Merge remote-tracking branch 'prism/master'

26 files changed, 942 insertions, 1059 deletions

diff --git a/jeschli/1systems/reagenzglas/.source.nix.swp b/jeschli/1systems/reagenzglas/.source.nix.swp
new file mode 100644
index 0000000..8c1a75f
--- /dev/null
+++ b/jeschli/1systems/reagenzglas/.source.nix.swp
diff --git a/jeschli/1systems/reagenzglas/config.nix b/jeschli/1systems/reagenzglas/config.nix
new file mode 100644
index 0000000..d65e897
--- /dev/null
+++ b/jeschli/1systems/reagenzglas/config.nix
@@ -0,0 +1,146 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      <stockholm/jeschli>
+      ./hardware-configuration.nix
+    ];
+
+  # Use the GRUB 2 boot loader.
+ # boot.loader.grub.enable = true;
+ # boot.loader.grub.version = 2;
+  # boot.loader.grub.efiSupport = true;
+  # boot.loader.grub.efiInstallAsRemovable = true;
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  # Define on which hard drive you want to install Grub.
+#  boot.loader.grub.device = "/dev/disk/by-id/wwn-0x5002538844584d30"; # or "nodev" for efi only
+
+  boot.initrd.luks.devices = [
+    {
+    name = "root";
+    device = "/dev/disk/by-id/wwn-0x5002538844584d30-part2";
+    preLVM = true;
+    allowDiscards = true;
+    }
+  ];
+  networking.hostName = "reaganzglas"; # Define your hostname.
+#  networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+  networking.networkmanager.enable = true;
+  # Select internationalisation properties.
+  # i18n = {
+  #   consoleFont = "Lat2-Terminus16";
+  #   consoleKeyMap = "us";
+  #   defaultLocale = "en_US.UTF-8";
+  # };
+
+  # Set your time zone.
+  # time.timeZone = "Europe/Amsterdam";
+
+  # List packages installed in system profile. To search by name, run:
+  # $ nix-env -qaP | grep wget
+  nixpkgs.config.allowUnfree = true;
+  environment.shellAliases = { n = "nix-shell"; };
+  environment.variables = { GOROOT= [ "${pkgs.go.out}/share/go" ]; };
+  environment.systemPackages = with pkgs; [
+  # system helper
+    ag
+    curl
+    copyq
+    dmenu
+    git
+    i3lock
+    keepass
+    networkmanagerapplet
+    rsync
+    terminator
+    tmux
+    wget
+    rxvt_unicode
+  # editors
+    emacs
+  # internet
+    thunderbird
+    chromium
+    google-chrome
+  # programming languages
+    go
+    gcc
+    ghc
+    python35
+    python35Packages.pip
+  # go tools
+    golint
+    gotools
+  # dev tools
+    gnumake
+  # document viewer
+    zathura
+   ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = { enable = true; enableSSHSupport = true; };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMPuFzd6p3zZETIjoV5mRxCTQgeZk9s/P374mEDbj58wDTT0uGWu2JRf7cL1QRTvd5238tYl0eSHXH65+oaFB/mIvmiRnuw6qQODOMHlSbJN5/J2hEw/3v5gveiP1xNLfKlFhj6mmMRF7Etvzns/kLGLCSjj1UTlfo4iHmtinPmU+iQ8J4foS4cZj4oZesF8gndkc2EFMfL6en7EuU8GK6U9GtwKNL9N4UoUZXu8Nf00pkn/jrpmsDdI4zdVVAxWeu/Lo4li43EVixLcfwQiwzf6S9FvYIv30xPdy92GJSJwxm/QkYuc48VZWUoE+qThf3IEPETtX+MRZrM8RTtY01 markus@reaganzglas"
+  ];
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable the X11 windowing system.
+   services.xserver.enable = true;
+   services.xserver.layout = "us";
+   services.xserver.xkbOptions = "eurosign:e";
+
+  # Enable touchpad support.
+   services.xserver.libinput.enable = true;
+
+  # Enable the KDE Desktop Environment.
+  services.xserver.displayManager.sddm.enable = true;
+  services.xserver.windowManager.xmonad.enable = true;
+  services.xserver.windowManager.xmonad.enableContribAndExtras = true;
+
+  # services.xserver.desktopManager.plasma5.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.extraUsers.jeschli = {
+     isNormalUser = true;
+     uid = 1000;
+  };
+
+  # This value determines the NixOS release with which your system is to be
+  # compatible, in order to avoid breaking some software such as database
+  # servers. You should change this only after NixOS release notes say you
+  # should.
+  system.stateVersion = "18.03"; # Did you read the comment?
+
+  programs.bash = {
+    enableCompletion = true;
+    interactiveShellInit = ''
+      export GOPATH=$HOME/go
+      export PATH=$PATH:$GOPATH/bin
+    '';
+  };
+
+  krebs.build.host = config.krebs.hosts.reagenzglas;
+
+  hardware.bluetooth.enable = true;
+}
diff --git a/jeschli/1systems/reagenzglas/hardware-configuration.nix b/jeschli/1systems/reagenzglas/hardware-configuration.nix
new file mode 100644
index 0000000..a6ab3f1
--- /dev/null
+++ b/jeschli/1systems/reagenzglas/hardware-configuration.nix
@@ -0,0 +1,33 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, ... }:
+
+{
+  imports =
+    [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "sd_mod" "sr_mod" "rtsx_pci_sdmmc" ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/09130cf7-b71b-42ab-9fa3-cb3c745f1fc9";
+      fsType = "ext4";
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/8bee50b3-5733-4373-a966-388def141774";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/DA40-AC19";
+      fsType = "vfat";
+    };
+  swapDevices = [ ];
+
+  nix.maxJobs = lib.mkDefault 8;
+#  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+}
diff --git a/jeschli/1systems/reagenzglas/source.nix b/jeschli/1systems/reagenzglas/source.nix
new file mode 100644
index 0000000..7543de6
--- /dev/null
+++ b/jeschli/1systems/reagenzglas/source.nix
@@ -0,0 +1,4 @@
+import <stockholm/jeschli/source.nix> {
+  name = "reagenzglas";
+  secure = true;
+}
diff --git a/jeschli/2configs/copy-vim.nix b/jeschli/2configs/copy-vim.nix
new file mode 100644
index 0000000..43fcb19
--- /dev/null
+++ b/jeschli/2configs/copy-vim.nix
@@ -0,0 +1,102 @@
+{ config, pkgs, ... }:
+
+
+# let 
+#   customPlugins.ultisnips = pkgs.vimUtils.buildVimPlugin {
+#     name = "ultisnips";
+#     src = pkgs.fetchFromGitHub {
+#       owner = "SirVer";
+#       repo = "ultisnips";
+#       rev = "3.1";
+#       sha256 = "0p9d91h9pm0nx0d77lqsgv6158q052cyj4nm1rd6zvbay9bkkf8b"; 
+#     };
+#   };
+#
+let
+  customPlugins.vim-javascript = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-javascript";
+    src = pkgs.fetchFromGitHub {
+      owner = "pangloss";
+      repo = "vim-javascript";
+      rev = "1.2.5.1";
+      sha256 = "08l7ricd3j5h2bj9i566byh39v9n5wj5mj75f2c8a5dsc732b2k7";
+    };
+  };
+   customPlugins.vim-jsx = pkgs.vimUtils.buildVimPlugin {
+     name = "vim-jsx";
+     src = pkgs.fetchFromGitHub {
+       owner = "mxw";
+       repo = "vim-jsx";
+       rev = "5b968dfa512c57c38ad7fe420f3e8ab75a73949a";
+       sha256 = "1z3yhhbmbzfw68qjzyvpbmlyv2a1p814sy5q2knn04kcl30vx94a"; 
+     };
+   };
+in {
+# {
+  environment.systemPackages = [
+    (pkgs.vim_configurable.customize {
+      name = "vim";
+
+    vimrcConfig.customRC = ''
+	:imap jk <Esc>
+	:vmap v v
+	:map gr :GoRun<Enter>
+	:nnoremap <S-TAB> :bnext<CR>
+	:nnoremap <C-TAB> <c-w><c-w>
+	set autowrite
+	set number
+	set ruler
+
+	noremap x "_x
+	set clipboard=unnamedplus
+
+  let g:jsx_ext_required = 0
+
+	let g:go_list_type = "quickfix"
+	let g:go_test_timeout = '10s'
+	let g:go_fmt_command = "goimports"
+	let g:go_snippet_case_type = "camelcase"
+	let g:go_highlight_types = 1
+	let g:go_highlight_fields = 1
+	let g:go_highlight_functions = 1
+	let g:go_highlight_methods = 1
+  let g:go_highlight_extra_types = 1
+  autocmd BufNewFile,BufRead *.go setlocal noexpandtab tabstop=4 shiftwidth=4 
+  let g:rehash256 = 1
+  let g:molokai_original = 1
+  colorscheme molokai
+	let g:go_metalinter_enabled = ['vet', 'golint', 'errcheck']
+	let g:go_metalinter_autosave = 1
+	" let g:go_metalinter_autosave_enabled = ['vet', 'golint']
+	" let g:go_def_mode = 'godef'
+	" let g:go_decls_includes = "func,type"
+
+
+	" Trigger configuration. Do not use <tab> if you use https://github.com/Valloric/YouCompleteMe.
+	let g:UltiSnipsExpandTrigger="<c-e>"
+	let g:UltiSnipsJumpForwardTrigger="<c-t>"
+	let g:UltiSnipsJumpBackwardTrigger="<c-q>"
+
+	" If you want :UltiSnipsEdit to split your window.
+	let g:UltiSnipsEditSplit="vertical"
+
+	if has('persistent_undo')      "check if your vim version supports it
+	set undofile                 "turn on the feature  
