diff --git a/hmModules/foot/default.nix b/hmModules/foot/default.nix
index 711a455..8fff506 100644
--- a/hmModules/foot/default.nix
+++ b/hmModules/foot/default.nix
@@ -9,17 +9,18 @@
     settings = {
       main = {
         term = "xterm-256color";
-
-        font = "Fira Code:size=11";
+        login-shell = "yes";
+        font = "Fira Code,Symbols Nerd Font,JoyPixels";
         dpi-aware = "yes";
       };
 
       mouse = {
         hide-when-typing = "yes";
       };
+
+      colors = {
+        background = "282C34";
+      };
     };
   };
-
-  # without `--login-shell` PATH isn't well configured (it's inherited from the "systemd shell")
-  systemd.user.services.foot.Service.ExecStart = lib.mkForce "${config.programs.foot.package}/bin/foot --server  --login-shell";
 }
diff --git a/hmModules/helix/default.nix b/hmModules/helix/default.nix
new file mode 100644
index 0000000..ead0fc4
--- /dev/null
+++ b/hmModules/helix/default.nix
@@ -0,0 +1,21 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  programs.helix = {
+    enable = true;
+    settings = {
+      theme = "onedark";
+      editor = {
+        indent-guides.render = true;
+        cursor-shape = {
+          insert = "bar";
+          normal = "block";
+          select = "underline";
+        };
+      };
+    };
+  };
+}
diff --git a/hmModules/shell/default.nix b/hmModules/shell/default.nix
index 0098c53..e554dec 100644
--- a/hmModules/shell/default.nix
+++ b/hmModules/shell/default.nix
@@ -62,6 +62,8 @@
       "cat" = "bat";
       "emw" = "emacsclient -c";
       "emnw" = "emacsclient -c -nw";
+      "pass-clone" = "[ -d .password-store ] && echo 'Password store archive already exists' || git clone git@git.sr.ht:~zrsk/pass ~/.password-store";
+      "getpass" = "pass show $(find .password-store/ -name \"*.gpg\" | sed \"s/\\.password-store\\/\\(.*\\)\\.gpg$/\\1/g\" | fzf) | wl-copy; ((sleep 60 && wl-copy --clear) &)";
     };
     localVariables = {
       PASSWORD_STORE_DIR = "/home/ccr/.password-store";
@@ -83,5 +85,27 @@
     enableZshIntegration = true;
   };
 
+  systemd.user.services.nix-index-update = {
+    Unit = {Description = "Update nix-index";};
+
+    Service = {
+      CPUSchedulingPolicy = "idle";
+      IOSchedulingClass = "idle";
+      ExecStart = "${pkgs.nix-index}/bin/nix-index --path ${config.programs.password-store.settings.PASSWORD_STORE_DIR}";
+    };
+  };
+
+  systemd.user.timers.nix-index-update = {
+    Unit = {Description = "Update nix-index";};
+
+    Timer = {
+      Unit = "nix-index-update.service";
+      OnCalendar = "OnCalendar=monday  *-*-* 10:00:00";
+      Persistent = true;
+    };
+
+    Install = {WantedBy = ["timers.target"];};
+  };
+
   home.packages = with pkgs; [thefuck];
 }
diff --git a/hmModules/sway/default.nix b/hmModules/sway/default.nix
index f213c90..bbb8599 100644
--- a/hmModules/sway/default.nix
+++ b/hmModules/sway/default.nix
@@ -22,7 +22,7 @@
 
