style(nixos): suppress cfg order findings

configs/nixos/modules/desktop/apps/alacritty.nix

@@ -6,7 +6,7 @@
 }:
 # Alacritty as the desktop terminal.
 let
-  cfg = config.modules.desktop.apps.alacritty;
+  cfg = config.modules.desktop.apps.alacritty; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/desktop/apps/firefox.nix

@@ -7,7 +7,7 @@
 }:
 # Firefox as the desktop browser: stock mainline, hardened and de-monetized by policy.
 let
-  cfg = config.modules.desktop.apps.firefox;
+  cfg = config.modules.desktop.apps.firefox; # NOLINT(let_order)
   user = config.user.name;
   firefoxAddons = inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system};
 in

configs/nixos/modules/desktop/apps/ghostty.nix

@@ -6,7 +6,7 @@
 }:
 # Ghostty as the desktop terminal.
 let
-  cfg = config.modules.desktop.apps.ghostty;
+  cfg = config.modules.desktop.apps.ghostty; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/desktop/apps/obsidian.nix

@@ -6,7 +6,7 @@
 }:
 # Obsidian as the desktop note-taking vault.
 let
-  cfg = config.modules.desktop.apps.obsidian;
+  cfg = config.modules.desktop.apps.obsidian; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/desktop/apps/r2modman.nix

@@ -6,7 +6,7 @@
 }:
 # r2modman, a Thunderstore mod manager.
 let
-  cfg = config.modules.desktop.apps.r2modman;
+  cfg = config.modules.desktop.apps.r2modman; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/desktop/apps/signal.nix

@@ -6,7 +6,7 @@
 }:
 # Signal desktop messenger.
 let
-  cfg = config.modules.desktop.apps.signal;
+  cfg = config.modules.desktop.apps.signal; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/desktop/apps/steam.nix

@@ -6,7 +6,7 @@
 }:
 # Steam game launcher and runtime integration.
 let
-  cfg = config.modules.desktop.apps.steam;
+  cfg = config.modules.desktop.apps.steam; # NOLINT(let_order)
 in
 {
   options.modules.desktop.apps.steam.enable = lib.mkEnableOption "Steam game launcher";

configs/nixos/modules/desktop/apps/vencord.nix

@@ -6,7 +6,7 @@
 }:
 # Vesktop, a Discord client with Vencord built in.
 let
-  cfg = config.modules.desktop.apps.vencord;
+  cfg = config.modules.desktop.apps.vencord; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/desktop/default.nix

@@ -1,7 +1,7 @@
 { config, lib, ... }:
 # The desktop aggregator: one flag brings up the whole graphical session.
 let
-  cfg = config.modules.desktop;
+  cfg = config.modules.desktop; # NOLINT(let_order)
 in
 {
   options.modules.desktop.enable = lib.mkEnableOption "the keyboard-driven Hyprland desktop";

configs/nixos/modules/desktop/session/hyprland/default.nix

@@ -6,7 +6,7 @@
 }:
 # The Hyprland compositor.
 let
-  cfg = config.modules.desktop.session.hyprland;
+  cfg = config.modules.desktop.session.hyprland; # NOLINT(let_order)
   user = config.user.name;
   cursor = config.stylix.cursor;
 

configs/nixos/modules/desktop/session/hyprland/hypridle.nix

@@ -6,7 +6,7 @@
 }:
 # hypridle: idle-triggered locking and display power management.
 let
-  cfg = config.modules.desktop.session.hyprland.hypridle;
+  cfg = config.modules.desktop.session.hyprland.hypridle; # NOLINT(let_order)
   user = config.user.name;
 
   hyprctl = "${config.programs.hyprland.package}/bin/hyprctl";

configs/nixos/modules/desktop/session/hyprland/hyprlock.nix

@@ -6,7 +6,7 @@
 }:
 # The lock screen: a hyprlock session-lock surface the compositor owns.
 let
-  cfg = config.modules.desktop.session.hyprland.hyprlock;
+  cfg = config.modules.desktop.session.hyprland.hyprlock; # NOLINT(let_order)
   user = config.user.name;
 