+	set undodir=$HOME/.vim/undo  "directory where the undo files will be stored
+	endif     
+        '';
+
+       vimrcConfig.vam.knownPlugins = pkgs.vimPlugins // customPlugins;
+       vimrcConfig.vam.pluginDictionaries = [
+         { names = [ "undotree" "molokai" ]; } # wanted: fatih/molokai
+         # vim-nix handles indentation better but does not perform sanity
+         { names = [ "vim-addon-nix" ]; ft_regex = "^nix\$"; }
+         { names = [ "vim-go" ]; ft_regex = "^go\$"; } # wanted: nsf/gocode
+         { names = [ "vim-javascript" ]; ft_regex = "^js\$"; }
+         { names = [ "vim-jsx" ]; ft_regex = "^js\$"; }
+         { names = [ "UltiSnips" ]; ft_regex = "^go\$"; } 
+       ];
+
+    })
+  ];
+}
diff --git a/jeschli/2configs/default.nix b/jeschli/2configs/default.nix
new file mode 100644
index 0000000..7fb2409
--- /dev/null
+++ b/jeschli/2configs/default.nix
@@ -0,0 +1,66 @@
+{ config, pkgs, ... }:
+with import <stockholm/lib>;
+{
+  imports = [
+    ./vim.nix
+    ./retiolum.nix
+    {
+      environment.variables = {
+        NIX_PATH = mkForce "secrets=/var/src/stockholm/null:/var/src";
+      };
+    }
+  ];
+
+  nixpkgs.config.allowUnfree = true;
+
+  environment.systemPackages = with pkgs; [
+  #stockholm
+    git
+    gnumake
+    jq
+    parallel
+    proot
+    populate
+
+  #style
+    most
+    rxvt_unicode.terminfo
+
+  #monitoring tools
+    htop
+    iotop
+
+  #network
+    iptables
+    iftop
+
+  #stuff for dl
+    aria2
+
+  #neat utils
+    file
+    kpaste
+    krebspaste
+    mosh
+    pciutils
+    psmisc
+   # q
+   # rs
+    tmux
+    untilport
+    usbutils
+  #  logify
+    goify
+
+  #unpack stuff
+    p7zip
+    unzip
+    unrar
+
+    (pkgs.writeDashBin "sshn" ''
+      ${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "$@"
+    '')
+  ];
+
+  krebs.enable = true;
+}
diff --git a/jeschli/2configs/retiolum.nix b/jeschli/2configs/retiolum.nix
new file mode 100644
index 0000000..403300b
--- /dev/null
+++ b/jeschli/2configs/retiolum.nix
@@ -0,0 +1,22 @@
+{ config, pkgs, ... }:
+
+{
+
+  krebs.tinc.retiolum = {
+    enable = true;
+    connectTo = [
+      "prism"
+      "gum"
+      "ni"
+      "dishfire"
+    ];
+  };
+
+  nixpkgs.config.packageOverrides = pkgs: {
+    tinc = pkgs.tinc_pre;
+  };
+
+  environment.systemPackages = [
+    pkgs.tinc
+  ];
+}
diff --git a/jeschli/2configs/vim.nix b/jeschli/2configs/vim.nix
new file mode 100644
index 0000000..f6c736f
--- /dev/null
+++ b/jeschli/2configs/vim.nix
@@ -0,0 +1,373 @@
+{ config, lib, pkgs, ... }:
+
+with import <stockholm/lib>;
+let
+  out = {
+    environment.systemPackages = [
+      (hiPrio vim)
+      pkgs.python35Packages.flake8
+    ];
+
+    environment.etc.vimrc.source = vimrc;
+
+    environment.variables.EDITOR = mkForce "vim";
+    environment.variables.VIMINIT = ":so /etc/vimrc";
+  };
+
+  vimrc = pkgs.writeText "vimrc" ''
+    set nocompatible
+
+    set autoindent
+    set backspace=indent,eol,start
+    set backup
+    set backupdir=${dirs.backupdir}/
+    set directory=${dirs.swapdir}//
+    set hlsearch
+    set incsearch
+    set mouse=a
+    set ruler
+    set pastetoggle=<INS>
+    set runtimepath=${extra-runtimepath},$VIMRUNTIME
+    set shortmess+=I
+    set showcmd
+    set showmatch
+    set ttimeoutlen=0
+    set undodir=${dirs.undodir}
+    set undofile
+    set undolevels=1000000
+    set undoreload=1000000
+    set viminfo='20,<1000,s100,h,n${files.viminfo}
+    set visualbell
+    set wildignore+=*.o,*.class,*.hi,*.dyn_hi,*.dyn_o
+    set wildmenu
+    set wildmode=longest,full
+
+    set title
+    set titleold=
+    set titlestring=(vim)\ %t%(\ %M%)%(\ (%{expand(\"%:p:h\")})%)%(\ %a%)\ -\ %{v:servername}
+
+    set et ts=2 sts=2 sw=2
+
+    filetype plugin indent on
+
+    set t_Co=256
+    colorscheme hack
+    syntax on
+
+    au Syntax * syn match Garbage containedin=ALL /\s\+$/
+            \ | syn match TabStop containedin=ALL /\t\+/
+            \ | syn keyword Todo containedin=ALL TODO
+
+    au BufRead,BufNewFile *.hs so ${hs.vim}
+
+    au BufRead,BufNewFile *.nix so ${nix.vim}
+
+    au BufRead,BufNewFile /dev/shm/* set nobackup nowritebackup noswapfile
+
+    "Syntastic config
+    let g:syntastic_python_checkers=['flake8']
+    let g:syntastic_python_flake8_post_args='--ignore=E501'
+
+    nmap <esc>q :buffer 
+    nmap <M-q> :buffer 
+
+    cnoremap <C-A> <Home>
+
+    noremap  <C-c> :q<cr>
+    vnoremap < <gv
+    vnoremap > >gv
+
+    nnoremap <esc>[5^  :tabp<cr>
+    nnoremap <esc>[6^  :tabn<cr>
+    nnoremap <esc>[5@  :tabm -1<cr>
+    nnoremap <esc>[6@  :tabm +1<cr>
+
+    nnoremap <f1> :tabp<cr>
+    nnoremap <f2> :tabn<cr>
+    inoremap <f1> <esc>:tabp<cr>
+    inoremap <f2> <esc>:tabn<cr>
+
+    " <C-{Up,Down,Right,Left>
+    noremap <esc>Oa <nop> | noremap! <esc>Oa <nop>
+    noremap <esc>Ob <nop> | noremap! <esc>Ob <nop>
+    noremap <esc>Oc <nop> | noremap! <esc>Oc <nop>
+    noremap <esc>Od <nop> | noremap! <esc>Od <nop>
+    " <[C]S-{Up,Down,Right,Left>
+    noremap <esc>[a <nop> | noremap! <esc>[a <nop>
+    noremap <esc>[b <nop> | noremap! <esc>[b <nop>
+    noremap <esc>[c <nop> | noremap! <esc>[c <nop>
+    noremap <esc>[d <nop> | noremap! <esc>[d <nop>
+
+    " search with ack
+    let g:ackprg = 'ag --vimgrep'
+    cnoreabbrev Ack Ack!
+
+    " copy/paste from/to xclipboard
+    noremap x "_x
+    set clipboard=unnamedplus
+  '';
+
+  extra-runtimepath = concatMapStringsSep "," (pkg: "${pkg.rtp}") [
+    pkgs.vimPlugins.ack-vim
+    pkgs.vimPlugins.Gundo
+    pkgs.vimPlugins.Syntastic
+    pkgs.vimPlugins.undotree
+    pkgs.vimPlugins.vim-go
+    (pkgs.vimUtils.buildVimPlugin {
+      name = "file-line-1.0";
+      src = pkgs.fetchFromGitHub {
+        owner = "bogado";
+        repo = "file-line";
+        rev = "1.0";
+        sha256 = "0z47zq9rqh06ny0q8lpcdsraf3lyzn9xvb59nywnarf3nxrk6hx0";
+      };
+    })
+    ((rtp: rtp // { inherit rtp; }) (pkgs.writeTextFile (let
+      name = "hack";
+    in {
+      name = "vim-color-${name}-1.0.2";
+      destination = "/colors/${name}.vim";
+      text = /* vim */ ''
+        set background=dark
+        hi clear
+        if exists("syntax_on")
+          syntax clear
+        endif
+
+        let colors_name = ${toJSON name}
+
+        hi Normal       ctermbg=235
+        hi Comment      ctermfg=242
+        hi Constant     ctermfg=062
+        hi Identifier   ctermfg=068
+        hi Function     ctermfg=041
+        hi Statement    ctermfg=167
+        hi PreProc      ctermfg=167
+        hi Type         ctermfg=041
+        hi Delimiter    ctermfg=251
+        hi Special      ctermfg=062
+
+        hi Garbage      ctermbg=088
+        hi TabStop      ctermbg=016
+        hi Todo         ctermfg=174 ctermbg=NONE
+
+        hi NixCode      ctermfg=148
+        hi NixData      ctermfg=149
+        hi NixQuote     ctermfg=150
+
+        hi diffNewFile  ctermfg=207
+        hi diffFile     ctermfg=207
+        hi diffLine     ctermfg=207
+        hi diffSubname  ctermfg=207
+        hi diffAdded    ctermfg=010
+        hi diffRemoved  ctermfg=009
+      '';
+    })))
+    ((rtp: rtp // { inherit rtp; }) (pkgs.writeTextFile (let
+      name = "vim";
+    in {
+      name = "vim-syntax-${name}-1.0.0";
+      destination = "/syntax/${name}.vim";
+      text = /* vim */ ''
+        ${concatMapStringsSep "\n" (s: /* vim */ ''
+          syn keyword vimColor${s} ${s}
+            \ containedin=ALLBUT,vimComment,vimLineComment
+          hi vimColor${s} ctermfg=${s}
+        '') (map (i: lpad 3 "0" (toString i)) (range 0 255))}
+      '';
+    })))
+    ((rtp: rtp // { inherit rtp; }) (pkgs.writeTextFile (let
+      name = "showsyntax";
+    in {
+      name = "vim-plugin-${name}-1.0.0";
+      destination = "/plugin/${name}.vim";
+      text = /* vim */ ''
+        if exists('g:loaded_showsyntax')
+          finish
+        endif
+        let g:loaded_showsyntax = 0
+
+        fu! ShowSyntax()
+          let id = synID(line("."), col("."), 1)