     gtk = {
       enable = true;
-      font.name = "DejaVu Sans";
+      font.name = "Fira Code,Symbols Nerd Font";
       iconTheme = {
         name = "Adwaita";
         package = pkgs.gnome.adwaita-icon-theme;
diff --git a/hmModules/sway/style.css b/hmModules/sway/style.css
index 5e3bf32..9223797 100644
--- a/hmModules/sway/style.css
+++ b/hmModules/sway/style.css
@@ -1,6 +1,6 @@
 * {
     border: none;
-    font-family: "Fira Code";
+    font-family: "Fira Code, Symbols Nerd Font";
     font-weight: bold;
     font-size: 9pt;
     min-height: 0;
diff --git a/hmModules/sway/waybar.nix b/hmModules/sway/waybar.nix
index 57f30e5..f30fc9b 100644
--- a/hmModules/sway/waybar.nix
+++ b/hmModules/sway/waybar.nix
@@ -15,13 +15,13 @@
         modules-center = ["sway/window"];
         modules-right = [
           "tray"
+          "pulseaudio"
           "network"
           "cpu"
           "memory"
-          "pulseaudio"
-          "clock"
-          "backlight"
+          "temperature"
           "battery"
+          "clock"
         ];
 
         "sway/workspaces" = {
@@ -32,36 +32,61 @@
         "sway/mode" = {tooltip = false;};
 
         "sway/window" = {max_length = 50;};
-
-        pulseaudio = {
-          format = "vol {volume}%";
-          on-click-middle = "${pkgs.sway}/bin/swaymsg exec \"${pkgs.pavucontrol}/bin/pavucontrol\"";
+        tray = {
+          spacing = "1px";
         };
-
-        network = {
-          format-wifi = "{essid} {signalStrength}% {bandwidthUpBits} {bandwidthDownBits}";
-          format-ethernet = "{ifname} eth {bandwidthUpBits} {bandwidthDownBits}";
-        };
-
-        cpu = {
-          interval = 2;
-          format = "{icon} {usage}";
-        };
-
-        memory.format = "mem {}%";
-
-        backlight = {
-          format = "nit {percent}%";
-          on-scroll-up = "${pkgs.brightnessctl}/bin/brightnessctl s +5%";
-          on-scroll-down = "${pkgs.brightnessctl}/bin/brightnessctl s 5%-";
-        };
-
-        tray.spacing = 10;
-
-        clock.format = "{:%a %b %d %H:%M}";
-
         battery = {
-          format = "bat {}";
+          format = "{capacity}% {icon}";
+          format-alt = "{time} {icon}";
+          format-charging = "{capacity}% ";
+          format-icons = ["" "" "" "" ""];
+          format-plugged = "{capacity}% ";
+          states = {
+            critical = 15;
+            warning = 30;
+          };
+        };
+        clock = {
+          format-alt = "{:%Y-%m-%d}";
+          tooltip-format = "{:%Y-%m-%d | %H:%M}";
+        };
+        cpu = {
+          format = "{usage}% ";
+          tooltip = false;
+        };
+        memory = {format = "{}% ";};
+        network = {
+          interval = 1;
+          format-alt = "{ifname}: {ipaddr}/{cidr}";
+          format-disconnected = "Disconnected ⚠";
