Merge remote-tracking branch 'origin/staging/jeschli'

32 files changed, 741 insertions, 547 deletions

diff --git a/lass/1systems/blue/config.nix b/lass/1systems/blue/config.nix
new file mode 100644
index 000000000..a84bb37f6
--- /dev/null
+++ b/lass/1systems/blue/config.nix
@@ -0,0 +1,49 @@
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    <stockholm/lass>
+    <stockholm/lass/2configs>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/exim-retiolum.nix>
+
+    <stockholm/lass/2configs/blue.nix>
+  ];
+
+  krebs.build.host = config.krebs.hosts.blue;
+
+  environment.shellAliases = {
+    deploy = pkgs.writeDash "deploy" ''
+      set -eu
+      export SYSTEM="$1"
+      $(nix-build $HOME/stockholm/lass/krops.nix --no-out-link --argstr name "$SYSTEM" -A deploy)
+    '';
+  };
+
+  networking.nameservers = [ "1.1.1.1" ];
+
+  lass.restic = genAttrs [
+    "daedalus"
+    "icarus"
+    "littleT"
+    "prism"
+    "shodan"
+    "skynet"
+  ] (dest: {
+    dirs = [
+      "/home/"
+      "/var/lib"
+    ];
+    passwordFile = (toString <secrets>) + "/restic/${dest}";
+    repo = "sftp:backup@${dest}.r:/backups/blue";
+    extraArguments = [
+      "sftp.command='ssh backup@${dest}.r -i ${config.krebs.build.host.ssh.privkey.path} -s sftp'"
+    ];
+    timerConfig = {
+      OnCalendar = "00:05";
+      RandomizedDelaySec = "5h";
+    };
+  });
+  time.timeZone = "Europe/Berlin";
+  users.users.mainUser.openssh.authorizedKeys.keys = [ config.krebs.users.lass-android.pubkey ];
+}
diff --git a/lass/1systems/blue/physical.nix b/lass/1systems/blue/physical.nix
new file mode 100644
index 000000000..7499ff723
--- /dev/null
+++ b/lass/1systems/blue/physical.nix
@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./config.nix
+  ];
+  boot.isContainer = true;
+  networking.useDHCP = false;
+  environment.variables.NIX_REMOTE = "daemon";
+}
diff --git a/lass/1systems/blue/source.nix b/lass/1systems/blue/source.nix
new file mode 100644
index 000000000..d8b979812
--- /dev/null
+++ b/lass/1systems/blue/source.nix
@@ -0,0 +1,4 @@
+import <stockholm/lass/source.nix> {
+  name = "blue";
+  secure = true;
+}
diff --git a/lass/1systems/cabal/config.nix b/lass/1systems/cabal/config.nix
index 7eba86c52..64c179e67 100644
--- a/lass/1systems/cabal/config.nix
+++ b/lass/1systems/cabal/config.nix
@@ -3,8 +3,6 @@
 {
   imports = [
     <stockholm/lass>
-    <stockholm/lass/2configs/hw/x220.nix>
-    <stockholm/lass/2configs/boot/stock-x220.nix>
 
     <stockholm/lass/2configs/mouse.nix>
     <stockholm/lass/2configs/retiolum.nix>
@@ -13,23 +11,11 @@
     <stockholm/lass/2configs/browsers.nix>
     <stockholm/lass/2configs/programs.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
-    <stockholm/lass/2configs/backups.nix>
     <stockholm/lass/2configs/games.nix>
     <stockholm/lass/2configs/bitcoin.nix>
+    <stockholm/lass/2configs/AP.nix>
+    <stockholm/lass/2configs/blue-host.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.cabal;
-
-  #fileSystems = {
-  #  "/bku" = {
-  #    device = "/dev/mapper/pool-bku";
-  #    fsType = "btrfs";
-  #    options = ["defaults" "noatime" "ssd" "compress=lzo"];
-  #  };
-  #};
-
-  #services.udev.extraRules = ''
-  #  SUBSYSTEM=="net", ATTR{address}=="00:24:d7:f0:a0:0c", NAME="wl0"
-  #  SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0"
-  #'';
 }
diff --git a/lass/1systems/cabal/physical.nix b/lass/1systems/cabal/physical.nix
new file mode 100644
index 000000000..3cc4af03b
--- /dev/null
+++ b/lass/1systems/cabal/physical.nix
@@ -0,0 +1,12 @@
+{
+  imports = [
+    ./config.nix
+    <stockholm/lass/2configs/hw/x220.nix>
+    <stockholm/lass/2configs/boot/stock-x220.nix>
+  ];
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:45:85:ac", NAME="wl0"
+    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:62:2b:1b", NAME="et0"
+  '';
+}
diff --git a/lass/1systems/daedalus/config.nix b/lass/1systems/daedalus/config.nix
index 609fae3c8..eafc0d06c 100644
--- a/lass/1systems/daedalus/config.nix
+++ b/lass/1systems/daedalus/config.nix
@@ -4,13 +4,11 @@ with import <stockholm/lib>;
 {
   imports = [
     <stockholm/lass>
-    <stockholm/lass/2configs/hw/x220.nix>
-    <stockholm/lass/2configs/boot/coreboot.nix>
 
     <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/backups.nix>
     <stockholm/lass/2configs/games.nix>
     <stockholm/lass/2configs/steam.nix>
+    <stockholm/lass/2configs/backup.nix>
     {
       # bubsy config
       users.users.bubsy = {
@@ -94,17 +92,4 @@ with import <stockholm/lib>;
   '';
 
