diff --git a/.drone.yml b/.drone.yml
index b4d4bb92..f54bd8f9 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -1,72 +1,79 @@
----
-kind: pipeline
-type: exec
-name: Check
-node:
-  hosttype: baremetal
-
-steps:
-  - name: "Check"
-    when:
-      event:
-        - pull_request
-    environment:
-      NIX_FLAGS: "--print-build-logs --verbose"
-    commands:
-      - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
-      - nix $$NIX_FLAGS develop --command nix flake show
-      - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
-
----
-kind: pipeline
-type: exec
-name: Tests
-node:
-  hosttype: baremetal
-
-steps:
-  - name: "Tests"
-    environment:
-      NIX_FLAGS: "--print-build-logs --verbose"
-    commands:
-      - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
-      - nix $$NIX_FLAGS build ".#checks.x86_64-linux.customTestFor-PubSolarOS-firstTest"
-      - nix-store --read-log result
-      - nix $$NIX_FLAGS flake check
-      - nix $$NIX_FLAGS develop --command echo OK
-
-  - name: "Upload artifacts"
-    environment:
-      TRITON_DONT_SOURCE_PROFILE: 1
-      PRIVATE_SSH_KEY:
-        from_secret: private_ssh_key
-      MANTA_USER: pub_solar
-      MANTA_URL: https://eu-central.manta.greenbaum.cloud
-      MANTA_KEY_ID: "5d:5f:3d:22:8d:37:1f:e6:d6:ab:06:18:d9:a2:04:67"
-    commands:
-      - export TARGET_DIR="ci/$${DRONE_REPO}/$${DRONE_BUILD_NUMBER}"
-      - echo env var TARGET_DIR is set to $$TARGET_DIR
-      - "mkdir ~/.ssh && chmod 700 ~/.ssh"
-      - echo "$$PRIVATE_SSH_KEY" > ~/.ssh/id_ed25519 && chmod 600 ~/.ssh/id_ed25519
-      - nix flake new --template "git+https://git.greenbaum.cloud/dev/tritonshell?ref=main" ./tritonshell
-      - git add tritonshell
-      - cd tritonshell
-      - nix develop --command mput -p -f ../result/foot_wayland_info.png ~~/public/$${TARGET_DIR}/foot_wayland_info.png
-      - nix develop --command mput -p -f ../result/test-wayland.out ~~/public/$${TARGET_DIR}/test-wayland.out
-
-trigger:
-  ref:
-    - refs/tags/v*
-    - refs/tags/t*
-
 ---
 kind: pipeline
 type: docker
-name: Notification
+name: Upstreaming
 
 steps:
+  - name: "Sync 'devos' branch with upstream"
+    image: alpine/git
+    when:
+      event:
+        - cron
+      cron:
+        - sync-main-with-upstream
+    environment:
+      GITEA_SSH_KEY:
+        from_secret: gitea_ssh_key
+    commands:
+      - ./.drone/setup_ssh.sh
+      - git remote add devos git@git.b12f.io:pub-solar/devos
+      - git remote set-url origin git@git.b12f.io:pub-solar/os
+      - git fetch --all
+      - git checkout -b devos --track origin/devos
+      - git merge -X theirs devos/main
+      - git push origin devos
+      - git remote set-url origin https://git.b12f.io/pub-solar/os.git
+
+  - name: "Sync $BRANCH with upstream"
+    image: alpine/git
+    when:
+      event:
+        - cron
+      cron:
+        - sync-main-with-upstream
+        - sync-b12f-with-main
+        - sync-teutat3s-with-main
+    environment:
+      GITEA_SSH_KEY:
+        from_secret: gitea_ssh_key
+    commands:
+      - git fetch origin
+      - git checkout origin/main
+      - ./.drone/setup_ssh.sh
+      - git remote set-url origin git@git.b12f.io:pub-solar/os
+      - git fetch --all
+      - ./.drone/upstream-branch.sh
+
+  - name: "Open pull request for failed merge"
+    image: nixery.dev/shell/tea
+    when:
+      status:
+        - failure
+      event:
+        - cron
+      cron:
+        - sync-main-with-upstream
+        - sync-b12f-with-main
+        - sync-teutat3s-with-main
+    environment:
+      TEA_CONFIG:
+        from_secret: tea_config
+    commands:
+      - mkdir -p ~/.config/tea
+      - echo "$$TEA_CONFIG" > ~/.config/tea/config.yml
+      - tea pulls create --base main --head devos
+
   - name: "Notify matrix"
     image: plugins/matrix
+    when:
+      status:
+        - failure
+      event:
+        - cron
+      cron:
+        - sync-main-with-upstream
+        - sync-b12f-with-main
+        - sync-teutat3s-with-main
     settings:
       homeserver: https://matrix.pub.solar
       roomid: dfQBqwkhIzrFjMSsxy:pub.solar
@@ -74,15 +81,31 @@ steps:
         from_secret: matrix_username
       password:
         from_secret: matrix_password
-      template: "Test run triggered by tag: {{ build.tag }}. Test run exit status: {{ build.status }}. Artifacts uploaded to Manta: https://eu-central.manta.greenbaum.cloud/pub_solar/public/ci/{{ repo.Owner }}/{{ repo.Name }}/{{ build.number }}/foot_wayland_info.png"
-
-depends_on:
-  - Tests
+      template: "Upstreaming {{ build.status }} [{{ build.branch }}#{{ truncate build.commit 8 }}]({{ build.link }}) by {{ build.author }}. [Pull requests](https://git.b12f.io/pub-solar/os/pulls)"
 
 trigger:
-  ref:
-    - refs/tags/v*
-    - refs/tags/t*
+  event:
+    - cron
+
+---
+kind: pipeline
+type: docker
+name: Check
+
+steps:
+  - name: "Check"
+    image: docker.nix-community.org/nixpkgs/nix-flakes:latest
+    when:
+      event:
+        - pull_request
+        - tag
+    environment:
+      NIX_FLAGS: "--print-build-logs --verbose"
+    commands:
+      - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
+      - nix $$NIX_FLAGS flake check
+      - nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel"
+      - nix $$NIX_FLAGS develop --command echo OK
 
 ---
 kind: pipeline
@@ -92,55 +115,41 @@ name: Publish ISO
 steps:
   - name: "Build ISO"
     image: docker.nix-community.org/nixpkgs/nix-flakes:latest
-    environment:
-      NIX_FLAGS: "--print-build-logs --verbose"
     volumes:
       - name: file-exchange
         path: /var/nix/iso-cache
     commands:
       - |
-        nix $$NIX_FLAGS build \
-          '.#nixosConfigurations.bootstrap.config.system.build.isoImage'
-      - cp $(readlink -f result)/iso/PubSolarOS*.iso /var/nix/iso-cache/
-      - nix shell nixpkgs#findutils
-      - cd /var/nix/iso-cache/
-      - export ISO_NAME=$(find . -name '*.iso' -printf "%f\n")
-      - sha256sum $ISO_NAME > $ISO_NAME.sha256
-      - ln -s $ISO_NAME PubSolarOS-latest.iso
-      - cp $ISO_NAME.sha256 PubSolarOS-latest.iso.sha256
-      - nix run nixpkgs#gnused -- --in-place "s/$ISO_NAME/PubSolarOS-latest.iso/" PubSolarOS-latest.iso.sha256
+        nix --print-build-logs --verbose \
+          build \
+            '.#nixosConfigurations.bootstrap.config.system.build.bootstrapIso'
+      - cp $(readlink -f result)/iso/*.iso /var/nix/iso-cache/
 
   - name: "Publish ISO"
-    # custom drone-scp image, source: https://git.b12f.io/pub-solar/drone-scp/
-    # docker build --tag registry.greenbaum.cloud/library/drone-scp:v1.6.5 --file ./docker/Dockerfile.linux.amd64 .
-    image: registry.greenbaum.cloud/library/drone-scp:v1.6.5
+    image: appleboy/drone-scp
     volumes:
       - name: file-exchange
         path: /var/nix/iso-cache
     settings:
       host:
-        from_secret: iso_web_ssh_host
+        from_secret: ssh_host
       user:
-        from_secret: iso_web_ssh_user
+        from_secret: ssh_user
       port:
-        from_secret: iso_web_ssh_port
+        from_secret: ssh_port
       key:
-        from_secret: iso_web_ssh_key
-      target: /srv/os/download
+        from_secret: ssh_key
+      target: /srv/os
       source:
         - /var/nix/iso-cache/*.iso
-        - /var/nix/iso-cache/*.iso.sha256
-      unlink_first: true
       strip_components: 3
 
 depends_on:
   - Check
 
 trigger:
-  branch:
-    - main
   event:
-    - push
+    - tag
 
 volumes:
   - name: file-exchange
@@ -148,6 +157,6 @@ volumes:
 
