feat(nixos): migrate system configuration

configs/nixos/modules/desktop/apps/alacritty.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Alacritty as the desktop terminal.
+let
+  cfg = config.modules.desktop.apps.alacritty;
+  user = config.user.name;
+in
+{
+  options.modules.desktop.apps.alacritty.enable = lib.mkEnableOption "Alacritty as the desktop terminal";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user}.home.packages = [ pkgs.alacritty ];
+  };
+}

configs/nixos/modules/desktop/apps/firefox.nix

@@ -0,0 +1,129 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+# Firefox as the desktop browser: stock mainline, hardened and de-monetized by policy.
+let
+  cfg = config.modules.desktop.apps.firefox;
+  user = config.user.name;
+  firefoxAddons = inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system};
+in
+{
+  options.modules.desktop.apps.firefox.enable = lib.mkEnableOption "Firefox as the desktop browser";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user} = hm: {
+      programs.firefox = {
+        enable = true;
+
+        # Enterprise policies: enforced and unchangeable from the browser UI.
+        policies = {
+          DisableTelemetry = true;
+          DisableFirefoxStudies = true;
+          DisablePocket = true;
+          OfferToSaveLogins = false;
+          DontCheckDefaultBrowser = true;
+          DisableFirefoxAccounts = true;
+
+          # Strip the monetized surfaces from the new-tab page.
+          FirefoxHome = {
+            SponsoredTopSites = false;
+            SponsoredPocket = false;
+            Snippets = false;
+          };
+        };
+
+        profiles.default = {
+          isDefault = true;
+
+          extensions = {
+            packages = with firefoxAddons; [
+              ublock-origin
+              proton-pass
+              sponsorblock
+            ];
+
+            # The Nord chrome theme is a declared extension setting, so home-manager
+            # owns the extension-settings store, overwriting runtime changes to it.
+            force = true;
+          };
+
+          # Stylix's Nord mapping paints the selected address-bar result a
+          # near-white grey, leaving its light text unreadable. Darken that one
+          # highlight to the Nord selection grey, from the same scheme.
+          extensions.settings."FirefoxColor@mozilla.com".settings.theme.colors.popup_highlight =
+            let
+              c = hm.config.lib.stylix.colors;
+            in
+            lib.mkForce {
+              r = c."base03-rgb-r";
+              g = c."base03-rgb-g";
+              b = c."base03-rgb-b";
+            };
+
+          settings = {
+            # Scale the UI and page by a fixed factor.
+            # Left at auto (-1), Firefox reads the panel's 1.5x and inflates its
+            # whole chrome while point-sized apps stay put.
+            # A shade under that brings it into line without dropping to true
+            # 1:1, which reads too small at this DPI.
+            "layout.css.devPixelsPerPx" = "1.25";
+
+            # Auto-enable the sideloaded Firefox Color add-on carrying the Nord
+            # chrome theme, which Firefox otherwise leaves disabled.
+            "extensions.autoDisableScopes" = 0;
+
+            # Sponsored surfaces the policies above do not reach.
+            "browser.urlbar.suggest.quicksuggest.sponsored" = false;
+            "browser.newtabpage.activity-stream.showSponsored" = false;
+            "browser.newtabpage.activity-stream.showSponsoredTopSites" = false;
+          };
+
+          search = {
+            # Declaring search overwrites Firefox's own engine list wholesale,
+            # so engines added later in the UI do not survive a rebuild.
+            force = true;
+            default = "ddg";
+
+            # The general-purpose commercial engines, hidden to leave a lean
+            # DuckDuckGo-and-Wikipedia list. They stay reachable through bangs.
+            # An engine carrying only metaData is treated as a builtin.
+            engines = {
+              google.metaData.hidden = true;
+              bing.metaData.hidden = true;
+              ebay.metaData.hidden = true;
+              "amazondotcom-us".metaData.hidden = true;
+            };
+            order = [ "ddg" ];
+          };
+        };
+      };
+
+      # Nord chrome for the one profile, applied through the Stylix-managed
+      # Firefox Color add-on that colorTheme enables.
+      stylix.targets.firefox = {
+        enable = true;
+        profileNames = [ "default" ];
+        colorTheme.enable = true;
+      };
+
+      # Links opened from other applications land in Firefox.
+      xdg.mimeApps = {
+        enable = true;
+        defaultApplications = {
+          "text/html" = "firefox.desktop";
+          "application/xhtml+xml" = "firefox.desktop";
+          "x-scheme-handler/http" = "firefox.desktop";
+          "x-scheme-handler/https" = "firefox.desktop";
+        };
+      };
+
+      # Firefox writes profiles.ini itself on first launch, so home-manager is
+      # told to own the file rather than fail activation refusing to clobber it.
+      home.file."${hm.config.programs.firefox.configPath}/profiles.ini".force = true;
+    };
+  };
+}