   krebs.build.host = config.krebs.hosts.daedalus;
-
-  fileSystems = {
-    "/bku" = {
-      device = "/dev/mapper/pool-bku";
-      fsType = "btrfs";
-      options = ["defaults" "noatime" "ssd" "compress=lzo"];
-    };
-  };
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="net", ATTR{address}=="08:11:96:0a:5d:6c", NAME="wl0"
-    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0"
-  '';
 }
diff --git a/lass/1systems/daedalus/physical.nix b/lass/1systems/daedalus/physical.nix
new file mode 100644
index 000000000..33a0cb473
--- /dev/null
+++ b/lass/1systems/daedalus/physical.nix
@@ -0,0 +1,20 @@
+{
+  imports = [
+    ./config.nix
+    <stockholm/lass/2configs/hw/x220.nix>
+    <stockholm/lass/2configs/boot/coreboot.nix>
+  ];
+
+  fileSystems = {
+    "/bku" = {
+      device = "/dev/mapper/pool-bku";
+      fsType = "btrfs";
+      options = ["defaults" "noatime" "ssd" "compress=lzo"];
+    };
+  };
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="08:11:96:0a:5d:6c", NAME="wl0"
+    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0"
+  '';
+}
diff --git a/lass/1systems/dishfire/config.nix b/lass/1systems/dishfire/config.nix
index 7993c763e..3d5f32180 100644
--- a/lass/1systems/dishfire/config.nix
+++ b/lass/1systems/dishfire/config.nix
@@ -4,42 +4,8 @@
   imports = [
     <stockholm/lass>
     <stockholm/lass/2configs/retiolum.nix>
-    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
     <stockholm/lass/2configs/git.nix>
     {
-      boot.loader.grub = {
-        device = "/dev/vda";
-        splashImage = null;
-      };
-
-      boot.initrd.availableKernelModules = [
-        "ata_piix"
-        "ehci_pci"
-        "uhci_hcd"
-        "virtio_pci"
-        "virtio_blk"
-      ];
-
-      fileSystems."/" = {
-        device = "/dev/mapper/pool-nix";
-        fsType = "ext4";
-      };
-
-      fileSystems."/srv/http" = {
-        device = "/dev/pool/srv_http";
-        fsType = "ext4";
-      };
-
-      fileSystems."/boot" = {
-        device = "/dev/vda1";
-        fsType = "ext4";
-      };
-      fileSystems."/bku" = {
-        device = "/dev/pool/bku";
-        fsType = "ext4";
-      };
-    }
-    {
       networking.dhcpcd.allowInterfaces = [
         "enp*"
         "eth*"
diff --git a/lass/1systems/dishfire/physical.nix b/lass/1systems/dishfire/physical.nix
new file mode 100644
index 000000000..64e3904e0
--- /dev/null
+++ b/lass/1systems/dishfire/physical.nix
@@ -0,0 +1,39 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./config.nix
+    <nixpkgs/nixos/modules/profiles/qemu-guest.nix>
+  ];
+
+  boot.loader.grub = {
+    device = "/dev/vda";
+    splashImage = null;
+  };
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "ehci_pci"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_blk"
+  ];
+
+  fileSystems."/" = {
+    device = "/dev/mapper/pool-nix";
+    fsType = "ext4";
+  };
+
+  fileSystems."/srv/http" = {
+    device = "/dev/pool/srv_http";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/vda1";
+    fsType = "ext4";
+  };
+  fileSystems."/bku" = {
+    device = "/dev/pool/bku";
+    fsType = "ext4";
+  };
+}
diff --git a/lass/1systems/echelon/config.nix b/lass/1systems/echelon/config.nix
deleted file mode 100644
index 6f96883bf..000000000
--- a/lass/1systems/echelon/config.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  inherit (import <stockholm/lass/4lib> { inherit pkgs lib; }) getDefaultGateway;
-  ip = config.krebs.build.host.nets.internet.ip4.addr;
-in {
-  imports = [
-    <stockholm/lass>
-    <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/os-templates/CAC-CentOS-7-64bit.nix>
-    <stockholm/lass/2configs/exim-retiolum.nix>
-    <stockholm/lass/2configs/privoxy-retiolum.nix>
-    <stockholm/lass/2configs/git.nix>
-    {
-      networking.interfaces.enp2s1.ip4 = [
-        {
-          address = ip;
-          prefixLength = 24;
-        }
-      ];
-      networking.defaultGateway = getDefaultGateway ip;
-      networking.nameservers = [
-        "8.8.8.8"
-      ];
-
-    }
-    {
-      sound.enable = false;
-    }
-    {
-      users.extraUsers = {
-        satan = {
-          name = "satan";
-          uid = 1338;
-          home = "/home/satan";
-          group = "users";
-          createHome = true;
-          useDefaultShell = true;
-          extraGroups = [
-          ];
-          openssh.authorizedKeys.keys = [
-            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC+l3ajjOd80uJBM8oHO9HRbtA5hK6hvrpxxnk7qWW7OloT9IXcoM8bbON755vK0O6XyxZo1JZ1SZ7QIaOREGVIRDjcbJbqD3O+nImc6Rzxnrz7hvE+tuav9Yylwcw5HeQi82UIMGTEAwMHwLvsW6R/xyMCuOTbbzo9Ib8vlJ8IPDECY/05RhL7ZYFR0fdphI7jq7PobnO8WEpCZDhMvSYjO9jf3ac53wyghT3gH7AN0cxTR9qgQlPHhTbw+nZEI0sUKtrIhjfVE80wgK3NQXZZj7YAplRs/hYwSi7i8V0+8CBt2epc/5RKnJdDHFQnaTENq9kYQPOpUCP6YUwQIo8X nineinchnade@gmail.com"
-          ];
-        };
-      };
-    }
-  ];
-
-  krebs.build.host = config.krebs.hosts.echelon;
-}
diff --git a/lass/1systems/helios/config.nix b/lass/1systems/helios/config.nix
index e64cfbe79..bd7f75c3e 100644
--- a/lass/1systems/helios/config.nix
+++ b/lass/1systems/helios/config.nix
@@ -12,47 +12,12 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/otp-ssh.nix>
     # TODO fix krebs.git.rules.[definition 2-entry 2].lass not defined
     #<stockholm/lass/2configs/git.nix>
-    <stockholm/lass/2configs/dcso-vpn.nix>
+    #<stockholm/lass/2configs/dcso-vpn.nix>
     <stockholm/lass/2configs/virtualbox.nix>
     <stockholm/lass/2configs/dcso-dev.nix>
     <stockholm/lass/2configs/steam.nix>
     <stockholm/lass/2configs/rtl-sdr.nix>
-    { # automatic hardware detection
-      boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
-      boot.kernelModules = [ "kvm-intel" ];
-
-      fileSystems."/" = {
-        device = "/dev/pool/root";
-        fsType = "btrfs";
-      };
-
-      fileSystems."/boot" = {
-        device = "/dev/disk/by-uuid/1F60-17C6";
-        fsType = "vfat";
-      };
-
-      fileSystems."/home" = {
-        device = "/dev/pool/home";
-        fsType = "btrfs";
-      };
-
-      fileSystems."/tmp" = {
-        device = "tmpfs";
-        fsType = "tmpfs";
-        options = ["nosuid" "nodev" "noatime"];
-      };
-
-      nix.maxJobs = lib.mkDefault 8;
-    }
-    { # crypto stuff
-      boot.initrd.luks = {
-        cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
-        devices =  [{
-           name = "luksroot";
-           device = "/dev/nvme0n1p3";
-        }];
-      };
-    }
+    <stockholm/lass/2configs/backup.nix>
     {
       services.xserver.dpi = 200;
       fonts.fontconfig.dpi = 200;
@@ -98,13 +63,6 @@ with import <stockholm/lib>;
     }
   ];
 
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  networking.wireless.enable = true;
-  hardware.enableRedistributableFirmware = true;
-
   environment.systemPackages = with pkgs; [
     ag
     vim
@@ -123,49 +81,17 @@ with import <stockholm/lib>;
 
   services.tlp.enable = true;
 
-  services.xserver.videoDrivers = [ "nvidia" ];
-  services.xserver.xrandrHeads = [
-    { output = "DP-2"; primary = true; }
-    { output = "DP-4"; monitorConfig = ''Option "Rotate" "left"''; }
-    { output = "DP-0"; }
-  ];
-
-  services.xserver.displayManager.sessionCommands = ''
-    ${pkgs.xorg.xrandr}/bin/xrandr --output DP-6 --off --output DP-5 --off --output DP-4 --mode 2560x1440 --pos 3840x0 --rotate left --output DP-3 --off --output DP-2 --primary --mode 3840x2160 --scale 0.5x0.5 --pos 0x400 --rotate normal --output DP-1 --off --output DP-0 --mode 2560x1440 --pos 5280x1120 --rotate normal
-  '';
-
   networking.hostName = lib.mkForce "BLN02NB0162";
 
   security.pki.certificateFiles = [
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC1G1.pem"; sha256 = "14vz9c0fk6li0a26vx0s5ha6y3yivnshx9pjlh9vmnpkbph5a7rh"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC2G1.pem"; sha256 = "0r1dd48a850cv7whk4g2maik550rd0vsrsl73r6x0ivzz7ap1xz5"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC3G1.pem"; sha256 = "0b5cdchdkvllnr0kz35d8jrmrf9cjw0kd98mmvzr0x6nkc8hwpdy"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC1G1.pem"; sha256 = "006j61q2z44z6d92638iin6r46r4cj82ipwm37784h34i5x4mp0d"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC2G1.pem"; sha256 = "1nkd1rjcn02q9xxjg7sw79lbwy08i7hb4v4pn98djknvcmplpz5m"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAROOTC3G1.pem"; sha256 = "094m12npglnnv1nf1ijcv70p8l15l00id44qq7rwynhcgxi5539i"; })
 