 ---
 kind: signature
-hmac: 291be33bbf2954d1f5e4bf569679e24a773e7d6f90db4765fb9dacb3686a825e
+hmac: da951ba8ede88996728acfb47846e01880eb0e3b91f66e47848d6c1cc727c5d9
 
 ...
diff --git a/flake.lock b/flake.lock
index 060a2aea..857bb989 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1665870395,
-        "narHash": "sha256-Tsbqb27LDNxOoPLh0gw2hIb6L/6Ow/6lIBvqcHzEKBI=",
+        "lastModified": 1652712410,
+        "narHash": "sha256-hMJ2TqLt0DleEnQFGUHK9sV2aAzJPU8pZeiZoqRozbE=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "a630400067c6d03c9b3e0455347dc8559db14288",
+        "rev": "7e5e58b98c3dcbf497543ff6f22591552ebfe65b",
         "type": "github"
       },
       "original": {
@@ -42,11 +42,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1667419884,
-        "narHash": "sha256-oLNw87ZI5NxTMlNQBv1wG2N27CUzo9admaFlnmavpiY=",
+        "lastModified": 1657835815,
+        "narHash": "sha256-CnZszAYpNKydh6N7+xg+eRtWNVoAAGqc6bg+Lpgq1xc=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "cfc0125eafadc9569d3d6a16ee928375b77e3100",
+        "rev": "54a24f042f93c79f5679f133faddedec61955cf2",
         "type": "github"
       },
       "original": {
@@ -143,16 +143,15 @@
         "nixpkgs-unstable": "nixpkgs-unstable"
       },
       "locked": {
-        "lastModified": 1661600857,
-        "narHash": "sha256-KfQCcTtfvU0PXV4fD9XKIMcKx9lUUR0xWJoBgc12fKE=",
-        "owner": "pub-solar",
+        "lastModified": 1659622306,
+        "narHash": "sha256-Kpfm2PNs+kZU0W7qcugoPATLG8I2P7FJFGTgsf1LJiU=",
+        "owner": "divnix",
         "repo": "digga",
-        "rev": "c902b3ef0aa45cb4f336c390f647bb182c38a221",
+        "rev": "d1193743a535d7fbbc7f3eda4e51295b10bd4d2c",
         "type": "github"
       },
       "original": {
-        "owner": "pub-solar",
-        "ref": "fix/bootstrap-iso",
+        "owner": "divnix",
         "repo": "digga",
         "type": "github"
       }
@@ -192,27 +191,11 @@
     "flake-compat_3": {
       "flake": false,
       "locked": {
-        "lastModified": 1650374568,
-        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "lastModified": 1648199409,
+        "narHash": "sha256-JwPKdC2PoVBkG6E+eWw3j6BMR6sL3COpYWfif7RVb8Y=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_4": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1650374568,
-        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "rev": "64a525ee38886ab9028e6f61790de0832aa3ef03",
         "type": "github"
       },
       "original": {
@@ -272,11 +255,11 @@
     },
     "flake-utils_3": {
       "locked": {
-        "lastModified": 1667077288,
-        "narHash": "sha256-bdC8sFNDpT0HK74u9fUkpbf1MEzVYJ+ka7NXCdgBoaA=",
+        "lastModified": 1649676176,
+        "narHash": "sha256-OWKJratjt2RW151VUlJPRALb7OU2S5s+f0vLj4o1bHM=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "6ee9ebb6b1ee695d2cacc4faa053a7b9baa76817",
+        "rev": "a4b154ebbdc88c8498a5c7b01589addc9e9cb678",
         "type": "github"
       },
       "original": {
@@ -292,11 +275,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1667677389,
-        "narHash": "sha256-y9Zdq8vtsn0T5TO1iTvWA7JndYIAGjzCjbYVi/hOSmA=",
+        "lastModified": 1656169755,
+        "narHash": "sha256-Nlnm4jeQWEGjYrE6hxi/7HYHjBSZ/E0RtjCYifnNsWk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "87d55517f6f36aa1afbd7a4a064869d5a1d405b8",
+        "rev": "4a3d01fb53f52ac83194081272795aa4612c2381",
         "type": "github"
       },
       "original": {
@@ -324,11 +307,11 @@
     },
     "latest_2": {
       "locked": {
-        "lastModified": 1667629849,
-        "narHash": "sha256-P+v+nDOFWicM4wziFK9S/ajF2lc0N2Rg9p6Y35uMoZI=",
+        "lastModified": 1660305968,
+        "narHash": "sha256-r0X1pZCSEA6mzt5OuTA7nHuLmvnbkwgpFAh1iLIx4GU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3bacde6273b09a21a8ccfba15586fb165078fb62",
+        "rev": "c4a0efdd5a728e20791b8d8d2f26f90ac228ee8d",
         "type": "github"
       },
       "original": {
@@ -345,11 +328,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1662220400,
-        "narHash": "sha256-9o2OGQqu4xyLZP9K6kNe1pTHnyPz0Wr3raGYnr9AIgY=",
+        "lastModified": 1659610603,
+        "narHash": "sha256-LYgASYSPYo7O71WfeUOaEUzYfzuXm8c8eavJcel+pfI=",
         "owner": "nmattia",
         "repo": "naersk",
-        "rev": "6944160c19cb591eb85bbf9b2f2768a935623ed3",
+        "rev": "c6a45e4277fa58abd524681466d3450f896dc094",
         "type": "github"
       },
       "original": {
@@ -375,11 +358,11 @@
     },
     "nixos": {
       "locked": {
-        "lastModified": 1667653703,
-        "narHash": "sha256-Xow4vx52/g5zkhlgZnMEm/TEXsj+13jTPCc2jIhW1xU=",
+        "lastModified": 1660318005,
+        "narHash": "sha256-g9WCa9lVUmOV6dYRbEPjv/TLOR5hamjeCcKExVGS3OQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f09ad462c5a121d0239fde645aacb2221553a217",
+        "rev": "5c211b47aeadcc178c5320afd4e74c7eed5c389f",
         "type": "github"
       },
       "original": {
@@ -395,11 +378,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1666812839,
-        "narHash": "sha256-0nBDgjPU+iDsvz89W+cDEyhnFGSwCJmwDl/gMGqYiU0=",
+        "lastModified": 1657748715,
+        "narHash": "sha256-WecDwDY/hEcDQYzFnccCNa+5Umht0lfjx/d1qGDy/rQ=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "41f3518bc194389df22a3d198215eae75e6b5ab9",
+        "rev": "3323b944d99b026aebfd8de439e001409dde067d",
         "type": "github"
       },
       "original": {
@@ -410,11 +393,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1667768008,
-        "narHash": "sha256-PGbX0s2hhXGnZDFVE6UIhPSOf5YegpWs5dUXpT/14F0=",
+        "lastModified": 1660407119,
+        "narHash": "sha256-04lWO0pDbhAXFdL4v2VzzwgxrZ5IefKn+TmZPiPeKxg=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "f6483e0def85efb9c1e884efbaff45a5e7aabb34",
+        "rev": "12620020f76b1b5d2b0e6fbbda831ed4f5fe56e1",
         "type": "github"
       },
       "original": {
@@ -469,18 +452,18 @@
     },
     "nvfetcher": {
       "inputs": {
-        "flake-compat": "flake-compat_4",
+        "flake-compat": "flake-compat_3",
         "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "nixos"
         ]
       },
       "locked": {
-        "lastModified": 1667620329,
-        "narHash": "sha256-v1Zk7rtEbAGpevBGPZvZBKpwbmw4I+uVwxvd+pBlp3o=",
+        "lastModified": 1654975372,
+        "narHash": "sha256-wkNZ16akgKViuZzE/IM+bux4uaJ04KIwUeexH8gBjgw=",
         "owner": "berberman",
         "repo": "nvfetcher",
-        "rev": "294826951113dcd3aa9abbcacfb1aa5b95a19116",
+        "rev": "d4b237c10f14f72f8266b0f658faad822e491e55",
         "type": "github"
       },
       "original": {
@@ -495,7 +478,6 @@
         "darwin": "darwin",
         "deploy": "deploy",
         "digga": "digga",
-        "flake-compat": "flake-compat_3",
         "home": "home",
         "latest": "latest_2",
         "naersk": "naersk",
diff --git a/flake.nix b/flake.nix
index cce3f8ee..bf050b2e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,10 +11,7 @@
       nixos.url = "github:nixos/nixpkgs/nixos-22.05";
       latest.url = "github:nixos/nixpkgs/nixos-unstable";
 
