Gentoo desktop

56 files changed, 262 insertions, 294 deletions

diff --git a/hosts/moyo/conf.d/dmcrypt b/hosts/moyo/conf.d/dmcrypt
new file mode 100644
index 0000000..d4179cd
--- /dev/null
+++ b/hosts/moyo/conf.d/dmcrypt
@@ -0,0 +1,67 @@
+# /etc/conf.d/dmcrypt
+
+# For people who run dmcrypt on top of some other layer (like raid),
+# use rc_need to specify that requirement.  See the runscript(8) man
+# page for more information.
+
+#--------------------
+# Instructions
+#--------------------
+
+# Note regarding the syntax of this file.  This file is *almost* bash,
+# but each line is evaluated separately.  Separate swaps/targets can be
+# specified.  The init-script which reads this file assumes that a
+# swap= or target= line starts a new section, similar to lilo or grub
+# configuration.
+
+# Note when using gpg keys and /usr on a separate partition, you will
+# have to copy /usr/bin/gpg to /bin/gpg so that it will work properly
+# and ensure that gpg has been compiled statically.
+# See http://bugs.gentoo.org/90482 for more information.
+
+# Note that the init-script which reads this file detects whether your
+# partition is LUKS or not. No mkfs is run unless you specify a makefs
+# option.
+
+# Global options:
+#----------------
+
+# How long to wait for each timeout (in seconds).
+dmcrypt_key_timeout=1
+
+# Max number of checks to perform (see dmcrypt_key_timeout).
+#dmcrypt_max_timeout=300
+
+# Number of password retries.
+dmcrypt_retries=10
+
+# Arguments:
+#-----------
+# target=<name>                      == Mapping name for partition.
+# swap=<name>                        == Mapping name for swap partition.
+# source='<dev>'                     == Real device for partition.
+#                                    Note: You can (and should) specify a tag like UUID
+#                                    for blkid (see -t option).  This is safer than using
+#                                    the full path to the device.
+# key='</path/to/keyfile>[:<mode>]'  == Fullpath from / or from inside removable media.
+# header='</path/to/header>'         == Full path to detached LUKS header file.
+# remdev='<dev>'                     == Device that will be assigned to removable media.
+# gpg_options='<opts>'               == Default are --quiet --decrypt
+# options='<opts>'                   == cryptsetup, for LUKS you can only use --readonly
+# loop_file='<file>'                 == Loopback file.
+#                                    Note: If you omit $source, then a free loopback will
+#                                    be looked up automatically.
+# pre_mount='cmds'                   == commands to execute before mounting partition.
+# post_mount='cmds'                  == commands to execute after mounting partition.
+# wait=5                             == wait given amount of seconds for source or
+#                                       detached header file appear.
+#-----------
+# Supported Modes
+# gpg					== decrypt and pipe key into cryptsetup.
+#						Note: new-line character must not be part of key.
+#						Command to erase \n char: 'cat key | tr -d '\n' > cleanKey'
+
+target=store
+source=UUID="b68bd1f0-912f-42f8-8d35-35db086ae323"
+
+# The file must be terminated by a newline.  Or leave this comment last.
diff --git a/hosts/moyo/conf.d/hostname b/hosts/moyo/conf.d/hostname
new file mode 100644
index 0000000..19f60ac
--- /dev/null
+++ b/hosts/moyo/conf.d/hostname
@@ -0,0 +1,2 @@
+# Hostname fallback if /etc/hostname does not exist
+hostname="moyo"
diff --git a/hosts/moyo/container.nix b/hosts/moyo/container.nix
deleted file mode 100644
index 23e7b02..0000000
--- a/hosts/moyo/container.nix
+++ /dev/null
@@ -1,97 +0,0 @@
-{ config, lib, pkgs, modulesPath, ... }: {
-  imports = [
-    "${modulesPath}/virtualisation/lxc-container.nix"
-  ];
-
-  boot.isContainer = true;
-
-  nix = {
-    settings = {
-      experimental-features = [ "nix-command" "flakes" ];
-      auto-optimise-store = true;
-      download-buffer-size = 134217728;
-    };
-    gc.automatic = false;
-    optimise.automatic = true;
-  };
-
-  nixpkgs.config.allowUnfree = true;
-  hardware.enableRedistributableFirmware = true;
-
-  users.users.andrew = {
-    isNormalUser = true;
-    uid = 1000;
-    extraGroups = [ "wheel" ];
-  };
-  nix.settings.trusted-users = [ "andrew" ];
-
-  nix.settings.system-features = [ "gccarch-znver1" ];
-  nixpkgs.hostPlatform = {
-    #gcc.arch = "znver1";
-    #gcc.tune = "znver1";
-    system = "x86_64-linux";
-  };
-
-  time.timeZone = "America/New_York";
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  networking = {
-    hostName = "the-p";
-    useDHCP = false;
-    dhcpcd.enable = false;
-    useHostResolvConf = false;
-    wireless.enable = false;
-    firewall = {
-      enable = false;
-      allowedTCPPorts = [ 22 25565 ];
-      allowedUDPPorts = [ ];
-    };
-  };
-
-  systemd.network = {
-    enable = true;
-    networks."50-eth0" = {
-      matchConfig.Name = "eth0";
-      networkConfig = {
-        DHCP = "ipv4";
-        IPv6AcceptRA = true;
-      };
-      linkConfig.RequiredForOnline = "routable";
-    };
-  };
-
-  users.defaultUserShell = pkgs.bashInteractive;
-
-  programs.screen = {
-    enable = true;
-    screenrc = ''
-      termcapinfo xterm* ti@:te@
-    '';
-  };
-
-  environment.systemPackages = with pkgs; [
-    git # flakes
-    kitty.terminfo
-    htop
-    jq
-    ((vim-full.override {
-      features = "small";
-      guiSupport = "off";
-      luaSupport = false;
-      pythonSupport = false;
-      rubySupport = false;
-      cscopeSupport = false;
-      netbeansSupport = false;
-      ximSupport = false;
-      ftNixSupport = false;
-      sodiumSupport = false;
-    }).customize {
-      name = "vi";
-      vimrcConfig = { customRC = ""; };
-    })
-    #jdk23
-    graalvm-ce
-  ];
-
-  system.stateVersion = "25.05";
-}
diff --git a/hosts/moyo/gentoo/make.conf b/hosts/moyo/gentoo/make.conf
index 9ee18b9..0873043 100644
--- a/hosts/moyo/gentoo/make.conf
+++ b/hosts/moyo/gentoo/make.conf
@@ -1,37 +1,46 @@
 WARNING_FLAGS="-Werror=odr -Werror=lto-type-mismatch -Werror=strict-aliasing"
-COMMON_FLAGS="-O2 -pipe -march=znver1 -mtune=znver1 -fno-semantic-interposition -flto ${WARNING_FLAGS}"
+COMMON_FLAGS="-O2 -pipe -march=znver1 -mtune=znver1 -fno-semantic-interposition -fomit-frame-pointer -fno-stack-protector -flto ${WARNING_FLAGS}"
 