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC2G1.pem"; sha256 = "0rn57zv1ry9vj4p2248mxmafmqqmdhbrfx1plszrxsphshbk2hfz"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC3G1.pem"; sha256 = "0w88qaqhwxzvdkx40kzj2gka1yi85ipppjdkxah4mscwfhlryrnk"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC2G1.pem"; sha256 = "1z2qkyhgjvri13bvi06ynkb7mjmpcznmc9yw8chx1lnwc3cxa7kf"; })
-    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC3G1.pem"; sha256 = "0smdjjvz95n652cb45yhzdb2lr83zg52najgbzf6lm3w71f8mv7f"; })
-    (pkgs.writeText "minio.cert" ''
-      -----BEGIN CERTIFICATE-----
-      MIIDFDCCAfygAwIBAgIQBEKYm9VmbR6T/XNLP2P5kDANBgkqhkiG9w0BAQsFADAS
-      MRAwDgYDVQQKEwdBY21lIENvMB4XDTE4MDIxNDEyNTk1OVoXDTE5MDIxNDEyNTk1
-      OVowEjEQMA4GA1UEChMHQWNtZSBDbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC
-      AQoCggEBAMmRGUTMDxOaoEZ3osG1ZpGj4enHl6ToWaoCXvRXvI6RB/99QOFlwLdL
-      8lGjIbXyovNkH686pVsfgCTOLRGzftWHmWgfmaSUv0TToBW8F9DN4ww9YgiLZjvV
-      YZunRyp1n0x9OrBXMs7xEBBa4q0AG1IvlRJTrd7CW519FlVq7T95LLB7P6t6K54C
-      ksG4kEzXLRPD/FMdU7LWbhWnQSOxPMCq8erTv3kW3A3Y9hSAKOFQKQHH/3O2HDrM
-      CbK5ldNklswg2rIHxx7kg1fteLD1lVCNPfCMfuwlLUaMeoRZ03HDof8wFlRz3pzw
-      hQRWPvfLfRvFCZ0LFNvfgAqXtmG/ywUCAwEAAaNmMGQwDgYDVR0PAQH/BAQDAgKk
-      MBMGA1UdJQQMMAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wLAYDVR0RBCUw
-      I4IJbG9jYWxob3N0ggZoZWxpb3OCCGhlbGlvcy5yhwR/AAABMA0GCSqGSIb3DQEB
-      CwUAA4IBAQBzrPb3NmAn60awoJG3d4BystaotaFKsO3iAnP4Lfve1bhKRELIjJ30
-      hX/mRYkEVRbfwKRgkkLab4zpJ/abjb3DjFNo8E4QPNeCqS+8xxeBOf7x61Kg/0Ox
-      jRQ95fTATyItiChwNkoxYjVIwosqxBVsbe3KxwhkmKPQ6wH/nvr6URX/IGUz2qWY
-      EqHdjsop83u4Rjn3C0u46U0P+W4U5IFiLfcE3RzFFYh67ko5YEhkyXP+tBNSgrTM
-      zFisVoQZdXpMCWWxBVWulB4FvvTx3jKUPRZVOrfexBfY4TA/PyhXLoz7FeEK9n2a
-      qFkrxy+GrHBXfSRZgCaHQFdKorg2fwwa
-      -----END CERTIFICATE-----
-    '')
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC2G1.pem"; sha256 = "1anfncdf5xsp219kryncv21ra87flpzcjwcc85hzvlwbxhid3g4x"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCACOMPC3G1.pem"; sha256 = "035kkfizyl5dndj7rhvmy91rr75lakqbqgjx4dpiw0kqq369mz8r"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC2G1.pem"; sha256 = "14fpzx1qjs9ws9sz0y7pb6j40336xlckkqcm2rc5j86yn7r22lp7"; })
+    (pkgs.fetchurl { url = "http://pki.dcso.de/ca/PEM/DCSOCAIDENC3G1.pem"; sha256 = "1yjl3kyw4chc8vw7bnqac2h9vn8dxryw7lr7i03lqi9sdvs4108s"; })
   ];
 
   programs.adb.enable = true;
diff --git a/lass/1systems/helios/physical.nix b/lass/1systems/helios/physical.nix
new file mode 100644
index 000000000..a5212454f
--- /dev/null
+++ b/lass/1systems/helios/physical.nix
@@ -0,0 +1,64 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./config.nix
+    { # automatic hardware detection
+      boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
+      boot.kernelModules = [ "kvm-intel" ];
+
+      fileSystems."/" = {
+        device = "/dev/pool/root";
+        fsType = "btrfs";
+      };
+
+      fileSystems."/boot" = {
+        device = "/dev/disk/by-uuid/1F60-17C6";
+        fsType = "vfat";
+      };
+
+      fileSystems."/home" = {
+        device = "/dev/pool/home";
+        fsType = "btrfs";
+      };
+
+      fileSystems."/tmp" = {
+        device = "tmpfs";
+        fsType = "tmpfs";
+        options = ["nosuid" "nodev" "noatime"];
+      };
+    }
+    { # crypto stuff
+      boot.initrd.luks = {
+        cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
+        devices =  [{
+           name = "luksroot";
+           device = "/dev/nvme0n1p3";
+        }];
+      };
+    }
+  ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.wireless.enable = true;
+  hardware.enableRedistributableFirmware = true;
+
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="f8:59:71:a9:05:65", NAME="wl0"
+    SUBSYSTEM=="net", ATTR{address}=="54:e1:ad:4f:06:83", NAME="et0"
+  '';
+
+  services.xserver.videoDrivers = [ "nvidia" ];
+  services.xserver.xrandrHeads = [
+    { output = "DP-2"; primary = true; }
+    { output = "DP-4"; monitorConfig = ''Option "Rotate" "left"''; }
+    { output = "DP-0"; }
+  ];
+
+  services.xserver.displayManager.sessionCommands = ''
+    ${pkgs.xorg.xrandr}/bin/xrandr --output DP-6 --off --output DP-5 --off --output DP-4 --mode 2560x1440 --pos 3840x0 --rotate left --output DP-3 --off --output DP-2 --primary --mode 3840x2160 --scale 0.5x0.5 --pos 0x400 --rotate normal --output DP-1 --off --output DP-0 --mode 2560x1440 --pos 5280x1120 --rotate normal
+  '';
+}
diff --git a/lass/1systems/icarus/config.nix b/lass/1systems/icarus/config.nix
index 46dc5e873..d54bd3e9e 100644
--- a/lass/1systems/icarus/config.nix
+++ b/lass/1systems/icarus/config.nix
@@ -3,8 +3,6 @@
 {
   imports = [
     <stockholm/lass>
-    <stockholm/lass/2configs/hw/x220.nix>
-    <stockholm/lass/2configs/boot/coreboot.nix>
 
     <stockholm/lass/2configs/mouse.nix>
     <stockholm/lass/2configs/retiolum.nix>
@@ -14,23 +12,21 @@
     <stockholm/lass/2configs/browsers.nix>
     <stockholm/lass/2configs/programs.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
-    <stockholm/lass/2configs/backups.nix>
     <stockholm/lass/2configs/games.nix>
     <stockholm/lass/2configs/bitcoin.nix>
+    <stockholm/lass/2configs/backup.nix>
+    <stockholm/lass/2configs/wine.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.icarus;
 