-      flake-compat.url = "github:edolstra/flake-compat";
-      flake-compat.flake = false;
-
-      digga.url = "github:pub-solar/digga/fix/bootstrap-iso";
+      digga.url = "github:divnix/digga";
       digga.inputs.nixpkgs.follows = "nixos";
       digga.inputs.nixlib.follows = "nixos";
       digga.inputs.home-manager.follows = "home";
@@ -95,10 +92,7 @@
             imports = [ (digga.lib.importExportableModules ./modules) ];
             modules = [
               { lib.our = self.lib; }
-              # FIXME: upstream module causes a huge number of unnecessary
-              # dependencies to be pulled in for all systems -- many of them are
-              # graphical. should only be imported as needed.
-              # digga.nixosModules.bootstrapIso
+              digga.nixosModules.bootstrapIso
               digga.nixosModules.nixConfig
               home.nixosModules.home-manager
               agenix.nixosModules.age
@@ -108,16 +102,7 @@
           imports = [ (digga.lib.importHosts ./hosts) ];
           hosts = {
             /* set host specific properties here */
-            bootstrap = {
-              modules = [
-                digga.nixosModules.bootstrapIso
-              ];
-            };
-            PubSolarOS = {
-              tests = [
-                (import ./tests/first-test.nix { pkgs = nixos.legacyPackages.x86_64-linux; lib = nixos.lib; })
-              ];
-            };
+            PubSolarOS = { };
           };
           importables = rec {
             profiles = digga.lib.rakeLeaves ./profiles // {
diff --git a/hosts/bootstrap.nix b/hosts/bootstrap.nix
index 49422675..ba509911 100644
--- a/hosts/bootstrap.nix
+++ b/hosts/bootstrap.nix
@@ -1,20 +1,9 @@
-{ config, lib, pkgs, profiles, ... }:
-with lib;
-let
-  # Gets hostname of host to be bundled inside iso
-  # Copied from https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L3-L11
-  getFqdn = config:
-    let
-      net = config.networking;
-      fqdn =
-        if (net ? domain) && (net.domain != null)
-        then "${net.hostName}.${net.domain}"
-        else net.hostName;
-    in
-      fqdn;
-in
+{ profiles, ... }:
 {
-  # build with: `nix build ".#nixosConfigurations.bootstrap.config.system.build.isoImage"`
+  # build with: `nix build '.#nixosConfigurations.bootstrap.config.system.build.bootstrapIso'`
+  # reachable on the local link via ssh root@fe80::47%eno1
+  # where 'eno1' is replaced by your own machine's network
+  # interface that has the local link to the target machine
   imports = [
     # profiles.networking
     profiles.users.root # make sure to configure ssh keys
@@ -24,28 +13,16 @@ in
     profiles.pub-solar-iso
   ];
 
-  config = {
-    boot.loader.systemd-boot.enable = true;
+  boot.loader.systemd-boot.enable = true;
 
-    # will be overridden by the bootstrapIso instrumentation
-    fileSystems."/" = { device = "/dev/disk/by-label/nixos"; };
+  # will be overridden by the bootstrapIso instrumentation
+  fileSystems."/" = { device = "/dev/disk/by-label/nixos"; };
 
-    system.nixos.label = "PubSolarOS-" + config.system.nixos.version;
-
-    # mkForce because a similar transformation gets double applied otherwise
-    # https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L17
-    # https://github.com/NixOS/nixpkgs/blob/aecd4d8349b94f9bd5718c74a5b789f233f67326/nixos/modules/installer/cd-dvd/installation-cd-base.nix#L21-L22
-    isoImage = {
-      isoBaseName =  mkForce (getFqdn config);
-      isoName = mkForce "${config.system.nixos.label}-${config.isoImage.isoBaseName}-${pkgs.stdenv.hostPlatform.system}.iso";
-    };
-
-    # This value determines the NixOS release from which the default
-    # settings for stateful data, like file locations and database versions
-    # on your system were taken. It‘s perfectly fine and recommended to leave
-    # this value at the release version of the first install of this system.
-    # Before changing this value read the documentation for this option
-    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-    system.stateVersion = "21.05"; # Did you read the comment?
-  };
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.05"; # Did you read the comment?
 }
diff --git a/lib/compat/default.nix b/lib/compat/default.nix
index ae3b4426..9d0c2837 100644
--- a/lib/compat/default.nix
+++ b/lib/compat/default.nix
@@ -1,14 +1,14 @@
 let
-  lock = builtins.fromJSON (builtins.readFile builtins.path { path = ../../flake.lock; name = "lockPath"; });
+  rev = "e7e5d481a0e15dcd459396e55327749989e04ce0";
   flake = (import
     (
       fetchTarball {
-        url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
-        sha256 = lock.nodes.flake-compat.locked.narHash;
+        url = "https://github.com/edolstra/flake-compat/archive/${rev}.tar.gz";
+        sha256 = "0zd3x46fswh5n6faq4x2kkpy6p3c6j593xbdlbsl40ppkclwc80x";
       }
     )
     {
-      src = builtins.path { path = ../../.; name = "projectRoot"; };
+      src = ../../.;
     });
 in
 flake
diff --git a/modules/ci-runner/default.nix b/modules/ci-runner/default.nix
deleted file mode 100644
index 1460ab16..00000000
--- a/modules/ci-runner/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ lib, config, pkgs, self, ... }:
-with lib;
-let
-  psCfg = config.pub-solar;
-  cfg = config.pub-solar.ci-runner;
-in
-{
-  options.pub-solar.ci-runner = {
-    enable = mkEnableOption "Enables a systemd service that runs drone-ci-runner";
-  };
-
-  config = mkIf cfg.enable {
-    systemd.user.services.ci-runner = {
-      enable = true;
-
-      description = "CI runner for the PubSolarOS repository that can run test VM instances with KVM.";
-
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-      };
-
-      path = [
-        pkgs.git
-        pkgs.nix
-        pkgs.libvirt
-      ];
-
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" "libvirtd.service" ];
-
-      script = ''${pkgs.drone-runner-exec}/bin/drone-runner-exec daemon /run/agenix/drone-runner-exec-config'';
-    };
-
-    age.secrets."drone-runner-exec-config" = {
-      file = "${self}/secrets/drone-runner-exec-config";
-      mode = "700";
-      owner = psCfg.user.name;
-    };
-  };
-}
diff --git a/modules/core/boot.nix b/modules/core/boot.nix
index cb16865d..10f67dc4 100644
--- a/modules/core/boot.nix
+++ b/modules/core/boot.nix
@@ -19,7 +19,7 @@ in
   config = {
     boot = {
       # Enable plymouth for better experience of booting
-      plymouth.enable = mkIf (!cfg.lite) (lib.mkDefault true);
+      plymouth.enable = true;
 
       # Mount / luks device in initrd
       # Allow fstrim to work on it.
diff --git a/modules/core/default.nix b/modules/core/default.nix
index 4f74b46d..80ca4926 100644
--- a/modules/core/default.nix
+++ b/modules/core/default.nix
@@ -2,6 +2,7 @@
 
 with lib;
 let
+  psCfg = config.pub-solar;
   cfg = config.pub-solar.core;
 in
 {
@@ -28,12 +29,12 @@ in
 
   config = {
     pub-solar = {
-      audio.enable = mkIf (!cfg.lite) (mkDefault true);
-      crypto.enable = mkIf (!cfg.lite) (mkDefault true);
-      devops.enable = mkIf (!cfg.lite) (mkDefault true);
+      audio.enable = lib.mkIf (!cfg.lite) true;
+      crypto.enable = lib.mkIf (!cfg.lite) true;
+      devops.enable = lib.mkIf (!cfg.lite) true;
 
       terminal-life = {
-        enable = mkDefault true;
+        enable = true;
         lite = cfg.lite;
       };
     };
diff --git a/modules/core/hibernation.nix b/modules/core/hibernation.nix
index a71ffd37..c0e912f1 100644
--- a/modules/core/hibernation.nix
+++ b/modules/core/hibernation.nix
@@ -13,7 +13,7 @@ in
 
     resumeDevice = mkOption {
       type = types.str;
-      default = "/dev/sda1";
+      default = "/swapfile";
       description = "The location of the hibernation resume swap file.";
     };
 