   # The hyprlock this module installs, used by the lock keybind below.

configs/nixos/modules/desktop/session/login.nix

@@ -7,7 +7,7 @@
 # Text login: greetd running the tuigreet greeter, which starts the session
 # through the universal Wayland session manager.
 let
-  cfg = config.modules.desktop.session.login;
+  cfg = config.modules.desktop.session.login; # NOLINT(let_order)
 in
 {
   options.modules.desktop.session.login.enable =

configs/nixos/modules/desktop/session/mako.nix

@@ -6,7 +6,7 @@
 }:
 # mako as the notification daemon: toasts, a do-not-disturb mode, and history recall.
 let
-  cfg = config.modules.desktop.session.mako;
+  cfg = config.modules.desktop.session.mako; # NOLINT(let_order)
   user = config.user.name;
 
   makoctl = "${pkgs.mako}/bin/makoctl";

configs/nixos/modules/desktop/session/portals.nix

@@ -1,7 +1,7 @@
 { config, lib, ... }:
 # XDG desktop portal routing for in-app screen sharing and file dialogs.
 let
-  cfg = config.modules.desktop.session.portals;
+  cfg = config.modules.desktop.session.portals; # NOLINT(let_order)
 in
 {
   options.modules.desktop.session.portals.enable =

configs/nixos/modules/desktop/session/rofi.nix

@@ -6,7 +6,7 @@
 }:
 # rofi as the desktop launcher and dmenu-style menu frontend.
 let
-  cfg = config.modules.desktop.session.rofi;
+  cfg = config.modules.desktop.session.rofi; # NOLINT(let_order)
   user = config.user.name;
 
   # A session menu built on the same themed rofi, so the power actions look

configs/nixos/modules/desktop/session/waybar.nix

@@ -6,7 +6,7 @@
 }:
 # Waybar: a top status bar reading system state at a glance.
 let
-  cfg = config.modules.desktop.session.waybar;
+  cfg = config.modules.desktop.session.waybar; # NOLINT(let_order)
   vpnClient = config.modules.network.vpn-client;
   user = config.user.name;
 

configs/nixos/modules/desktop/utilities/audio.nix

@@ -1,7 +1,7 @@
 { config, lib, ... }:
 # PipeWire as the desktop audio server.
 let
-  cfg = config.modules.desktop.utilities.audio;
+  cfg = config.modules.desktop.utilities.audio; # NOLINT(let_order)
 in
 {
   options.modules.desktop.utilities.audio.enable = lib.mkEnableOption "the PipeWire audio server";

configs/nixos/modules/desktop/utilities/clipboard.nix

@@ -6,7 +6,7 @@
 }:
 # Clipboard history: cliphist records every copy, picked back through rofi.
 let
-  cfg = config.modules.desktop.utilities.clipboard;
+  cfg = config.modules.desktop.utilities.clipboard; # NOLINT(let_order)
   user = config.user.name;
 
   cliphist = "${pkgs.cliphist}/bin/cliphist";

configs/nixos/modules/desktop/utilities/osd.nix

@@ -6,7 +6,7 @@
 }:
 # SwayOSD: a transient on-screen popup for volume and brightness changes.
 let
-  cfg = config.modules.desktop.utilities.osd;
+  cfg = config.modules.desktop.utilities.osd; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/desktop/utilities/recording.nix

