diff --git a/Brewfile b/Brewfile
new file mode 100644
index 0000000..3cf66ad
--- /dev/null
+++ b/Brewfile
@@ -0,0 +1,49 @@
+brew "ack"
+brew "acme.sh"
+brew "age"
+brew "cask"
+brew "certbot"
+brew "cmake"
+brew "direnv"
+brew "earthly"
+brew "git-lfs"
+brew "gnupg"
+brew "go"
+brew "gradle"
+brew "httpie"
+brew "john-jumbo"
+brew "jq"
+brew "mosh"
+brew "openssh"
+brew "pipenv"
+brew "pipx"
+brew "pkgconf"
+brew "pwgen"
+brew "pwntools"
+brew "qemu"
+brew "restic"
+brew "ruby"
+brew "ruby@3.3"
+brew "rustup"
+brew "shellcheck"
+brew "starship"
+brew "tmux"
+brew "virtualenvwrapper"
+cask "font-fira-code-nerd-font"
+cask "font-fira-mono-nerd-font"
+cask "font-go-mono-nerd-font"
+cask "font-hack-nerd-font"
+cask "font-inconsolata-nerd-font"
+cask "font-symbols-only-nerd-font"
+cask "font-terminess-ttf-nerd-font"
+cask "ghidra"
+cask "gimp"
+cask "github"
+cask "google-cloud-sdk"
+cask "iterm2"
+cask "macfuse"
+cask "mitmproxy"
+cask "raycast"
+cask "temurin"
+cask "veracrypt"
+cask "zulu@17"
diff --git a/bin/install_tool b/bin/install_tool
index 9fc10c1..8a9538e 100755
--- a/bin/install_tool
+++ b/bin/install_tool
@@ -218,11 +218,11 @@ case ${TOOL} in
     ;;
   dex2jar)
     makedest_or_die
-    src="https://github.com/pxb1988/dex2jar/releases/download/2.0/dex-tools-2.0.zip"
+    src="https://github.com/pxb1988/dex2jar/releases/download/v2.4/dex-tools-v2.4.zip"
     download ${src} /tmp/dex2jar.zip
     tmpd=$(mktemp -d)
     unzip -d "${tmpd}" /tmp/dex2jar.zip
-    mv "${tmpd}"/* "${DESTDIR}"
+    mv "${tmpd}"/dex-tools-*/* "${DESTDIR}"
     rm /tmp/dex2jar.zip
     rm -rf "${tmpd}"
     rm "${DESTDIR}"/*.bat
diff --git a/bin/restic-backup.sh b/bin/restic-backup.sh
new file mode 100755
index 0000000..07acd05
--- /dev/null
+++ b/bin/restic-backup.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -ue
+
+export RESTIC_DEFAULT_BE="google"
+export RESTIC_PASSWORD_FILE=${HOME}/.restic-password
+
+case "${RESTIC_BACKEND:=${RESTIC_DEFAULT_BE}}" in
+  google)
+    export GOOGLE_PROJECT_ID=systemoverlord.com:systemoverlord
+    export GOOGLE_APPLICATION_CREDENTIALS=${HOME}/.config/boto/restic-creds.json
+    export RESTIC_REPOSITORY="gs:systemoverlord-backups-scar-2:/"
+    ;;
+  b2)
+    . ${HOME}/.restic-backups-scar-creds
+    export AWS_ACCESS_KEY_ID
+    export AWS_SECRET_ACCESS_KEY
+    export RESTIC_REPOSITORY="s3:s3.us-west-004.backblazeb2.com/systemoverlord-backups-scar"
+    ;;
+  *)
+    echo "Unknown restic backend $RESTIC_BACKEND" >&2
+    exit 1
+    ;;
+esac
+
+cd ${HOME}
+
+if [ -z "${1}" ] ; then
+
+  restic backup \
+    --files-from "${HOME}/.restic-backup" \
+    --limit-upload 5000 \
+    --limit-download 10000
+
+else
+  restic "$@"
+fi
diff --git a/dotfiles/config/direnv/lib/python.sh b/dotfiles/config/direnv/lib/python.sh
new file mode 100644
index 0000000..2bb5104
--- /dev/null
+++ b/dotfiles/config/direnv/lib/python.sh
@@ -0,0 +1,16 @@
+layout_python() {
+  local DIR_NAME="$(basename $(pwd))"
+  VIRTUAL_ENV="${VIRTUAL_ENV:-$(pwd)/.venv/${DIR_NAME}}"
+  local PYBIN="$(command -v python 2>/dev/null || command -v python3 2>/dev/null)"
+  if [[ -z "${PYBIN}" ]]; then
+    log_error "No python found!"
+    return 1
+  fi
+  if [[ ! -d $VIRTUAL_ENV ]]; then
+    log_status "No virtual environment exists. Executing \`${PYBIN} -m venv ${VIRTUAL_ENV}\`."