+          let name = synIDattr(id, "name")
+          let transName = synIDattr(synIDtrans(id),"name")
+          if name != transName
+            let name .= " (" . transName . ")"
+          endif
+          echo "Syntax: " . name
+        endfu
+
+        command! -n=0 -bar ShowSyntax :call ShowSyntax()
+      '';
+    })))
+  ];
+
+  dirs = {
+    backupdir = "$HOME/.cache/vim/backup";
+    swapdir   = "$HOME/.cache/vim/swap";
+    undodir   = "$HOME/.cache/vim/undo";
+  };
+  files = {
+    viminfo   = "$HOME/.cache/vim/info";
+  };
+
+  mkdirs = let
+    dirOf = s: let out = concatStringsSep "/" (init (splitString "/" s));
+               in assert out != ""; out;
+    alldirs = attrValues dirs ++ map dirOf (attrValues files);
+  in unique (sort lessThan alldirs);
+
+  vim = pkgs.symlinkJoin {
+    name = "vim";
+    paths = [
+      (pkgs.writeDashBin "vim" ''
+        set -efu
+        (umask 0077; exec ${pkgs.coreutils}/bin/mkdir -p ${toString mkdirs})
+        exec ${pkgs.vim}/bin/vim "$@"
+      '')
+      pkgs.vim
+    ];
+  };
+
+  hs.vim = pkgs.writeText "hs.vim" ''
+    syn region String start=+\[[[:alnum:]]*|+ end=+|]+
+
+    hi link ConId Identifier
+    hi link VarId Identifier
+    hi link hsDelimiter Delimiter
+  '';
+
+  nix.vim = pkgs.writeText "nix.vim" ''
+    setf nix
+
+    " Ref <nix/src/libexpr/lexer.l>
+    syn match NixID    /[a-zA-Z\_][a-zA-Z0-9\_\'\-]*/
+    syn match NixINT   /\<[0-9]\+\>/
+    syn match NixPATH  /[a-zA-Z0-9\.\_\-\+]*\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
+    syn match NixHPATH /\~\(\/[a-zA-Z0-9\.\_\-\+]\+\)\+/
+    syn match NixSPATH /<[a-zA-Z0-9\.\_\-\+]\+\(\/[a-zA-Z0-9\.\_\-\+]\+\)*>/
+    syn match NixURI   /[a-zA-Z][a-zA-Z0-9\+\-\.]*:[a-zA-Z0-9\%\/\?\:\@\&\=\+\$\,\-\_\.\!\~\*\']\+/
+    syn region NixSTRING
+      \ matchgroup=NixSTRING
+      \ start='"'
+      \ skip='\\"'
+      \ end='"'
+    syn region NixIND_STRING
+      \ matchgroup=NixIND_STRING
+      \ start="'''"
+      \ skip="'''\('\|[$]\|\\[nrt]\)"
+      \ end="'''"
+
+    syn match NixOther /[():/;=.,?\[\]]/
+
+    syn match NixCommentMatch /\(^\|\s\)#.*/
+    syn region NixCommentRegion start="/\*" end="\*/"
+
+    hi link NixCode Statement
+    hi link NixData Constant
+    hi link NixComment Comment
+
+    hi link NixCommentMatch NixComment
+    hi link NixCommentRegion NixComment
+    hi link NixID NixCode
+    hi link NixINT NixData
+    hi link NixPATH NixData
+    hi link NixHPATH NixData
+    hi link NixSPATH NixData
+    hi link NixURI NixData
+    hi link NixSTRING NixData
+    hi link NixIND_STRING NixData
+
+    hi link NixEnter NixCode
+    hi link NixOther NixCode
+    hi link NixQuote NixData
+
+    syn cluster nix_has_dollar_curly contains=@nix_ind_strings,@nix_strings
+    syn cluster nix_ind_strings contains=NixIND_STRING
+    syn cluster nix_strings contains=NixSTRING
+
+    ${concatStringsSep "\n" (mapAttrsToList (lang: { extraStart ? null }: let
+      startAlts = filter isString [
+        ''/\* ${lang} \*/''
+        extraStart
+      ];
+      sigil = ''\(${concatStringsSep ''\|'' startAlts}\)[ \t\r\n]*'';
+    in /* vim */ ''
+      syn include @nix_${lang}_syntax syntax/${lang}.vim
+      unlet b:current_syntax
+
+      syn match nix_${lang}_sigil
+        \ X${replaceStrings ["X"] ["\\X"] sigil}\ze\('''\|"\)X
+        \ nextgroup=nix_${lang}_region_IND_STRING,nix_${lang}_region_STRING
+        \ transparent
+
+      syn region nix_${lang}_region_STRING
+        \ matchgroup=NixSTRING
+        \ start='"'
+        \ skip='\\"'
+        \ end='"'
+        \ contained
+        \ contains=@nix_${lang}_syntax
+        \ transparent
+
+      syn region nix_${lang}_region_IND_STRING
+        \ matchgroup=NixIND_STRING
+        \ start="'''"
+        \ skip="'''\('\|[$]\|\\[nrt]\)"
+        \ end="'''"
+        \ contained
+        \ contains=@nix_${lang}_syntax
+        \ transparent
+
+      syn cluster nix_ind_strings
+        \ add=nix_${lang}_region_IND_STRING
+
+      syn cluster nix_strings
+        \ add=nix_${lang}_region_STRING
+
+      syn cluster nix_has_dollar_curly
+        \ add=@nix_${lang}_syntax
+    '') {
+      c = {};
+      cabal = {};
+      haskell = {};
+      sh.extraStart = ''write\(Ba\|Da\)sh[^ \t\r\n]*[ \t\r\n]*"[^"]*"'';
+      vim.extraStart =
+        ''write[^ \t\r\n]*[ \t\r\n]*"\(\([^"]*\.\)\?vimrc\|[^"]*\.vim\)"'';
+    })}
+
+    " Clear syntax that interferes with nixINSIDE_DOLLAR_CURLY.
+    syn clear shVarAssign
+
+    syn region nixINSIDE_DOLLAR_CURLY
+      \ matchgroup=NixEnter
+      \ start="[$]{"
+      \ end="}"
+      \ contains=TOP
+      \ containedin=@nix_has_dollar_curly
+      \ transparent
+
+    syn region nix_inside_curly
+      \ matchgroup=NixEnter
+      \ start="{"
+      \ end="}"
+      \ contains=TOP
+      \ containedin=nixINSIDE_DOLLAR_CURLY,nix_inside_curly
+      \ transparent
+
+    syn match NixQuote /'''\([''$']\|\\.\)/he=s+2
+      \ containedin=@nix_ind_strings
+      \ contained
+
+    syn match NixQuote /\\./he=s+1
+      \ containedin=@nix_strings
+      \ contained
+
+    syn sync fromstart
+
+    let b:current_syntax = "nix"
+
+    set isk=@,48-57,_,192-255,-,'
+  '';
+in
+out
diff --git a/jeschli/default.nix b/jeschli/default.nix
new file mode 100644
index 0000000..7886fef
--- /dev/null
+++ b/jeschli/default.nix
@@ -0,0 +1,9 @@
+_:
+{
+  imports = [
+    ../krebs
+    ./2configs
+#    ./3modules
+#    ./5pkgs
+  ];
+}
diff --git a/jeschli/source.nix b/jeschli/source.nix
new file mode 100644
index 0000000..d5e14a8
--- /dev/null
+++ b/jeschli/source.nix
@@ -0,0 +1,22 @@
+with import <stockholm/lib>;
+host@{ name, secure ? false, override ? {} }: let
+  builder = if getEnv "dummy_secrets" == "true"
+              then "buildbot"
+              else "jeschli";
+  _file = <stockholm> + "/jeschli/1systems/${name}/source.nix";
+in
+  evalSource (toString _file) [
+    {
+      nixos-config.symlink = "stockholm/jeschli/1systems/${name}/config.nix";
+      nixpkgs.git = {
+        url = https://github.com/nixos/nixpkgs;
+        ref = "f9390d6";
+      };
+      secrets.file = getAttr builder {
+        buildbot = toString <stockholm/jeschli/2configs/tests/dummy-secrets>;
+        jeschli = "/home/jeschli/secrets/${name}";
+      };
+      stockholm.file = toString <stockholm>;
+    }
+    override
+  ]
diff --git a/lib/types.nix b/lib/types.nix
index 08dc097..c3b14d8 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -92,7 +92,7 @@ rec {
         default = null;
       };
       addrs = mkOption {
-        type = listOf cidr;
+        type = listOf addr;
         default =
           optional (config.ip4 != null) config.ip4.addr ++
           optional (config.ip6 != null) config.ip6.addr;
@@ -155,6 +155,8 @@ rec {
                 ++
                 (map (a: "Subnet = ${a}") net.addrs)
                 ++
+                (map (a: "Subnet = ${a}") config.subnets)
+                ++
                 [config.extraConfig]
                 ++
                 [config.pubkey]
@@ -173,6 +175,11 @@ rec {
               description = "tinc port to use to connect to host";
               default = 655;
             };
+            subnets = mkOption {
+              type = listOf cidr;
+              description = "tinc subnets";
+              default = [];
+            };
           };
         }));
         default = null;
diff --git a/mv/1systems/stro/config.nix b/mv/1systems/stro/config.nix
index 669655e..941b3f6 100644
--- a/mv/1systems/stro/config.nix
+++ b/mv/1systems/stro/config.nix
@@ -14,7 +14,6 @@ with import <stockholm/lib>;
   imports = [
     <secrets>
     <stockholm/krebs>
-    <stockholm/tv/2configs/audit.nix>
     <stockholm/tv/2configs/bash>
     <stockholm/tv/2configs/exim-retiolum.nix>
     <stockholm/tv/2configs/hw/x220.nix>
diff --git a/shell.nix b/shell.nix
index 53b0f96..bfdf1b3 100644
--- a/shell.nix
+++ b/shell.nix
@@ -2,239 +2,16 @@ let
   lib = import ./lib;
   pkgs = import <nixpkgs> { overlays = [(import ./krebs/5pkgs)]; };
 
