diff --git a/home_external/.bashrc b/home_external/.bashrc
index 1b5d147..2ff28c1 100644
--- a/home_external/.bashrc
+++ b/home_external/.bashrc
@@ -186,26 +186,29 @@ colours() {
 
 # ex - archive extractor
 # usage: ex <file>
-ex ()
-{
-  if [ -f $1 ] ; then
-    case $1 in
-      *.tar.bz2)   tar xjf $1   ;;
-      *.tar.gz)    tar xzf $1   ;;
-      *.bz2)       bunzip2 $1   ;;
-      *.rar)       unrar x $1   ;;
-      *.gz)        gunzip $1    ;;
-      *.tar)       tar xf $1    ;;
-      *.tbz2)      tar xjf $1   ;;
-      *.tgz)       tar xzf $1   ;;
-      *.zip)       unzip $1     ;;
-      *.Z)         uncompress $1;;
-      *.7z)        7z x $1      ;;
-      *)           echo "'$1' cannot be extracted via ex()" ;;
-    esac
-  else
-    echo "'$1' is not a valid file"
-  fi
+ex() {
+   if [[ ! -f "$1" ]]; then
+      echo "'$1' is not a valid file"
+      return 1;
+   fi
+   # FIXME 7z kann (theoretisch) tar
+   outdir=${1%.*}
+   case "$1" in
+      *.tar.bz2 | *.tbz | *.tbz2)
+         tar xjf $1 -C $outdir;;
+      *.tar.gz  | *.tgz)
+         tar xzf $1 -C $outdir;;
+      *.tar)
+         tar xf $1 -C $outdir;;
+      *.7z | *.zip | *.gz | *.bz | *.bz2)
+         7z x -o$outdir $1;;
+      *.rar)
+         unrar x $1;;
+      *.Z)
+         uncompress $1;;
+      *)
+         echo "'$1' cannot be extracted via ex()";;
+   esac
 }
 
 # BEGIN_KITTY_SHELL_INTEGRATION
diff --git a/home_external/.config/sublime-text-3/Packages/User/Preferences.sublime-settings b/home_external/.config/sublime-text-3/Packages/User/Preferences.sublime-settings
index 22fac81..ec5cd32 100644
--- a/home_external/.config/sublime-text-3/Packages/User/Preferences.sublime-settings
+++ b/home_external/.config/sublime-text-3/Packages/User/Preferences.sublime-settings
@@ -44,4 +44,5 @@
    "use_tab_stops": false,
    "word_wrap": true,
    "wrap_width": 120,
+   "index_files": true,
 }
diff --git a/root_external/etc/ssh/sshd_config b/root_external/etc/ssh/sshd_config
index e414d3f..95ca100 100644
--- a/root_external/etc/ssh/sshd_config
+++ b/root_external/etc/ssh/sshd_config
@@ -63,10 +63,6 @@ PasswordAuthentication no
 
 # Change to yes to enable challenge-response passwords (beware issues with
 # some PAM modules and threads)
-# FIXME! outdated/ replaced by KbdInteractiveAuthentication?
-ChallengeResponseAuthentication no
-
-# Change to no to disable s/key passwords
 KbdInteractiveAuthentication no
 
 # Kerberos options
@@ -86,7 +82,7 @@ KbdInteractiveAuthentication no
 # be allowed through the KbdInteractiveAuthentication and
 # PasswordAuthentication.  Depending on your PAM configuration,
 # PAM authentication via KbdInteractiveAuthentication may bypass
-# the setting of "PermitRootLogin without-password".
+# the setting of "PermitRootLogin prohibit-password".
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
 # and KbdInteractiveAuthentication to 'no'.
@@ -122,10 +118,10 @@ PrintMotd no # pam does that
 AcceptEnv LANG LC_*
 
 # override default of no subsystems
-# DEACTIVATED because no need for sftp and differences between debian and arch
 # debian
 Subsystem   sftp   /usr/lib/openssh/sftp-server
 # arch
+# DEACTIVATED because no need for sftp and differences between debian and arch
 # Subsystem   sftp   /usr/lib/ssh/sftp-server
 
 # Example of overriding settings on a per-user basis
diff --git a/scripts/archive_and_compress.sh b/scripts/archive_and_compress.sh
new file mode 100755
index 0000000..1386094
--- /dev/null
+++ b/scripts/archive_and_compress.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+source=${1%/}; # cut off trailing "/"
+tar cfv $source.tar $source && xz $source.tar;
diff --git a/scripts/backup_edi.sh b/scripts/backup_edi.sh
index d1497f4..42d8ee2 100755
--- a/scripts/backup_edi.sh
+++ b/scripts/backup_edi.sh
@@ -1,35 +1,41 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-source /sync/home_external/.bash_aliases
+source /sync/scripts/backup_resources.sh
+# FSFIXME expand_aliases still needed?
 shopt -s expand_aliases # make aliases work
 