+    "${PYBIN}" -m venv "${VIRTUAL_ENV}"
+  fi
+
+  # Activate the virtual environment
+  . $VIRTUAL_ENV/bin/activate
+}
diff --git a/dotfiles/config/htop/htoprc b/dotfiles/config/htop/htoprc
index 3e2ec5f..5b22607 100644
--- a/dotfiles/config/htop/htoprc
+++ b/dotfiles/config/htop/htoprc
@@ -39,14 +39,14 @@ column_meter_modes_0=1 1 1
 column_meters_1=Tasks LoadAverage Uptime
 column_meter_modes_1=2 2 2
 tree_view=0
-sort_key=46
+sort_key=47
 tree_sort_key=0
 sort_direction=-1
 tree_sort_direction=1
 tree_view_always_by_pid=0
 all_branches_collapsed=0
 screen:Main=PID USER PRIORITY NICE M_VIRT M_RESIDENT M_SHARE STATE PERCENT_CPU PERCENT_MEM TIME Command
-.sort_key=PERCENT_CPU
+.sort_key=PERCENT_MEM
 .tree_sort_key=PID
 .tree_view=0
 .tree_view_always_by_pid=0
diff --git a/dotfiles/gitconfig b/dotfiles/gitconfig
index d68fb52..f806c0a 100644
--- a/dotfiles/gitconfig
+++ b/dotfiles/gitconfig
@@ -87,3 +87,8 @@
 [delta]
   navigate = true
   line-numbers = true
+[filter "lfs"]
+	required = true
+	clean = git-lfs clean -- %f
+	smudge = git-lfs smudge -- %f
+	process = git-lfs filter-process
diff --git a/dotfiles/rsync_ignore b/dotfiles/rsync_ignore
index dfd67a3..e719bb3 100644
--- a/dotfiles/rsync_ignore
+++ b/dotfiles/rsync_ignore
@@ -41,5 +41,7 @@ Downloads
 SpiderOak Hive
 Unity
 VirtualBox VMs
+go
 tmp
 tools
+PDFs.tar.bz2
diff --git a/dotfiles/vim/pack/matir/opt/solarized8 b/dotfiles/vim/pack/matir/opt/solarized8
index 6178a07..7b63990 160000
--- a/dotfiles/vim/pack/matir/opt/solarized8
+++ b/dotfiles/vim/pack/matir/opt/solarized8
@@ -1 +1 @@
-Subproject commit 6178a07f442a1fe559673cef6ac2b7031ab21edb
+Subproject commit 7b6399093c090ef931e9a4ba031bff90fb7c8de1
diff --git a/dotfiles/vim/pack/matir/start/editorconfig b/dotfiles/vim/pack/matir/start/editorconfig
index 8b7da79..8f6eba5 160000
--- a/dotfiles/vim/pack/matir/start/editorconfig
+++ b/dotfiles/vim/pack/matir/start/editorconfig
@@ -1 +1 @@
-Subproject commit 8b7da79e9daee7a3f3a8d4fe29886b9756305aff
+Subproject commit 8f6eba5fd6c306e0480ea72917902a2bde162d73
diff --git a/dotfiles/vim/pack/matir/start/fugitive b/dotfiles/vim/pack/matir/start/fugitive
index 64d6caf..2a53d79 160000
--- a/dotfiles/vim/pack/matir/start/fugitive
+++ b/dotfiles/vim/pack/matir/start/fugitive
@@ -1 +1 @@
-Subproject commit 64d6cafb9dcbacce18c26d7daf617ebb96b273f3
+Subproject commit 2a53d7924877b38b3d82fba188fd9053bfbc646e
diff --git a/dotfiles/vim/pack/matir/start/surround b/dotfiles/vim/pack/matir/start/surround
index 3d188ed..f51a26d 160000
--- a/dotfiles/vim/pack/matir/start/surround
+++ b/dotfiles/vim/pack/matir/start/surround
@@ -1 +1 @@
-Subproject commit 3d188ed2113431cf8dac77be61b842acb64433d9
+Subproject commit f51a26d3710629d031806305b6c8727189cd1935
diff --git a/dotfiles/zshrc b/dotfiles/zshrc
index 091a158..9417670 100755
--- a/dotfiles/zshrc
+++ b/dotfiles/zshrc
@@ -97,6 +97,10 @@ if [[ $- == *i* ]] ; then
   done
   # extra completions, prompt
   fpath=(~/.zshrc.completions ~/.zshrc.d/matir_prompt ~/.zshrc.d/agnoster_prompt $fpath)
+  # Homebrew on mac
+  if test -x /opt/homebrew/bin/brew ; then
+    eval $(/opt/homebrew/bin/brew shellenv)
+  fi
   # Completion
   zstyle ':compinstall' filename "${HOME}/.zshrc"
   zstyle ':completion:*' users root ${USER}
@@ -108,6 +112,8 @@ if [[ $- == *i* ]] ; then
     source /usr/share/virtualenvwrapper/virtualenvwrapper_lazy.sh