-  fileSystems = {
-    "/bku" = {
-      device = "/dev/mapper/pool-bku";
-      fsType = "btrfs";
-      options = ["defaults" "noatime" "ssd" "compress=lzo"];
-    };
+  environment.systemPackages = with pkgs; [
+    macchanger
+    dpass
+  ];
+  services.redshift = {
+    enable = true;
+    provider = "geoclue2";
   };
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="net", ATTR{address}=="00:24:d7:f0:a0:0c", NAME="wl0"
-    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0"
-  '';
+  programs.adb.enable = true;
 }
diff --git a/lass/1systems/icarus/physical.nix b/lass/1systems/icarus/physical.nix
new file mode 100644
index 000000000..6cc77a47d
--- /dev/null
+++ b/lass/1systems/icarus/physical.nix
@@ -0,0 +1,20 @@
+{
+  imports = [
+    ./config.nix
+    <stockholm/lass/2configs/hw/x220.nix>
+    <stockholm/lass/2configs/boot/coreboot.nix>
+  ];
+
+  fileSystems = {
+    "/bku" = {
+      device = "/dev/mapper/pool-bku";
+      fsType = "btrfs";
+      options = ["defaults" "noatime" "ssd" "compress=lzo"];
+    };
+  };
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="00:24:d7:f0:a0:0c", NAME="wl0"
+    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0"
+  '';
+}
diff --git a/lass/1systems/littleT/config.nix b/lass/1systems/littleT/config.nix
index 7211c78eb..44617d3e7 100644
--- a/lass/1systems/littleT/config.nix
+++ b/lass/1systems/littleT/config.nix
@@ -4,11 +4,9 @@ with import <stockholm/lib>;
 {
   imports = [
     <stockholm/lass>
-    <stockholm/lass/2configs/hw/x220.nix>
-    <stockholm/lass/2configs/boot/stock-x220.nix>
 
     <stockholm/lass/2configs/retiolum.nix>
-    <stockholm/lass/2configs/backups.nix>
+    <stockholm/lass/2configs/backup.nix>
     <stockholm/lass/2configs/steam.nix>
     {
       users.users.blacky = {
@@ -68,17 +66,4 @@ with import <stockholm/lib>;
   '';
 
   krebs.build.host = config.krebs.hosts.littleT;
-
-  #fileSystems = {
-  #  "/bku" = {
-  #    device = "/dev/mapper/pool-bku";
-  #    fsType = "btrfs";
-  #    options = ["defaults" "noatime" "ssd" "compress=lzo"];
-  #  };
-  #};
-
-  #services.udev.extraRules = ''
-  #  SUBSYSTEM=="net", ATTR{address}=="08:11:96:0a:5d:6c", NAME="wl0"
-  #  SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:71:cb:35", NAME="et0"
-  #'';
 }
diff --git a/lass/1systems/littleT/physical.nix b/lass/1systems/littleT/physical.nix
new file mode 100644
index 000000000..9776211ae
--- /dev/null
+++ b/lass/1systems/littleT/physical.nix
@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./config.nix
+    <stockholm/lass/2configs/hw/x220.nix>
+    <stockholm/lass/2configs/boot/stock-x220.nix>
+  ];
+}
diff --git a/lass/1systems/mors/config.nix b/lass/1systems/mors/config.nix
index cd259d0fe..97e69146e 100644
--- a/lass/1systems/mors/config.nix
+++ b/lass/1systems/mors/config.nix
@@ -4,8 +4,6 @@ with import <stockholm/lib>;
 {
   imports = [
     <stockholm/lass>
-    <stockholm/lass/2configs/hw/x220.nix>
-    <stockholm/lass/2configs/boot/stock-x220.nix>
 
     <stockholm/lass/2configs/mouse.nix>
     <stockholm/lass/2configs/retiolum.nix>
@@ -33,10 +31,13 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/ableton.nix>
     <stockholm/lass/2configs/dunst.nix>
     <stockholm/lass/2configs/rtl-sdr.nix>
+    <stockholm/lass/2configs/backup.nix>
     {
-      #risk of rain port
       krebs.iptables.tables.filter.INPUT.rules = [
+        #risk of rain
         { predicate = "-p tcp --dport 11100"; target = "ACCEPT"; }
+        #chromecast
+        { predicate = "-p udp -m multiport --sports 32768:61000 -m multiport --dports 32768:61000"; target = "ACCEPT"; }
       ];
     }
     {
@@ -85,43 +86,6 @@ with import <stockholm/lib>;
 
   krebs.build.host = config.krebs.hosts.mors;
 
-  fileSystems = {
-    "/bku" = {
-      device = "/dev/mapper/pool-bku";
-      fsType = "btrfs";
-      options = ["defaults" "noatime" "ssd" "compress=lzo"];
-    };
-    "/home/virtual" = {
-      device = "/dev/mapper/pool-virtual";
-      fsType = "ext4";
-    };
-  };
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="net", ATTR{address}=="00:24:d7:f0:e8:c8", NAME="wl0"
-    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:8f:8a:78", NAME="et0"
-  '';
-
-  #TODO activationScripts seem broken, fix them!
-  #activationScripts
-  #split up and move into base
-  system.activationScripts.powertopTunables = ''
-    #Runtime PMs
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:02.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:00.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.3/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.2/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1d.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.3/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1b.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1a.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:19.0/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.1/power/control'
-    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.4/power/control'
-  '';
-
   environment.systemPackages = with pkgs; [
     acronym
     brain
@@ -140,7 +104,18 @@ with import <stockholm/lib>;
     dpass
 
     dnsutils
+    woeusb
+    l-gen-secrets
     generate-secrets
+    (pkgs.writeDashBin "btc-coinbase" ''
+      ${pkgs.curl}/bin/curl -Ss 'https://api.coinbase.com/v2/prices/spot?currency=EUR' | ${pkgs.jq}/bin/jq '.data.amount'
+    '')
+    (pkgs.writeDashBin "btc-wex" ''
+      ${pkgs.curl}/bin/curl -Ss 'https://wex.nz/api/3/ticker/btc_eur' | ${pkgs.jq}/bin/jq '.btc_eur.avg'
+    '')
+    (pkgs.writeDashBin "btc-kraken" ''
+      ${pkgs.curl}/bin/curl -Ss  'https://api.kraken.com/0/public/Ticker?pair=BTCEUR' | ${pkgs.jq}/bin/jq '.result.XXBTZEUR.a[0]'
+    '')
   ];
 
   #TODO: fix this shit
@@ -165,16 +140,43 @@ with import <stockholm/lib>;
     OnCalendar = "00:37";
   };
 
-  environment.shellAliases = {
-    deploy = pkgs.writeDash "deploy" ''
-      set -eu
-      export SYSTEM="$1"
-      $(nix-build $HOME/stockholm/lass/kops.nix --no-out-link --argstr name "$SYSTEM" -A deploy)
-    '';
-  };
-
   nix.package = pkgs.nixUnstable;
   programs.adb.enable = true;
   users.users.mainUser.extraGroups = [ "adbusers" "docker" ];
   virtualisation.docker.enable = true;
+  services.redshift = {
+    enable = true;
+    provider = "geoclue2";
+  };
+
+  lass.restic = genAttrs [
+    "daedalus"
+    "icarus"
+    "littleT"
+    "prism"
+    "shodan"
+    "skynet"
+  ] (dest: {
+    dirs = [
+      "/home/lass/src"
+      "/home/lass/work"
+      "/home/lass/.gnupg"
+      "/home/lass/Maildir"
+      "/home/lass/stockholm"
+      "/home/lass/.password-store"
+      "/home/bitcoin"
+      "/home/bch"
+    ];
+    passwordFile = (toString <secrets>) + "/restic/${dest}";
+    repo = "sftp:backup@${dest}.r:/backups/mors";
+    #sshPrivateKey = config.krebs.build.host.ssh.privkey.path;
+    extraArguments = [
+      "sftp.command='ssh backup@${dest}.r -i ${config.krebs.build.host.ssh.privkey.path} -s sftp'"
+    ];
+    timerConfig = {
+      OnCalendar = "00:05";
+      RandomizedDelaySec = "5h";
+    };
+  });
+  virtualisation.libvirtd.enable = true;
 }
diff --git a/lass/1systems/mors/physical.nix b/lass/1systems/mors/physical.nix
new file mode 100644
index 000000000..680dc9bde
--- /dev/null
+++ b/lass/1systems/mors/physical.nix
@@ -0,0 +1,44 @@
+{
+  imports = [
+    ./config.nix
+    <stockholm/lass/2configs/hw/x220.nix>
+    <stockholm/lass/2configs/boot/stock-x220.nix>
+  ];
+
+  fileSystems = {
+    "/bku" = {
+      device = "/dev/mapper/pool-bku";
+      fsType = "btrfs";
+      options = ["defaults" "noatime" "ssd" "compress=lzo"];
+    };
+    "/home/virtual" = {
+      device = "/dev/mapper/pool-virtual";
+      fsType = "ext4";
+    };
+  };
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="10:0b:a9:72:f4:88", NAME="wl0"
+    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:c4:7a:f1", NAME="et0"
+  '';
+
+  #TODO activationScripts seem broken, fix them!
+  #activationScripts
+  #split up and move into base
+  system.activationScripts.powertopTunables = ''
+    #Runtime PMs
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:02.0/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:00.0/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.3/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.2/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1f.0/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1d.0/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.3/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.0/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1b.0/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1a.0/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:19.0/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.1/power/control'
+    echo 'auto' > '/sys/bus/pci/devices/0000:00:1c.4/power/control'
+  '';
+}
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index c0e4620cc..9a0bb49e9 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -1,86 +1,9 @@
 { config, lib, pkgs, ... }:
 with import <stockholm/lib>;
 