+          format-ethernet = "{ifname}: {ipaddr}/{cidr}   up: {bandwidthUpBits} down: {bandwidthDownBits}";
+          format-linked = "{ifname} (No IP) ";
+          format-wifi = "{essid} ({signalStrength}%) ";
+        };
+        pulseaudio = {
+          format = "{volume}% {icon} {format_source}";
+          format-bluetooth = "{volume}% {icon} {format_source}";
+          format-bluetooth-muted = " {icon} {format_source}";
+          format-icons = {
+            car = "";
+            default = ["" "" ""];
+            handsfree = "";
+            headphones = "";
+            headset = "";
+            phone = "";
+            portable = "";
+          };
+          format-muted = " {format_source}";
+          format-source = "{volume}% ";
+          format-source-muted = "";
+          on-click = "${pkgs.pavucontrol}/bin/pavucontrol";
+        };
+        "sway/mode" = {format = ''<span style="italic">{}</span>'';};
+        temperature = {
+          critical-threshold = 80;
+          format = "{temperatureC}°C {icon}";
+          format-icons = ["" "" ""];
+          hwmon-path = "/sys/class/thermal/thermal_zone4/temp";
         };
       };
     };
diff --git a/hosts/beebox/default.nix b/hosts/beebox/default.nix
new file mode 100644
index 0000000..d99b8b1
--- /dev/null
+++ b/hosts/beebox/default.nix
@@ -0,0 +1,23 @@
+{
+  fleetModules,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports =
+    [
+      ./hardware-configuration.nix
+    ]
+    ++ fleetModules [
+      "common"
+      "ssh"
+      "ccr"
+      "audio"
+      "dbus"
+      "bluetooth"
+      "kodi"
+      "udisks2"
+    ];
+
+  ccr.enable = true;
+}
diff --git a/hosts/beebox/hardware-configuration.nix b/hosts/beebox/hardware-configuration.nix
new file mode 100644
index 0000000..5ea0dce
--- /dev/null
+++ b/hosts/beebox/hardware-configuration.nix
@@ -0,0 +1,60 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-intel"];
+  boot.extraModulePackages = [];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "f2fs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "vfat";
+  };
+
+  swapDevices = [
+    {device = "/dev/disk/by-label/swap";}
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking = {
+    useDHCP = false;
+    interfaces.wlp1s0.useDHCP = true;
+    networkmanager.enable = true;
+  };
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+
+  hardware.opengl = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver # LIBVA_DRIVER_NAME=iHD
+      vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
+      vaapiVdpau
+      libvdpau-va-gl
+    ];
+  };
+}
diff --git a/hosts/hs/default.nix b/hosts/hs/default.nix
index 4c11ec2..e771feb 100644
--- a/hosts/hs/default.nix
+++ b/hosts/hs/default.nix
@@ -2,6 +2,7 @@
   fleetModules,
   pkgs,
   lib,
+  config,
   ...
 }: {
   imports =
@@ -128,7 +129,7 @@
 