configs/nixos/modules/desktop/apps/ghostty.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Ghostty as the desktop terminal.
+let
+  cfg = config.modules.desktop.apps.ghostty;
+  user = config.user.name;
+in
+{
+  options.modules.desktop.apps.ghostty.enable = lib.mkEnableOption "Ghostty as the desktop terminal";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user}.home.packages = [ pkgs.ghostty ];
+  };
+}

configs/nixos/modules/desktop/apps/obsidian.nix

@@ -0,0 +1,18 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Obsidian as the desktop note-taking vault.
+let
+  cfg = config.modules.desktop.apps.obsidian;
+  user = config.user.name;
+in
+{
+  options.modules.desktop.apps.obsidian.enable = lib.mkEnableOption "Obsidian as the desktop note-taking vault";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user}.home.packages = [ pkgs.obsidian ];
+  };
+}

configs/nixos/modules/desktop/apps/steam.nix

@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Steam game launcher and runtime integration.
+let
+  cfg = config.modules.desktop.apps.steam;
+in
+{
+  options.modules.desktop.apps.steam.enable = lib.mkEnableOption "Steam game launcher";
+
+  config = lib.mkIf cfg.enable {
+    programs.steam = {
+      enable = true;
+      package = pkgs.steam.override {
+        extraEnv.STEAM_FORCE_DESKTOPUI_SCALING = "1.5";
+      };
+    };
+
+    hardware.steam-hardware.enable = true;
+  };
+}

configs/nixos/modules/desktop/default.nix

@@ -0,0 +1,30 @@
+{ config, lib, ... }:
+# The desktop aggregator: one flag brings up the whole graphical session.
+let
+  cfg = config.modules.desktop;
+in
+{
+  options.modules.desktop.enable = lib.mkEnableOption "the keyboard-driven Hyprland desktop";
+
+  # Each piece is turned on at default priority, so a host can still override
+  # any one of them while the single flag above enables the whole desktop.
+  config = lib.mkIf cfg.enable {
+    modules.desktop.apps.firefox.enable = lib.mkDefault true;
+    modules.desktop.apps.ghostty.enable = lib.mkDefault true;
+    modules.desktop.session.hyprland.enable = lib.mkDefault true;
+    modules.desktop.session.hyprland.hypridle.enable = lib.mkDefault true;
+    modules.desktop.session.hyprland.hyprlock.enable = lib.mkDefault true;
+    modules.desktop.session.login.enable = lib.mkDefault true;
+    modules.desktop.session.mako.enable = lib.mkDefault true;
+    modules.desktop.session.portals.enable = lib.mkDefault true;
+    modules.desktop.session.rofi.enable = lib.mkDefault true;
+    modules.desktop.session.waybar.enable = lib.mkDefault true;
+    modules.desktop.utilities.audio.enable = lib.mkDefault true;
+    modules.desktop.utilities.clipboard.enable = lib.mkDefault true;
+    modules.desktop.utilities.osd.enable = lib.mkDefault true;
+    modules.desktop.utilities.recording.enable = lib.mkDefault true;
+    modules.desktop.utilities.screenshot.enable = lib.mkDefault true;
+    modules.desktop.utilities.theming.enable = lib.mkDefault true;
+    modules.desktop.utilities.userdirs.enable = lib.mkDefault true;
+  };
+}