 CFLAGS="${COMMON_FLAGS}"
 CXXFLAGS="${COMMON_FLAGS}"
 FCFLAGS="${COMMON_FLAGS}"
 FFLAGS="${COMMON_FLAGS}"
+LDFLAGS="${COMMON_FLAGS} ${LDFLAGS} ${WARNING_FLAGS}"
 
 CGO_CFLAGS="${COMMON_FLAGS}"
 CGO_CXXFLAGS="${COMMON_FLAGS}"
 CGO_FFLAGS="${COMMON_FLAGS}"
 CGO_LDFLAGS="${LDFLAGS}"
 
-RUSTFLAGS="-C opt-level=2 -C target-cpu=znver1"
+RUSTFLAGS="${RUSTFLAGS} -C target-cpu=znver1"
 
-MAKEOPTS="-j4"
+MAKEOPTS="-j4 -l5"
+#EMERGE_DEFAULT_OPTS="--jobs 2 --with-bdeps-auto=n"
 EMERGE_DEFAULT_OPTS="--jobs 2"
 
 RUBY_TARGETS="ruby32"
 
+PERL_FEATURES=""
+
 LUA_SINGLE_TARGET="lua5-4"
 LUA_TARGETS="lua5-4"
 
-KERNEL="linux"
-
 ACCEPT_KEYWORDS="amd64"
-ACCEPT_LICENSE="-* @FREE @BINARY-REDISTRIBUTABLE"
+ACCEPT_LICENSE="-* @FREE"
 
-USE="lto pgo orc native-extensions dbus udev policykit acl -systemd -consolekit -X -wayland -gtk -gnome -kde -qt5 -qt6 -alsa -jack -pulseaudio -bluetooth -introspection -nls -numa -selinux -caps -filecaps -sysprof -pie -pic -unwind -ssp -hardened -sanitize -debug -cpudetection"
+USE="modules-compress lto pgo orc \
+    -numa -selinux -sysprof -pie -pic -unwind -ssp -cet -hardened -sanitize -debug \
+    -policykit -consolekit -systemd -nls -introspection -vala \
+    -X -wayland -gtk -qt5 -qt6 -gnome -kde \
+    -dbus -bluetooth -alsa -jack -pulseaudio -pipewire"
 
 GRUB_PLATFORMS="efi-64"
 
-VIDEO_CARDS="amdgpu radeonsi"
 INPUT_DEVICES="keyboard"
 