-let
-  ip = config.krebs.build.host.nets.internet.ip4.addr;
-
-in {
+{
   imports = [
     <stockholm/lass>
-    {
-      networking.interfaces.et0.ip4 = [
-        {
-          address = ip;
-          prefixLength = 27;
-        }
-      ];
-      networking.defaultGateway = "46.4.114.225";
-      networking.nameservers = [
-        "8.8.8.8"
-      ];
-      services.udev.extraRules = ''
-        SUBSYSTEM=="net", ATTR{address}=="08:60:6e:e7:87:04", NAME="et0"
-      '';
-    }
-    {
-      imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
-
-      boot.loader.grub = {
-        devices = [
-          "/dev/sda"
-          "/dev/sdb"
-        ];
-        splashImage = null;
-      };
-
-      boot.initrd.availableKernelModules = [
-        "ata_piix"
-        "vmw_pvscsi"
-        "ahci" "sd_mod"
-      ];
-
-      boot.kernelModules = [ "kvm-intel" ];
-
-      fileSystems."/" = {
-        device = "/dev/pool/nix_root";
-        fsType = "ext4";
-      };
-
-      fileSystems."/tmp" = {
-        device = "tmpfs";
-        fsType = "tmpfs";
-        options = ["nosuid" "nodev" "noatime"];
-      };
-
-      fileSystems."/var/download" = {
-        device = "/dev/pool/download";
-        fsType = "ext4";
-      };
-
-      fileSystems."/srv/http" = {
-        device = "/dev/pool/http";
-        fsType = "ext4";
-      };
-
-      fileSystems."/home" = {
-        device = "/dev/pool/home";
-        fsType = "ext4";
-      };
-
-      fileSystems."/bku" = {
-        device = "/dev/pool/bku";
-        fsType = "ext4";
-      };
-
-      swapDevices = [
-        { label = "swap1"; }
-        { label = "swap2"; }
-      ];
-
-      sound.enable = false;
-      nixpkgs.config.allowUnfree = true;
-      time.timeZone = "Europe/Berlin";
-    }
     <stockholm/lass/2configs/retiolum.nix>
     <stockholm/lass/2configs/libvirt.nix>
     {
@@ -100,6 +23,7 @@ in {
       ];
     }
     { # TODO make new hfos.nix out of this vv
+      boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
       users.users.riot = {
         uid = genid "riot";
         isNormalUser = true;
@@ -110,29 +34,13 @@ in {
       };
 