configs/nixos/modules/desktop/session/hyprland/default.nix

@@ -0,0 +1,191 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# The Hyprland compositor.
+let
+  cfg = config.modules.desktop.session.hyprland;
+  user = config.user.name;
+  cursor = config.stylix.cursor;
+
+  # Numbered-workspace switch and move for 1..9, the operator's i3 muscle memory.
+  workspaceBinds = lib.concatMap (n: [
+    "$mod, ${toString n}, workspace, ${toString n}"
+    "$mod SHIFT, ${toString n}, movetoworkspace, ${toString n}"
+  ]) (lib.range 1 9);
+
+  # Flip the tiling strategy between the two built-in layouts, since neither a
+  # dispatcher nor a keyword toggles it on its own.
+  toggleLayout = pkgs.writeShellScript "hypr-toggle-layout" ''
+    if [ "$(hyprctl getoption -j general:layout | ${pkgs.jq}/bin/jq -r .str)" = dwindle ]; then
+      hyprctl keyword general:layout master
+    else
+      hyprctl keyword general:layout dwindle
+    fi
+  '';
+in
+{
+  options.modules.desktop.session.hyprland = {
+    enable = lib.mkEnableOption "the Hyprland compositor";
+
+    blur = lib.mkEnableOption ''
+      window blur. Off by default as the single biggest battery cost on a
+      laptop, left on for a host with the headroom to spend it'';
+  };
+
+  config = lib.mkIf cfg.enable {
+    # This program integration owns the session, portals, and polkit, launched
+    # through the universal Wayland session manager.
+    programs.hyprland = {
+      enable = true;
+      withUWSM = true;
+    };
+
+    home-manager.users.${user}.wayland.windowManager.hyprland = {
+      enable = true;
+
+      # One package drives the whole session, so there is never a version split.
+      # The program integration above installs it and the portal, leaving home-
+      # manager to write only the config.
+      package = null;
+      portalPackage = null;
+
+      # uwsm owns the systemd graphical-session targets.
+      systemd.enable = false;
+
+      # Write the native hyprlang hyprland.conf, whose variable and bind syntax
+      # the settings below are expressed in.
+      configType = "hyprlang";
+
+      settings = {
+        "$mod" = "SUPER";
+        "$terminal" = "ghostty";
+
+        # Session variables handed to the compositor directly.
+        # UWSM launches the session without the shell profile that would carry
+        # them, so a variable the compositor or its children must see is set
+        # here rather than through home-manager's sessionVariables.
+        env =
+          [
+            # Chromium and Electron apps read this to select native Wayland;
+            # nixpkgs wrappers (Obsidian's included) gate their Wayland flags on
+            # it, so without it they run under XWayland and blur at this DPI.
+            "NIXOS_OZONE_WL,1"
+          ]
+          # Bibata ships XCursor only.
+          # The hyprcursor variables name the same theme, which Hyprland
+          # resolves through its XCursor fallback.
+          ++ lib.optionals (cursor != null) [
+            "XCURSOR_THEME,${cursor.name}"
+            "XCURSOR_SIZE,${toString cursor.size}"
+            "HYPRCURSOR_THEME,${cursor.name}"
+            "HYPRCURSOR_SIZE,${toString cursor.size}"
+          ];
+
+        input = {
+          kb_layout = "us";
+          # Caps is a second Escape.
+          # Shift+Caps still toggles a real CapsLock.
+          kb_options = "caps:escape_shifted_capslock";
+          # Snappy key repeat.
+          repeat_delay = 250;
+          repeat_rate = 45;