-L10N="en"
-LC_MESSAGES=C.utf8
+L10N="en en-US"
+LC_MESSAGES="C.utf8"
+
+GENTOO_MIRRORS="https://gentoo.osuosl.org/ \
+    https://mirror.servaxnet.com/gentoo/ \
+    http://gentoo-mirror.flux.utah.edu/"
diff --git a/hosts/moyo/gentoo/package.accept_keywords/cowsql b/hosts/moyo/gentoo/package.accept_keywords/cowsql
deleted file mode 100644
index 744c16e..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/cowsql
+++ /dev/null
@@ -1 +0,0 @@
-dev-libs/cowsql ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/foot-terminfo b/hosts/moyo/gentoo/package.accept_keywords/foot-terminfo
deleted file mode 100644
index c42d2a9..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/foot-terminfo
+++ /dev/null
@@ -1 +0,0 @@
-gui-apps/foot-terminfo ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/incus b/hosts/moyo/gentoo/package.accept_keywords/incus
deleted file mode 100644
index 5fae8e1..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/incus
+++ /dev/null
@@ -1 +0,0 @@
-app-containers/incus ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/megatools b/hosts/moyo/gentoo/package.accept_keywords/megatools
deleted file mode 100644
index 9b81e46..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/megatools
+++ /dev/null
@@ -1 +0,0 @@
-net-misc/megatools ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/qemu b/hosts/moyo/gentoo/package.accept_keywords/qemu
deleted file mode 100644
index 0d5a3eb..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/qemu
+++ /dev/null
@@ -1 +0,0 @@
-app-emulation/qemu ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/samba b/hosts/moyo/gentoo/package.accept_keywords/samba
deleted file mode 100644
index 90d7b6d..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/samba
+++ /dev/null
@@ -1 +0,0 @@
-net-fs/samba ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/seabios-bin b/hosts/moyo/gentoo/package.accept_keywords/seabios-bin
deleted file mode 100644
index 02519e6..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/seabios-bin
+++ /dev/null
@@ -1 +0,0 @@
-sys-firmware/seabios-bin ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/talloc b/hosts/moyo/gentoo/package.accept_keywords/talloc
deleted file mode 100644
index f08e38b..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/talloc
+++ /dev/null
@@ -1 +0,0 @@
-sys-libs/talloc ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/tdb b/hosts/moyo/gentoo/package.accept_keywords/tdb
deleted file mode 100644
index 4b53952..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/tdb
+++ /dev/null
@@ -1 +0,0 @@
-sys-libs/tdb ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/tevent b/hosts/moyo/gentoo/package.accept_keywords/tevent
deleted file mode 100644
index 924bdcc..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/tevent
+++ /dev/null
@@ -1 +0,0 @@
-sys-libs/tevent ~amd64
diff --git a/hosts/moyo/gentoo/package.accept_keywords/virtiofsd b/hosts/moyo/gentoo/package.accept_keywords/virtiofsd
deleted file mode 100644
index f7504db..0000000
--- a/hosts/moyo/gentoo/package.accept_keywords/virtiofsd
+++ /dev/null
@@ -1 +0,0 @@
-app-emulation/virtiofsd ~amd64
diff --git a/hosts/moyo/gentoo/package.license/kernel b/hosts/moyo/gentoo/package.license/kernel
new file mode 100644
index 0000000..348558e
--- /dev/null
+++ b/hosts/moyo/gentoo/package.license/kernel
@@ -0,0 +1 @@
+sys-kernel/linux-firmware linux-fw-redistributable
diff --git a/hosts/moyo/gentoo/package.mask/python b/hosts/moyo/gentoo/package.mask/python
index 20d7841..af9ebaf 100644
--- a/hosts/moyo/gentoo/package.mask/python
+++ b/hosts/moyo/gentoo/package.mask/python
@@ -1 +1 @@
->=dev-lang/python-3.13
+>=dev-lang/python-3.14.0
diff --git a/hosts/moyo/gentoo/package.use/00cpu-flags b/hosts/moyo/gentoo/package.use/00cpu-flags
index 102a85d..ea302d2 100644
--- a/hosts/moyo/gentoo/package.use/00cpu-flags
+++ b/hosts/moyo/gentoo/package.use/00cpu-flags
@@ -1 +1 @@
-*/* CPU_FLAGS_X86: aes avx avx2 f16c fma3 mmx mmxext pclmul popcnt rdrand sha sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3
+*/* CPU_FLAGS_X86: aes avx avx2 bmi1 bmi2 f16c fma3 mmx mmxext pclmul popcnt rdrand sha sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3
diff --git a/hosts/moyo/gentoo/package.use/00video-cards b/hosts/moyo/gentoo/package.use/00video-cards
new file mode 100644
index 0000000..320548a
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/00video-cards
@@ -0,0 +1 @@
+*/* VIDEO_CARDS: -* amdgpu radeonsi radeon
diff --git a/hosts/moyo/gentoo/package.use/apparmor-profiles b/hosts/moyo/gentoo/package.use/apparmor-profiles
new file mode 100644
index 0000000..7993ade
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/apparmor-profiles
@@ -0,0 +1 @@
+sec-policy/apparmor-profiles minimal
diff --git a/hosts/moyo/gentoo/package.use/binutils b/hosts/moyo/gentoo/package.use/binutils
deleted file mode 100644
index 3dbc67d..0000000
--- a/hosts/moyo/gentoo/package.use/binutils
+++ /dev/null
@@ -1 +0,0 @@
-sys-devel/binutils pgo -cet
diff --git a/hosts/moyo/gentoo/package.use/binutils-libs b/hosts/moyo/gentoo/package.use/binutils-libs
deleted file mode 100644
index d2d9d0d..0000000
--- a/hosts/moyo/gentoo/package.use/binutils-libs
+++ /dev/null
@@ -1 +0,0 @@
-sys-libs/binutils-libs -cet
diff --git a/hosts/moyo/gentoo/package.use/chrony b/hosts/moyo/gentoo/package.use/chrony
new file mode 100644
index 0000000..826c085
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/chrony
@@ -0,0 +1 @@
+net-misc/chrony samba
diff --git a/hosts/moyo/gentoo/package.use/connman b/hosts/moyo/gentoo/package.use/connman
new file mode 100644
index 0000000..001a89a
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/connman
@@ -0,0 +1 @@
+net-misc/connman -wifi
diff --git a/hosts/moyo/gentoo/package.use/dhcp b/hosts/moyo/gentoo/package.use/dhcp
new file mode 100644
index 0000000..068becd
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/dhcp
@@ -0,0 +1 @@
+net-misc/dhcp -server
diff --git a/hosts/moyo/gentoo/package.use/doas b/hosts/moyo/gentoo/package.use/doas
new file mode 100644
index 0000000..2d1cc48
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/doas
@@ -0,0 +1 @@
+app-admin/doas persist
diff --git a/hosts/moyo/gentoo/package.use/elfutils b/hosts/moyo/gentoo/package.use/elfutils
new file mode 100644
index 0000000..1c494f6
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/elfutils
@@ -0,0 +1 @@
+dev-libs/elfutils zstd
diff --git a/hosts/moyo/gentoo/package.use/ffmpeg b/hosts/moyo/gentoo/package.use/ffmpeg
new file mode 100644
index 0000000..3434c7a
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/ffmpeg
@@ -0,0 +1 @@
+media-video/ffmpeg -libass
diff --git a/hosts/moyo/gentoo/package.use/freetype b/hosts/moyo/gentoo/package.use/freetype
index 4a5bb71..f8b3be5 100644
--- a/hosts/moyo/gentoo/package.use/freetype
+++ b/hosts/moyo/gentoo/package.use/freetype
@@ -1 +1 @@
-media-libs/freetype -adobe-cff -bzip2 -cleartype-hinting -png 
+media-libs/freetype -harfbuzz -adobe-cff -bzip2 -cleartype-hinting -png
diff --git a/hosts/moyo/gentoo/package.use/gcc b/hosts/moyo/gentoo/package.use/gcc
index f301a50..4a5f9cd 100644
--- a/hosts/moyo/gentoo/package.use/gcc
+++ b/hosts/moyo/gentoo/package.use/gcc
@@ -1 +1 @@
-sys-devel/gcc pgo jit graphite -fortran -ssp -default-stack-clash-protection -default-znow -cet
+sys-devel/gcc jit graphite -fortran -default-stack-clash-protection -default-znow
diff --git a/hosts/moyo/gentoo/package.use/git b/hosts/moyo/gentoo/package.use/git
new file mode 100644
index 0000000..553f74b
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/git
@@ -0,0 +1 @@
+dev-vcs/git -webdav -perl
diff --git a/hosts/moyo/gentoo/package.use/glib b/hosts/moyo/gentoo/package.use/glib
new file mode 100644
index 0000000..fce79db
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/glib
@@ -0,0 +1 @@
+dev-libs/glib -mime
diff --git a/hosts/moyo/gentoo/package.use/glibc b/hosts/moyo/gentoo/package.use/glibc
index 33fe408..ec6d969 100644
--- a/hosts/moyo/gentoo/package.use/glibc
+++ b/hosts/moyo/gentoo/package.use/glibc
@@ -1 +1 @@
-sys-libs/glibc -multiarch -profile -ssp -cet
+sys-libs/glibc -multiarch -profile
diff --git a/hosts/moyo/gentoo/package.use/gmp b/hosts/moyo/gentoo/package.use/gmp
index a5b882c..9ff5eb5 100644
--- a/hosts/moyo/gentoo/package.use/gmp
+++ b/hosts/moyo/gentoo/package.use/gmp
@@ -1 +1 @@
-dev-libs/gmp cxx
+dev-libs/gmp -cxx -cpudetection
diff --git a/hosts/moyo/gentoo/package.use/harfbuzz b/hosts/moyo/gentoo/package.use/harfbuzz
index 5df986b..036249d 100644
--- a/hosts/moyo/gentoo/package.use/harfbuzz
+++ b/hosts/moyo/gentoo/package.use/harfbuzz
@@ -1 +1 @@
-media-libs/harfbuzz -cairo -glib -graphite -introspection -truetype
+media-libs/harfbuzz graphite -cairo -glib -introspection
diff --git a/hosts/moyo/gentoo/package.use/htop b/hosts/moyo/gentoo/package.use/htop
index 926bf14..b7af6cf 100644
--- a/hosts/moyo/gentoo/package.use/htop
+++ b/hosts/moyo/gentoo/package.use/htop
@@ -1 +1 @@
-sys-process/htop lm-sensors
+sys-process/htop lm-sensors caps
diff --git a/hosts/moyo/gentoo/package.use/installkernel b/hosts/moyo/gentoo/package.use/installkernel
new file mode 100644
index 0000000..6622e7a
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/installkernel
@@ -0,0 +1 @@
+sys-kernel/installkernel dracut grub
diff --git a/hosts/moyo/gentoo/package.use/libglvnd b/hosts/moyo/gentoo/package.use/libglvnd
index 9471c08..992f32b 100644