-  #
-  # high level commands
-  #
-
-  cmds.deploy = pkgs.withGetopt {
-    force-populate = { default = /* sh */ "false"; switch = true; };
-    quiet = { default = /* sh */ "false"; switch = true; };
-    source_file = {
-      default = /* sh */ "$user/1systems/$system/source.nix";
-      long = "source";
-    };
-    system = {};
-    target.default = /* sh */ "$system";
-    user.default = /* sh */ "$LOGNAME";
-  } (opts: pkgs.writeDash "cmds.deploy" ''
-    set -efu
-
-    . ${init.env}
-    . ${init.proxy "deploy" opts}
-
-    # Use system's nixos-rebuild, which is not self-contained
-    export PATH=/run/current-system/sw/bin
-    exec ${utils.with-whatsupnix} \
-    nixos-rebuild switch \
-        --show-trace \
-        -I "$target_path"
-  '');
-
-  cmds.install = pkgs.withGetopt {
-    force-populate = { default = /* sh */ "false"; switch = true; };
-    quiet = { default = /* sh */ "false"; switch = true; };
-    source_file = {
-      default = /* sh */ "$user/1systems/$system/source.nix";
-      long = "source";
-    };
-    system = {};
-    target = {};
-    user.default = /* sh */ "$LOGNAME";
-  } (opts: pkgs.writeBash "cmds.install" ''
-    set -efu
-
-    . ${init.env}
-
-    if \test "''${using_proxy-}" != true; then
-      ${pkgs.openssh}/bin/ssh \
-          -o StrictHostKeyChecking=no \
-          -o UserKnownHostsFile=/dev/null \
-          "$target_user@$target_host" -p "$target_port" \
-          env target_path=$(quote "$target_path") \
-              sh -s prepare < ${./krebs/4lib/infest/prepare.sh}
-              # TODO inline prepare.sh?
-    fi
-
-    . ${init.proxy "install" opts}
-
-    # Reset PATH because we need access to nixos-install.
-    # TODO provide nixos-install instead of relying on prepare.sh
-    export PATH="$OLD_PATH"
-
-    # these variables get defined by nix-shell (i.e. nix-build) from
-    # XDG_RUNTIME_DIR and reference the wrong directory (/run/user/0),
-    # which only exists on / and not at /mnt.
-    export NIX_BUILD_TOP=/tmp
-    export TEMPDIR=/tmp
-    export TEMP=/tmp
-    export TMPDIR=/tmp
-    export TMP=/tmp
-    export XDG_RUNTIME_DIR=/tmp
-
-    export NIXOS_CONFIG="$target_path/nixos-config"
-
-    cd
-    exec nixos-install
-  '');
-
-  cmds.test = pkgs.withGetopt {
-    force-populate = { default = /* sh */ "false"; switch = true; };
-    quiet = { default = /* sh */ "false"; switch = true; };
-    source_file = {
-      default = /* sh */ "$user/1systems/$system/source.nix";
-      long = "source";
-    };
-    system = {};
-    target = {};
-    user.default = /* sh */ "$LOGNAME";
-  } (opts: pkgs.writeDash "cmds.test" /* sh */ ''
-    set -efu
-
-    export dummy_secrets=true
-
-    . ${init.env}
-    . ${init.proxy "test" opts}
-
-    exec ${utils.build} config.system.build.toplevel
-  '');
-
-  #
-  # low level commands
-  #
-
-  # usage: get-source SOURCE_FILE
-  cmds.get-source = pkgs.writeDash "cmds.get-source" ''
-    set -efu
-    exec ${pkgs.nix}/bin/nix-instantiate \
-        --eval \
-        --json \
-        --readonly-mode \
-        --show-trace \
-        --strict \
-        "$1"
-  '';
-
-  # usage: parse-target [--default=TARGET] TARGET
-  # TARGET = [USER@]HOST[:PORT][/PATH]
-  cmds.parse-target = pkgs.withGetopt {
-    default_target = {
-      long = "default";
-      short = "d";
-    };
-  } (opts: pkgs.writeDash "cmds.parse-target" ''
-    set -efu
-    target=$1; shift
-    for arg; do echo "$0: bad argument: $arg" >&2; done
-    if \test $# != 0; then exit 2; fi
-    exec ${pkgs.jq}/bin/jq \
-        -enr \
-        --arg default_target "$default_target" \
-        --arg target "$target" \
-        -f ${pkgs.writeText "cmds.parse-target.jq" ''
-          def parse: match("^(?:([^@]+)@)?([^:/]+)?(?::([0-9]+))?(/.*)?$") | {
-            user: .captures[0].string,
-            host: .captures[1].string,
-            port: .captures[2].string,
-            path: .captures[3].string,
-          };
-          def sanitize: with_entries(select(.value != null));
-          ($default_target | parse) + ($target | parse | sanitize) |
-          . + { local: (.user == env.LOGNAME and .host == env.HOSTNAME) }
-        ''}
-  '');
-
-  init.env = pkgs.writeText "init.env" /* sh */ ''
-    export quiet
-    export system
-    export target
-    export user
-
-    default_target=root@$system:22/var/src
-
-    export target_object="$(parse-target "$target" -d "$default_target")"
-    export target_user="$(echo $target_object | ${pkgs.jq}/bin/jq -r .user)"
-    export target_host="$(echo $target_object | ${pkgs.jq}/bin/jq -r .host)"
-    export target_port="$(echo $target_object | ${pkgs.jq}/bin/jq -r .port)"
-    export target_path="$(echo $target_object | ${pkgs.jq}/bin/jq -r .path)"
-    export target_local="$(echo $target_object | ${pkgs.jq}/bin/jq -r .local)"
-  '';
-
-  init.proxy = command: opts: pkgs.writeText "init.proxy" /* sh */ ''
-    if \test "''${using_proxy-}" != true; then
-
-      source=$(get-source "$source_file")
-      qualified_target=$target_user@$target_host:$target_port$target_path
-      if \test "$force_populate" = true; then
-        echo "$source" | populate --force "$qualified_target"
-      else
-        echo "$source" | populate "$qualified_target"
-      fi
-
-      if \test "$target_local" != true; then
-        exec ${pkgs.openssh}/bin/ssh \
-            "$target_user@$target_host" -p "$target_port" \
-            cd "$target_path/stockholm" \; \
-            NIX_PATH=$(quote "$target_path") \
-            STOCKHOLM_VERSION=$(quote "$STOCKHOLM_VERSION") \
-            nix-shell --run "$(quote "
-              ${lib.concatStringsSep " " (lib.mapAttrsToList
-                (name: opt: /* sh */ "${opt.varname}=\$(quote ${opt.ref})")
-                opts
-              )} \
-              using_proxy=true \
-              ${lib.shell.escape command} \
-              $WITHGETOPT_ORIG_ARGS \
-            ")"
-      fi
-    fi
-  '';
-
-  utils.build = pkgs.writeDash "utils.build" ''
-    set -efu
-    ${utils.with-whatsupnix} \
-    ${pkgs.nix}/bin/nix-build \
-        --no-out-link \
-        --show-trace \
-        -E "with import <stockholm>; $1" \
-        -I "$target_path" \
-  '';
-
-  utils.with-whatsupnix = pkgs.writeDash "utils.with-whatsupnix" ''
-    set -efu
-    if \test "$quiet" = true; then
-      "$@" -Q 2>&1 | ${pkgs.whatsupnix}/bin/whatsupnix
-    else
-      exec "$@"
-    fi
-  '';
-
-  shell.get-version = pkgs.writeDash "shell.get-version" ''
-    set -efu
-    version=git.$(${pkgs.git}/bin/git describe --always --dirty)
-    case $version in (*-dirty)
-      version=$version@$HOSTNAME
-    esac
-    date=$(${pkgs.coreutils}/bin/date +%y.%m)
-    echo "$date.$version"
-  '';
-
-  shell.cmdspkg = pkgs.writeOut "shell.cmdspkg" (lib.mapAttrs' (name: link:
-    lib.nameValuePair "/bin/${name}" { inherit link; }
-  ) cmds);
-
 in pkgs.stdenv.mkDerivation {
   name = "stockholm";
   shellHook = /* sh */ ''
-    export OLD_PATH="$PATH"
     export NIX_PATH=stockholm=${toString ./.}:nixpkgs=${toString <nixpkgs>}
     if test -e /nix/var/nix/daemon-socket/socket; then
       export NIX_REMOTE=daemon
     fi
     export PATH=${lib.makeBinPath [
-      pkgs.populate
-      pkgs.quote
-      shell.cmdspkg
-    ]}
+      pkgs.stockholm
+    ]}''${PATH+:$PATH}
 