     transmission = {
       enable = true;
-      # the following json is merged to this attrset, it must have `rpc-username` and `rpc-password`
+      # following json is merged to this attrset, it must have `rpc-username` and `rpc-password`
       credentialsFile = "/mnt/archivio/transmission/credentials.json";
       settings = {
         download-dir = "/mnt/archivio/transmission/";
@@ -295,11 +296,13 @@
       4712 # amule
       4711 # amule web gui
       8384 # syncthing
+      53 # dns
     ];
     allowedUDPPorts = [
       137 # samba
       138 # samba
       51820 # wireguard
+      53 # dns
     ];
   };
 
@@ -360,4 +363,35 @@
   };
 
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+
+  # TODO move away
+  networking.nameservers = [
+    # https://libreops.cc/radicaldns.html
+    "88.198.92.222"
+    "192.71.166.92"
+  ];
+
+  #environment.etc."coredns/blocklist.hosts".source = ../blocklist.hosts;
+
+  services.coredns = {
+    enable = true;
+    config = ''
+      . {
+        # RadicalDNS Forwarding
+        forward . 88.198.92.222 192.71.166.92
+        cache
+      }
+
+      ccr.ydns.eu {
+          template IN A  {
+            answer "{{ .Name }} 0 IN A 192.168.1.33"
+          }
+      }
+      *.ccr.ydns.eu {
+          template IN A  {
+            answer "{{ .Name }} 0 IN A 192.168.1.33"
+          }
+      }
+    '';
+  };
 }
diff --git a/hosts/thinkpad/default.nix b/hosts/thinkpad/default.nix
index f450234..9a9e038 100644
--- a/hosts/thinkpad/default.nix
+++ b/hosts/thinkpad/default.nix
@@ -50,6 +50,7 @@
       "discord"
       "cura"
       "xdg"
+      "helix"
     ];
     packages = with pkgs; [
       comma
diff --git a/modules/fonts/default.nix b/modules/fonts/default.nix
index f5b871d..fb547ae 100644
--- a/modules/fonts/default.nix
+++ b/modules/fonts/default.nix
@@ -1,9 +1,10 @@
 {pkgs, ...}: {
   fonts = {
-    fonts = with pkgs; [powerline-fonts dejavu_fonts fira-code fira-code-symbols emacs-all-the-icons-fonts];
+    fonts = with pkgs; [powerline-fonts dejavu_fonts fira-code fira-code-symbols emacs-all-the-icons-fonts nerdfonts joypixels];
     fontconfig.defaultFonts = {
       monospace = ["DejaVu Sans Mono for Powerline"];
       sansSerif = ["DejaVu Sans"];
     };
   };
+  nixpkgs.config.joypixels.acceptLicense = true;
 }
diff --git a/modules/kodi/default.nix b/modules/kodi/default.nix
new file mode 100644
index 0000000..b3e89c1
--- /dev/null
+++ b/modules/kodi/default.nix
@@ -0,0 +1,78 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  services.xserver = {
+    enable = true;
+    desktopManager.kodi = {
+      enable = true;
+      package = pkgs.kodi.withPackages (ps:
+        with ps; [
+          joystick
+          youtube
+          libretro
+          libretro-mgba
+        ]);
+    };
+    displayManager.autoLogin = {
+      enable = true;
+      user = "kodi";
+    };
+  };
+
+  users.extraUsers.kodi = {
+    isNormalUser = true;
+    uid = 1002;
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [8080];
+    allowedUDPPorts = [8080];
+  };
+
+  environment.systemPackages = with pkgs; [xboxdrv cifs-utils];
+  fileSystems."/mnt/film" = {
+    device = "//ccr.ydns.eu/film";
+    fsType = "cifs";
+    options = let
+      credentials = pkgs.writeText "credentials" ''
+        username=guest
+        password=
+      '';
+    in ["credentials=${credentials},x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"];
+  };
+  fileSystems."/mnt/archivio" = {
+    device = "//ccr.ydns.eu/archivio";
+    fsType = "cifs";
+    options = let
+      credentials = pkgs.writeText "credentials" ''
+        username=guest
+        password=
+      '';
+    in ["credentials=${credentials},x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s"];
+  };
+
+  systemd.services.xboxdrv = {
+    wantedBy = ["multi-user.target"];
+    after = ["network.target"];
+    serviceConfig = {
+      Type = "forking";
+      User = "root";
+      ExecStart = ''${pkgs.xboxdrv}/bin/xboxdrv --daemon --detach --pid-file /var/run/xboxdrv.pid --dbus disabled --silent --deadzone 4000 --deadzone-trigger 10% --mimic-xpad-wireless'';
+    };
+  };
+
+  services.xserver.config = ''
+    Section "InputClass"
+         Identifier "joystick catchall"
+         MatchIsJoystick "on"
+         MatchDevicePath "/dev/input/event*"
+     Driver "evdev"
+         Option "StartKeysEnabled" "False"
+         Option "StartMouseEnabled" "False"
+    EndSection
+  '';
+  boot.blacklistedKernelModules = ["xpad"];
+}
diff --git a/modules/nix/default.nix b/modules/nix/default.nix
index fc74066..aebd401 100644
--- a/modules/nix/default.nix
+++ b/modules/nix/default.nix
@@ -41,7 +41,7 @@
   system.activationScripts = {
     populate-netrc.text = ''
       cat <<EOF> /etc/nix/netrc
-      machine mlabs.cachix.org login "" password "$(cat ${config.age.secrets.mlabs-cachix.path})"
+      machine mlabs.cachix.org login x password "$(cat ${config.age.secrets.mlabs-cachix.path})"
       EOF
     '';
   };
diff --git a/utils/default.nix b/utils/default.nix
index fc73aae..8341b21 100644
--- a/utils/default.nix
+++ b/utils/default.nix
@@ -64,6 +64,10 @@
       system = supportedSystems.aarch64-linux;
       modules = ["${nixosHardware}/pine64/pinebook-pro"];
     };
+    beebox = mkConfiguration {
+      name = "beebox";
+      system = supportedSystems.x86_64-linux;
+    };
   };
 
   mkVmApp = system: configuration: let