@@ -27,7 +27,12 @@ in
   config = {
     boot = mkIf cfg.enable {
       resumeDevice = cfg.resumeDevice;
-      kernelParams = mkIf (cfg.resumeOffset != null) [ "resume_offset=${builtins.toString cfg.resumeOffset}" ];
+      kernelParams = [
+        "resume=${cfg.resumeDevice}"
+      ] ++ (
+        if (cfg.resumeOffset == null && cfg.enable) then builtins.abort "config.pub-solar.resumeOffset has to be set if config.pub-solar.enable is true."
+        else [ "resume_offset=${cfg.resumeOffset}" ]
+      );
     };
   };
 }
diff --git a/modules/core/networking.nix b/modules/core/networking.nix
index c5ec9cbe..95db64e3 100644
--- a/modules/core/networking.nix
+++ b/modules/core/networking.nix
@@ -6,15 +6,6 @@ let cfg = config.pub-solar.core;
 in
 {
   options.pub-solar.core = {
-    enableCaddy = mkOption {
-      type = types.bool;
-      default = !cfg.lite;
-    };
-    enableHelp = mkOption {
-      type = types.bool;
-      default = !cfg.lite;
-    };
-
     binaryCaches = mkOption {
       type = types.listOf types.str;
       default = [ ];
@@ -25,57 +16,45 @@ in
       default = [ ];
       description = "Public keys of binary caches.";
     };
+    iwdConfig = mkOption {
+      type = with types; nullOr (attrsOf (attrsOf (oneOf [ bool int str ])));
+      default = null;
+      description = "Configuratoin of iNet Wireless Daemon.";
+    };
   };
   config = {
-    # disable NetworkManager-wait-online by default
-    systemd.services.NetworkManager-wait-online.enable = lib.mkDefault false;
-
     networking.networkmanager = {
       # Enable networkmanager. REMEMBER to add yourself to group in order to use nm related stuff.
       enable = true;
-      wifi.backend = "iwd";
     };
 
-    networking.firewall.enable = true;
-
     # Customized binary caches list (with fallback to official binary cache)
     nix.binaryCaches = cfg.binaryCaches;
     nix.binaryCachePublicKeys = cfg.publicKeys;
 
     # These entries get added to /etc/hosts
     networking.hosts = {
-      "127.0.0.1" = [ ]
-        ++ lib.optionals cfg.enableCaddy [ "caddy.local" ]
-        ++ lib.optionals config.pub-solar.printing.enable [ "cups.local" ]
-        ++ lib.optionals cfg.enableHelp [ "help.local" ];
+      "127.0.0.1" = [ "cups.local" "help.local" "caddy.local" ];
     };
 
     # Caddy reverse proxy for local services like cups
     services.caddy = {
-      enable = cfg.enableCaddy;
+      enable = true;
       globalConfig = ''
         default_bind 127.0.0.1
         auto_https off
       '';
-      extraConfig = concatStringsSep "\n" [
-        (lib.optionalString
-          config.pub-solar.printing.enable
-          ''
-            cups.local:80 {
-              request_header Host localhost:631
-              reverse_proxy unix//run/cups/cups.sock
-            }
-          '')
+      extraConfig = ''
+        cups.local:80 {
+          request_header Host localhost:631
+          reverse_proxy unix//run/cups/cups.sock
+        }
 
-        (lib.optionalString
-          cfg.enableHelp
-          ''
-            help.local:80 {
-              root * ${pkgs.psos-docs}/lib/html
-              file_server
-            }
-          '')
-      ];
+        help.local:80 {
+          root * ${pkgs.psos-docs}/lib/html
+          file_server
+        }
+      '';
     };
   };
 }
diff --git a/modules/core/nix.nix b/modules/core/nix.nix
index f7ff5fa4..38b70cfc 100644
--- a/modules/core/nix.nix
+++ b/modules/core/nix.nix
@@ -2,8 +2,6 @@
 
 {
   nix = {
-    # Use default version alias for nix package
-    package = pkgs.nix;
     # Improve nix store disk usage
     autoOptimiseStore = true;
     gc.automatic = true;
diff --git a/modules/core/services.nix b/modules/core/services.nix
index 6ce74472..61ba6ea0 100644
--- a/modules/core/services.nix
+++ b/modules/core/services.nix
@@ -4,10 +4,7 @@
   # For rage encryption, all hosts need a ssh key pair
   services.openssh = {
     enable = true;
-    # If you don't want the host to have SSH actually opened up to the net,
-    # set `services.openssh.openFirewall` to false in your config.
-    openFirewall = lib.mkDefault true;
-    passwordAuthentication = false;
+    openFirewall = lib.mkDefault false;
   };
 
   # Service that makes Out of Memory Killer more effective
diff --git a/modules/graphical/alacritty.nix b/modules/graphical/alacritty.nix
index b389343c..e4e2f6ad 100644
--- a/modules/graphical/alacritty.nix
+++ b/modules/graphical/alacritty.nix
@@ -100,15 +100,10 @@
       foreground = "0xe3e1e4";
     };
 
-    # Cursor colors
-    #
-    # Colors which should be used to draw the terminal cursor.
-    #
-    # Allowed values are CellForeground/CellBackground, which reference the
-    # affected cell, or hexadecimal colors like #ff00ff.
+    # Colors the cursor will use if `custom_cursor_colors` is true
     cursor = {
-      text = "CellBackground";
-      cursor = "CellForeground";
+      text = "0x1a181a";
+      cursor = "0xe3e1e4";
     };
 
     # Colors used for the search bar and match highlighting.
@@ -120,25 +115,14 @@
         background = "0x1a181a";
       };
       focused_match = {
-        foreground = "CellBackground";
-        background = "CellForeground";
+        foreground = "0xe5c463";
+        background = "0xe3e1e4";
       };
       #bar =
       #  background = "#c5c8c6";
       #  foreground = "#1d1f21";
     };
 
-    # Selection colors
-    #
-    # Colors which should be used to draw the selection area.
-    #
-    # Allowed values are CellForeground/CellBackground, which reference the
-    # affected cell, or hexadecimal colors like #ff00ff.
-    selection = {
-      text = "0x1a181a";
-      background = "0xf85e84";
-    };
-
     # Normal colors
     normal = {
       black = "0x1a181a";
diff --git a/modules/graphical/default.nix b/modules/graphical/default.nix
index ede262b3..a506c2ef 100644
--- a/modules/graphical/default.nix
+++ b/modules/graphical/default.nix
@@ -61,7 +61,7 @@ in
       };
     };
 
-    services.getty.autologinUser = mkIf cfg.autologin.enable (mkForce "${psCfg.user.name}");
+    services.getty.autologinUser = mkIf cfg.autologin.enable "${psCfg.user.name}";
 
     qt5 = {
       enable = true;
diff --git a/modules/paranoia/default.nix b/modules/paranoia/default.nix
index 2dc439cf..bb319767 100644
--- a/modules/paranoia/default.nix
+++ b/modules/paranoia/default.nix
@@ -20,33 +20,5 @@ in
 