--- a/hosts/moyo/gentoo/package.use/libglvnd
+++ b/hosts/moyo/gentoo/package.use/libglvnd
@@ -1 +1 @@
-media-libs/libglvnd X
+media-libs/libglvnd -X
diff --git a/hosts/moyo/gentoo/package.use/libnl b/hosts/moyo/gentoo/package.use/libnl
deleted file mode 100644
index 7970840..0000000
--- a/hosts/moyo/gentoo/package.use/libnl
+++ /dev/null
@@ -1 +0,0 @@
-dev-libs/libnl -debug
diff --git a/hosts/moyo/gentoo/package.use/libvirt b/hosts/moyo/gentoo/package.use/libvirt
index ccd9468..6aae84f 100644
--- a/hosts/moyo/gentoo/package.use/libvirt
+++ b/hosts/moyo/gentoo/package.use/libvirt
@@ -1 +1 @@
-app-emulation/libvirt pcap parted lvm policykit iscsi iscsi-direct
+app-emulation/libvirt pcap
diff --git a/hosts/moyo/gentoo/package.use/linux-firmware b/hosts/moyo/gentoo/package.use/linux-firmware
new file mode 100644
index 0000000..5d0b8c9
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/linux-firmware
@@ -0,0 +1 @@
+sys-kernel/linux-firmware compress-zstd
diff --git a/hosts/moyo/gentoo/package.use/lxc b/hosts/moyo/gentoo/package.use/lxc
index 56754cb..0b6d483 100644
--- a/hosts/moyo/gentoo/package.use/lxc
+++ b/hosts/moyo/gentoo/package.use/lxc
@@ -1 +1 @@
-app-containers/lxc caps io-uring -apparmor
+app-containers/lxc io-uring -apparmor
diff --git a/hosts/moyo/gentoo/package.use/miscfiles b/hosts/moyo/gentoo/package.use/miscfiles
new file mode 100644
index 0000000..0d07a72
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/miscfiles
@@ -0,0 +1 @@
+sys-apps/miscfiles minimal
diff --git a/hosts/moyo/gentoo/package.use/nvidia-drivers b/hosts/moyo/gentoo/package.use/nvidia-drivers
deleted file mode 100644
index 502813d..0000000
--- a/hosts/moyo/gentoo/package.use/nvidia-drivers
+++ /dev/null
@@ -1 +0,0 @@
-x11-drivers/nvidia-drivers -X -wayland -multilib -abi_x86_32 kms -gtk3 -tools -compat uvm
diff --git a/hosts/moyo/gentoo/package.use/pillow b/hosts/moyo/gentoo/package.use/pillow
new file mode 100644
index 0000000..37f5d53
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/pillow
@@ -0,0 +1 @@
+dev-python/pillow -jpeg -zlib
diff --git a/hosts/moyo/gentoo/package.use/python b/hosts/moyo/gentoo/package.use/python
index 10a653e..f4d398e 100644
--- a/hosts/moyo/gentoo/package.use/python
+++ b/hosts/moyo/gentoo/package.use/python
@@ -1,3 +1,3 @@
-dev-lang/python sqlite pgo -bluetooth
-*/* PYTHON_TARGETS: -* python3_12
-*/* PYTHON_SINGLE_TARGET: -* python3_12
+dev-lang/python sqlite
+*/* PYTHON_TARGETS: -* python3_13
+*/* PYTHON_SINGLE_TARGET: -* python3_13
diff --git a/hosts/moyo/gentoo/package.use/qemu b/hosts/moyo/gentoo/package.use/qemu
index 1a2a440..dd22332 100644
--- a/hosts/moyo/gentoo/package.use/qemu
+++ b/hosts/moyo/gentoo/package.use/qemu
@@ -1 +1 @@
-app-emulation/qemu -doc pin-upstream-blobs -gnutls -sdl -gtk io-uring jemalloc iscsi -opengl spice usb usbredir -virgl virtfs -vnc -ncurses -oss -png QEMU_SOFTMMU_TARGETS: aarch64 x86_64 m68k i386
+app-emulation/qemu io-uring -doc -gnutls -jpeg -ncurses -opengl -oss -png -vnc -xattr QEMU_SOFTMMU_TARGETS: x86_64
diff --git a/hosts/moyo/gentoo/package.use/qtgui b/hosts/moyo/gentoo/package.use/qtgui
deleted file mode 100644
index ecf6b50..0000000
--- a/hosts/moyo/gentoo/package.use/qtgui
+++ /dev/null
@@ -1 +0,0 @@
-dev-qt/qtgui linuxfb -egl -eglfs -gles2-only -png -dbus -libinput -udev
diff --git a/hosts/moyo/gentoo/package.use/qtwidgets b/hosts/moyo/gentoo/package.use/qtwidgets
deleted file mode 100644
index 5b50f8a..0000000
--- a/hosts/moyo/gentoo/package.use/qtwidgets
+++ /dev/null
@@ -1 +0,0 @@
-dev-qt/qtwidgets -dbus -png
diff --git a/hosts/moyo/gentoo/package.use/sysklogd b/hosts/moyo/gentoo/package.use/sysklogd
new file mode 100644
index 0000000..4d866b0
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/sysklogd
@@ -0,0 +1 @@
+app-admin/sysklogd logrotate
diff --git a/hosts/moyo/gentoo/package.use/talloc b/hosts/moyo/gentoo/package.use/talloc
new file mode 100644
index 0000000..04e8a13
--- /dev/null
+++ b/hosts/moyo/gentoo/package.use/talloc
@@ -0,0 +1 @@
+sys-libs/talloc -python
diff --git a/hosts/moyo/gentoo/package.use/zlib b/hosts/moyo/gentoo/package.use/zlib
index b934da8..e7c562a 100644
--- a/hosts/moyo/gentoo/package.use/zlib
+++ b/hosts/moyo/gentoo/package.use/zlib
@@ -1 +1,14 @@
 sys-libs/zlib minizip
+# required by app-containers/incus-6.0.4-r1::gentoo
+# required by incus (argument)
+>=dev-libs/raft-0.22.1 lz4
+# required by app-containers/incus-6.0.4-r1::gentoo
+# required by incus (argument)
+>=dev-util/xdelta-3.0.11-r1 lzma
+# required by app-containers/incus-6.0.4-r1::gentoo
+# required by incus (argument)
+>=sys-fs/squashfs-tools-4.7 lzma
+# required by app-containers/lxc-6.0.4-r1::gentoo[tools,caps]
+# required by app-containers/incus-6.0.4-r1::gentoo
+# required by incus (argument)
+>=sys-libs/libcap-2.76 static-libs
diff --git a/hosts/moyo/gentoo/package.use/zz-autounmask b/hosts/moyo/gentoo/package.use/zz-autounmask
deleted file mode 100644
index a25b21a..0000000
--- a/hosts/moyo/gentoo/package.use/zz-autounmask
+++ /dev/null
@@ -1,17 +0,0 @@
-# required by app-containers/incus-6.0.0-r1::gentoo
-# required by incus (argument)
->=dev-libs/raft-0.22.1 lz4
-# required by app-containers/incus-6.0.0-r1::gentoo
-# required by incus (argument)
->=dev-util/xdelta-3.0.11-r1 lzma
-# required by app-containers/incus-6.0.0-r1::gentoo
-# required by incus (argument)
->=sys-fs/squashfs-tools-4.6.1 lzma
-# required by app-containers/lxc-6.0.0-r1::gentoo[-caps,tools]
-# required by app-containers/incus-6.0.0-r1::gentoo
-# required by incus (argument)
->=sys-libs/libcap-2.69-r1 static-libs
-# required by net-dns/bind-tools-9.18.0::gentoo
-# required by @selected
-# required by @world (argument)
->=net-dns/bind-9.18.29-r2 idn
diff --git a/hosts/moyo/gentoo/profile/package.use.force/force.conf b/hosts/moyo/gentoo/profile/package.use.force/force.conf
index 13ec281..eb5575d 100644
--- a/hosts/moyo/gentoo/profile/package.use.force/force.conf
+++ b/hosts/moyo/gentoo/profile/package.use.force/force.conf
@@ -1,2 +1,2 @@
-*/* -pie
-sys-devel/gcc -default-stack-clash-protection -default-znow
+sys-devel/gcc -pie -default-stack-clash-protection -default-znow
+sys-devel/binutils -cet
diff --git a/hosts/moyo/kernel_config b/hosts/moyo/kernel_config
index 5a6b3d1..6abe5dd 100644
--- a/hosts/moyo/kernel_config
+++ b/hosts/moyo/kernel_config
@@ -47,8 +47,8 @@ CONFIG_HAVE_KERNEL_ZSTD=y
 # CONFIG_KERNEL_LZMA is not set
 # CONFIG_KERNEL_XZ is not set
 # CONFIG_KERNEL_LZO is not set
-CONFIG_KERNEL_LZ4=y
-# CONFIG_KERNEL_ZSTD is not set
+# CONFIG_KERNEL_LZ4 is not set
+CONFIG_KERNEL_ZSTD=y
 CONFIG_DEFAULT_INIT=""
 CONFIG_DEFAULT_HOSTNAME="(none)"
 CONFIG_SYSVIPC=y
@@ -234,12 +234,12 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_RELAY=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
-CONFIG_RD_GZIP=y
-CONFIG_RD_BZIP2=y
-CONFIG_RD_LZMA=y
-CONFIG_RD_XZ=y
-CONFIG_RD_LZO=y
-CONFIG_RD_LZ4=y
+# CONFIG_RD_GZIP is not set
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_LZ4 is not set
 CONFIG_RD_ZSTD=y
 # CONFIG_BOOT_CONFIG is not set
 CONFIG_INITRAMFS_PRESERVE_MTIME=y
@@ -344,7 +344,7 @@ CONFIG_X86_CPU_RESCTRL=y
 # CONFIG_X86_EXTENDED_PLATFORM is not set
 # CONFIG_X86_INTEL_LPSS is not set
 CONFIG_X86_AMD_PLATFORM_DEVICE=y
-# CONFIG_IOSF_MBI is not set
+CONFIG_IOSF_MBI=m
 CONFIG_X86_SUPPORTS_MEMORY_FAILURE=y
 CONFIG_SCHED_OMIT_FRAME_POINTER=y
 # CONFIG_HYPERVISOR_GUEST is not set
@@ -461,7 +461,11 @@ CONFIG_X86_PMEM_LEGACY_DEVICE=y
 CONFIG_X86_PMEM_LEGACY=m
 CONFIG_X86_CHECK_BIOS_CORRUPTION=y
 CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y
-# CONFIG_MTRR is not set
+CONFIG_MTRR=y
+CONFIG_MTRR_SANITIZER=y
+CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0
+CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
+CONFIG_X86_PAT=y
 CONFIG_X86_UMIP=y
 CONFIG_CC_HAS_IBT=y
 # CONFIG_X86_KERNEL_IBT is not set
@@ -522,16 +526,10 @@ CONFIG_ARCH_HAS_ADD_PAGES=y
 #
 # Power management and ACPI options
 #
-CONFIG_ARCH_HIBERNATION_HEADER=y
 CONFIG_SUSPEND=y
 CONFIG_SUSPEND_FREEZER=y
 # CONFIG_SUSPEND_SKIP_SYNC is not set
-CONFIG_HIBERNATE_CALLBACKS=y
-CONFIG_HIBERNATION=y
-CONFIG_HIBERNATION_SNAPSHOT_DEV=y
-CONFIG_HIBERNATION_COMP_LZO=y
-CONFIG_HIBERNATION_DEF_COMP="lzo"
-CONFIG_PM_STD_PARTITION=""
+# CONFIG_HIBERNATION is not set
 CONFIG_PM_SLEEP=y
 CONFIG_PM_SLEEP_SMP=y
 # CONFIG_PM_AUTOSLEEP is not set
@@ -888,9 +886,9 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 # CONFIG_MODULE_SIG is not set
 CONFIG_MODULE_COMPRESS=y
-CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_GZIP is not set
 # CONFIG_MODULE_COMPRESS_XZ is not set
-# CONFIG_MODULE_COMPRESS_ZSTD is not set
+CONFIG_MODULE_COMPRESS_ZSTD=y
 CONFIG_MODULE_COMPRESS_ALL=y
 # CONFIG_MODULE_DECOMPRESS is not set
 # CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set
@@ -1059,7 +1057,8 @@ CONFIG_MMU_NOTIFIER=y
 CONFIG_KSM=y
 CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
 CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y
-# CONFIG_MEMORY_FAILURE is not set
+CONFIG_MEMORY_FAILURE=y
+# CONFIG_HWPOISON_INJECT is not set
 CONFIG_ARCH_WANT_GENERAL_HUGETLB=y
 CONFIG_ARCH_WANTS_THP_SWAP=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
@@ -1093,6 +1092,7 @@ CONFIG_GET_FREE_REGION=y
 CONFIG_DEVICE_PRIVATE=y
 CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y
 CONFIG_ARCH_HAS_PKEYS=y
+CONFIG_ARCH_USES_PG_ARCH_2=y
 CONFIG_VM_EVENT_COUNTERS=y
 # CONFIG_PERCPU_STATS is not set
 