     eval "$(declare -F | ${pkgs.gnused}/bin/sed s/declare/unset/)"
     shopt -u no_empty_cmd_completion
@@ -251,9 +28,6 @@ in pkgs.stdenv.mkDerivation {
       :
     }
 
-    export HOSTNAME="$(${pkgs.nettools}/bin/hostname)"
-    export STOCKHOLM_VERSION="''${STOCKHOLM_VERSION-$(${shell.get-version})}"
-
     PS1='\[\e[38;5;162m\]\w\[\e[0m\] '
   '';
 }
diff --git a/tv/1systems/alnus/config.nix b/tv/1systems/alnus/config.nix
index 71302d5..001ad0b 100644
--- a/tv/1systems/alnus/config.nix
+++ b/tv/1systems/alnus/config.nix
@@ -26,8 +26,9 @@ with import <stockholm/lib>;
     chromium
     firefoxWrapper
     networkmanagerapplet
-    pidginotr
-    pidgin-with-plugins
+    (pkgs.pidgin-with-plugins.override {
+      plugins = [ pkgs.pidginotr ];
+    })
   ];
 
   fileSystems = {
diff --git a/tv/1systems/mu/config.nix b/tv/1systems/mu/config.nix
index 10d7b21..6c22971 100644
--- a/tv/1systems/mu/config.nix
+++ b/tv/1systems/mu/config.nix
@@ -57,8 +57,9 @@ with import <stockholm/lib>;
     gimp
     iptables
     libreoffice
-    pidginotr
-    pidgin-with-plugins
+    (pkgs.pidgin-with-plugins.override {
+      plugins = [ pkgs.pidginotr ];
+    })
     skype
     slock
     tinc_pre
diff --git a/tv/1systems/querel/config.nix b/tv/1systems/querel/config.nix
new file mode 100644
index 0000000..b564383
--- /dev/null
+++ b/tv/1systems/querel/config.nix
@@ -0,0 +1,95 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: {
+
+  imports = [
+    <stockholm/krebs>
+    <stockholm/tv/2configs>
+    <stockholm/tv/3modules>
+    <stockholm/tv/2configs/retiolum.nix>
+  ];
+
+  krebs.build.host = config.krebs.hosts.querel;
+  krebs.build.user = mkForce config.krebs.users.itak;
+
+  boot.initrd.availableKernelModules = [ "ahci" ];
+  boot.initrd.luks = {
+    cryptoModules = [ "aes" "sha512" "xts" ];
+    devices.querel-luks1 = {
+      allowDiscards = true;
+      device = "/dev/sda2";
+    };
+  };
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.loader = {
+    efi.canTouchEfiVariables = true;
+    systemd-boot.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    firefoxWrapper
+    gimp
+    kate
+    libreoffice
+    (pkgs.pidgin-with-plugins.override {
+      plugins = [ pkgs.pidginotr ];
+    })
+    sxiv
+    texlive.combined.scheme-full
+    vim
+    zathura
+  ];
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/mapper/querel-root";
+      fsType = "ext4";
+      options = [ "defaults" "discard" ];
+    };
+    "/home" = {
+      device = "/dev/mapper/querel-home";
+      fsType = "ext4";
+      options = [ "defaults" "discard" ];
+    };
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+  };
+
+  hardware.enableRedistributableFirmware = true;
+  hardware.pulseaudio.enable = true;
+
+  i18n.defaultLocale = "de_DE.UTF-8";
+
+  networking.networkmanager.enable = true;
+
+  programs.ssh.startAgent = false;
+
+  services.printing = {
+    enable = true;
+  };
+
+  services.xserver.enable = true;
+  services.xserver.layout = "de";
+  services.xserver.xkbOptions = "eurosign:e";
+
+  services.xserver.synaptics = {
+    enable = true;
+    twoFingerScroll = true;
+  };
+
+  services.xserver.desktopManager.plasma5.enable = true;
+  services.xserver.displayManager.auto = {
+    enable = true;
+    user = "itak";
+  };
+
+  users.users.itak = {
+    inherit (config.krebs.users.itak) home uid;
+    isNormalUser = true;
+    extraGroups = [
+      "audio"
+      "video"
+      "networkmanager"
+    ];
+  };
+}
diff --git a/tv/1systems/querel/source.nix b/tv/1systems/querel/source.nix
new file mode 100644
index 0000000..74eab51
--- /dev/null
+++ b/tv/1systems/querel/source.nix
@@ -0,0 +1,3 @@
+import <stockholm/tv/source.nix> {
+  name = "querel";
+}
diff --git a/tv/2configs/audit.nix b/tv/2configs/audit.nix
deleted file mode 100644
index 644741a..0000000
--- a/tv/2configs/audit.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ ... }:
-
-{
-  security.audit = {
-    rules = [
-      "-a task,never"
-    ];
-  };
-}
diff --git a/tv/2configs/backup.nix b/tv/2configs/backup.nix
index f76fb2e..14d3815 100644
--- a/tv/2configs/backup.nix
+++ b/tv/2configs/backup.nix
@@ -22,6 +22,12 @@ with import <stockholm/lib>;
       dst = { host = config.krebs.hosts.zu; path = "/bku/nomic-home"; };
       startAt = "04:20";
     };
+    nomic-pull-querel-home = {
+      method = "pull";
+      src = { host = config.krebs.hosts.querel; path = "/home"; };
+      dst = { host = config.krebs.hosts.nomic; path = "/fs/ponyhof/bku/querel-home"; };
+      startAt = "00:00";
+    };
     wu-home-xu = {
       method = "push";
       src = { host = config.krebs.hosts.wu; path = "/home"; };
diff --git a/tv/2configs/bash/completion.sh b/tv/2configs/bash/completion.sh
deleted file mode 100644
index 537484f..0000000
--- a/tv/2configs/bash/completion.sh
+++ /dev/null
@@ -1,779 +0,0 @@
-
-# Expand variable starting with tilde (~)
-# We want to expand ~foo/... to /home/foo/... to avoid problems when
-# word-to-complete starting with a tilde is fed to commands and ending up
-# quoted instead of expanded.
-# Only the first portion of the variable from the tilde up to the first slash
-# (~../) is expanded.  The remainder of the variable, containing for example
-# a dollar sign variable ($) or asterisk (*) is not expanded.
-# Example usage:
-#
-#    $ v="~"; __expand_tilde_by_ref v; echo "$v"
-#
-# Example output:
-#
-#       v                  output
-#    --------         ----------------
-#    ~                /home/user
-#    ~foo/bar         /home/foo/bar
-#    ~foo/$HOME       /home/foo/$HOME
-#    ~foo/a  b        /home/foo/a  b
-#    ~foo/*           /home/foo/*
-#
-# @param $1  Name of variable (not the value of the variable) to expand
-__expand_tilde_by_ref()
-{
-    # Does $1 start with tilde (~)?
-    if [[ ${!1} == \~* ]]; then
-        # Does $1 contain slash (/)?
-        if [[ ${!1} == */* ]]; then
-            # Yes, $1 contains slash;
-            # 1: Remove * including and after first slash (/), i.e. "~a/b"
-            #    becomes "~a".  Double quotes allow eval.
-            # 2: Remove * before the first slash (/), i.e. "~a/b"
-            #    becomes "b".  Single quotes prevent eval.
-            #       +-----1----+ +---2----+
-            eval $1="${!1/%\/*}"/'${!1#*/}'
-        else
-            # No, $1 doesn't contain slash
-            eval $1="${!1}"
-        fi
-    fi
-} # __expand_tilde_by_ref()
-
-
-# Get the word to complete.
-# This is nicer than ${COMP_WORDS[$COMP_CWORD]}, since it handles cases
-# where the user is completing in the middle of a word.
-# (For example, if the line is "ls foobar",
-# and the cursor is here -------->   ^
-# @param $1 string  Characters out of $COMP_WORDBREAKS which should NOT be
-#     considered word breaks. This is useful for things like scp where
-#     we want to return host:path and not only path, so we would pass the
-#     colon (:) as $1 in this case.
-# @param $2 integer  Index number of word to return, negatively offset to the
-#     current word (default is 0, previous is 1), respecting the exclusions
-#     given at $1.  For example, `_get_cword "=:" 1' returns the word left of
-#     the current word, respecting the exclusions "=:".
-# @deprecated  Use `_get_comp_words_by_ref cur' instead
-# @see _get_comp_words_by_ref()
-_get_cword()
-{
-    local LC_CTYPE=C
-    local cword words
-    __reassemble_comp_words_by_ref "$1" words cword
-
-    # return previous word offset by $2
-    if [[ ${2//[^0-9]/} ]]; then
-        printf "%s" "${words[cword-$2]}"
-    elif [[ "${#words[cword]}" -eq 0 || "$COMP_POINT" == "${#COMP_LINE}" ]]; then
-        printf "%s" "${words[cword]}"
-    else
-        local i
-        local cur="$COMP_LINE"
-        local index="$COMP_POINT"
-        for (( i = 0; i <= cword; ++i )); do
-            while [[
-                # Current word fits in $cur?
-                "${#cur}" -ge ${#words[i]} &&
-                # $cur doesn't match cword?
-                "${cur:0:${#words[i]}}" != "${words[i]}"
-            ]]; do
-                # Strip first character
-                cur="${cur:1}"
-                # Decrease cursor position
-                ((index--))
-            done
-
-            # Does found word matches cword?
-            if [[ "$i" -lt "$cword" ]]; then
-                # No, cword lies further;
-                local old_size="${#cur}"
-                cur="${cur#${words[i]}}"
-                local new_size="${#cur}"
-                index=$(( index - old_size + new_size ))
-            fi
-        done
-
-        if [[ "${words[cword]:0:${#cur}}" != "$cur" ]]; then
-            # We messed up! At least return the whole word so things
-            # keep working
-            printf "%s" "${words[cword]}"
-        else
-            printf "%s" "${cur:0:$index}"
-        fi
-    fi
-} # _get_cword()
-
-
-# Get word previous to the current word.
-# This is a good alternative to `prev=${COMP_WORDS[COMP_CWORD-1]}' because bash4
-# will properly return the previous word with respect to any given exclusions to
-# COMP_WORDBREAKS.
-# @deprecated  Use `_get_comp_words_by_ref cur prev' instead
-# @see _get_comp_words_by_ref()
-#
-_get_pword()
-{
-    if [[ $COMP_CWORD -ge 1 ]]; then
-        _get_cword "${@:-}" 1
-    fi
-}
-
-
-
-# Complete variables.
-# @return  True (0) if variables were completed,
-#          False (> 0) if not.
-_variables()
-{
-    if [[ $cur =~ ^(\$\{?)([A-Za-z0-9_]*)$ ]]; then
-        [[ $cur == *{* ]] && local suffix=} || local suffix=
-        COMPREPLY+=( $( compgen -P ${BASH_REMATCH[1]} -S "$suffix" -v -- \
-            "${BASH_REMATCH[2]}" ) )
-        return 0
-    fi
-    return 1
-}
-
-# Assign variable one scope above the caller
-# Usage: local "$1" && _upvar $1 "value(s)"
-# Param: $1  Variable name to assign value to
-# Param: $*  Value(s) to assign.  If multiple values, an array is
-#            assigned, otherwise a single value is assigned.
-# NOTE: For assigning multiple variables, use '_upvars'.  Do NOT
-#       use multiple '_upvar' calls, since one '_upvar' call might
-#       reassign a variable to be used by another '_upvar' call.
-# See: http://fvue.nl/wiki/Bash:_Passing_variables_by_reference
-_upvar()
-{
-    if unset -v "$1"; then           # Unset & validate varname
-        if (( $# == 2 )); then
-            eval $1=\"\$2\"          # Return single value
-        else
-            eval $1=\(\"\${@:2}\"\)  # Return array
-        fi
-    fi
-}
-
-# Assign variables one scope above the caller
-# Usage: local varname [varname ...] &&
-#        _upvars [-v varname value] | [-aN varname [value ...]] ...
-# Available OPTIONS:
-#     -aN  Assign next N values to varname as array
-#     -v   Assign single value to varname
-# Return: 1 if error occurs
-# See: http://fvue.nl/wiki/Bash:_Passing_variables_by_reference
-_upvars()
-{
-    if ! (( $# )); then
-        echo "${FUNCNAME[0]}: usage: ${FUNCNAME[0]} [-v varname"\
-            "value] | [-aN varname [value ...]] ..." 1>&2
-        return 2
-    fi
-    while (( $# )); do
-        case $1 in
-            -a*)
-                # Error checking
-                [[ ${1#-a} ]] || { echo "bash: ${FUNCNAME[0]}: \`$1': missing"\
-                    "number specifier" 1>&2; return 1; }
-                printf %d "${1#-a}" &> /dev/null || { echo "bash:"\