-
 ###############################
 ### update local backup dir ###
 ###############################
 
 BACKUP_DIR=/sync/backup
+ensureDirectory $BACKUP_DIR
 BACKUP_DIR_HOME=$BACKUP_DIR/home
-if [[ !($HOME/.bash_aliases_local -ef $BACKUP_DIR_HOME/.bash_aliases_local) ]]; then
-   ln $HOME/.bash_aliases_local $BACKUP_DIR_HOME/.bash_aliases_local
-fi
-rsync_backup --link-dest="$HOME/.ssh/" $HOME/.ssh/ $BACKUP_DIR_HOME/.ssh/
+ensureDirectory $BACKUP_DIR_HOME
+
+backupDirectory $HOME/.ssh/ $BACKUP_DIR_HOME/.ssh/
 
 BACKUP_DIR_ROOT=$BACKUP_DIR/root/etc
-sd rsync_backup --link-dest="/etc/ddclient/" /etc/ddclient/ $BACKUP_DIR_ROOT/ddclient/
-sd rsync_backup --link-dest="/etc/letsencrypt/" /etc/letsencrypt/ $BACKUP_DIR_ROOT/letsencrypt/
-sd rsync_backup --link-dest="/etc/nginx/" /etc/nginx/ $BACKUP_DIR_ROOT/nginx/
-sd rsync_backup --link-dest="/etc/ssh/" /etc/ssh/ $BACKUP_DIR_ROOT/ssh/
-sd rsync_backup --link-dest="/etc/wireguard/" /etc/wireguard/ $BACKUP_DIR_ROOT/wireguard/
-if [[ !(/etc/ddclient.conf -ef $BACKUP_DIR_ROOT/ddclient.conf) ]]; then
-   ln /etc/ddclient.conf $BACKUP_DIR_ROOT/ddclient.conf
-fi
+ensureRootDirectory $BACKUP_DIR_ROOT
 
+sd rsync_backup /etc/hosts $BACKUP_DIR_ROOT/
+sd rsync_backup /etc/ddclient.conf $BACKUP_DIR_ROOT/
+backupRootDirectory /etc/ddclient/ $BACKUP_DIR_ROOT/ddclient/
+backupRootDirectory /etc/letsencrypt/ $BACKUP_DIR_ROOT/letsencrypt/
+backupRootDirectory /etc/nginx/ $BACKUP_DIR_ROOT/nginx/
+backupRootDirectory /etc/ssh/ $BACKUP_DIR_ROOT/ssh/
+backupRootDirectory /etc/wireguard/ $BACKUP_DIR_ROOT/wireguard/
+backupRootDirectory /etc/docker/daemon.json $BACKUP_DIR_ROOT/docker/
 
 #####################
 ### upload backup ###
 #####################
 
+if [[ $# > 0 && "$1" == "--noupload" ]]; then
+   exit 0;
+fi
+
 sd rsync_backup -e "ssh -i /home/edi/.ssh/id_ed25519" --filter="P /home/docker" /sync/backup/ fabian@garrus:/citadel/backup/edi/
 sd rsync_backup -e "ssh -i /home/edi/.ssh/id_ed25519" /home/edi/docker/ fabian@garrus:/citadel/backup/edi/home/docker/
+echo "Note: remember to keep /citadel in sync!"
diff --git a/scripts/backup_garrus.sh b/scripts/backup_garrus.sh
index c8e24bb..bea10dc 100755
--- a/scripts/backup_garrus.sh
+++ b/scripts/backup_garrus.sh
@@ -1,22 +1,22 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-source /sync/home_external/.bash_aliases
+source /sync/scripts/backup_resources.sh
+# FSFIXME expand_aliases still needed?
 shopt -s expand_aliases # make aliases work
 
-
 ###############################
 ### update local backup dir ###
 ###############################
 
 BACKUP_DIR=/sync/backup
+ensureDirectory $BACKUP_DIR
 BACKUP_DIR_HOME=$BACKUP_DIR/home
-if [[ !($HOME/.bash_aliases_local -ef $BACKUP_DIR_HOME/.bash_aliases_local) ]]; then
-   ln $HOME/.bash_aliases_local $BACKUP_DIR_HOME/.bash_aliases_local
-fi
+ensureDirectory $BACKUP_DIR_HOME
 