       # TODO write function for proxy_pass (ssl/nonssl)
-      services.nginx.virtualHosts."hackerfleet.de" = {
-        serverAliases = [
-          "*.hackerfleet.de"
-        ];
-        locations."/".extraConfig = ''
-          proxy_pass http://192.168.122.92:80;
-        '';
-      };
-      services.nginx.virtualHosts."hackerfleet.de-s" = {
-        serverName = "hackerfleet.de";
-        listen = [
-          {
-            addr = "0.0.0.0";
-            port = 443;
-          }
-        ];
-        serverAliases = [
-          "*.hackerfleet.de"
-        ];
-        locations."/".extraConfig = ''
-          proxy_pass http://192.168.122.92:443;
-        '';
-      };
+
+      krebs.iptables.tables.filter.FORWARD.rules = [
+        { v6 = false; precedence = 1000; predicate = "-d 192.168.122.92"; target = "ACCEPT"; }
+      ];
+      krebs.iptables.tables.nat.PREROUTING.rules = [
+        { v6 = false; precedence = 1000; predicate = "-d 46.4.114.243"; target = "DNAT --to-destination 192.168.122.92"; }
+      ];
     }
     {
       users.users.tv = {
@@ -202,26 +110,6 @@ in {
       };
     }
     {
-      #kaepsele
-      systemd.services."container@kaepsele".reloadIfChanged = mkForce false;
-      containers.kaepsele = {
-        config = { ... }: {
-          imports = [ <stockholm/lass/2configs/rebuild-on-boot.nix> ];
-          environment.systemPackages = [ pkgs.git ];
-          services.openssh.enable = true;
-          users.users.root.openssh.authorizedKeys.keys = with config.krebs.users; [
-            lass.pubkey
-            tv.pubkey
-          ];
-        };
-        autoStart = true;
-        enableTun = true;
-        privateNetwork = true;
-        hostAddress = "10.233.2.3";
-        localAddress = "10.233.2.4";
-      };
-    }
-    {
       #onondaga
       systemd.services."container@onondaga".reloadIfChanged = mkForce false;
       containers.onondaga = {
@@ -243,19 +131,17 @@ in {
     }
     <stockholm/lass/2configs/exim-smarthost.nix>
     <stockholm/lass/2configs/ts3.nix>
-    <stockholm/lass/2configs/IM.nix>
     <stockholm/lass/2configs/privoxy-retiolum.nix>
     <stockholm/lass/2configs/radio.nix>
     <stockholm/lass/2configs/repo-sync.nix>
     <stockholm/lass/2configs/binary-cache/server.nix>
     <stockholm/lass/2configs/iodined.nix>
-    <stockholm/lass/2configs/monitoring/server.nix>
-    <stockholm/lass/2configs/monitoring/monit-alarms.nix>
     <stockholm/lass/2configs/paste.nix>
     <stockholm/lass/2configs/syncthing.nix>
     <stockholm/lass/2configs/reaktor-coders.nix>
     <stockholm/lass/2configs/ciko.nix>
     <stockholm/lass/2configs/container-networking.nix>
+    <stockholm/lass/2configs/monitoring/prometheus-server.nix>
     { # quasi bepasty.nix
       imports = [
         <stockholm/lass/2configs/bepasty.nix>
@@ -289,7 +175,6 @@ in {
         alias /var/realwallpaper/realwallpaper.png;
       '';
     }
-    <stockholm/krebs/2configs/reaktor-krebs.nix>
     <stockholm/lass/2configs/dcso-dev.nix>
     {
       users.users.jeschli = {
@@ -336,6 +221,126 @@ in {
         { predicate = "-p tcp --dport 53589"; target = "ACCEPT"; }
       ];
     }
+    <stockholm/lass/2configs/go.nix>
+    {
+      environment.systemPackages = [ pkgs.cryptsetup ];
+      systemd.services."container@red".reloadIfChanged = mkForce false;
+      containers.red = {
+        config = { ... }: {
+          environment.systemPackages = [ pkgs.git ];
+          services.openssh.enable = true;
+          users.users.root.openssh.authorizedKeys.keys = [
+            config.krebs.users.lass.pubkey
+          ];
+        };
+        autoStart = false;
+        enableTun = true;
+        privateNetwork = true;
+        hostAddress = "10.233.2.3";
+        localAddress = "10.233.2.4";
+      };
+      services.nginx.virtualHosts."rote-allez-fraktion.de" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          extraConfig = ''
+            proxy_set_header Host rote-allez-fraktion.de;
+            proxy_pass http://10.233.2.4;
+          '';
+        };
+      };
+    }
+    {
+      imports = [ <stockholm/lass/2configs/backup.nix> ];
+      lass.restic = genAttrs [
+        "daedalus"
+        "icarus"
+        "littleT"
+        "mors"
+        "shodan"
+        "skynet"
+      ] (dest: {
+        dirs = [
+          "/home/chat/.weechat"
+          "/bku/sql_dumps"
+        ];
+        passwordFile = (toString <secrets>) + "/restic/${dest}";
+        repo = "sftp:backup@${dest}.r:/backups/prism";
+        extraArguments = [
+          "sftp.command='ssh backup@${dest}.r -i ${config.krebs.build.host.ssh.privkey.path} -s sftp'"
+        ];
+        timerConfig = {
+          OnCalendar = "00:05";
+          RandomizedDelaySec = "5h";
+        };
+      });
+    }
+    {
+      users.users.download.openssh.authorizedKeys.keys = [
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDB0d0JA20Vqn7I4lCte6Ne2EOmLZyMJyS9yIKJYXNLjbLwkQ4AYoQKantPBkTxR75M09E7d3j5heuWnCjWH45TrfQfe1EOSSC3ppCI6C6aIVlaNs+KhAYZS0m2Y8WkKn+TT5JLEa8yybYVN/RlZPOilpj/1QgjU6CQK+eJ1k/kK+QFXcwN82GDVh5kbTVcKUNp2tiyxFA+z9LY0xFDg/JHif2ROpjJVLQBJ+YPuOXZN5LDnVcuyLWKThjxy5srQ8iDjoxBg7dwLHjby5Mv41K4W61Gq6xM53gDEgfXk4cQhJnmx7jA/pUnsn2ZQDeww3hcc7vRf8soogXXz2KC9maiq0M/svaATsa9Ul4hrKnqPZP9Q8ScSEAUX+VI+x54iWrnW0p/yqBiRAzwsczdPzaQroUFTBxrq8R/n5TFdSHRMX7fYNOeVMjhfNca/gtfw9dYBVquCvuqUuFiRc0I7yK44rrMjjVQRcAbw6F8O7+04qWCmaJ8MPlmApwu2c05VMv9hiJo5p6PnzterRSLCqF6rIdhSnuOwrUIt1s/V+EEZXHCwSaNLaQJnYL0H9YjaIuGz4c8kVzxw4c0B6nl+hqW5y5/B2cuHiumnlRIDKOIzlv8ufhh21iN7QpIsPizahPezGoT1XqvzeXfH4qryo8O4yTN/PWoA+f7o9POU7L6hQ== lhebendanz@nixos"
+      ];
+    }
+    {
+      lass.nichtparasoup.enable = true;
+      services.nginx = {
+        enable = true;
+        virtualHosts."lol.lassul.us" = {
+          forceSSL = true;
+          enableACME = true;
+          locations."/".extraConfig = ''
+            proxy_pass http://localhost:5001;
+          '';
+        };
+      };
+    }
+    { #weechat port forwarding to blue
+      krebs.iptables.tables.filter.INPUT.rules = [
+        { predicate = "-p tcp --dport 9998"; target = "ACCEPT";}
+      ];
+      krebs.iptables.tables.nat.PREROUTING.rules = [
+        { v6 = false; precedence = 1000; predicate = "-d ${config.krebs.hosts.prism.nets.internet.ip4.addr} -p tcp --dport 9998"; target = "DNAT --to-destination ${config.krebs.hosts.blue.nets.retiolum.ip4.addr}:9999"; }
+      ];
+      krebs.iptables.tables.filter.FORWARD.rules = [
+        { v6 = false; precedence = 1000; predicate = "-d ${config.krebs.hosts.blue.nets.retiolum.ip4.addr} -p tcp --dport 9999"; target = "ACCEPT"; }
+        { v6 = false; precedence = 1000; predicate = "-s ${config.krebs.hosts.blue.nets.retiolum.ip4.addr}"; target = "ACCEPT"; }
+      ];
+      krebs.iptables.tables.nat.POSTROUTING.rules = [
+        { v6 = false; predicate = "-d ${config.krebs.hosts.blue.nets.retiolum.ip4.addr} -p tcp --dport 9999"; target = "MASQUERADE"; }
+      ];
+    }
+    {
+      krebs.iptables.tables.filter.INPUT.rules = [
+         { predicate = "-p udp --dport 51820"; target = "ACCEPT"; }
+      ];
+      krebs.iptables.tables.nat.PREROUTING.rules = [
+        { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; }
+      ];
+      krebs.iptables.tables.filter.FORWARD.rules = [
+        { v6 = false; precedence = 1000; predicate = "-s 10.244.1.0/24"; target = "ACCEPT"; }
+        { v6 = false; precedence = 1000; predicate = "-s 10.243.0.0/16 -d 10.244.1.0/24"; target = "ACCEPT"; }
+      ];
+      krebs.iptables.tables.nat.POSTROUTING.rules = [
+        { v6 = false; predicate = "-s 10.244.1.0/24 ! -d 10.244.1.0/24"; target = "MASQUERADE"; }
+      ];
+      networking.wireguard.interfaces.wg0 = {
+        ips = [ "10.244.1.1/24" ];
+        listenPort = 51820;
+        privateKeyFile = (toString <secrets>) + "/wireguard.key";
+        allowedIPsAsRoutes = true;
+        peers = [
+          {
+            # lass-android
+            allowedIPs = [ "10.244.1.2/32" ];
+            publicKey = "63+ns9AGv6e6a8WgxiZNFEt1xQT0YKFlEHzRaYJWtmk=";
+          }
+        ];
+      };
+    }
+    {
+      krebs.iptables.tables.filter.INPUT.rules = [
+        { predicate = "-p udp --dport 60000:61000"; target = "ACCEPT";}
+      ];
+    }
   ];
 