   elif test -f /usr/bin/virtualenvwrapper_lazy.sh ; then
     source /usr/bin/virtualenvwrapper_lazy.sh
+  elif test -f /opt/homebrew/bin/virtualenvwrapper_lazy.sh ; then
+    source /opt/homebrew/bin/virtualenvwrapper_lazy.sh
   fi
   if command ls --version >/dev/null 2>&1 ; then
     alias ls="$(whence -p ls) --color=auto"
@@ -140,6 +146,10 @@ if [[ $- == *i* ]] ; then
   # History
   alias fullhist="history 1"
   alias longhist="history -1000"
+  # direnv if present
+  if command -v direnv >/dev/null 2>&1 ; then
+    eval "$(direnv hook zsh)"
+  fi
 fi  # End interactive-only block
 
 # In case ack is named ack-grep
@@ -164,11 +174,17 @@ fi
 # Load any local settings
 if [ -e $HOME/.zshrc.local ] ; then source $HOME/.zshrc.local ; fi
 
-# Set prompt based on local settings
-if test -f "${HOME}/.zprompt" ; then
-  THEME=${THEME:=$(cat "${HOME}/.zprompt")}
+# separate interactive block based on .zshrc.local
+if [[ $- == *i* ]] ; then
+  # Set prompt based on local settings
+  if test -f "${HOME}/.zprompt" ; then
+    THEME=${THEME:=$(cat "${HOME}/.zprompt")}
+  fi
+  if command -v starship >/dev/null 2>&1 ; then
+    : ${THEME:=starship}
+    if [ "${THEME}" = "starship" ] ; then
+      eval "$(starship init zsh)"
+    fi
+  fi
+  prompt "${THEME:-matir}" >/dev/null 2>&1
 fi
-if command -v starship >/dev/null 2>&1 ; then
-  : ${THEME:=starship}
-fi
-prompt "${THEME:-matir}" >/dev/null 2>&1
diff --git a/dotfiles/zshrc.d/android.zsh b/dotfiles/zshrc.d/android.zsh
new file mode 100644
index 0000000..c8810b8
--- /dev/null
+++ b/dotfiles/zshrc.d/android.zsh
@@ -0,0 +1,7 @@
+ANDROID_HOME=$HOME/Library/Android/sdk
+
+if test -d $ANDROID_HOME ; then
+  PATH=$PATH:$ANDROID_HOME/emulator:$ANDROID_HOME/platform-tools
+else
+  unset ANDROID_HOME
+fi
diff --git a/dotfiles/zshrc.d/functions.zsh b/dotfiles/zshrc.d/functions.zsh
index fac09e7..8997b98 100644
--- a/dotfiles/zshrc.d/functions.zsh
+++ b/dotfiles/zshrc.d/functions.zsh
@@ -25,3 +25,13 @@ unset _STARSHIP_PATH
 function hashall {
   tee >(md5sum) | tee >(sha1sum) | sha256sum
 }
+
+function rtmux {
+  if [ "$#" -lt 1 ] ; then
+    echo "Usage: $0 <host> [tmux args]" >&2
+    return 1
+  fi
+  HOST="${1}"
+  shift
+  ssh -t ${HOST} -- tmux "$@"
+}
diff --git a/dotfiles/zshrc.d/gcloud.zsh b/dotfiles/zshrc.d/gcloud.zsh
index febfd38..35b1db7 100755
--- a/dotfiles/zshrc.d/gcloud.zsh
+++ b/dotfiles/zshrc.d/gcloud.zsh
@@ -10,6 +10,9 @@ if [ -d "${GCL}" ] ; then
   source "${GCL}/completion.zsh.inc"
 elif [ -f /usr/share/google-cloud-sdk/completion.zsh.inc ] ; then
   source /usr/share/google-cloud-sdk/completion.zsh.inc
+elif [ -d /opt/homebrew/share/google-cloud-sdk/ ] ; then
+  source /opt/homebrew/share/google-cloud-sdk/completion.zsh.inc
+  source /opt/homebrew/share/google-cloud-sdk/path.zsh.inc
 fi
 
 
diff --git a/keys/ssh/id_ed25519_baymax.pub b/keys/ssh/id_ed25519_baymax.pub
new file mode 100644
index 0000000..931408c
--- /dev/null
+++ b/keys/ssh/id_ed25519_baymax.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINFlZdKMzY8S/znw16R3X9jO+BaJ30NloH9XWtftjYh6 david@baymax.local
diff --git a/keys/ssh/trusted/id_ed25519_baymax.pub b/keys/ssh/trusted/id_ed25519_baymax.pub
new file mode 120000
index 0000000..c48e5cd
--- /dev/null
+++ b/keys/ssh/trusted/id_ed25519_baymax.pub
@@ -0,0 +1 @@
+../id_ed25519_baymax.pub
\ No newline at end of file