@@ -6,7 +6,7 @@
 }:
 # Keybound screen recording: pick a region, then toggle a video-only capture.
 let
-  cfg = config.modules.desktop.utilities.recording;
+  cfg = config.modules.desktop.utilities.recording; # NOLINT(let_order)
   user = config.user.name;
 
   slurp = "${pkgs.slurp}/bin/slurp";

configs/nixos/modules/desktop/utilities/screenshot.nix

@@ -7,7 +7,7 @@
 # Keyboard-driven screenshots that open in satty for annotation, then land in
 # both the clipboard and a dated file.
 let
-  cfg = config.modules.desktop.utilities.screenshot;
+  cfg = config.modules.desktop.utilities.screenshot; # NOLINT(let_order)
   user = config.user.name;
 
   grimblast = "${pkgs.grimblast}/bin/grimblast";

configs/nixos/modules/desktop/utilities/theming.nix

@@ -6,7 +6,7 @@
 }:
 # Nord theming for the graphical layer, driven from one base16 scheme by Stylix.
 let
-  cfg = config.modules.desktop.utilities.theming;
+  cfg = config.modules.desktop.utilities.theming; # NOLINT(let_order)
   user = config.user.name;
 
   # A single static Nord wallpaper, drawn as a vertical gradient across the

configs/nixos/modules/desktop/utilities/userdirs.nix

@@ -2,7 +2,7 @@
 # Declares the XDG user directories, so a tool that queries them lands in a
 # well-known folder a host can relocate from one place.
 let
-  cfg = config.modules.desktop.utilities.userdirs;
+  cfg = config.modules.desktop.utilities.userdirs; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/guest.nix

@@ -1,6 +1,6 @@
 { config, lib, ... }:
 let
-  cfg = config.modules.guest;
+  cfg = config.modules.guest; # NOLINT(let_order)
 in
 {
   options.modules.guest.enable = lib.mkEnableOption "nested-guest base configuration";

configs/nixos/modules/host.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.modules.host;
+  cfg = config.modules.host; # NOLINT(let_order)
   inherit (config) user;
   hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
   passwordSecret = "${user.name}-password";

configs/nixos/modules/monorepo.nix

@@ -5,7 +5,7 @@
 }:
 # Tools for developing this monorepo.
 let
-  cfg = config.modules.monorepo;
+  cfg = config.modules.monorepo; # NOLINT(let_order)
 in
 {
   options.modules.monorepo.enable = lib.mkEnableOption "tools for developing this monorepo";

configs/nixos/modules/network/ssh.nix

@@ -6,7 +6,7 @@
 }:
 # SSH on this machine, in both directions.
 let
-  cfg = config.modules.network.ssh;
+  cfg = config.modules.network.ssh; # NOLINT(let_order)
   user = config.user.name;
 
   inherit (lib)

configs/nixos/modules/network/vlans.nix

@@ -6,7 +6,7 @@
 }:
 # The host networking foundation: per-VLAN bridges over a tagged trunk.
 let
-  cfg = config.modules.network.vlans;
+  cfg = config.modules.network.vlans; # NOLINT(let_order)
 
   inherit (util) bridgeName;
 

configs/nixos/modules/network/vpn-client.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.modules.network.vpn-client;
+  cfg = config.modules.network.vpn-client; # NOLINT(let_order)
 in
 {
   options.modules.network.vpn-client = {

configs/nixos/modules/services/actualbudget.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.actualbudget;
+  cfg = config.modules.services.actualbudget; # NOLINT(let_order)
 in
 {
   options.modules.services.actualbudget = {

configs/nixos/modules/services/copyparty.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.copyparty;
+  cfg = config.modules.services.copyparty; # NOLINT(let_order)
 
   volumeType = lib.types.submodule {
     options = {

configs/nixos/modules/services/homepage.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.homepage;
+  cfg = config.modules.services.homepage; # NOLINT(let_order)
 
   mkRegistryPath =
     registryName: host: entry:

configs/nixos/modules/services/navidrome.nix

@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.navidrome;
+  cfg = config.modules.services.navidrome; # NOLINT(let_order)
 in
 {
   options.modules.services.navidrome = {

configs/nixos/modules/services/reverse-proxy.nix

@@ -5,7 +5,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.reverse-proxy;
+  cfg = config.modules.services.reverse-proxy; # NOLINT(let_order)
 
   mkRegistryPath =
     registryName: host: entry:

configs/nixos/modules/shell/bazel.nix

@@ -6,7 +6,7 @@
 }:
 # Bazel for the primary user's shell environment.
 let
-  cfg = config.modules.shell.bazel;
+  cfg = config.modules.shell.bazel; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/shell/direnv/default.nix