   krebs.build.host = config.krebs.hosts.prism;
diff --git a/lass/1systems/prism/physical.nix b/lass/1systems/prism/physical.nix
new file mode 100644
index 000000000..83f127c22
--- /dev/null
+++ b/lass/1systems/prism/physical.nix
@@ -0,0 +1,85 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./config.nix
+    {
+      networking.interfaces.et0.ipv4.addresses = [
+        {
+          address = config.krebs.build.host.nets.internet.ip4.addr;
+          prefixLength = 27;
+        }
+        {
+          address = "46.4.114.243";
+          prefixLength = 27;
+        }
+      ];
+      networking.defaultGateway = "46.4.114.225";
+      networking.nameservers = [
+        "8.8.8.8"
+      ];
+      services.udev.extraRules = ''
+        SUBSYSTEM=="net", ATTR{address}=="08:60:6e:e7:87:04", NAME="et0"
+      '';
+    }
+    {
+      imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
+
+      boot.loader.grub = {
+        devices = [
+          "/dev/sda"
+          "/dev/sdb"
+        ];
+        splashImage = null;
+      };
+
+      boot.initrd.availableKernelModules = [
+        "ata_piix"
+        "vmw_pvscsi"
+        "ahci" "sd_mod"
+      ];
+
+      boot.kernelModules = [ "kvm-intel" ];
+
+      fileSystems."/" = {
+        device = "/dev/pool/nix_root";
+        fsType = "ext4";
+      };
+
+      fileSystems."/tmp" = {
+        device = "tmpfs";
+        fsType = "tmpfs";
+        options = ["nosuid" "nodev" "noatime"];
+      };
+
+      fileSystems."/var/download" = {
+        device = "/dev/pool/download";
+        fsType = "ext4";
+      };
+
+      fileSystems."/srv/http" = {
+        device = "/dev/pool/http";
+        fsType = "ext4";
+      };
+
+      fileSystems."/home" = {
+        device = "/dev/pool/home";
+        fsType = "ext4";
+      };
+
+      fileSystems."/bku" = {
+        device = "/dev/pool/bku";
+        fsType = "ext4";
+      };
+
+      swapDevices = [
+        { label = "swap1"; }
+        { label = "swap2"; }
+      ];
+
+      sound.enable = false;
+      nixpkgs.config.allowUnfree = true;
+      time.timeZone = "Europe/Berlin";
+    }
+  ];
+
+}
diff --git a/lass/1systems/red/config.nix b/lass/1systems/red/config.nix
new file mode 100644
index 000000000..3139e94a2
--- /dev/null
+++ b/lass/1systems/red/config.nix
@@ -0,0 +1,28 @@
+with import <stockholm/lib>;
+{ config, lib, pkgs, ... }:
+let
+  inherit (import <stockholm/lass/2configs/websites/util.nix> {inherit lib pkgs;})
+    servephpBB
+  ;
+in
+{
+  imports = [
+    <stockholm/lass>
+    <stockholm/lass/2configs>
+    <stockholm/lass/2configs/retiolum.nix>
+    <stockholm/lass/2configs/websites>
+    <stockholm/lass/2configs/websites/sqlBackup.nix>
+    (servephpBB [ "rote-allez-fraktion.de" ])
+  ];
+
+  krebs.iptables.tables.filter.INPUT.rules = [
+    { predicate = "-p tcp --dport 80"; target = "ACCEPT"; }
+  ];
+
+  krebs.build.host = config.krebs.hosts.red;
+
+  services.nginx.enable = true;
+  environment.systemPackages = [
+    pkgs.mk_sql_pair
+  ];
+}
diff --git a/lass/1systems/red/physical.nix b/lass/1systems/red/physical.nix
new file mode 100644
index 000000000..7499ff723
--- /dev/null
+++ b/lass/1systems/red/physical.nix
@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./config.nix
+  ];
+  boot.isContainer = true;
+  networking.useDHCP = false;
+  environment.variables.NIX_REMOTE = "daemon";
+}
diff --git a/lass/1systems/echelon/source.nix b/lass/1systems/red/source.nix
index 96888d5a8..f2bad743c 100644
--- a/lass/1systems/echelon/source.nix
+++ b/lass/1systems/red/source.nix
@@ -1,3 +1,4 @@
 import <stockholm/lass/source.nix> {
-  name = "echelon";
+  name = "red";
+  secure = true;
 }
diff --git a/lass/1systems/shodan/config.nix b/lass/1systems/shodan/config.nix
index 7fb57544f..8405b0f1f 100644
--- a/lass/1systems/shodan/config.nix
+++ b/lass/1systems/shodan/config.nix
@@ -4,8 +4,6 @@ with import <stockholm/lib>;
 {
   imports = [
     <stockholm/lass>
-    #TODO reinstall with correct layout and use lass/hw/x220
-    <stockholm/krebs/2configs/hw/x220.nix>
 
     <stockholm/lass/2configs/mouse.nix>
     <stockholm/lass/2configs/retiolum.nix>
@@ -15,53 +13,13 @@ with import <stockholm/lib>;
     <stockholm/lass/2configs/browsers.nix>
     <stockholm/lass/2configs/programs.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
-    <stockholm/lass/2configs/backups.nix>
     <stockholm/lass/2configs/wine.nix>
     <stockholm/lass/2configs/bitcoin.nix>
+    <stockholm/lass/2configs/backup.nix>
   ];
 
   krebs.build.host = config.krebs.hosts.shodan;
 
-  boot = {
-    loader.grub.enable = true;
-    loader.grub.version = 2;
-    loader.grub.device = "/dev/sda";
-
-    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ];
-    initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
-    initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
-    #kernelModules = [ "kvm-intel" "msr" ];
-  };
-  fileSystems = {
-    "/" = {
-      device = "/dev/pool/nix";
-      fsType = "btrfs";
-    };
-
-    "/boot" = {
-      device = "/dev/sda1";
-    };
-    "/home" = {
-      device = "/dev/mapper/pool-home";
-      fsType = "btrfs";
-      options = ["defaults" "noatime" "ssd" "compress=lzo"];
-    };
-    "/tmp" = {
-      device = "tmpfs";
-      fsType = "tmpfs";
-      options = ["nosuid" "nodev" "noatime"];
-    };
-    "/bku" = {
-      device = "/dev/pool/bku";
-      fsType = "btrfs";
-    };
-  };
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:29:26:bc", NAME="wl0"
-    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:0c:a7:63", NAME="et0"
-  '';
-
   services.logind.extraConfig = ''
     HandleLidSwitch=ignore
   '';
diff --git a/lass/1systems/shodan/physical.nix b/lass/1systems/shodan/physical.nix
new file mode 100644
index 000000000..4a550d0a4
--- /dev/null
+++ b/lass/1systems/shodan/physical.nix
@@ -0,0 +1,47 @@
+{
+  #TODO reinstall with correct layout and use lass/hw/x220
+  imports = [
+    ./config.nix
+    <stockholm/krebs/2configs/hw/x220.nix>
+  ];
+
+  boot = {
+    loader.grub.enable = true;
+    loader.grub.version = 2;
+    loader.grub.device = "/dev/sda";
+
+    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ];
+    initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
+    initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
+    #kernelModules = [ "kvm-intel" "msr" ];
+  };
+  fileSystems = {
+    "/" = {
+      device = "/dev/pool/nix";
+      fsType = "btrfs";
+    };
+
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+    "/home" = {
+      device = "/dev/mapper/pool-home";
+      fsType = "btrfs";
+      options = ["defaults" "noatime" "ssd" "compress=lzo"];
+    };
+    "/tmp" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = ["nosuid" "nodev" "noatime"];
+    };
+    "/bku" = {
+      device = "/dev/pool/bku";
+      fsType = "btrfs";
+    };
+  };
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="a0:88:b4:29:26:bc", NAME="wl0"
+    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:0c:a7:63", NAME="et0"
+  '';
+}
diff --git a/lass/1systems/skynet/config.nix b/lass/1systems/skynet/config.nix
index 0b9499982..b6c08f797 100644
--- a/lass/1systems/skynet/config.nix
+++ b/lass/1systems/skynet/config.nix
@@ -3,13 +3,10 @@ with import <stockholm/lib>;
 {
   imports = [
     <stockholm/lass>
-    <stockholm/lass/2configs/hw/x220.nix>
-    <stockholm/lass/2configs/boot/stock-x220.nix>
 