@@ -1829,12 +1829,11 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 # Firmware loader
 #
 CONFIG_FW_LOADER=y
-CONFIG_FW_LOADER_PAGED_BUF=y
-CONFIG_EXTRA_FIRMWARE="amdgpu/vega12_asd.bin amdgpu/vega12_ce.bin amdgpu/vega12_gpu_info.bin amdgpu/vega12_me.bin amdgpu/vega12_mec.bin amdgpu/vega12_mec2.bin amdgpu/vega12_pfp.bin amdgpu/vega12_rlc.bin amdgpu/vega12_sdma.bin amdgpu/vega12_sdma1.bin amdgpu/vega12_smc.bin amdgpu/vega12_sos.bin amdgpu/vega12_uvd.bin amdgpu/vega12_vce.bin amd-ucode/microcode_amd_fam17h.bin"
+CONFIG_EXTRA_FIRMWARE="amdgpu/vega12_asd.bin.zst amdgpu/vega12_ce.bin.zst amdgpu/vega12_gpu_info.bin.zst amdgpu/vega12_me.bin.zst amdgpu/vega12_mec.bin.zst amdgpu/vega12_mec2.bin.zst amdgpu/vega12_pfp.bin.zst amdgpu/vega12_rlc.bin.zst amdgpu/vega12_sdma.bin.zst amdgpu/vega12_sdma1.bin.zst amdgpu/vega12_smc.bin.zst amdgpu/vega12_sos.bin.zst amdgpu/vega12_uvd.bin.zst amdgpu/vega12_vce.bin.zst amd-ucode/microcode_amd_fam17h.bin"
 CONFIG_EXTRA_FIRMWARE_DIR="/lib/firmware"
 # CONFIG_FW_LOADER_USER_HELPER is not set
 CONFIG_FW_LOADER_COMPRESS=y
-CONFIG_FW_LOADER_COMPRESS_XZ=y
+# CONFIG_FW_LOADER_COMPRESS_XZ is not set
 CONFIG_FW_LOADER_COMPRESS_ZSTD=y
 CONFIG_FW_CACHE=y
 # CONFIG_FW_UPLOAD is not set
@@ -1849,6 +1848,7 @@ CONFIG_GENERIC_CPU_DEVICES=y
 CONFIG_GENERIC_CPU_AUTOPROBE=y
 CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=m
 CONFIG_DMA_SHARED_BUFFER=y
 # CONFIG_DMA_FENCE_TRACE is not set
 # CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT is not set
@@ -1954,7 +1954,7 @@ CONFIG_BLK_DEV_LOOP_MIN_COUNT=16
 CONFIG_NVME_CORE=y
 CONFIG_BLK_DEV_NVME=y
 # CONFIG_NVME_MULTIPATH is not set
-# CONFIG_NVME_VERBOSE_ERRORS is not set
+CONFIG_NVME_VERBOSE_ERRORS=y
 CONFIG_NVME_HWMON=y
 # CONFIG_NVME_FC is not set
 # CONFIG_NVME_TCP is not set
@@ -1994,7 +1994,7 @@ CONFIG_NVME_HWMON=y
 # CONFIG_EEPROM_MAX6875 is not set
 # CONFIG_EEPROM_93CX6 is not set
 # CONFIG_EEPROM_IDT_89HPESX is not set
-# CONFIG_EEPROM_EE1004 is not set
+CONFIG_EEPROM_EE1004=m
 # end of EEPROM support
 