   config = mkIf cfg.enable {
     pub-solar.core.hibernation.enable = true;
-    services.logind.lidSwitch = "hibernate";
-
-    # The options below are directly taken from or inspired by
-    # https://xeiaso.net/blog/paranoid-nixos-2021-07-18
-
-    # Don't set this if you need sftp
-    services.openssh.allowSFTP = false;
-    services.openssh.openFirewall = false; # Lock yourself out
-
-    # Limit the use of sudo to the group wheel
-    security.sudo.execWheelOnly = true;
-
-    # Remove the complete default environment of packages like
-    # nano, perl and rsync
-    environment.defaultPackages = lib.mkForce [ ];
-
-    # fileSystems."/".options = [ "noexec" ];
-
-    services.openssh = {
-      kbdInteractiveAuthentication = false;
-      extraConfig = ''
-        AllowTcpForwarding yes
-        X11Forwarding no
-        AllowAgentForwarding no
-        AllowStreamLocalForwarding no
-        AuthenticationMethods publickey
-      '';
-    };
   };
 }
diff --git a/modules/sway/config/config.d/mode_system.conf.nix b/modules/sway/config/config.d/mode_system.conf.nix
index f01921c4..c505a9f5 100644
--- a/modules/sway/config/config.d/mode_system.conf.nix
+++ b/modules/sway/config/config.d/mode_system.conf.nix
@@ -1,22 +1,15 @@
-{ pkgs, psCfg, ... }: ''
+{ psCfg, ... }: ''
   # Set shut down, restart and locking features
-'' + (if psCfg.core.hibernation.enable && !psCfg.paranoia.enable then ''
-  set $mode_system (e)xit, (h)ibernate, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
-'' else if psCfg.paranoia.enable then ''
   set $mode_system (e)xit, (h)ibernate, (r)eboot, (Shift+s)hutdown
-'' else ''
-  set $mode_system (e)xit, (l)ock, (s)uspend, (r)eboot, (Shift+s)hutdown
-'')
-+ ''
   bindsym $mod+0 mode "$mode_system"
   mode "$mode_system" {
       bindsym e exec swaymsg exit, mode "default"
-'' + (if psCfg.core.hibernation.enable then ''
-      bindsym h exec systemctl hibernate, mode "default"
+'' + (if !psCfg.core.hibernation.enable then ''
+  bindsym h exec systemctl hibernate, mode "default"
 '' else "")
 + (if !psCfg.paranoia.enable then ''
-      bindsym l exec ${pkgs.swaylock-bg}/bin/swaylock-bg, mode "default"
-      bindsym s exec systemctl suspend, mode "default"
+  bindsym l exec swaylock-bg, mode "default"
+  bindsym s exec systemctl suspend, mode "default"
 '' else "") + ''
       bindsym r exec systemctl reboot, mode "default"
       bindsym Shift+s exec systemctl poweroff, mode "default"
diff --git a/modules/sway/config/config.d/systemd.conf b/modules/sway/config/config.d/systemd.conf
index 66759c4f..d6380d41 100644
--- a/modules/sway/config/config.d/systemd.conf
+++ b/modules/sway/config/config.d/systemd.conf
@@ -5,4 +5,4 @@
 # https://github.com/swaywm/sway/wiki/Systemd-integration
 # Also, import the most important environment variables into the D-Bus and systemd
 # user environments (e.g. required for screen sharing and Pinentry prompts):
-exec "systemctl --user import-environment; systemctl --user start sway-session.target; exec dbus-update-activation-environment --systemd $IMPORT_ENVIRONMENT_ENV_LIST DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP; systemd-cat --identifier=sway sway"
+exec "systemctl --user import-environment DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP; systemctl --user start sway-session.target; exec dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP; systemd-cat --identifier=sway sway"
diff --git a/modules/sway/default.nix b/modules/sway/default.nix
index c173e9ce..dd0e6055 100644
--- a/modules/sway/default.nix
+++ b/modules/sway/default.nix
@@ -98,7 +98,7 @@ in
         xdg.configFile."sway/config.d/theme.conf".source = ./config/config.d/theme.conf;
         xdg.configFile."sway/config.d/gaps.conf".source = ./config/config.d/gaps.conf;
         xdg.configFile."sway/config.d/custom-keybindings.conf".source = ./config/config.d/custom-keybindings.conf;
-        xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix { inherit pkgs psCfg; };
+        xdg.configFile."sway/config.d/mode_system.conf".text = import ./config/config.d/mode_system.conf.nix { inherit psCfg; };
         xdg.configFile."sway/config.d/applications.conf".source = ./config/config.d/applications.conf;
         xdg.configFile."sway/config.d/systemd.conf".source = ./config/config.d/systemd.conf;
       };
diff --git a/modules/sway/mako.service.nix b/modules/sway/mako.service.nix
index 1f210c74..b155e148 100644
--- a/modules/sway/mako.service.nix
+++ b/modules/sway/mako.service.nix
@@ -5,6 +5,7 @@
     Documentation = [ "man:mako(1)" ];
     BindsTo = [ "sway-session.target" ];
     After = [ "sway-session.target" ];
+    # ConditionEnvironment requires systemd v247 to work correctly
     ConditionEnvironment = [ "WAYLAND_DISPLAY" ];
   };
   Service = {
diff --git a/modules/sway/swayidle.service.nix b/modules/sway/swayidle.service.nix
index 80a04518..3b87c610 100644
--- a/modules/sway/swayidle.service.nix
+++ b/modules/sway/swayidle.service.nix
@@ -9,16 +9,18 @@
   };
   Service = {
     Type = "simple";
-    Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin:${pkgs.swaylock-bg}/bin:${pkgs.swayidle}/bin";
-    ExecStart = ''swayidle -w \
-        after-resume 'swaymsg "output * dpms on"' \
-        before-sleep 'swaylock-bg' '' + (if psCfg.paranoia.enable then '' \
-        timeout 120 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"' \
-        timeout 150 'systemctl hibernate'
-      '' else '' \
-        timeout 600 'swaylock-bg' \
-        timeout 900 'swaymsg "output * dpms off"' resume 'swaymsg "output * dpms on"'
-      '');
+    Environment = "PATH=/run/current-system/sw/bin:${pkgs.sway}/bin";
+    ExecStart = if psCfg.paranoia.enable then ''
+      ${pkgs.swayidle}/bin/swayidle -w \
+      timeout 120 'swaymsg "output * dpms off"' \
+      timeout 150 'systemctl hibernate' \
+    '' else ''
+      ${pkgs.swayidle}/bin/swayidle -w \
+      timeout 600 'swaylock-bg' \
+      timeout 900 'swaymsg "output * dpms off"' \
+      resume 'swaymsg "output * dpms on"' \
+      before-sleep 'swaylock-bg'
+    '';
   };
   Install = {
     WantedBy = [ "sway-session.target" ];
diff --git a/modules/sway/waybar.service.nix b/modules/sway/waybar.service.nix
index 0237612f..98b8ed35 100644
--- a/modules/sway/waybar.service.nix
+++ b/modules/sway/waybar.service.nix
@@ -4,9 +4,8 @@
     Description = "Highly customizable Wayland bar for Sway and Wlroots based compositors.";
     Documentation = "https://github.com/Alexays/Waybar/wiki/";
     BindsTo = [ "sway-session.target" ];
-    After = [ "sway-session.target" "network-online.target" ];
+    After = [ "graphical-session-pre.target" "network-online.target" ];
     Wants = [ "graphical-session-pre.target" "network-online.target" "blueman-applet.service" ];
-    ConditionEnvironment = [ "WAYLAND_DISPLAY" ];
   };
 
   Service = {
diff --git a/modules/terminal-life/nvim/default.nix b/modules/terminal-life/nvim/default.nix
index 4df1892a..bc06943b 100644
--- a/modules/terminal-life/nvim/default.nix
+++ b/modules/terminal-life/nvim/default.nix
@@ -5,6 +5,66 @@ let
   xdg = config.home-manager.users."${psCfg.user.name}".xdg;
 
   preview-file = pkgs.writeShellScriptBin "preview-file" (import ./preview-file.nix pkgs);
+
+  vimagit-master = pkgs.vimUtils.buildVimPlugin {
+    name = "vimagit-master";
+    src = pkgs.fetchFromGitHub {
+      owner = "jreybert";
+      repo = "vimagit";
+      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
+      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
+    };
+  };
+
+  instant-nvim = pkgs.vimUtils.buildVimPlugin {
+    name = "instant";
+    src = pkgs.fetchFromGitHub {
+      owner = "jbyuki";
+      repo = "instant.nvim";
+      rev = "c02d72267b12130609b7ad39b76cf7f4a3bc9554";
+      sha256 = "sha256-7Pr2Au/oGKp5kMXuLsQY4BK5Wny9L1EBdXtyS5EaZPI=";
+    };
+  };
+
+  vim-caddyfile = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-caddyfile";
+    src = pkgs.fetchFromGitHub {
+      owner = "isobit";
+      repo = "vim-caddyfile";
+      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
+      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
+    };
+  };
+
+  workspace = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-workspace";
+    src = pkgs.fetchFromGitHub {
+      owner = "thaerkh";
+      repo = "vim-workspace";
+      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
+      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
+    };
+  };
+
+  beautify = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-beautify";
+    src = pkgs.fetchFromGitHub {
+      owner = "zeekay";
+      repo = "vim-beautify";
+      rev = "e0691483927dc5a0c051433602397419f9628623";
+      sha256 = "QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
+    };
+  };
+
+  apprentice = pkgs.vimUtils.buildVimPlugin {
+    name = "vim-apprentice";
+    src = pkgs.fetchFromGitHub {
+      owner = "romainl";
+      repo = "Apprentice";
+      rev = "ecd41698037f15a58125b349be76dbd2595bfb6d";
+      sha256 = "sha256-9s7Yzn3IEJBjcyUq9NBIQ9wb45Xr7jOkEIoWf0lAYYg=";
+    };
+  };
 in
 {
   enable = true;
@@ -48,7 +108,7 @@ in
     lsp_extensions-nvim
     nvim-lspconfig
 