     <stockholm/lass/2configs/retiolum.nix>
     #<stockholm/lass/2configs/exim-retiolum.nix>
     <stockholm/lass/2configs/fetchWallpaper.nix>
-    <stockholm/lass/2configs/backups.nix>
     {
       # discordius config
       services.xserver.enable = true;
@@ -47,17 +44,4 @@ with import <stockholm/lib>;
   services.logind.extraConfig = ''
     HandleLidSwitch=ignore
   '';
-
-  #fileSystems = {
-  #  "/bku" = {
-  #    device = "/dev/mapper/pool-bku";
-  #    fsType = "btrfs";
-  #    options = ["defaults" "noatime" "ssd" "compress=lzo"];
-  #  };
-  #};
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="net", ATTR{address}=="10:0b:a9:a6:44:04", NAME="wl0"
-    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:d1:90:fc", NAME="et0"
-  '';
 }
diff --git a/lass/1systems/skynet/physical.nix b/lass/1systems/skynet/physical.nix
new file mode 100644
index 000000000..358e1f511
--- /dev/null
+++ b/lass/1systems/skynet/physical.nix
@@ -0,0 +1,12 @@
+{
+  imports = [
+    ./config.nix
+    <stockholm/lass/2configs/hw/x220.nix>
+    <stockholm/lass/2configs/boot/stock-x220.nix>
+  ];
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="10:0b:a9:a6:44:04", NAME="wl0"
+    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:d1:90:fc", NAME="et0"
+  '';
+}
diff --git a/lass/1systems/uriel/config.nix b/lass/1systems/uriel/config.nix
index 70bef9883..3eddcfc52 100644
--- a/lass/1systems/uriel/config.nix
+++ b/lass/1systems/uriel/config.nix
@@ -41,60 +41,5 @@ with import <stockholm/lib>;
   ];
 
   krebs.build.host = config.krebs.hosts.uriel;
-
-  hardware.enableAllFirmware = true;
   nixpkgs.config.allowUnfree = true;
-
-  boot = {
-    #kernelParams = [
-    #  "acpi.brightness_switch_enabled=0"
-    #];
-    #loader.grub.enable = true;
-    #loader.grub.version = 2;
-    #loader.grub.device = "/dev/sda";
-
-    loader.systemd-boot.enable = true;
-    loader.timeout = 5;
-
-    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ];
-    initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
-    initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
-    #kernelModules = [ "kvm-intel" "msr" ];
-    kernelModules = [ "msr" ];
-  };
-  fileSystems = {
-    "/" = {
-      device = "/dev/pool/root";
-      fsType = "ext4";
-    };
-
-    "/bku" = {
-      device = "/dev/pool/bku";
-      fsType = "ext4";
-    };
-
-    "/boot" = {
-      device = "/dev/sda1";
-    };
-    "/tmp" = {
-      device = "tmpfs";
-      fsType = "tmpfs";
-      options = ["nosuid" "nodev" "noatime"];
-    };
-  };
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="net", ATTR{address}=="64:27:37:7d:d8:ae", NAME="wl0"
-    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:b8:c8:2e", NAME="et0"
-  '';
-
-  services.xserver.synaptics = {
-    enable = true;
-    twoFingerScroll = true;
-    accelFactor = "0.035";
-    additionalOptions = ''
-      Option "FingerHigh" "60"
-      Option "FingerLow"  "60"
-    '';
-  };
 }
diff --git a/lass/1systems/uriel/physical.nix b/lass/1systems/uriel/physical.nix
new file mode 100644
index 000000000..9ac3468a8
--- /dev/null
+++ b/lass/1systems/uriel/physical.nix
@@ -0,0 +1,59 @@
+{
+  imports = [
+    ./config.nix
+  ];
+
+  hardware.enableAllFirmware = true;
+  boot = {
+    #kernelParams = [
+    #  "acpi.brightness_switch_enabled=0"
+    #];
+    #loader.grub.enable = true;
+    #loader.grub.version = 2;
+    #loader.grub.device = "/dev/sda";
+
+    loader.systemd-boot.enable = true;
+    loader.timeout = 5;
+
+    initrd.luks.devices = [ { name = "luksroot"; device = "/dev/sda2"; } ];
+    initrd.luks.cryptoModules = [ "aes" "sha512" "sha1" "xts" ];
+    initrd.availableKernelModules = [ "xhci_hcd" "ehci_pci" "ahci" "usb_storage" ];
+    #kernelModules = [ "kvm-intel" "msr" ];
+    kernelModules = [ "msr" ];
+  };
+  fileSystems = {
+    "/" = {
+      device = "/dev/pool/root";
+      fsType = "ext4";
+    };
+
+    "/bku" = {
+      device = "/dev/pool/bku";
+      fsType = "ext4";
+    };
+
+    "/boot" = {
+      device = "/dev/sda1";
+    };
+    "/tmp" = {
+      device = "tmpfs";
+      fsType = "tmpfs";
+      options = ["nosuid" "nodev" "noatime"];
+    };
+  };
+
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="64:27:37:7d:d8:ae", NAME="wl0"
+    SUBSYSTEM=="net", ATTR{address}=="f0:de:f1:b8:c8:2e", NAME="et0"
+  '';
+
+  services.xserver.synaptics = {
+    enable = true;
+    twoFingerScroll = true;
+    accelFactor = "0.035";
+    additionalOptions = ''
+      Option "FingerHigh" "60"
+      Option "FingerLow"  "60"
+    '';
+  };
+}
diff --git a/lass/1systems/xerxes/config.nix b/lass/1systems/xerxes/config.nix
index 0669748f5..1bd6cf2c5 100644
--- a/lass/1systems/xerxes/config.nix
+++ b/lass/1systems/xerxes/config.nix
@@ -3,8 +3,6 @@
 {
   imports = [
     <stockholm/lass>
-    <stockholm/lass/2configs/hw/gpd-pocket.nix>
-    <stockholm/lass/2configs/boot/stock-x220.nix>
 
     <stockholm/lass/2configs/retiolum.nix>
     <stockholm/lass/2configs/exim-retiolum.nix>
@@ -15,26 +13,4 @@
   ];
 
   krebs.build.host = config.krebs.hosts.xerxes;
-
-  services.udev.extraRules = ''
-    SUBSYSTEM=="net", ATTR{address}=="b0:f1:ec:9f:5c:78", NAME="wl0"
-  '';
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/d227d88f-bd24-4e8a-aa14-9e966b471437";
-    fsType = "btrfs";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/16C8-D053";
-    fsType = "vfat";
-  };
-
-  fileSystems."/home" = {
-    device = "/dev/disk/by-uuid/1ec4193b-7f41-490d-8782-7677d437b358";
-    fsType = "btrfs";
-  };
-
-  boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/disk/by-uuid/d17f19a3-dcba-456d-b5da-e45cc15dc9c8"; } ];
-  networking.wireless.enable = true;
 }
diff --git a/lass/1systems/xerxes/physical.nix b/lass/1systems/xerxes/physical.nix
new file mode 100644
index 000000000..17caccfe6
--- /dev/null
+++ b/lass/1systems/xerxes/physical.nix
@@ -0,0 +1,29 @@
+{
+  imports = [
+    ./config.nix
+    <stockholm/lass/2configs/hw/gpd-pocket.nix>
+    <stockholm/lass/2configs/boot/stock-x220.nix>
+  ];
+  services.udev.extraRules = ''
+    SUBSYSTEM=="net", ATTR{address}=="b0:f1:ec:9f:5c:78", NAME="wl0"
+  '';
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/d227d88f-bd24-4e8a-aa14-9e966b471437";
+    fsType = "btrfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/16C8-D053";
+    fsType = "vfat";
+  };
+
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/1ec4193b-7f41-490d-8782-7677d437b358";
+    fsType = "btrfs";
+  };
+
+  boot.initrd.luks.devices = [ { name = "luksroot"; device = "/dev/disk/by-uuid/d17f19a3-dcba-456d-b5da-e45cc15dc9c8"; } ];
+
+  networking.wireless.enable = true;
+}
diff --git a/lass/1systems/xerxes/source.nix b/lass/1systems/xerxes/source.nix
index 11f5bf796..d256b885b 100644
--- a/lass/1systems/xerxes/source.nix
+++ b/lass/1systems/xerxes/source.nix
@@ -2,10 +2,4 @@ with import <stockholm/lib>;
 import <stockholm/lass/source.nix> {
   name = "xerxes";
   secure = true;
-  override = {
-    nixpkgs.git = mkForce {
-      url = https://github.com/lassulus/nixpkgs;
-      ref = "3eccd0b";
-    };
-  };
 }