diff --git a/home/xin/common/default.nix b/home/xin/common/default.nix
index 20f1d80..da76694 100644
--- a/home/xin/common/default.nix
+++ b/home/xin/common/default.nix
@@ -5,6 +5,15 @@
     ./zellij.nix
     ./vim.nix
   ];
+
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    auto-optimise-store = true;
+    substituters = "https://cache.nixos.org https://mirrors.ustc.edu.cn/nix-channels/store https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store https://cache.nixos.org/ https://cuda-maintainers.cachix.org";
+    trusted-public-keys = "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= cuda-maintainers.cachix.org-1:0dq3bujKpuEPMCX6U4WylrUDZ9JyUG0VpVZa7CNfq5E=";
+  };
+
+
   home.packages = with pkgs; [
     dig
     du-dust # du + rust
diff --git a/home/xin/common/fish.nix b/home/xin/common/fish.nix
index 19950bf..7d8fecb 100644
--- a/home/xin/common/fish.nix
+++ b/home/xin/common/fish.nix
@@ -26,6 +26,9 @@
           echo -n "<🚀lv$SHLVL>"
         end
       end
+      function fish_command_not_found
+        ${pkgs.comma}/bin/comma $argv
+      end
     '';
     functions = {
       gitignore = "curl -sL https://www.gitignore.io/api/$argv";
diff --git a/machines/calcite/configuration.nix b/machines/calcite/configuration.nix
index 2599fad..a5d45f8 100644
--- a/machines/calcite/configuration.nix
+++ b/machines/calcite/configuration.nix
@@ -212,6 +212,7 @@
     enable = true;
   };
 
+
   system.stateVersion = "22.05";
 
   # Use mirror for binary cache
@@ -219,15 +220,20 @@
     "https://mirrors.ustc.edu.cn/nix-channels/store"
     "https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store"
   ];
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  nix.settings.auto-optimise-store = true;
-  nix.settings.access-tokens = [ "github.com=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" ];
-  nix.settings.trusted-users = [ "xin" "root" ];
   nix.gc = {
     automatic = true;
     dates = "weekly";
     options = "--delete-older-than 30d";
   };
+  nix.settings.trusted-users = [ "xin" "root" ];
+  nix.extraOptions = ''
+    !include "${config.sops.secrets.github_public_token.path}"
+  '';
+  sops = {
+    secrets.github_public_token = {
+      owner = "xin";
+    };
+  };
 
   # MTP support
   services.gvfs.enable = true;
diff --git a/machines/calcite/secrets.yaml b/machines/calcite/secrets.yaml
index ae8271c..e69de29 100644
--- a/machines/calcite/secrets.yaml
+++ b/machines/calcite/secrets.yaml
@@ -1,30 +0,0 @@
