diff --git a/.config/zsh/rc.d/05-pre-omz.zsh b/.config/zsh/rc.d/05-pre-omz.zsh
new file mode 100644
index 0000000..e99da84
--- /dev/null
+++ b/.config/zsh/rc.d/05-pre-omz.zsh
@@ -0,0 +1,30 @@
+# Everything that has to be set before oh-my-zsh is sourced, and nothing else.
+#
+# oh-my-zsh reads the theme and its own settings while being sourced, so any of
+# these placed in a role file - which comes afterwards - is silently ignored.
+# The first attempt put ZSH_THEME in the role file and produced a shell that
+# reported the right value while running without powerlevel10k at all.
+#
+# The role COLOUR is deliberately NOT here. ~/.p10k.zsh assigns
+# POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced later from
+# 30-path.zsh, so a colour set here is overwritten before the first prompt is
+# drawn. It belongs in the role files, which run after that.
+
+if [[ -d "${ZSH_CUSTOM:-$ZSH/custom}/themes/powerlevel10k" ]]; then
+  ZSH_THEME="powerlevel10k/powerlevel10k"
+elif [[ "$ROLE" == "server" ]]; then
+  # What shron already used. Without this it would silently fall back to
+  # oh-my-zsh's default, which is a change nobody asked for.
+  ZSH_THEME="ys"
+fi
+
+case "$ROLE" in
+  server)
+    # A server should not decide on its own to go fetching updates while
+    # someone is logged in trying to fix something.
+    DISABLE_AUTO_UPDATE="true"
+    ;;
+  *)
+    zstyle ':omz:update' mode auto
+    ;;
+esac
diff --git a/.config/zsh/rc.d/05-prompt.zsh b/.config/zsh/rc.d/05-prompt.zsh
deleted file mode 100644
index 6e9e41d..0000000
--- a/.config/zsh/rc.d/05-prompt.zsh
+++ /dev/null
@@ -1,15 +0,0 @@
-# Theme selection. Sourced by the stub BEFORE oh-my-zsh, and that placement is
-# the point of the file.
-#
-# oh-my-zsh loads the theme while it is being sourced, so ZSH_THEME set
-# afterwards is ignored - the first attempt put it in the role file and produced
-# a shell reporting the right value while running without powerlevel10k at all.
-#
-# The role COLOUR is deliberately not here. ~/.p10k.zsh sets
-# POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced later, so a colour set
-# here is overwritten before the first prompt is ever drawn. It lives in the
-# role files, which come after.
-
-if [[ -d "${ZSH_CUSTOM:-$ZSH/custom}/themes/powerlevel10k" ]]; then
-  ZSH_THEME="powerlevel10k/powerlevel10k"
-fi
diff --git a/.config/zsh/rc.d/50-server.zsh b/.config/zsh/rc.d/50-server.zsh
index dba9dd0..4ff92b9 100644
--- a/.config/zsh/rc.d/50-server.zsh
+++ b/.config/zsh/rc.d/50-server.zsh
@@ -1,15 +1,100 @@
-# Role: server (shron - Arch, headless)
+# Role: server (shron - Arch, headless, mail/web/cloud)
 #
-# Deliberately thin. A server shell wants to be recognisable and otherwise get
-# out of the way; anything that assumes a graphical session belongs in
-# 50-desktop.zsh.
+# The theme and DISABLE_AUTO_UPDATE are in 05-pre-omz.zsh, because oh-my-zsh
+# reads them while it is being sourced.
 
-# Role colour, set here rather than in 05-prompt.zsh because ~/.p10k.zsh
-# assigns POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced in 30-path.zsh.
-# Anything set before that is silently replaced. Not decoration: shron carries
-# mail, web and cloud, and a glance should say which machine this is.
+# Role colour, set here rather than earlier because ~/.p10k.zsh assigns
+# POWERLEVEL9K_CONTEXT_BACKGROUND itself and is sourced in 30-path.zsh.
+#
+# Note that this only takes effect where powerlevel10k is installed, and on
+# shron it is not - the ys theme has no equivalent. The colour is kept anyway
+# so it works the moment p10k arrives, but the red prompt cannot be relied on
+# as a safeguard there today.
 typeset -g POWERLEVEL9K_CONTEXT_BACKGROUND=red
-# Show the host even in a local shell. Noise on a desktop; here it is the one
-# thing worth always having in view.
 typeset -g POWERLEVEL9K_ALWAYS_SHOW_CONTEXT=true
 