-                    "${FUNCNAME[0]}: \`$1': invalid number specifier" 1>&2
-                    return 1; }
-                # Assign array of -aN elements
-                [[ "$2" ]] && unset -v "$2" && eval $2=\(\"\${@:3:${1#-a}}\"\) &&
-                shift $((${1#-a} + 2)) || { echo "bash: ${FUNCNAME[0]}:"\
-                    "\`$1${2+ }$2': missing argument(s)" 1>&2; return 1; }
-                ;;
-            -v)
-                # Assign single value
-                [[ "$2" ]] && unset -v "$2" && eval $2=\"\$3\" &&
-                shift 3 || { echo "bash: ${FUNCNAME[0]}: $1: missing"\
-                "argument(s)" 1>&2; return 1; }
-                ;;
-            *)
-                echo "bash: ${FUNCNAME[0]}: $1: invalid option" 1>&2
-                return 1 ;;
-        esac
-    done
-}
-
-# @param $1 exclude  Characters out of $COMP_WORDBREAKS which should NOT be
-#     considered word breaks. This is useful for things like scp where
-#     we want to return host:path and not only path, so we would pass the
-#     colon (:) as $1 in this case.
-# @param $2 words  Name of variable to return words to
-# @param $3 cword  Name of variable to return cword to
-# @param $4 cur  Name of variable to return current word to complete to
-# @see __reassemble_comp_words_by_ref()
-__get_cword_at_cursor_by_ref()
-{
-    local cword words=()
-    __reassemble_comp_words_by_ref "$1" words cword
-
-    local i cur index=$COMP_POINT lead=${COMP_LINE:0:$COMP_POINT}
-    # Cursor not at position 0 and not leaded by just space(s)?
-    if [[ $index -gt 0 && ( $lead && ${lead//[[:space:]]} ) ]]; then
-        cur=$COMP_LINE
-        for (( i = 0; i <= cword; ++i )); do
-            while [[
-                # Current word fits in $cur?
-                ${#cur} -ge ${#words[i]} &&
-                # $cur doesn't match cword?
-                "${cur:0:${#words[i]}}" != "${words[i]}"
-            ]]; do
-                # Strip first character
-                cur="${cur:1}"
-                # Decrease cursor position
-                ((index--))
-            done
-
-            # Does found word match cword?
-            if [[ $i -lt $cword ]]; then
-                # No, cword lies further;
-                local old_size=${#cur}
-                cur="${cur#"${words[i]}"}"
-                local new_size=${#cur}
-                index=$(( index - old_size + new_size ))
-            fi
-        done
-        # Clear $cur if just space(s)
-        [[ $cur && ! ${cur//[[:space:]]} ]] && cur=
-        # Zero $index if negative
-        [[ $index -lt 0 ]] && index=0
-    fi
-
-    local "$2" "$3" "$4" && _upvars -a${#words[@]} $2 "${words[@]}" \
-        -v $3 "$cword" -v $4 "${cur:0:$index}"
-}
-
-# Reassemble command line words, excluding specified characters from the
-# list of word completion separators (COMP_WORDBREAKS).
-# @param $1 chars  Characters out of $COMP_WORDBREAKS which should
-#     NOT be considered word breaks. This is useful for things like scp where
-#     we want to return host:path and not only path, so we would pass the
-#     colon (:) as $1 here.
-# @param $2 words  Name of variable to return words to
-# @param $3 cword  Name of variable to return cword to
-#
-__reassemble_comp_words_by_ref()
-{
-    local exclude i j line ref
-    # Exclude word separator characters?
-    if [[ $1 ]]; then
-        # Yes, exclude word separator characters;
-        # Exclude only those characters, which were really included
-        exclude="${1//[^$COMP_WORDBREAKS]}"
-    fi
-
-    # Default to cword unchanged
-    eval $3=$COMP_CWORD
-    # Are characters excluded which were former included?
-    if [[ $exclude ]]; then
-        # Yes, list of word completion separators has shrunk;
-        line=$COMP_LINE
-        # Re-assemble words to complete
-        for (( i=0, j=0; i < ${#COMP_WORDS[@]}; i++, j++)); do
-            # Is current word not word 0 (the command itself) and is word not
-            # empty and is word made up of just word separator characters to
-            # be excluded and is current word not preceded by whitespace in
-            # original line?
-            while [[ $i -gt 0 && ${COMP_WORDS[$i]} == +([$exclude]) ]]; do
-                # Is word separator not preceded by whitespace in original line
-                # and are we not going to append to word 0 (the command
-                # itself), then append to current word.
-                [[ $line != [$' \t']* ]] && (( j >= 2 )) && ((j--))
-                # Append word separator to current or new word
-                ref="$2[$j]"
-                eval $2[$j]=\${!ref}\${COMP_WORDS[i]}
-                # Indicate new cword
-                [[ $i == $COMP_CWORD ]] && eval $3=$j
-                # Remove optional whitespace + word separator from line copy
-                line=${line#*"${COMP_WORDS[$i]}"}
-                # Start new word if word separator in original line is
-                # followed by whitespace.
-                [[ $line == [$' \t']* ]] && ((j++))
-                # Indicate next word if available, else end *both* while and
-                # for loop
-                (( $i < ${#COMP_WORDS[@]} - 1)) && ((i++)) || break 2
-            done
-            # Append word to current word
-            ref="$2[$j]"
-            eval $2[$j]=\${!ref}\${COMP_WORDS[i]}
-            # Remove optional whitespace + word from line copy
-            line=${line#*"${COMP_WORDS[i]}"}
-            # Indicate new cword
-            [[ $i == $COMP_CWORD ]] && eval $3=$j
-        done
-        [[ $i == $COMP_CWORD ]] && eval $3=$j
-    else
-        # No, list of word completions separators hasn't changed;
-        eval $2=\( \"\${COMP_WORDS[@]}\" \)
-    fi
-} # __reassemble_comp_words_by_ref()
-
-
-# If the word-to-complete contains a colon (:), left-trim COMPREPLY items with
-# word-to-complete.
-# With a colon in COMP_WORDBREAKS, words containing
-# colons are always completed as entire words if the word to complete contains
-# a colon.  This function fixes this, by removing the colon-containing-prefix
-# from COMPREPLY items.
-# The preferred solution is to remove the colon (:) from COMP_WORDBREAKS in
-# your .bashrc:
-#
-#    # Remove colon (:) from list of word completion separators
-#    COMP_WORDBREAKS=${COMP_WORDBREAKS//:}
-#
-# See also: Bash FAQ - E13) Why does filename completion misbehave if a colon
-# appears in the filename? - http://tiswww.case.edu/php/chet/bash/FAQ
-# @param $1 current word to complete (cur)
-# @modifies global array $COMPREPLY
-#
-__ltrim_colon_completions()
-{
-    if [[ "$1" == *:* && "$COMP_WORDBREAKS" == *:* ]]; then
-        # Remove colon-word prefix from COMPREPLY items
-        local colon_word=${1%"${1##*:}"}
-        local i=${#COMPREPLY[*]}
-        while [[ $((--i)) -ge 0 ]]; do
-            COMPREPLY[$i]=${COMPREPLY[$i]#"$colon_word"}
-        done
-    fi
-} # __ltrim_colon_completions()
-
-
-# NOTE: Using this function as a helper function is deprecated.  Use
-#       `_known_hosts_real' instead.
-_known_hosts()
-{
-    local cur prev words cword
-    _init_completion -n : || return
-
-    # NOTE: Using `_known_hosts' as a helper function and passing options
-    #       to `_known_hosts' is deprecated: Use `_known_hosts_real' instead.
-    local options
-    [[ "$1" == -a || "$2" == -a ]] && options=-a
-    [[ "$1" == -c || "$2" == -c ]] && options+=" -c"
-    _known_hosts_real $options -- "$cur"
-} # _known_hosts()
-
-
-# Helper function for completing _known_hosts.
-# This function performs host completion based on ssh's config and known_hosts
-# files, as well as hostnames reported by avahi-browse if
-# COMP_KNOWN_HOSTS_WITH_AVAHI is set to a non-empty value.  Also hosts from
-# HOSTFILE (compgen -A hostname) are added, unless
-# COMP_KNOWN_HOSTS_WITH_HOSTFILE is set to an empty value.
-# Usage: _known_hosts_real [OPTIONS] CWORD
-# Options:  -a             Use aliases
-#           -c             Use `:' suffix
-#           -F configfile  Use `configfile' for configuration settings
-#           -p PREFIX      Use PREFIX
-# Return: Completions, starting with CWORD, are added to COMPREPLY[]
-_known_hosts_real()
-{
-    local configfile flag prefix
-    local cur curd awkcur user suffix aliases i host
-    local -a kh khd config
-
-    local OPTIND=1
-    while getopts "acF:p:" flag "$@"; do
-        case $flag in
-            a) aliases='yes' ;;
-            c) suffix=':' ;;
-            F) configfile=$OPTARG ;;
-            p) prefix=$OPTARG ;;
-        esac
-    done
-    [[ $# -lt $OPTIND ]] && echo "error: $FUNCNAME: missing mandatory argument CWORD"
-    cur=${!OPTIND}; let "OPTIND += 1"
-    [[ $# -ge $OPTIND ]] && echo "error: $FUNCNAME("$@"): unprocessed arguments:"\
-    $(while [[ $# -ge $OPTIND ]]; do printf '%s\n' ${!OPTIND}; shift; done)
-
-    [[ $cur == *@* ]] && user=${cur%@*}@ && cur=${cur#*@}
-    kh=()
-
-    # ssh config files
-    if [[ -n $configfile ]]; then
-        [[ -r $configfile ]] && config+=( "$configfile" )
-    else
-        for i in /etc/ssh/ssh_config ~/.ssh/config ~/.ssh2/config; do
-            [[ -r $i ]] && config+=( "$i" )
-        done
-    fi
-
-    # Known hosts files from configs
-    if [[ ${#config[@]} -gt 0 ]]; then
-        local OIFS=$IFS IFS=$'\n' j
-        local -a tmpkh
-        # expand paths (if present) to global and user known hosts files
-        # TODO(?): try to make known hosts files with more than one consecutive
-        #          spaces in their name work (watch out for ~ expansion
-        #          breakage! Alioth#311595)
-        tmpkh=( $( awk 'sub("^[ \t]*([Gg][Ll][Oo][Bb][Aa][Ll]|[Uu][Ss][Ee][Rr])[Kk][Nn][Oo][Ww][Nn][Hh][Oo][Ss][Tt][Ss][Ff][Ii][Ll][Ee][ \t]+", "") { print $0 }' "${config[@]}" | sort -u ) )
-        IFS=$OIFS
-        for i in "${tmpkh[@]}"; do
-            # First deal with quoted entries...
-            while [[ $i =~ ^([^\"]*)\"([^\"]*)\"(.*)$ ]]; do
-                i=${BASH_REMATCH[1]}${BASH_REMATCH[3]}
-                j=${BASH_REMATCH[2]}
-                __expand_tilde_by_ref j # Eval/expand possible `~' or `~user'
-                [[ -r $j ]] && kh+=( "$j" )
-            done
-            # ...and then the rest.
-            for j in $i; do
-                __expand_tilde_by_ref j # Eval/expand possible `~' or `~user'
-                [[ -r $j ]] && kh+=( "$j" )
-            done
-        done
-    fi
-
-
-    if [[ -z $configfile ]]; then
-        # Global and user known_hosts files
-        for i in /etc/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts2 \
-            /etc/known_hosts /etc/known_hosts2 ~/.ssh/known_hosts \
-            ~/.ssh/known_hosts2; do
-            [[ -r $i ]] && kh+=( "$i" )
-        done
-        for i in /etc/ssh2/knownhosts ~/.ssh2/hostkeys; do
-            [[ -d $i ]] && khd+=( "$i"/*pub )
-        done
-    fi
-
-    # If we have known_hosts files to use
-    if [[ ${#kh[@]} -gt 0 || ${#khd[@]} -gt 0 ]]; then
-        # Escape slashes and dots in paths for awk
-        awkcur=${cur//\//\\\/}
-        awkcur=${awkcur//\./\\\.}
-        curd=$awkcur
-
-        if [[ "$awkcur" == [0-9]*[.:]* ]]; then
-            # Digits followed by a dot or a colon - just search for that
-            awkcur="^$awkcur[.:]*"
-        elif [[ "$awkcur" == [0-9]* ]]; then