-clash_subscription_link: ENC[AES256_GCM,data:HKHMCu6FAhXroM+j33coUhJybw2P0k4c+2NyVoLkHRtxyWc2qDmwLfyaYfU9hkBdE60eZ6t5ewNFnMFe78DatVTcwPXGznY=,iv:0yP9LG8lUdjKiize6z5LjY3NsGmKST4H2aMvOZoUXyo=,tag:vcBk7seKuaSpEw8PXmM05A==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1uw059wcwfvd9xuj0hpqzqpeg7qemecspjrsatg37wc7rs2pumfdsgken0c
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuRXoxNVJzZERQTFdDNWlL
-            N2s2ajdCVzFFZWlSY1dndWhCL0RuMnk3aVdJCjJaQUJ2a1VPanArN2YxMy9vSEYv
-            blBISEZQL3UvNnRFN0ozZ3hzbEcvaDQKLS0tIEYydmF2bHBwQWdTSFFQQ29ROGxi
-            OFo3K3N6VWsyRnphblVsM2pHZnljUncKWLyzuKl+8WXtvlPtsaYG4PyGYNmPFdG5
-            gxlMsQvaUrGReCs9M3EeS0KKvl9INzOP33KCiwrIAfq1PygP1xF1QQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ytwfqfeez3dqtazyjltn7mznccwx3ua8djhned7n8mxqhw4p6e5s97skfa
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1ZHpMa0NiYzJSa0Jyd3dD
-            WUFzenY3dEYzRjBxbVk4NWFGUnp0N0oySjE4CllEMlRXSmR6cWR0QlMrOWJGdEhO
-            ZzkwaFRRMVdjcVhLaEpMcFhxMTVxcTQKLS0tIEY3eER1d3B0NGtsdk9RaENscTBk
-            eHg2UVZRRkdVWm5PdW1MSzhVTGlpc3cKnZj4fil9mysiJJcDK4SLo+I0TcUtgww1
-            67W3wpd2y+ofIEP/qBSTVU4PYJ+ZsYDr1hy+6qJ7r4rgQ9wzLiWBog==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-22T15:22:58Z"
-    mac: ENC[AES256_GCM,data:3LtivTLt04ADulz9XkMxcpgAY6it+hWFuXZVI9AOuFVQCgGE41fpH0RUKgJ4kIpr5kvbe4wVLQ6OTFqBcAkPnBBPCCg/Npzo7sWbGOiBEyK3aEk2uGsmZHqpDexHS5VJvSY0iePD+Qb/LNxjBo4KLWGNj+frKnpGALV0Qn6yzIE=,iv:alylpWLPhIIL4piaVFpjHbXJY4nz0pcUIFN5TvVcj74=,tag:HaSjcpwRMZ06UjXoDwEmyg==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3
diff --git a/machines/clash.nix b/machines/clash.nix
index 1ba117e..e6c76ca 100644
--- a/machines/clash.nix
+++ b/machines/clash.nix
@@ -17,10 +17,6 @@
   systemd.services."clash-config-update" = {
     script = ''
       ${pkgs.curl}/bin/curl $(${pkgs.coreutils}/bin/cat ${config.sops.secrets.clash_subscription_link.path}) > /tmp/config.yaml && mv /tmp/config.yaml /home/xin/.config/clash/ 
-      ${pkgs.gnused}/bin/sed -i 's/enable: false/enable: true/g; s/log-level: info/log-level: warning/g' /home/xin/.config/clash/config.yaml
-      ${pkgs.gnused}/bin/sed -i '0,/proxies/s/114.114.114.114/https:\/\/dns.alidns.com\/dns-query/g; 0,/proxies/s/119.29.29.29/tls:\/\/dns.tuna.tsinghua.edu.cn:8853/g' /home/xin/.config/clash/config.yaml
-      ${pkgs.gnused}/bin/sed -i 's/dns:/dns: \n  nameserver-policy:\n     +.ts.net: "100.100.100.100"/g; s/log-level: info/log-level: warning/g' /home/xin/.config/clash/config.yaml
-      ${pkgs.gnused}/bin/sed -i 's/www.gstatic.cn/www.google.com/g' /home/xin/.config/clash/config.yaml
     '';
     serviceConfig = {
       Type = "oneshot";