-    instant-nvim-nvfetcher
+    instant-nvim
 
     ack-vim
     vim-airline
@@ -59,23 +119,23 @@ in
     syntastic
     vim-gutentags
     vim-vinegar
-    vim-workspace-nvfetcher
+    workspace
 
     sonokai
     vim-hybrid-material
     vim-airline-themes
-    vim-apprentice-nvfetcher
+    apprentice
 
     fugitive
     vim-gitgutter
     vim-rhubarb
-    vimagit-nvfetcher
+    vimagit-master
 
     fzf-vim
     fzfWrapper
     vim-highlightedyank
 
-    vim-beautify-nvfetcher
+    beautify
     vim-surround
 
     vim-bufkill
@@ -84,7 +144,7 @@ in
     ansible-vim
     emmet-vim
     rust-vim
-    vim-caddyfile-nvfetcher
+    vim-caddyfile
     vim-go
     vim-javascript
     vim-json
diff --git a/modules/terminal-life/zsh/default.nix b/modules/terminal-life/zsh/default.nix
index 36ec41ad..2db8bc41 100644
--- a/modules/terminal-life/zsh/default.nix
+++ b/modules/terminal-life/zsh/default.nix
@@ -39,30 +39,21 @@ in
     nixos-option = "nixos-option -I nixpkgs=${self}/lib/compat";
     myip = "dig +short myip.opendns.com @208.67.222.222 2>&1";
   };
-  plugins = [
-    # src gets fetched by nvfetcher, see: ./pkgs/sources.toml
-    {
-      # will source ohmyzsh/plugins/z/
-      name = "zsh-plugins-z";
-      file = "plugins/z/z.plugin.zsh";
-      src = pkgs.sources.ohmyzsh.src;
-    }
-    {
-      name = "zsh-powerlevel10k";
-      file = "powerlevel10k.zsh-theme";
-      src = pkgs.sources.powerlevel10k.src;
-    }
-    {
-      name = "zsh-fast-syntax-highlighting";
-      file = "F-Sy-H.plugin.zsh";
-      src = pkgs.sources.F-Sy-H.src;
-    }
-    {
-      name = "zsh-nix-shell";
-      file = "nix-shell.plugin.zsh";
-      src = pkgs.sources.zsh-nix-shell.src;
-    }
-  ];
+  zplug = {
+    enable = true;
+    plugins = [
+      {
+        name = "plugins/z";
+        tags = [ "from:oh-my-zsh" ];
+      }
+      {
+        name = "romkatv/powerlevel10k";
+        tags = [ "as:theme" "depth:1" ];
+      }
+      { name = "zdharma/fast-syntax-highlighting"; }
+      { name = "chisui/zsh-nix-shell"; }
+    ];
+  };
 
   initExtra = ''
     bindkey -v
diff --git a/modules/user/default.nix b/modules/user/default.nix
index 7c869380..2fd5958e 100644
--- a/modules/user/default.nix
+++ b/modules/user/default.nix
@@ -23,7 +23,7 @@ in
       };
       publicKeys = mkOption {
         description = "User SSH public keys";
-        type = types.listOf types.str;
+        type = types.listOf types.path;
         default = [ ];
       };
       fullName = mkOption {
diff --git a/overlays/neovim-plugins.nix b/overlays/neovim-plugins.nix
deleted file mode 100644
index b022049c..00000000
--- a/overlays/neovim-plugins.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-final: prev: {
-  vimPlugins = prev.vimPlugins // {
-    instant-nvim-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.instant-nvim-nvfetcher) pname version src;
-    };
-    vimagit-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vimagit-nvfetcher) pname version src;
-    };
-    vim-caddyfile-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vim-caddyfile-nvfetcher) pname version src;
-    };
-    vim-workspace-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vim-workspace-nvfetcher) pname version src;
-    };
-    vim-beautify-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vim-beautify-nvfetcher) pname version src;
-    };
-    vim-apprentice-nvfetcher = prev.vimUtils.buildVimPluginFrom2Nix {
-      inherit (prev.sources.vim-apprentice-nvfetcher) pname version src;
-    };
-  };
-}
diff --git a/overlays/rnix-lsp.nix b/overlays/rnix-lsp.nix
index f755d110..62c0f2b0 100644
--- a/overlays/rnix-lsp.nix
+++ b/overlays/rnix-lsp.nix
@@ -1,6 +1,13 @@
 final: prev: {
   rnix-lsp = prev.rnix-lsp.overrideAttrs (oldAttrs: rec {
-    inherit (prev.sources.rnix-lsp-nvfetcher) pname version src;
+    version = "unstable-2022-07-28";
+
+    src = prev.fetchFromGitHub {
+      owner = "nix-community";
+      repo = "rnix-lsp";
+      rev = "ff18e04551a39ccdab0ff9c83926db3807b23478";
+      sha256 = "sha256-4OIpATLdPQvryyhRQPELeqNYC0n6PCyjD6LCPdwOztc=";
+    };
 