-            # Digits followed by no dot or colon - search for digits followed
-            # by a dot or a colon
-            awkcur="^$awkcur.*[.:]"
-        elif [[ -z $awkcur ]]; then
-            # A blank - search for a dot, a colon, or an alpha character
-            awkcur="[a-z.:]"
-        else
-            awkcur="^$awkcur"
-        fi
-
-        if [[ ${#kh[@]} -gt 0 ]]; then
-            # FS needs to look for a comma separated list
-            COMPREPLY+=( $( awk 'BEGIN {FS=","}
-            /^\s*[^|\#]/ {
-            sub("^@[^ ]+ +", ""); \
-            sub(" .*$", ""); \
-            for (i=1; i<=NF; ++i) { \
-            sub("^\\[", "", $i); sub("\\](:[0-9]+)?$", "", $i); \
-            if ($i !~ /[*?]/ && $i ~ /'"$awkcur"'/) {print $i} \
-            }}' "${kh[@]}" 2>/dev/null ) )
-        fi
-        if [[ ${#khd[@]} -gt 0 ]]; then
-            # Needs to look for files called
-            # .../.ssh2/key_22_<hostname>.pub
-            # dont fork any processes, because in a cluster environment,
-            # there can be hundreds of hostkeys
-            for i in "${khd[@]}" ; do
-                if [[ "$i" == *key_22_$curd*.pub && -r "$i" ]]; then
-                    host=${i/#*key_22_/}
-                    host=${host/%.pub/}
-                    COMPREPLY+=( $host )
-                fi
-            done
-        fi
-
-        # apply suffix and prefix
-        for (( i=0; i < ${#COMPREPLY[@]}; i++ )); do
-            COMPREPLY[i]=$prefix$user${COMPREPLY[i]}$suffix
-        done
-    fi
-
-    # append any available aliases from config files
-    if [[ ${#config[@]} -gt 0 && -n "$aliases" ]]; then
-        local hosts=$( sed -ne 's/^[ \t]*[Hh][Oo][Ss][Tt]\([Nn][Aa][Mm][Ee]\)\{0,1\}['"$'\t '"']\{1,\}\([^#*?]*\)\(#.*\)\{0,1\}$/\2/p' "${config[@]}" )
-        COMPREPLY+=( $( compgen -P "$prefix$user" \
-            -S "$suffix" -W "$hosts" -- "$cur" ) )
-    fi
-
-    # Add hosts reported by avahi-browse, if desired and it's available.
-    if [[ ${COMP_KNOWN_HOSTS_WITH_AVAHI:-} ]] && \
-        type avahi-browse &>/dev/null; then
-        # The original call to avahi-browse also had "-k", to avoid lookups
-        # into avahi's services DB. We don't need the name of the service, and
-        # if it contains ";", it may mistify the result. But on Gentoo (at
-        # least), -k wasn't available (even if mentioned in the manpage) some
-        # time ago, so...
-        COMPREPLY+=( $( compgen -P "$prefix$user" -S "$suffix" -W \
-            "$( avahi-browse -cpr _workstation._tcp 2>/dev/null | \
-                 awk -F';' '/^=/ { print $7 }' | sort -u )" -- "$cur" ) )
-    fi
-
-    # Add hosts reported by ruptime.
-    COMPREPLY+=( $( compgen -W \
-        "$( ruptime 2>/dev/null | awk '!/^ruptime:/ { print $1 }' )" \
-        -- "$cur" ) )
-
-    # Add results of normal hostname completion, unless
-    # `COMP_KNOWN_HOSTS_WITH_HOSTFILE' is set to an empty value.
-    if [[ -n ${COMP_KNOWN_HOSTS_WITH_HOSTFILE-1} ]]; then
-        COMPREPLY+=(
-            $( compgen -A hostname -P "$prefix$user" -S "$suffix" -- "$cur" ) )
-    fi
-
-    __ltrim_colon_completions "$prefix$user$cur"
-
-    return 0
-} # _known_hosts_real()
-
-
-# Get the word to complete and optional previous words.
-# This is nicer than ${COMP_WORDS[$COMP_CWORD]}, since it handles cases
-# where the user is completing in the middle of a word.
-# (For example, if the line is "ls foobar",
-# and the cursor is here -------->   ^
-# Also one is able to cross over possible wordbreak characters.
-# Usage: _get_comp_words_by_ref [OPTIONS] [VARNAMES]
-# Available VARNAMES:
-#     cur         Return cur via $cur
-#     prev        Return prev via $prev
-#     words       Return words via $words
-#     cword       Return cword via $cword
-#
-# Available OPTIONS:
-#     -n EXCLUDE  Characters out of $COMP_WORDBREAKS which should NOT be
-#                 considered word breaks. This is useful for things like scp
-#                 where we want to return host:path and not only path, so we
-#                 would pass the colon (:) as -n option in this case.
-#     -c VARNAME  Return cur via $VARNAME
-#     -p VARNAME  Return prev via $VARNAME
-#     -w VARNAME  Return words via $VARNAME
-#     -i VARNAME  Return cword via $VARNAME
-#
-# Example usage:
-#
-#    $ _get_comp_words_by_ref -n : cur prev
-#
-_get_comp_words_by_ref()
-{
-    local exclude flag i OPTIND=1
-    local cur cword words=()
-    local upargs=() upvars=() vcur vcword vprev vwords
-
-    while getopts "c:i:n:p:w:" flag "$@"; do
-        case $flag in
-            c) vcur=$OPTARG ;;
-            i) vcword=$OPTARG ;;
-            n) exclude=$OPTARG ;;
-            p) vprev=$OPTARG ;;
-            w) vwords=$OPTARG ;;
-        esac
-    done
-    while [[ $# -ge $OPTIND ]]; do
-        case ${!OPTIND} in
-            cur)   vcur=cur ;;
-            prev)  vprev=prev ;;
-            cword) vcword=cword ;;
-            words) vwords=words ;;
-            *) echo "bash: $FUNCNAME(): \`${!OPTIND}': unknown argument" \
-                1>&2; return 1
-        esac
-        let "OPTIND += 1"
-    done
-
-    __get_cword_at_cursor_by_ref "$exclude" words cword cur
-
-    [[ $vcur   ]] && { upvars+=("$vcur"  ); upargs+=(-v $vcur   "$cur"  ); }
-    [[ $vcword ]] && { upvars+=("$vcword"); upargs+=(-v $vcword "$cword"); }
-    [[ $vprev && $cword -ge 1 ]] && { upvars+=("$vprev" ); upargs+=(-v $vprev
-        "${words[cword - 1]}"); }
-    [[ $vwords ]] && { upvars+=("$vwords"); upargs+=(-a${#words[@]} $vwords
-        "${words[@]}"); }
-
-    (( ${#upvars[@]} )) && local "${upvars[@]}" && _upvars "${upargs[@]}"
-}
-
-# Initialize completion and deal with various general things: do file
-# and variable completion where appropriate, and adjust prev, words,
-# and cword as if no redirections exist so that completions do not
-# need to deal with them.  Before calling this function, make sure
-# cur, prev, words, and cword are local, ditto split if you use -s.
-#
-# Options:
-#     -n EXCLUDE  Passed to _get_comp_words_by_ref -n with redirection chars
-#     -e XSPEC    Passed to _filedir as first arg for stderr redirections
-#     -o XSPEC    Passed to _filedir as first arg for other output redirections
-#     -i XSPEC    Passed to _filedir as first arg for stdin redirections
-#     -s          Split long options with _split_longopt, implies -n =
-# @return  True (0) if completion needs further processing,
-#          False (> 0) no further processing is necessary.
-#
-_init_completion()
-{
-    local exclude= flag outx errx inx OPTIND=1
-
-    while getopts "n:e:o:i:s" flag "$@"; do
-        case $flag in
-            n) exclude+=$OPTARG ;;
-            e) errx=$OPTARG ;;
-            o) outx=$OPTARG ;;
-            i) inx=$OPTARG ;;
-            s) split=false ; exclude+== ;;
-        esac
-    done
-
-    # For some reason completion functions are not invoked at all by
-    # bash (at least as of 4.1.7) after the command line contains an
-    # ampersand so we don't get a chance to deal with redirections
-    # containing them, but if we did, hopefully the below would also
-    # do the right thing with them...
-
-    COMPREPLY=()
-    local redir="@(?([0-9])<|?([0-9&])>?(>)|>&)"
-    _get_comp_words_by_ref -n "$exclude<>&" cur prev words cword
-
-    # Complete variable names.
-    _variables && return 1
-
-    # Complete on files if current is a redirect possibly followed by a
-    # filename, e.g. ">foo", or previous is a "bare" redirect, e.g. ">".
-    if [[ $cur == $redir* || $prev == $redir ]]; then
-        local xspec
-        case $cur in
-            2'>'*) xspec=$errx ;;
-            *'>'*) xspec=$outx ;;
-            *'<'*) xspec=$inx ;;
-            *)
-                case $prev in
-                    2'>'*) xspec=$errx ;;
-                    *'>'*) xspec=$outx ;;
-                    *'<'*) xspec=$inx ;;
-                esac
-                ;;
-        esac
-        cur="${cur##$redir}"
-        _filedir $xspec
-        return 1
-    fi
-
-    # Remove all redirections so completions don't have to deal with them.
-    local i skip
-    for (( i=1; i < ${#words[@]}; )); do
-        if [[ ${words[i]} == $redir* ]]; then
-            # If "bare" redirect, remove also the next word (skip=2).
-            [[ ${words[i]} == $redir ]] && skip=2 || skip=1
-            words=( "${words[@]:0:i}" "${words[@]:i+skip}" )
-            [[ $i -le $cword ]] && cword=$(( cword - skip ))
-        else
-            i=$(( ++i ))
-        fi
-    done
-
-    [[ $cword -le 0 ]] && return 1
-    prev=${words[cword-1]}
-
-    [[ ${split-} ]] && _split_longopt && split=true
-
-    return 0
-}
-
-# Try to complete -o SubOptions=
-#
-# Returns 0 if the completion was handled or non-zero otherwise.
-_ssh_suboption_check()
-{
-    # Get prev and cur words without splitting on =
-    local cureq=`_get_cword :=` preveq=`_get_pword :=`
-    if [[ $cureq == *=* && $preveq == -o ]]; then
-        _ssh_suboption $cureq
-        return $?
-    fi
-    return 1
-}
-
-_complete_ssh()
-{
-    local cur prev words cword
-    _init_completion -n : || return
-
-    local configfile
-    local -a config
-
-    _ssh_suboption_check && return 0
-
-    case $prev in
-        -F|-i|-S)
-            _filedir
-            return 0
-            ;;
-        -c)
-            _ssh_ciphers
-            return 0
-            ;;
-        -m)
-            _ssh_macs
-            return 0
-            ;;
-        -l)
-            COMPREPLY=( $( compgen -u -- "$cur" ) )
-            return 0
-            ;;
-        -O)
-            COMPREPLY=( $( compgen -W 'check forward exit stop' -- "$cur" ) )
-            return 0
-            ;;
-        -o)
-            _ssh_options
-            return 0
-            ;;
-        -w)
-            _available_interfaces
-            return 0
-            ;;
-        -b)
-            _ip_addresses
-            return 0
-            ;;
-        -D|-e|-I|-L|-p|-R|-W)
-            return 0
-            ;;
-    esac
-
-    if [[ "$cur" == -F* ]]; then
-        cur=${cur#-F}
-        _filedir
-        # Prefix completions with '-F'
-        COMPREPLY=( "${COMPREPLY[@]/#/-F}" )
-        cur=-F$cur  # Restore cur
-    elif [[ "$cur" == -* ]]; then
-        COMPREPLY=( $( compgen -W '$( _parse_usage "$1" )' -- "$cur" ) )
-    else
-        # Search COMP_WORDS for '-F configfile' or '-Fconfigfile' argument
-        set -- "${words[@]}"
-        while [[ $# -gt 0 ]]; do
-            if [[ $1 == -F* ]]; then
-                if [[ ${#1} -gt 2 ]]; then
-                    configfile="$(dequote "${1:2}")"
-                else
-                    shift
-                    [[ $1 ]] && configfile="$(dequote "$1")"
-                fi
-                break
-            fi
-            shift
-        done
-        _known_hosts_real -a -F "$configfile" "$cur"
-        if [[ $cword -ne 1 ]]; then
-            compopt -o filenames
-            COMPREPLY+=( $( compgen -c -- "$cur" ) )
-        fi
-    fi
-
-    return 0
-} &&
-shopt -u hostcomplete && complete -F _complete_ssh ssh
diff --git a/tv/2configs/default.nix b/tv/2configs/default.nix
index f418b9f..280552f 100644
--- a/tv/2configs/default.nix
+++ b/tv/2configs/default.nix
@@ -11,7 +11,6 @@ with import <stockholm/lib>;
 