+# German locale. The base does not set one, since the desktop inherits it from
+# the session and the Mac has its own; an SSH session brings only what the
+# client sends, which is usually nothing useful.
+export LANG=de_DE.UTF-8
+export LANGUAGE=de_DE.UTF-8
+export LC_MESSAGES=de_DE.UTF-8
+export LC_ALL=de_DE.UTF-8
+
+# vim rather than the base's nvim. Both are installed here; this is the
+# existing preference and there is no reason to change it from a distance.
+alias vi="vim"
+
+# Colours for ls, from a file that only exists on this machine.
+[[ -f "$HOME/.dircolors" ]] && eval "$(dircolors "$HOME/.dircolors")"
+
+# Block a single address permanently.
+ipt-block() {
+  sudo iptables -A INPUT -s "$1" -j DROP
+  echo "permblocked $1"
+}
+
+# Lift a CrowdSec ban and whitelist the address for a while. The message says
+# one hour, the command says twelve - left as it was rather than guessing which
+# one was meant.
+whitelist() {
+    if [[ -z "$1" ]]; then
+        echo "Bitte geben Sie eine IP-Adresse an."
+        return 1
+    fi
+
+    local ip="$1"
+    sudo cscli decisions delete --ip "$ip"
+    sudo cscli decisions add --ip "$ip" --duration 12h --type whitelist --reason "Manuell whitelisted"
+    echo "IP $ip wurde für 1 Stunde whitelisted und entbannt."
+}
+
+# Is the running kernel still the installed one?
+reboot_required() {
+  local installed running
+  installed=$(pacman -Q linux-lts | sed 's/linux-lts //')
+  running=$(uname -r | sed 's/-lts//')
+
+  if [[ "$installed" == "$running" ]]; then
+    echo "no reboot required."
+  else
+    echo "reboot required!"
+  fi
+}
+
+# Pull the OpenBL list into an iptables chain.
+#
+# Carried over unchanged, but it does not work: www.openbl.org answers 301 and
+# the curl call has no -L, so the download returns nothing and the function
+# reports "Blacklist download failed" every time. Kept rather than deleted
+# because the iptables chain it manages may still exist and be worth cleaning
+# up deliberately - CrowdSec covers this ground now.
+update-blacklist() {
+  local CHAINLIST BLACKLIST IPCOUNT
+  CHAINLIST=$(sudo /sbin/iptables -nL | grep 'Chain block-traffic-from-openbl' | cut -d' ' -f 2)
+
+  if [ -z "$CHAINLIST" ]; then
+    sudo /sbin/iptables -N block-traffic-from-openbl
+    sudo /sbin/iptables -A INPUT -j block-traffic-from-openbl
+  fi
+
+  BLACKLIST=$(/usr/bin/curl -fs http://www.openbl.org/lists/base_7days.txt.gz | gunzip | grep -E "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}")
+
+  if [ -z "$BLACKLIST" ]; then
+    echo "Blacklist download failed."
+    return 1
+  fi
+
+  sudo /sbin/iptables -F block-traffic-from-openbl
+  IPCOUNT=$(echo "$BLACKLIST" | tr ' ' '\n' | wc -l)
+  echo "Adding $IPCOUNT IPs to blacklist. - $(date)"
+
+  echo "$BLACKLIST" | tr ' ' '\n' | while read -r line ; do
+    case "$line" in \#*) continue ;; esac
+    sudo /sbin/iptables -A block-traffic-from-openbl -p tcp -s "$line" -j REJECT --reject-with tcp-reset
+  done
+}
+
+# The previous configuration exported PYTHONPATH=/usr/lib/python3.4/site-packages.
+# Python 3.4 has not shipped with Arch for years and the directory is gone, so
+# it is not carried over. beastix had the same line pointing at 3.9.
diff --git a/.zshrc b/.zshrc
index b7706f4..21049fc 100644
--- a/.zshrc
+++ b/.zshrc
@@ -41,12 +41,10 @@ for _p in $_want_plugins; do
 done
 unset _p _want_plugins
 
-zstyle ':omz:update' mode auto
-
-# Also before oh-my-zsh: it loads the theme while sourcing, and powerlevel10k
-# reads its settings when it loads. Putting either in the role file - which is
-# sourced afterwards - leaves the value set and the theme unloaded.
-[[ -r "$HOME/.config/zsh/rc.d/05-prompt.zsh" ]] && source "$HOME/.config/zsh/rc.d/05-prompt.zsh"
+# Theme and oh-my-zsh's own settings, which it reads while being sourced.
+# Anything of that kind placed in a role file - which comes afterwards - is
+# silently ignored, so it lives here instead.
+[[ -r "$HOME/.config/zsh/rc.d/05-pre-omz.zsh" ]] && source "$HOME/.config/zsh/rc.d/05-pre-omz.zsh"
 
 source "$ZSH/oh-my-zsh.sh"