     cargoDeps = oldAttrs.cargoDeps.overrideAttrs (prev.lib.const {
       name = "rnix-lsp-vendor.tar.gz";
diff --git a/pkgs/_sources/generated.nix b/pkgs/_sources/generated.nix
index 30bcbdef..71be3965 100644
--- a/pkgs/_sources/generated.nix
+++ b/pkgs/_sources/generated.nix
@@ -1,136 +1,16 @@
 # This file was generated by nvfetcher, please do not modify it manually.
-{ fetchgit, fetchurl, fetchFromGitHub }:
+{ fetchgit, fetchurl }:
 {
-  F-Sy-H = {
-    pname = "F-Sy-H";
-    version = "b935a87a75560f8173dd78deee6717c59d464e06";
-    src = fetchFromGitHub ({
-      owner = "z-shell";
-      repo = "F-Sy-H";
-      rev = "b935a87a75560f8173dd78deee6717c59d464e06";
-      fetchSubmodules = false;
-      sha256 = "sha256-448OlDnrDkUjvaSLDhXsa9bkgYXzj1Ju8CTpJVjH8LM=";
-    });
-  };
-  instant-nvim-nvfetcher = {
-    pname = "instant-nvim-nvfetcher";
-    version = "294b6d08143b3db8f9db7f606829270149e1a786";
-    src = fetchFromGitHub ({
-      owner = "jbyuki";
-      repo = "instant.nvim";
-      rev = "294b6d08143b3db8f9db7f606829270149e1a786";
-      fetchSubmodules = false;
-      sha256 = "sha256-DXJWji/NR8ZCxe014rD51v3EHJHMhRQeOoI3SsY8mR4=";
-    });
-  };
   manix = {
     pname = "manix";
     version = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
-    src = fetchFromGitHub ({
-      owner = "mlvzk";
-      repo = "manix";
+    src = fetchgit {
+      url = "https://github.com/mlvzk/manix";
       rev = "d08e7ca185445b929f097f8bfb1243a8ef3e10e4";
       fetchSubmodules = false;
-      sha256 = "sha256-GqPuYscLhkR5E2HnSFV4R48hCWvtM3C++3zlJhiK/aw=";
-    });
-  };
-  ohmyzsh = {
-    pname = "ohmyzsh";
-    version = "65a1e4edbe678cdac37ad96ca4bc4f6d77e27adf";
-    src = fetchFromGitHub ({
-      owner = "ohmyzsh";
-      repo = "ohmyzsh";
-      rev = "65a1e4edbe678cdac37ad96ca4bc4f6d77e27adf";
-      fetchSubmodules = false;
-      sha256 = "sha256-qyI7CU0vKhhADZfQtD73GsyAbqdMPhDQ1uA03h4erpw=";
-    });
-  };
-  powerlevel10k = {
-    pname = "powerlevel10k";
-    version = "8091c8a3a8a845c70046684235a01cd500075def";
-    src = fetchFromGitHub ({
-      owner = "romkatv";
-      repo = "powerlevel10k";
-      rev = "8091c8a3a8a845c70046684235a01cd500075def";
-      fetchSubmodules = false;
-      sha256 = "sha256-I0/tktXCbZ3hMYTNvPoWfOEYWRgmHoXsar/jcUB6bpo=";
-    });
-  };
-  rnix-lsp-nvfetcher = {
-    pname = "rnix-lsp-nvfetcher";
-    version = "6925256babec4307479a4080b44f2be38056f210";
-    src = fetchFromGitHub ({
-      owner = "nix-community";
-      repo = "rnix-lsp";
-      rev = "6925256babec4307479a4080b44f2be38056f210";
-      fetchSubmodules = false;
-      sha256 = "sha256-OKLyIXIXhUnRB3Xw+7zI3u6XkwF7Mrbfz1XaasV6i7Q=";
-    });
-  };
-  vim-apprentice-nvfetcher = {
-    pname = "vim-apprentice-nvfetcher";
-    version = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
-    src = fetchFromGitHub ({
-      owner = "romainl";
-      repo = "Apprentice";
-      rev = "9942d0bb0a5d82f7a24450b00051c1f2cc008659";
-      fetchSubmodules = false;
-      sha256 = "sha256-Xs+vTdnihNbBFPOKsW+NB40pqN9eaadqzc0DIeNoOFo=";
-    });
-  };
-  vim-beautify-nvfetcher = {
-    pname = "vim-beautify-nvfetcher";
-    version = "e0691483927dc5a0c051433602397419f9628623";
-    src = fetchFromGitHub ({
-      owner = "zeekay";
-      repo = "vim-beautify";
-      rev = "e0691483927dc5a0c051433602397419f9628623";
-      fetchSubmodules = false;
-      sha256 = "sha256-QPTCl6KaGcAjTS5yVDov9yxmv0fDaFoPLMsrtVIG6GQ=";
-    });
-  };
-  vim-caddyfile-nvfetcher = {
-    pname = "vim-caddyfile-nvfetcher";
-    version = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
-    src = fetchFromGitHub ({
-      owner = "isobit";
-      repo = "vim-caddyfile";
-      rev = "24fe0720551883e407cb70ae1d7c03f162d1d5a0";
-      fetchSubmodules = false;
-      sha256 = "sha256-rRYv3vnt31g7hNTxttTD6BWdv5JJ+ko3rPNyDUEOZ9o=";
-    });
-  };
-  vim-workspace-nvfetcher = {
-    pname = "vim-workspace-nvfetcher";
-    version = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
-    src = fetchFromGitHub ({
-      owner = "thaerkh";
-      repo = "vim-workspace";
-      rev = "c26b473f9b073f24bacecd38477f44c5cd1f5a62";
-      fetchSubmodules = false;
-      sha256 = "sha256-XV7opLyfkHIDO0+JJaO/x0za0gsHuklrzapTGdLHJmI=";
-    });
-  };
-  vimagit-nvfetcher = {
-    pname = "vimagit-nvfetcher";
-    version = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
-    src = fetchFromGitHub ({
-      owner = "jreybert";
-      repo = "vimagit";
-      rev = "308650ddc1e9a94e49fae0ea04bbc1c45f23d4c4";
-      fetchSubmodules = false;
-      sha256 = "sha256-fhazQQqyFaO0fdoeNI9nBshwTDhKNHH262H/QThtuO0=";
-    });
-  };
-  zsh-nix-shell = {
-    pname = "zsh-nix-shell";
-    version = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
-    src = fetchFromGitHub ({
-      owner = "chisui";
-      repo = "zsh-nix-shell";
-      rev = "af6f8a266ea1875b9a3e86e14796cadbe1cfbf08";
-      fetchSubmodules = false;
-      sha256 = "sha256-BjgMhILEL/qdgfno4LR64LSB8n9pC9R+gG7IQWwgyfQ=";
-    });
+      deepClone = false;
+      leaveDotGit = false;
+      sha256 = "1b7xi8c2drbwzfz70czddc4j33s7g1alirv12dwl91hbqxifx8qs";
+    };
   };
 }
diff --git a/pkgs/drone-docker-runner.nix b/pkgs/drone-docker-runner.nix
index e1773d5a..7d098536 100644
--- a/pkgs/drone-docker-runner.nix
+++ b/pkgs/drone-docker-runner.nix
@@ -6,7 +6,7 @@ self: with self; ''
         --env=DRONE_RPC_PROTO=$DRONE_RPC_PROTO \
         --env=DRONE_RPC_HOST=$DRONE_RPC_HOST \
         --env=DRONE_RPC_SECRET=$(${self.libsecret}/bin/secret-tool lookup drone rpc-secret) \
-        --env=DRONE_RUNNER_CAPACITY=8 \
+        --env=DRONE_RUNNER_CAPACITY=4 \
         --env=DRONE_RUNNER_NAME=$(${self.inetutils}/bin/hostname) \
         --publish=3000:3000 \
         --restart=always \
diff --git a/pkgs/sources.toml b/pkgs/sources.toml
index 5ec5e936..f7af168e 100644
--- a/pkgs/sources.toml
+++ b/pkgs/sources.toml
@@ -2,47 +2,3 @@
 [manix]
 src.git = "https://github.com/mlvzk/manix"
 fetch.github = "mlvzk/manix"
-
-[ohmyzsh]
-src.git = "https://github.com/ohmyzsh/ohmyzsh"
-fetch.github = "ohmyzsh/ohmyzsh"
-
-[powerlevel10k]
-src.git = "https://github.com/romkatv/powerlevel10k"
-fetch.github = "romkatv/powerlevel10k"
-
-[F-Sy-H]
-src.git = "https://github.com/z-shell/F-Sy-H"
-fetch.github = "z-shell/F-Sy-H"
-
-[zsh-nix-shell]
-src.git = "https://github.com/chisui/zsh-nix-shell"
-fetch.github = "chisui/zsh-nix-shell"
-
-[rnix-lsp-nvfetcher]
-src.git = "https://github.com/nix-community/rnix-lsp"
-fetch.github = "nix-community/rnix-lsp"
-
-[vimagit-nvfetcher]
-src.git = "https://github.com/jreybert/vimagit"
-fetch.github = "jreybert/vimagit"
-
-[instant-nvim-nvfetcher]
-src.git = "https://github.com/jbyuki/instant.nvim"
-fetch.github = "jbyuki/instant.nvim"
-
-[vim-caddyfile-nvfetcher]
-src.git = "https://github.com/isobit/vim-caddyfile"
-fetch.github = "isobit/vim-caddyfile"
-
-[vim-workspace-nvfetcher]
-src.git = "https://github.com/thaerkh/vim-workspace"
-fetch.github = "thaerkh/vim-workspace"
-
-[vim-beautify-nvfetcher]
-src.git = "https://github.com/zeekay/vim-beautify"
-fetch.github = "zeekay/vim-beautify"
-
-[vim-apprentice-nvfetcher]
-src.git = "https://github.com/romainl/Apprentice"
-fetch.github = "romainl/Apprentice"
diff --git a/pkgs/sway-service.nix b/pkgs/sway-service.nix
index 2ab84c62..f0b97ee7 100644
--- a/pkgs/sway-service.nix
+++ b/pkgs/sway-service.nix
@@ -1,6 +1,6 @@
 self: with self; ''
   # first import environment variables from the login manager
-  systemctl --user import-environment;
+  systemctl --user import-environment
   # then start the service
   exec systemctl --wait --user start sway.service
 ''
diff --git a/pkgs/swaylock-bg.nix b/pkgs/swaylock-bg.nix
index 75bcd7de..b55c32ae 100644
--- a/pkgs/swaylock-bg.nix
+++ b/pkgs/swaylock-bg.nix
@@ -3,17 +3,18 @@ self: with self; ''
   # swaylock
 