 BACKUP_DIR_ROOT=$BACKUP_DIR/root/etc
-rsync_backup --link-dest="/etc/ssh/" /etc/ssh/ $BACKUP_DIR_ROOT/ssh/
+ensureRootDirectory $BACKUP_DIR_ROOT
+backupRootDirectory /etc/ssh/ $BACKUP_DIR_ROOT/ssh/
 if [[ !(-d $BACKUP_DIR_ROOT/udev/rules.d) ]]; then
    mkdir $BACKUP_DIR_ROOT/udev/rules.d
 fi
@@ -24,6 +24,7 @@ if [[ !(/etc/udev/rules.d/69-hdparm.rules -ef $BACKUP_DIR_ROOT/udev/rules.d/69-h
    ln /etc/udev/rules.d/69-hdparm.rules $BACKUP_DIR_ROOT/udev/rules.d/69-hdparm.rules
 fi
 
+backupRootDirectory /etc/ssh/ $BACKUP_DIR_ROOT/ssh/
 
 #####################
 ### upload backup ###
diff --git a/scripts/backup_resources.sh b/scripts/backup_resources.sh
new file mode 100644
index 0000000..c99b601
--- /dev/null
+++ b/scripts/backup_resources.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source /sync/home_external/.bash_aliases
+shopt -s expand_aliases # make aliases work
+
+
+backupRootDirectory() {
+   ensureRootDirectory $2
+   sd rsync_backup $1 $2
+}
+
+
+backupDirectory() {
+   ensureDirectory $2
+   rsync_backup $1 $2
+}
+
+
+ensureRootDirectory() {
+   ensureDirectory $1
+   sudo chown root:root $1
+}
+
+
+ensureDirectory() {
+   if [[ ! -d $1 ]]; then
+      mkdir -p $1
+   fi
+}
diff --git a/scripts/backup_shepard.sh b/scripts/backup_shepard.sh
index 84d9b1f..f14eb87 100755
--- a/scripts/backup_shepard.sh
+++ b/scripts/backup_shepard.sh
@@ -1,24 +1,27 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-source /sync/home_external/.bash_aliases
+source /sync/scripts/backup_resources.sh
+# FSFIXME expand_aliases still needed?
 shopt -s expand_aliases # make aliases work
 
-
 ###############################
 ### update local backup dir ###
 ###############################
 
 BACKUP_DIR=/sync/backup
+ensureDirectory $BACKUP_DIR
 BACKUP_DIR_HOME=$BACKUP_DIR/home
-if [[ !($HOME/.bash_aliases_local -ef $BACKUP_DIR_HOME/.bash_aliases_local) ]]; then
-   ln $HOME/.bash_aliases_local $BACKUP_DIR_HOME/.bash_aliases_local
-fi
-rsync_backup --link-dest="$HOME/.ssh/" $HOME/.ssh/ $BACKUP_DIR_HOME/.ssh/
+ensureDirectory $BACKUP_DIR_HOME
 
+backupDirectory $HOME/.ssh/ $BACKUP_DIR_HOME/.ssh/
 
 #####################
 ### upload backup ###
 #####################
 
+if [[ "$1" == "--noupload" ]]; then
+   exit 0;
+fi
+
 sd rsync_backup -e "ssh -i /home/fabian/.ssh/id_ed25519" $BACKUP_DIR/ fabian@garrus:/citadel/backup/shepard/
diff --git a/scripts/decompress_and_unarchive.sh b/scripts/decompress_and_unarchive.sh
new file mode 100755
index 0000000..b0f34c2
--- /dev/null
+++ b/scripts/decompress_and_unarchive.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+source=$1;
+archive=${source%.xz}; # cut off trailing ".xz"
+unxz $source && tar xfv $archive
diff --git a/scripts/dockerContainerAction.sh b/scripts/dockerContainerAction.sh
index 74a4e1f..87e2da9 100644
--- a/scripts/dockerContainerAction.sh
+++ b/scripts/dockerContainerAction.sh
@@ -16,7 +16,7 @@ upDownContainers() {
          continue;
       fi
       cd $subdir;
-      docker-compose $@;
+      docker compose $@;
    done
 }
 
diff --git a/scripts/escapeFilenames.sh b/scripts/escapeFilenames.sh
index d0c350f..e41eb3e 100755
--- a/scripts/escapeFilenames.sh
+++ b/scripts/escapeFilenames.sh
@@ -11,6 +11,8 @@ replacements[':']='_';
 replacements["'"]='_';
 replacements['(']='_';
 replacements[')']='_';
+replacements['[']='_';
+replacements[']']='_';
 while [[ $# > 0 ]]; do
    replacements["$1"]="$2";
    shift 2;
diff --git a/scripts/mount_edi.sh b/scripts/mount_edi.sh
index 9ed5648..8eec9bb 100755
--- a/scripts/mount_edi.sh
+++ b/scripts/mount_edi.sh
@@ -3,4 +3,4 @@ set -euo pipefail
 