diff --git a/machines/secrets.yaml b/machines/secrets.yaml
index 3d9bfee..97a4df9 100644
--- a/machines/secrets.yaml
+++ b/machines/secrets.yaml
@@ -1,6 +1,7 @@
-clash_subscription_link: ENC[AES256_GCM,data:QwszQooTzHboIgIsbxcL1ZrVgOn91pKC8mMUSY7R0FB426ERiVPNyGWBy5ar4m0yk/XwcFLdFRmiWOrQG9mWsx9J6/tH7K8=,iv:zeDuLmDRUiCtKfUlpl1KJl62DP4DnQ2c6gOjpiHw+4c=,tag:w5AQIUC1p3nrwepdxH7Kkw==,type:str]
+clash_subscription_link: ENC[AES256_GCM,data:Vwy0c8gOeR1XG/QNp8TGuBe/5kezD7SSStN/iCnihbbJYW78LNfPfvmVAEXjQlf5Ycts2Cb2JHGtWp3rmQQtWBx8LfIewqhNDk9fCywqIv7uSmqVpJNTHfYhjpF6PLvtz51VfTKph+fplZ9dMu23P9g7Wn6dzVizo8DX6xHWN2jDyHza5zkiNrzbmiaLwbLu1dAzvNSI67A=,iv:pZ189IPPCBjscXzEdgQCRdFlls3TniwDfNCd+H1FFaQ=,tag:dpt+3kdx8m1f0X0SHm+ATA==,type:str]
 autofs-nas: ENC[AES256_GCM,data:wcrA2t8/i9PaxA1PQ3CDVJZUhVchGV4vCfa5j/ReNahKV3cfDf2owbpeB827sMpjYyyvSH6nri7mra/BLMAPcgySCpZNAgdR9DQZXAQ=,iv:QJzsS5a6vWeoBxkB13yXdVbyn0tt2QTvqj0LaHn6S2g=,tag:TtgubLgWBBzl67MVal5BvQ==,type:str]
 autofs-nas-secret: ENC[AES256_GCM,data:OBh8h5CFv1Z4G6bMesna4zmXNASKhYdjFBvg47T9aKBCLDp/xVWnnQj8N7AFGg49wJ+0gYuqb33lIqpSnQ==,iv:UCaGeE8j4RqJzA0xhu3oB2xvzombzQD3fjLKCWd5fDg=,tag:+Oc78ddpLH7R2aT7gW3Ouw==,type:str]
+github_public_token: ENC[AES256_GCM,data:SYj6F8jXhAvpYgPllyJca4cdekp52ayYPndCaGtg9GFLBAVt1Y+d2Q07l/zGFlcLXDTE4FI9kAHVzpXchZlfCWcjJGJ/gCHr306s0zoaa5zVfAsfQaLmkYNvYBuOu8WHifsL3RNvkQrx4xWiH5KlCbrKelAsUaoj,iv:/bYv5+PtVcqNKgrOy8ojY09GtS0+U1W8JI34CcBeoHE=,tag:Xsh6XOVrn06RQL6s1ze4PA==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -34,8 +35,8 @@ sops:
             dWVDd2VSd213NmpYdDcvNUZXTHdzSDgKj68TLxSYYExtGg/hyuAiPqmdXPGIWzou
             DnCdBitTPPswI+BVwYufnGmHdt8xz5nofBxACWg/bS3NUTGFcnIPWQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-25T04:49:58Z"
-    mac: ENC[AES256_GCM,data:Xig/sBJAEs9D6hsoeTAJ4CL156IrFLipacI7eHfBd79Lsa0IXPfLvVn/tVTIfEixmBA9QKkQ9QYjTFVZNr0BTRqHC/C7izgZbOBn73EE+KXYLQEiZ4RbgRfrFb8gU2/uSWXGZEO6YELuom9BEXWCMp0HTS+MQTKk8Tz20/hVyV4=,iv:Uq74PG7DDanb5WpcXUdylT8LW4ERlEsT8YX0BxZdo8w=,tag:7zKveIEJjh0Yc2fLKsTUjA==,type:str]
+    lastmodified: "2023-07-22T02:00:48Z"
+    mac: ENC[AES256_GCM,data:DXQaCRuD4trEjIFvVAGF3/F/AiUcIOKGmqKKF/S7tJ51ZGXIh64g7vXZhZC22UxGs2pYU/gQOfA58cSxrHav0hmA0KbidLGA2ySRzVCSP3IH2jLx9KXdYv6SIS5I3MRMUqf7ZH+5rtdjTrrYBDWZrDzB9T7naMn1BujMqi+SwsU=,iv:QrFcEz7sxC0kbRtFr45cUaT4VosFq5ICtF3HOZ3If9I=,tag:Ste0v4xcONasn182R2ZyFw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.7.3
diff --git a/note.md b/note.md
new file mode 100644
index 0000000..93a14d6
--- /dev/null
+++ b/note.md
@@ -0,0 +1,3 @@
+# nix-tree
+
+Demonstrate disk usage by nix-store path.