   imports = [
     <secrets>
-    ./audit.nix
     ./backup.nix
     ./bash
     ./htop.nix
@@ -142,6 +141,7 @@ with import <stockholm/lib>;
       environment.systemPackages = [
         pkgs.get
         pkgs.git
+        pkgs.git-preview
         pkgs.hashPassword
         pkgs.htop
         pkgs.kpaste
diff --git a/tv/2configs/urlwatch.nix b/tv/2configs/urlwatch.nix
index 515f899..509257c 100644
--- a/tv/2configs/urlwatch.nix
+++ b/tv/2configs/urlwatch.nix
@@ -13,8 +13,16 @@ with import <stockholm/lib>;
 
       http://www.exim.org/
 
+      {
+        url = https://api.github.com/repos/Gabriel439/nix-diff/git/refs/heads/master;
+        filter = "system:${pkgs.jq}/bin/jq -r .object.sha";
+      }
+
       # ref src/nixpkgs/pkgs/tools/admin/sec/default.nix
-      https://api.github.com/repos/simple-evcorr/sec/tags
+      {
+        url = https://api.github.com/repos/simple-evcorr/sec/tags;
+        filter = "system:${pkgs.jq}/bin/jq .";
+      }
 
       # ref src/nixpkgs/pkgs/tools/networking/urlwatch/default.nix
       https://thp.io/2008/urlwatch/
@@ -47,11 +55,13 @@ with import <stockholm/lib>;
       #http://hackage.haskell.org/package/web-page
 
       # ref <stockholm/krebs/3modules>, services.openssh.knownHosts.github*
-      https://help.github.com/articles/github-s-ip-addresses/
+      https://api.github.com/meta
 
       # <stockholm/tv/2configs/xserver/xserver.conf.nix>
       # is derived from `configFile` in:
       https://raw.githubusercontent.com/NixOS/nixpkgs/master/nixos/modules/services/x11/xserver.nix
+
+      https://www.rabbitmq.com/changelog.html
     ];
     hooksFile = toFile "hooks.py" ''
       import subprocess
diff --git a/tv/2configs/vim.nix b/tv/2configs/vim.nix
index ca47186..8a27b60 100644
--- a/tv/2configs/vim.nix
+++ b/tv/2configs/vim.nix
@@ -173,9 +173,13 @@ let {
         syn cluster nix_ind_strings contains=NixIND_STRING
         syn cluster nix_strings contains=NixSTRING
 
-        ${concatStringsSep "\n" (mapAttrsToList (lang: { extraStart ? null }: let
+        ${concatStringsSep "\n" (mapAttrsToList (name: {
+          extraStart ? null,
+          lang ? name
+        }:
+        let
           startAlts = filter isString [
-            ''/\* ${lang} \*/''
+            ''/\* ${name} \*/''
             extraStart
           ];
           sigil = ''\(${concatStringsSep ''\|'' startAlts}\)[ \t\r\n]*'';
diff --git a/tv/2configs/xserver/default.nix b/tv/2configs/xserver/default.nix
index 8f3ee59..7ba78b9 100644
--- a/tv/2configs/xserver/default.nix
+++ b/tv/2configs/xserver/default.nix
@@ -1,7 +1,12 @@
 { config, pkgs, ... }@args:
 with import <stockholm/lib>;
 let
-  user = config.krebs.build.user;
+  cfg = {
+    cacheDir = cfg.dataDir;
+    configDir = "/var/empty";
+    dataDir = "/run/xdg/${cfg.user.name}/xmonad";
+    user = config.krebs.build.user;
+  };
 in {
 
   environment.systemPackages = [
@@ -25,7 +30,7 @@ in {
     group = "wheel";
     envp = {
       DISPLAY = ":${toString config.services.xserver.display}";
-      USER = user.name;
+      USER = cfg.user.name;
     };
   };
 
@@ -54,6 +59,10 @@ in {
     environment = {
       DISPLAY = ":${toString config.services.xserver.display}";
 
+      XMONAD_CACHE_DIR = cfg.cacheDir;
+      XMONAD_CONFIG_DIR = cfg.configDir;
+      XMONAD_DATA_DIR = cfg.dataDir;
+
       XMONAD_STARTUP_HOOK = pkgs.writeDash "xmonad-startup-hook" ''
         ${pkgs.xorg.xhost}/bin/xhost +LOCAL: &
         ${pkgs.xorg.xmodmap}/bin/xmodmap ${import ./Xmodmap.nix args} &
@@ -62,8 +71,6 @@ in {
         wait
       '';
 
-      XMONAD_STATE = "/tmp/xmonad.state";
-
       # XXX JSON is close enough :)
       XMONAD_WORKSPACES0_FILE = pkgs.writeText "xmonad.workspaces0" (toJSON [
         "Dashboard" # we start here
@@ -79,10 +86,15 @@ in {
     };
     serviceConfig = {
       SyslogIdentifier = "xmonad";
+      ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${toString [
+        "\${XMONAD_CACHE_DIR}"
+        "\${XMONAD_CONFIG_DIR}"
+        "\${XMONAD_DATA_DIR}"
+      ]}";
       ExecStart = "${pkgs.xmonad-tv}/bin/xmonad";
       ExecStop = "${pkgs.xmonad-tv}/bin/xmonad --shutdown";
-      User = user.name;
-      WorkingDirectory = user.home;
+      User = cfg.user.name;
+      WorkingDirectory = cfg.user.home;
     };
   };
 
@@ -125,7 +137,7 @@ in {
       Restart = "always";
       RestartSec = "2s";
       StartLimitBurst = 0;
-      User = user.name;
+      User = cfg.user.name;
     };
   };
 }
diff --git a/tv/5pkgs/default.nix b/tv/5pkgs/default.nix
index 261871e..82474ad 100644
--- a/tv/5pkgs/default.nix
+++ b/tv/5pkgs/default.nix
@@ -33,13 +33,4 @@ foldl' mergeAttrs {}
   '';
 
   gnupg = self.gnupg22;
-
-  # https://github.com/NixOS/nixpkgs/issues/16113
-  wvdial = let
-    nixpkgs-1509 = import (self.fetchFromGitHub {
-      owner = "NixOS"; repo = "nixpkgs-channels";
-      rev = "91371c2bb6e20fc0df7a812332d99c38b21a2bda";
-      sha256 = "1as1i0j9d2n3iap9b471y4x01561r2s3vmjc5281qinirlr4al73";
-    }) {};
-  in nixpkgs-1509.wvdial;
 }
diff --git a/tv/5pkgs/simple/xmonad-tv/default.nix b/tv/5pkgs/simple/xmonad-tv/default.nix
index f73175b..94c7015 100644
--- a/tv/5pkgs/simple/xmonad-tv/default.nix
+++ b/tv/5pkgs/simple/xmonad-tv/default.nix
@@ -3,6 +3,7 @@ pkgs.writeHaskell "xmonad-tv" {
   executables.xmonad = {
     extra-depends = [
       "containers"
+      "extra"
       "unix"
       "X11"
       "xmonad"
@@ -19,11 +20,12 @@ pkgs.writeHaskell "xmonad-tv" {
 module Main where
 
 import Control.Exception
+import Control.Monad.Extra (whenJustM)
 import Graphics.X11.ExtraTypes.XF86
 import Text.Read (readEither)
 import XMonad
 import System.IO (hPutStrLn, stderr)
-import System.Environment (getArgs, withArgs, getEnv, getEnvironment)
+import System.Environment (getArgs, withArgs, getEnv, getEnvironment, lookupEnv)
 import System.Posix.Process (executeFile)
 import XMonad.Actions.DynamicWorkspaces ( addWorkspacePrompt, renameWorkspace
                                         , removeEmptyWorkspace)
@@ -69,7 +71,7 @@ main = getArgs >>= \case
 mainNoArgs :: IO ()
 mainNoArgs = do
     workspaces0 <- getWorkspaces0
-    xmonad'
+    xmonad
         -- $ withUrgencyHookC dzenUrgencyHook { args = ["-bg", "magenta", "-fg", "magenta", "-h", "2"], duration = 500000 }
         --                   urgencyConfig { remindWhen = Every 1 }
         -- $ withUrgencyHook borderUrgencyHook "magenta"
@@ -84,26 +86,15 @@ mainNoArgs = do
             -- , handleEventHook   = myHandleEventHooks <+> handleTimerEvent
             --, handleEventHook   = handleTimerEvent
             , manageHook        = placeHook (smart (1,0)) <+> floatNextHook
-            , startupHook = do
-                path <- liftIO (getEnv "XMONAD_STARTUP_HOOK")
-                forkFile path [] Nothing
+            , startupHook =
+                whenJustM (liftIO (lookupEnv "XMONAD_STARTUP_HOOK"))
+                          (\path -> forkFile path [] Nothing)
             , normalBorderColor  = "#1c1c1c"
             , focusedBorderColor = "#f000b0"
             , handleEventHook = handleShutdownEvent
             }
 
 
-xmonad' :: (LayoutClass l Window, Read (l Window)) => XConfig l -> IO ()
-xmonad' conf = do
-    path <- getEnv "XMONAD_STATE"
-    try (readFile path) >>= \case
-        Right content -> do
-            hPutStrLn stderr ("resuming from " ++ path)
-            withArgs ("--resume" : lines content) (xmonad conf)
-        Left e -> do
-            hPutStrLn stderr (displaySomeException e)
-            xmonad conf
-
 getWorkspaces0 :: IO [String]
 getWorkspaces0 =
     try (getEnv "XMONAD_WORKSPACES0_FILE") >>= \case