a/tv/5pkgs/override/rxvt_unicode/finish-running-selection.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-diff --git a/src/rxvttoolkit.h b/src/rxvttoolkit.h
-index 56c9a3f..429055d 100644
---- a/src/rxvttoolkit.h
-+++ b/src/rxvttoolkit.h
-@@ -384,6 +384,7 @@ struct rxvt_selection
- {