 # CONFIG_CB710_CORE is not set
@@ -2112,7 +2112,7 @@ CONFIG_ATA=y
 CONFIG_SATA_HOST=y
 CONFIG_PATA_TIMINGS=y
 CONFIG_ATA_VERBOSE_ERROR=y
-CONFIG_ATA_FORCE=y
+# CONFIG_ATA_FORCE is not set
 CONFIG_ATA_ACPI=y
 # CONFIG_SATA_ZPODD is not set
 CONFIG_SATA_PMP=y
@@ -2127,83 +2127,7 @@ CONFIG_SATA_MOBILE_LPM_POLICY=0
 # CONFIG_SATA_INIC162X is not set
 # CONFIG_SATA_ACARD_AHCI is not set
 # CONFIG_SATA_SIL24 is not set
-CONFIG_ATA_SFF=y
-
-#
-# SFF controllers with custom DMA interface
-#
-# CONFIG_PDC_ADMA is not set
-# CONFIG_SATA_QSTOR is not set
-# CONFIG_SATA_SX4 is not set
-CONFIG_ATA_BMDMA=y
-
-#
-# SATA SFF controllers with BMDMA
-#
-# CONFIG_ATA_PIIX is not set
-# CONFIG_SATA_DWC is not set
-# CONFIG_SATA_MV is not set
-# CONFIG_SATA_NV is not set
-# CONFIG_SATA_PROMISE is not set
-# CONFIG_SATA_SIL is not set
-# CONFIG_SATA_SIS is not set
-# CONFIG_SATA_SVW is not set
-# CONFIG_SATA_ULI is not set
-# CONFIG_SATA_VIA is not set
-# CONFIG_SATA_VITESSE is not set
-
-#
-# PATA SFF controllers with BMDMA
-#
-# CONFIG_PATA_ALI is not set
-# CONFIG_PATA_AMD is not set
-# CONFIG_PATA_ARTOP is not set
-# CONFIG_PATA_ATIIXP is not set
-# CONFIG_PATA_ATP867X is not set
-# CONFIG_PATA_CMD64X is not set
-# CONFIG_PATA_CYPRESS is not set
-# CONFIG_PATA_EFAR is not set
-# CONFIG_PATA_HPT366 is not set
-# CONFIG_PATA_HPT37X is not set
-# CONFIG_PATA_HPT3X2N is not set
-# CONFIG_PATA_HPT3X3 is not set
-# CONFIG_PATA_IT8213 is not set
-# CONFIG_PATA_IT821X is not set
-# CONFIG_PATA_JMICRON is not set
-# CONFIG_PATA_MARVELL is not set
-# CONFIG_PATA_NETCELL is not set
-# CONFIG_PATA_NINJA32 is not set
-# CONFIG_PATA_NS87415 is not set
-# CONFIG_PATA_OLDPIIX is not set
-# CONFIG_PATA_OPTIDMA is not set
-# CONFIG_PATA_PDC2027X is not set
-# CONFIG_PATA_PDC_OLD is not set
-# CONFIG_PATA_RADISYS is not set
-# CONFIG_PATA_RDC is not set
-# CONFIG_PATA_SCH is not set
-# CONFIG_PATA_SERVERWORKS is not set
-# CONFIG_PATA_SIL680 is not set
-# CONFIG_PATA_SIS is not set
-# CONFIG_PATA_TOSHIBA is not set
-# CONFIG_PATA_TRIFLEX is not set
-# CONFIG_PATA_VIA is not set
-# CONFIG_PATA_WINBOND is not set
-
-#
-# PIO-only SFF controllers
-#
-# CONFIG_PATA_CMD640_PCI is not set
-# CONFIG_PATA_MPIIX is not set
-# CONFIG_PATA_NS87410 is not set
-# CONFIG_PATA_OPTI is not set
-# CONFIG_PATA_RZ1000 is not set
-
-#
-# Generic fallback / legacy drivers
-#
-# CONFIG_PATA_ACPI is not set
-# CONFIG_ATA_GENERIC is not set
-# CONFIG_PATA_LEGACY is not set
+# CONFIG_ATA_SFF is not set
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=y
 CONFIG_MD_AUTODETECT=y
@@ -2234,11 +2158,7 @@ CONFIG_DM_MIRROR=y
 # CONFIG_DM_LOG_USERSPACE is not set
 CONFIG_DM_RAID=y
 CONFIG_DM_ZERO=y
-CONFIG_DM_MULTIPATH=y
-CONFIG_DM_MULTIPATH_QL=y
-CONFIG_DM_MULTIPATH_ST=y
-# CONFIG_DM_MULTIPATH_HST is not set
-# CONFIG_DM_MULTIPATH_IOA is not set
+# CONFIG_DM_MULTIPATH is not set
 # CONFIG_DM_DELAY is not set
 # CONFIG_DM_DUST is not set
 # CONFIG_DM_INIT is not set
@@ -2884,7 +2804,6 @@ CONFIG_POWER_SUPPLY=y
 # CONFIG_BATTERY_UG3105 is not set
 # CONFIG_FUEL_GAUGE_MM8013 is not set
 CONFIG_HWMON=y
-CONFIG_HWMON_VID=m
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
@@ -2940,7 +2859,7 @@ CONFIG_SENSORS_FAM15H_POWER=m
 # CONFIG_SENSORS_I5500 is not set
 # CONFIG_SENSORS_CORETEMP is not set
 # CONFIG_SENSORS_IT87 is not set
-# CONFIG_SENSORS_JC42 is not set
+CONFIG_SENSORS_JC42=m
 # CONFIG_SENSORS_POWERZ is not set
 # CONFIG_SENSORS_POWR1220 is not set
 # CONFIG_SENSORS_LENOVO_EC is not set
@@ -2993,8 +2912,7 @@ CONFIG_SENSORS_FAM15H_POWER=m
 # CONFIG_SENSORS_PC87360 is not set
 # CONFIG_SENSORS_PC87427 is not set
 # CONFIG_SENSORS_NCT6683 is not set
-CONFIG_SENSORS_NCT6775_CORE=m
-CONFIG_SENSORS_NCT6775=m
+# CONFIG_SENSORS_NCT6775 is not set
 # CONFIG_SENSORS_NCT6775_I2C is not set
 # CONFIG_SENSORS_NCT7802 is not set
 # CONFIG_SENSORS_NCT7904 is not set
@@ -3097,7 +3015,7 @@ CONFIG_THERMAL_GOV_USER_SPACE=y
 # end of Intel thermal drivers
 