 source /sync/scripts/mount_general.sh
 
-sshMount edi edi fabian FabisDokumente
+sshMount edi edi fabian FabisDokumente media Medien
diff --git a/scripts/mount_garrus.sh b/scripts/mount_garrus.sh
index 1f99015..47f14a8 100755
--- a/scripts/mount_garrus.sh
+++ b/scripts/mount_garrus.sh
@@ -3,4 +3,4 @@ set -euo pipefail
 
 source /sync/scripts/mount_general.sh
 
-sshMount fabian garrus fabian FabisDokumente media Filme
+sshMount fabian garrus fabian FabisDokumente media Medien
diff --git a/scripts/mount_general.sh b/scripts/mount_general.sh
index 6e87eba..1a16264 100644
--- a/scripts/mount_general.sh
+++ b/scripts/mount_general.sh
@@ -2,10 +2,12 @@
 set -euo pipefail
 
 sshMount () {
+   serverUser=$1;
+   serverHost=$2;
+   shift 2;
    args=($@)
-   args=(${args[@]:2})
    for ((i=0; i < ${#args[@]}; i=i + 2)); do
-      sshfs $1@$2:/citadel/${args[$i]}/ /home/fabian/${args[$i + 1]}/ -o reconnect,ServerAliveInterval=15,ServerAliveCountMax=8
+      sshfs ${serverUser}@${serverHost}:/citadel/${args[$i]}/ $HOME/${args[$i + 1]}/ -o reconnect,ServerAliveInterval=15,ServerAliveCountMax=8
    done
 }
 
diff --git a/scripts/reencode_audio.sh b/scripts/reencode_audio.sh
index 814eb43..511ea6d 100755
--- a/scripts/reencode_audio.sh
+++ b/scripts/reencode_audio.sh
@@ -5,7 +5,7 @@ set -euo pipefail
 dir="$(pwd)"
 dest=${dir%/*}/${dir##*/}_reencode
 if [[ !(-d $dest) ]]; then
-   mkdir $dest
+   mkdir "$dest"
 fi
 
 for file in ./*.$1; do
diff --git a/scripts/reencode_m4a.sh b/scripts/reencode_m4a.sh
index 38e1bcc..8ddc742 100755
--- a/scripts/reencode_m4a.sh
+++ b/scripts/reencode_m4a.sh
@@ -21,7 +21,7 @@ fi
 dir="$(pwd)"
 dest=${dir%/*}/${dir##*/}_reencode
 if [[ !(-d $dest) ]]; then
-   mkdir $dest
+   mkdir "$dest"
 fi
 
 for file in ./*.m4a; do
diff --git a/scripts/transcode_flac.sh b/scripts/transcode_flac.sh
new file mode 100755
index 0000000..161499c
--- /dev/null
+++ b/scripts/transcode_flac.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# evaluate options through given arguments
+file_suffix='wav'
+map=
+while [[ $# > 0 ]]; do
+   case $1 in
+      -t | --type) file_suffix=$2; shift 2;;
+      -map       ) map='-map 0:0'; shift;;
+      *          )                 break ;; # Anything else stops command line processing.
+   esac
+done
+
+# ensure existence of destination folder
+dir="$(pwd)"
+dest=${dir%/*}/${dir##*/}_flac
+if [[ !(-d $dest) ]]; then
+   mkdir "$dest"
+fi
+
+for file in ./*.$file_suffix; do
+   echo "ffmpeg -i '$file' -c:a flac $map '$dest/${file%$file_suffix}flac'";
+   ffmpeg -i "$file" -c:a flac $map "$dest/${file%$file_suffix}flac";
+done
diff --git a/scripts/transcode_opus.sh b/scripts/transcode_opus.sh
index 8ca6e3a..f3da181 100755
--- a/scripts/transcode_opus.sh
+++ b/scripts/transcode_opus.sh
@@ -16,7 +16,7 @@ done
 dir="$(pwd)"
 dest=${dir%/*}/${dir##*/}_ogg
 if [[ !(-d $dest) ]]; then
-   mkdir $dest
+   mkdir "$dest"
 fi
 
 for file in ./*.$file_suffix; do
diff --git a/scripts/unmount_edi.sh b/scripts/unmount_edi.sh
index 02c54ea..ddf8375 100755
--- a/scripts/unmount_edi.sh
+++ b/scripts/unmount_edi.sh
@@ -3,4 +3,4 @@ set -euo pipefail
 
 source /sync/scripts/unmount_general.sh
 
-sshUnmount FabisDokumente
+sshUnmount FabisDokumente Medien
diff --git a/scripts/unmount_garrus.sh b/scripts/unmount_garrus.sh
index 9e986df..ddf8375 100755
--- a/scripts/unmount_garrus.sh
+++ b/scripts/unmount_garrus.sh
@@ -3,4 +3,4 @@ set -euo pipefail
 
 source /sync/scripts/unmount_general.sh
 
-sshUnmount FabisDokumente Filme
+sshUnmount FabisDokumente Medien