   # Make sure we aren't running twice
-  RUNNING=$(${procps}/bin/pgrep -c ${swaylock}/bin/swaylock)
-  if [ "$RUNNING" -ne 0 ]; then
+  RUNNING=$(ps -A | grep swaylock | wc -l)
+  if [ $RUNNING -ne 0 ]; then
     exit 0
   fi
 
-  IMAGE="$XDG_CONFIG_HOME/wallpaper.jpg"
+  IMAGE=$XDG_CONFIG_HOME/wallpaper.jpg
   LOCKARGS=""
 
-  for OUTPUT in $(${sway}/bin/swaymsg -t get_outputs | ${jq}/bin/jq -r '.[].name')
+  for OUTPUT in `${sway}/bin/swaymsg -t get_outputs | jq -r '.[].name'`
   do
       LOCKARGS="''${LOCKARGS} --image ''${OUTPUT}:''${IMAGE}"
+      IMAGES="''${IMAGES} ''${IMAGE}"
   done
   exec ${swaylock}/bin/swaylock $LOCKARGS
 ''
diff --git a/profiles/base-user/default.nix b/profiles/base-user/default.nix
index 374dca40..9ff21c8e 100644
--- a/profiles/base-user/default.nix
+++ b/profiles/base-user/default.nix
@@ -25,7 +25,7 @@ in
       ];
       initialHashedPassword = if psCfg.user.password != null then psCfg.user.password else "";
       shell = pkgs.zsh;
-      openssh.authorizedKeys.keys = if psCfg.user.publicKeys != null then psCfg.user.publicKeys else [ ];
+      openssh.authorizedKeys.keyFiles = if psCfg.user.publicKeys != null then psCfg.user.publicKeys else [ ];
     };
   };
 }
diff --git a/profiles/base-user/session-variables.nix b/profiles/base-user/session-variables.nix
index e922781b..5bbfa8ee 100644
--- a/profiles/base-user/session-variables.nix
+++ b/profiles/base-user/session-variables.nix
@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, ... }:
 let
   psCfg = config.pub-solar;
   wlroots = psCfg.graphical.wayland;
@@ -77,22 +77,10 @@ let
     # TELEMETRY BS
     VUEDX_TELEMETRY = "off";
   };
-
-  envListNames = lib.attrsets.mapAttrsToList (name: value: name) variables;
-
-  # Here we merge an extra variable into the attrset called FULL_ENV_LIST.
-  # It's a list of the variable names defined above.
-  # We can use this to tell `systemctl import-environment` to import the full list above.
-  variablesWithMeta = lib.attrsets.zipAttrsWith (name: values: builtins.head values) [
-    variables
-    { IMPORT_ENVIRONMENT_ENV_LIST = lib.lists.foldl (a: b: a + " " + b) "IMPORT_ENVIRONMENT_ENV_LIST" envListNames; }
-  ];
 in
 {
   home-manager = pkgs.lib.setAttrByPath [ "users" psCfg.user.name ] {
-    home.sessionVariables = variablesWithMeta;
-    systemd.user.sessionVariables = variablesWithMeta;
+    home.sessionVariables = variables;
+    systemd.user.sessionVariables = variables;
   };
-
-  environment.variables = variablesWithMeta;
 }
diff --git a/shell/devos.nix b/shell/devos.nix
index 382a6d34..bd3399a1 100644
--- a/shell/devos.nix
+++ b/shell/devos.nix
@@ -6,7 +6,7 @@ let
     cachix
     editorconfig-checker
     mdbook
-    nix
+    nixUnstable
     nixpkgs-fmt
     nvfetcher
     ;
@@ -28,6 +28,21 @@ in
   # override for our own welcome
   devshell.name = pkgs.lib.mkForce "PubSolarOS";
 
+  # tempfix: remove when merged https://github.com/numtide/devshell/pull/123
+  devshell.startup.load_profiles = pkgs.lib.mkForce (pkgs.lib.noDepEntry ''
+    # PATH is devshell's exorbitant privilige:
+    # fence against its pollution
+    _PATH=''${PATH}
+    # Load installed profiles
+    for file in "$DEVSHELL_DIR/etc/profile.d/"*.sh; do
+      # If that folder doesn't exist, bash loves to return the whole glob
+      [[ -f "$file" ]] && source "$file"
+    done
+    # Exert exorbitant privilige and leave no trace
+    export PATH=''${_PATH}
+    unset _PATH
+  '');
+
   commands = with pkgs; [
     (devos nix)
     (devos agenix)
diff --git a/tests/first-test.nix b/tests/first-test.nix
deleted file mode 100644
index 251779a1..00000000
--- a/tests/first-test.nix
+++ /dev/null
@@ -1,87 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  name = "firstTest";
-
-  nodes.test-machine = { suites ? null, ... }: {
-    imports = suites.iso;
-
-    home-manager.users.pub-solar.programs.zsh.shellAliases = {
-      test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
-      test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
-    };
-
-    # source: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/tests/sway.nix
-    environment = {
-      # For glinfo and wayland-info:
-      systemPackages = with pkgs; [ mesa-demos wayland-utils alacritty ];
-      # Use a fixed SWAYSOCK path (for swaymsg):
-      variables = {
-        "SWAYSOCK" = "/tmp/sway-ipc.sock";
-        # TODO: Investigate if we can get hardware acceleration to work (via
-        # virtio-gpu and Virgil). We currently have to use the Pixman software
-        # renderer since the GLES2 renderer doesn't work inside the VM (even
-        # with WLR_RENDERER_ALLOW_SOFTWARE):
-        # "WLR_RENDERER_ALLOW_SOFTWARE" = "1";
-        "WLR_RENDERER" = "pixman";
-      };
-
-      # To help with OCR:
-      etc."xdg/foot/foot.ini".text = lib.generators.toINI { } {
-        main = {
-          font = "inconsolata:size=14";
-        };
-        colors = rec {
-          foreground = "000000";
-          background = "ffffff";
-          regular2 = foreground;
-        };
-      };
-    };
-
-    fonts.fonts = [ pkgs.inconsolata ];
-
-    # Need to switch to a different GPU driver than the default one (-vga std) so that Sway can launch:
-    virtualisation.qemu.options = [ "-vga none -device virtio-gpu-pci" ];
-    virtualisation.cores = 4;
-    virtualisation.memorySize = 2048;
-  };
-
-  enableOCR = true;
-
-  testScript = ''
-    import shlex
-    def swaymsg(command: str, succeed=True):
-        with machine.nested(f"sending swaymsg {command!r}" + " (allowed to fail)" * (not succeed)):
-          (machine.succeed if succeed else machine.execute)(
-            f"su - pub-solar -c {shlex.quote('swaymsg -- ' + command)}"
-          )
-
-
-    machine.wait_for_unit("multi-user.target")
-
-    # To check the version:
-    print(machine.succeed("sway --version"))
-
-    # Wait for Sway to complete startup:
-    machine.wait_for_file("/run/user/1000/wayland-1")
-    machine.wait_for_file("/tmp/sway-ipc.sock")
-
-    # Start a terminal (foot) on workspace 3:
-    machine.wait_for_text("1")
-    machine.send_key("meta_l-3")
-    machine.sleep(3)
-    machine.send_key("meta_l-ret")
-    machine.sleep(10)
-    machine.send_chars("whoami\n")
-    machine.sleep(3)
-    machine.wait_for_text("pub-solar")
-    machine.send_chars("test-wayland\n")
-    machine.wait_for_file("/tmp/test-wayland-exit-ok")
-    print(machine.succeed("cat /tmp/test-wayland.out"))
-    machine.copy_from_vm("/tmp/test-wayland.out")
-    machine.sleep(3)
-    machine.screenshot("foot_wayland_info")
-    machine.send_key("meta_l-shift-q")
-    machine.wait_until_fails("pgrep foot")
-  '';
-}
diff --git a/tests/second-test.nix b/tests/second-test.nix
deleted file mode 100644
index d6409820..00000000
--- a/tests/second-test.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ }:
-{
-  name = "secondTest";
-
-  nodes.test-machine2 = { suites ? null, ... }: {
-    imports = [
-      suites.iso
-    ];
-  };
-
-  testScript = ''
-    machines[0].systemctl("is-system-running --wait")
-  '';
-}