 CONFIG_WATCHDOG=y
-# CONFIG_WATCHDOG_CORE is not set
+CONFIG_WATCHDOG_CORE=m
 # CONFIG_WATCHDOG_NOWAYOUT is not set
 CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y
 CONFIG_WATCHDOG_OPEN_TIMEOUT=0
@@ -3107,6 +3025,7 @@ CONFIG_WATCHDOG_OPEN_TIMEOUT=0
 #
 # Watchdog Pretimeout Governors
 #
+# CONFIG_WATCHDOG_PRETIMEOUT_GOV is not set
 
 #
 # Watchdog Device Drivers
@@ -3127,7 +3046,7 @@ CONFIG_WATCHDOG_OPEN_TIMEOUT=0
 # CONFIG_EBC_C384_WDT is not set
 # CONFIG_EXAR_WDT is not set
 # CONFIG_F71808E_WDT is not set
-# CONFIG_SP5100_TCO is not set
+CONFIG_SP5100_TCO=m
 # CONFIG_SBC_FITPC2_WATCHDOG is not set
 # CONFIG_EUROTECH_WDT is not set
 # CONFIG_IB700_WDT is not set
@@ -3710,7 +3629,7 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_KARMA is not set
 # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
 # CONFIG_USB_STORAGE_ENE_UB6250 is not set
-# CONFIG_USB_UAS is not set
+CONFIG_USB_UAS=m
 
 #
 # USB Imaging devices
@@ -4064,6 +3983,7 @@ CONFIG_ACPI_WMI=m
 # CONFIG_YOGABOOK is not set
 # CONFIG_ACERHDF is not set
 # CONFIG_ACER_WIRELESS is not set
+# CONFIG_AMD_PMF is not set
 # CONFIG_AMD_PMC is not set
 # CONFIG_AMD_HSMP is not set
 # CONFIG_AMD_WBRF is not set
@@ -4080,6 +4000,7 @@ CONFIG_ACPI_WMI=m
 # CONFIG_IBM_RTL is not set
 # CONFIG_SENSORS_HDAPS is not set
 # CONFIG_THINKPAD_LMI is not set
+# CONFIG_INTEL_ATOMISP2_PM is not set
 # CONFIG_INTEL_SAR_INT1092 is not set
 
 #
@@ -4292,7 +4213,10 @@ CONFIG_IRQ_REMAP=y
 # CONFIG_PHY_INTEL_LGM_EMMC is not set
 # end of PHY Subsystem
 
-# CONFIG_POWERCAP is not set
+CONFIG_POWERCAP=y
+CONFIG_INTEL_RAPL_CORE=m
+CONFIG_INTEL_RAPL=m
+# CONFIG_IDLE_INJECT is not set
 # CONFIG_MCB is not set
 
 #
@@ -4302,6 +4226,8 @@ CONFIG_IRQ_REMAP=y
 # end of Performance monitor support
 
 CONFIG_RAS=y
+CONFIG_AMD_ATL=m
+CONFIG_AMD_ATL_PRM=y
 # CONFIG_USB4 is not set
 
 #
@@ -4326,7 +4252,7 @@ CONFIG_NVDIMM_KEYS=y
 CONFIG_DAX=y
 # CONFIG_DEV_DAX is not set
 CONFIG_NVMEM=y
-# CONFIG_NVMEM_SYSFS is not set
+CONFIG_NVMEM_SYSFS=y
 # CONFIG_NVMEM_LAYOUTS is not set
 # CONFIG_NVMEM_RMEM is not set
 
@@ -4338,7 +4264,8 @@ CONFIG_NVMEM=y
 # end of HW tracing support
 
 # CONFIG_FPGA is not set
-# CONFIG_TEE is not set
+CONFIG_TEE=m
+CONFIG_AMDTEE=m
 # CONFIG_SIOX is not set
 # CONFIG_SLIMBUS is not set
 # CONFIG_INTERCONNECT is not set
@@ -4784,10 +4711,11 @@ CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CTR=y
 # CONFIG_CRYPTO_CTS is not set
 CONFIG_CRYPTO_ECB=y
-# CONFIG_CRYPTO_HCTR2 is not set
+CONFIG_CRYPTO_HCTR2=m
 # CONFIG_CRYPTO_KEYWRAP is not set
 # CONFIG_CRYPTO_LRW is not set
 # CONFIG_CRYPTO_PCBC is not set
+CONFIG_CRYPTO_XCTR=m
 CONFIG_CRYPTO_XTS=m
 # end of Length-preserving ciphers and modes
 