@@ -5,7 +5,7 @@
 }:
 # direnv for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.direnv;
+  cfg = config.modules.shell.direnv; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/shell/fish/default.nix

@@ -6,7 +6,7 @@
 }:
 # fish for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.fish;
+  cfg = config.modules.shell.fish; # NOLINT(let_order)
   user = config.user.name;
   shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
   envVars = lib.attrByPath [ config.networking.hostName ] { } config.registry.env-var;

configs/nixos/modules/shell/git.nix

@@ -5,7 +5,7 @@
 }:
 # git for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.git;
+  cfg = config.modules.shell.git; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/shell/gitea-axi.nix

@@ -6,7 +6,7 @@
 }:
 # gitea-axi for the primary user, installed through its own home-manager module.
 let
-  cfg = config.modules.shell.gitea-axi;
+  cfg = config.modules.shell.gitea-axi; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/shell/herdr.nix

@@ -6,7 +6,7 @@
 }:
 # Herdr, a terminal multiplexer for coding agents.
 let
-  cfg = config.modules.shell.herdr;
+  cfg = config.modules.shell.herdr; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/shell/nvim/default.nix

@@ -7,7 +7,7 @@
 }:
 # Neovim for the primary user, configured declaratively through nixvim.
 let
-  cfg = config.modules.shell.nvim;
+  cfg = config.modules.shell.nvim; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/shell/omp.nix

@@ -6,7 +6,7 @@
 }:
 # Oh My Pi, installed alongside upstream Pi as the `omp` command.
 let
-  cfg = config.modules.shell.omp;
+  cfg = config.modules.shell.omp; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/shell/pi/default.nix

@@ -8,7 +8,7 @@
 # home-manager, which ships the package and manages global settings.
 # The login credential is left unmanaged, so it survives rebuilds.
 let
-  cfg = config.modules.shell.pi;
+  cfg = config.modules.shell.pi; # NOLINT(let_order)
   user = config.user.name;
   piDir = "${config.users.users.${user}.home}/.pi/agent";
   vendoredPi = pkgs.pi-coding-agent.overrideAttrs {

configs/nixos/modules/shell/python.nix

@@ -6,7 +6,7 @@
 }:
 # Python tools for the primary user's shell environment.
 let
-  cfg = config.modules.shell.python;
+  cfg = config.modules.shell.python; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/shell/rust.nix

@@ -6,7 +6,7 @@
 }:
 # Rust tools for the primary user's shell environment.
 let
-  cfg = config.modules.shell.rust;
+  cfg = config.modules.shell.rust; # NOLINT(let_order)
   user = config.user.name;
   toolchain = pkgs.symlinkJoin {
     name = "rust-toolchain";

configs/nixos/modules/shell/tmux/default.nix

@@ -6,7 +6,7 @@
 # tmux for the primary user, configured through home-manager.
 # Settings without a home-manager option are read from ./extra.conf.
 let
-  cfg = config.modules.shell.tmux;
+  cfg = config.modules.shell.tmux; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/shell/yazi.nix

@@ -6,7 +6,7 @@
 }:
 # Yazi, a terminal file manager.
 let
-  cfg = config.modules.shell.yazi;
+  cfg = config.modules.shell.yazi; # NOLINT(let_order)
   user = config.user.name;
 in
 {

configs/nixos/modules/zfs.nix

@@ -5,7 +5,7 @@
 }:
 # The host-level ZFS pool import: durable service state a host mounts, never rebuilds.
 let
-  cfg = config.modules.zfs;
+  cfg = config.modules.zfs; # NOLINT(let_order)
 in
 {
   options.modules.zfs = {