@@ -4814,6 +4742,7 @@ CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_MICHAEL_MIC is not set
+CONFIG_CRYPTO_POLYVAL=m
 # CONFIG_CRYPTO_POLY1305 is not set
 # CONFIG_CRYPTO_RMD160 is not set
 CONFIG_CRYPTO_SHA1=y
@@ -4833,14 +4762,14 @@ CONFIG_CRYPTO_XXHASH=y
 #
 CONFIG_CRYPTO_CRC32C=y
 # CONFIG_CRYPTO_CRC32 is not set
-# CONFIG_CRYPTO_CRCT10DIF is not set
+CONFIG_CRYPTO_CRCT10DIF=m
 # end of CRCs (cyclic redundancy checks)
 
 #
 # Compression
 #
 CONFIG_CRYPTO_DEFLATE=m
-CONFIG_CRYPTO_LZO=y
+# CONFIG_CRYPTO_LZO is not set
 # CONFIG_CRYPTO_842 is not set
 # CONFIG_CRYPTO_LZ4 is not set
 # CONFIG_CRYPTO_LZ4HC is not set
@@ -4905,15 +4834,16 @@ CONFIG_CRYPTO_CHACHA20_X86_64=m
 # CONFIG_CRYPTO_NHPOLY1305_SSE2 is not set
 # CONFIG_CRYPTO_NHPOLY1305_AVX2 is not set
 CONFIG_CRYPTO_BLAKE2S_X86=y
-# CONFIG_CRYPTO_POLYVAL_CLMUL_NI is not set
+CONFIG_CRYPTO_POLYVAL_CLMUL_NI=m
 CONFIG_CRYPTO_POLY1305_X86_64=m
-# CONFIG_CRYPTO_SHA1_SSSE3 is not set
+CONFIG_CRYPTO_SHA1_SSSE3=m
 CONFIG_CRYPTO_SHA256_SSSE3=m
-# CONFIG_CRYPTO_SHA512_SSSE3 is not set
+CONFIG_CRYPTO_SHA512_SSSE3=m
 # CONFIG_CRYPTO_SM3_AVX_X86_64 is not set
-# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set
+CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL=m
 CONFIG_CRYPTO_CRC32C_INTEL=m
 CONFIG_CRYPTO_CRC32_PCLMUL=m
+CONFIG_CRYPTO_CRCT10DIF_PCLMUL=m
 # end of Accelerated Cryptographic Algorithms for CPU (x86)
 
 CONFIG_CRYPTO_HW=y
@@ -5006,7 +4936,7 @@ CONFIG_CRYPTO_LIB_SHA256=y
 
 CONFIG_CRC_CCITT=y
 CONFIG_CRC16=y
-# CONFIG_CRC_T10DIF is not set
+CONFIG_CRC_T10DIF=m
 # CONFIG_CRC64_ROCKSOFT is not set
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
@@ -5022,11 +4952,8 @@ CONFIG_LIBCRC32C=y
 # CONFIG_CRC8 is not set
 CONFIG_XXHASH=y
 # CONFIG_RANDOM32_SELFTEST is not set
-CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_INFLATE=m
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_LZO_COMPRESS=y
-CONFIG_LZO_DECOMPRESS=y
-CONFIG_LZ4_DECOMPRESS=y
 CONFIG_ZSTD_COMMON=y
 CONFIG_ZSTD_COMPRESS=y
 CONFIG_ZSTD_DECOMPRESS=y
@@ -5041,12 +4968,6 @@ CONFIG_XZ_DEC_RISCV=y
 # CONFIG_XZ_DEC_MICROLZMA is not set
 CONFIG_XZ_DEC_BCJ=y
 # CONFIG_XZ_DEC_TEST is not set
-CONFIG_DECOMPRESS_GZIP=y
-CONFIG_DECOMPRESS_BZIP2=y
-CONFIG_DECOMPRESS_LZMA=y
-CONFIG_DECOMPRESS_XZ=y
-CONFIG_DECOMPRESS_LZO=y
-CONFIG_DECOMPRESS_LZ4=y
 CONFIG_DECOMPRESS_ZSTD=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_INTERVAL_TREE=y
diff --git a/hosts/moyo/moyo_maintenance.txt b/hosts/moyo/moyo_maintenance.txt
new file mode 100644
index 0000000..899ccc9
--- /dev/null
+++ b/hosts/moyo/moyo_maintenance.txt
@@ -0,0 +1,70 @@
+= Moyo
+
+== TODO
+- [ ] Auto mount /dev/store without manual password input.
+
+== World
+* app-admin/doas
+* app-admin/sysklogd
+* app-editors/vim minimal
+ - Effectively `vi`.
+* app-emulation/libvirt
+* app-misc/jq
+ - Old pizzabot.
+* app-misc/neofetch
+* app-misc/screen
+* app-shells/bash-completion
+* dev-lang/rust
+ - rust-bin is pulled in by default, so prefer this.
+* dev-vcs/git
+* media-video/ffmpeg
+ - Old pizzabot.
+* net-fs/nfs-utils
+* net-fs/samba
+* net-misc/chrony
+* net-misc/dhcpcd
+* sys-apps/amdgpu_top
+* sys-apps/lm-sensors
+* sys-apps/nvme-cli
+ - dracut.
+* sys-block/io-scheduler-udev-rules
+* sys-fs/cryptsetup
+ - dracut.
+* sys-fs/dosfstools
+ - /efi fsck
+* sys-fs/lvm2
+ - dracut.
+* sys-kernel/gentoo-sources
+* sys-kernel/installkernel
+* sys-kernel/linux-firmware
+* sys-process/htop
+* x11-terms/kitty-terminfo
+
+== Services
+default:
+ sysklogd
+ cronie
+ dhcpcd
+ chronyd
+ libvirtd
+ libvirt-guests
+ sshd
+boot:
+ dmcrypt
+
+== Config
+/etc/rc.conf
+ rc_logger="YES"
+
+== Kernel
+=== General
+* No debugging.
+* Hardware mitigations not compiled in.
+* Select zstd for all compression.
+=== Specific CONFIG_* Rationale
+* CONFIG_MTTR & CONFIG_X86_PAT
+ - Requested by amdgpu.
+* CONFIG_AMD_ATL
+ - Should look into what this actually changes.
+* CONFIG_ATA_SFF
+ - Pretty sure no hardware I have uses this.