+          accel_profile = "flat";
+          touchpad = {
+            natural_scroll = true;
+            tap-to-click = true;
+            disable_while_typing = true;
+          };
+        };
+
+        general = {
+          gaps_in = 4;
+          gaps_out = 8;
+          border_size = 2;
+          layout = "dwindle";
+        };
+
+        decoration = {
+          rounding = 6;
+          blur.enabled = cfg.blur;
+        };
+
+        # XWayland clients render at the panel's native resolution instead of
+        # being raster-scaled by the compositor at the fractional monitor scale.
+        xwayland.force_zero_scaling = true;
+
+        animations = {
+          enabled = true;
+          bezier = [ "ease, 0.25, 0.1, 0.25, 1.0" ];
+          # Durations are in centiseconds.
+          # Short values keep the motion subtle.
+          animation = [
+            "windows, 1, 3, ease"
+            "fade, 1, 3, ease"
+            # Layer surfaces like the launcher fade in a touch quicker than windows.
+            "layersIn, 1, 2, ease"
+            "fadeLayersIn, 1, 2, ease"
+            "workspaces, 1, 3, ease"
+            "border, 1, 3, ease"
+          ];
+        };
+
+        dwindle = {
+          preserve_split = true;
+        };
+
+        bind = [
+          "$mod, Return, exec, $terminal"
+
+          # Move focus.
+          "$mod, H, movefocus, l"
+          "$mod, J, movefocus, d"
+          "$mod, K, movefocus, u"
+          "$mod, L, movefocus, r"
+
+          # Move the window within the layout.
+          "$mod SHIFT, H, movewindow, l"
+          "$mod SHIFT, J, movewindow, d"
+          "$mod SHIFT, K, movewindow, u"
+          "$mod SHIFT, L, movewindow, r"
+
+          # Resize the active window.
+          "$mod ALT, H, resizeactive, -40 0"
+          "$mod ALT, J, resizeactive, 0 40"
+          "$mod ALT, K, resizeactive, 0 -40"
+          "$mod ALT, L, resizeactive, 40 0"
+
+          "$mod, Space, togglefloating,"
+          "$mod, F, fullscreen,"
+          # togglesplit is a dwindle layout message, reached through layoutmsg.
+          "$mod, T, layoutmsg, togglesplit"
+          "$mod SHIFT, T, exec, ${toggleLayout}"
+          "$mod SHIFT, Q, killactive,"
+          "$mod CTRL, Q, forcekillactive,"
+        ]
+        ++ workspaceBinds;
+
+        # Volume and brightness keys repeat while held, each raising a popup
+        # through the OSD client.
+        # Volume is capped at 100 percent.
+        # The client floors brightness so a full hold cannot black the screen out.
+        binde = [
+          ", XF86AudioRaiseVolume, exec, ${pkgs.swayosd}/bin/swayosd-client --output-volume raise --max-volume 100"
+          ", XF86AudioLowerVolume, exec, ${pkgs.swayosd}/bin/swayosd-client --output-volume lower"
+          ", XF86MonBrightnessUp, exec, ${pkgs.swayosd}/bin/swayosd-client --brightness raise"
+          ", XF86MonBrightnessDown, exec, ${pkgs.swayosd}/bin/swayosd-client --brightness lower"
+        ];
+
+        # Mute and media transport still fire while the session is locked.
+        bindl = [
+          ", XF86AudioMute, exec, ${pkgs.swayosd}/bin/swayosd-client --output-volume mute-toggle"
+          ", XF86AudioPlay, exec, ${pkgs.playerctl}/bin/playerctl play-pause"
+          ", XF86AudioNext, exec, ${pkgs.playerctl}/bin/playerctl next"
+          ", XF86AudioPrev, exec, ${pkgs.playerctl}/bin/playerctl previous"
+        ];
+      };
+    };
+  };
+}

configs/nixos/modules/desktop/session/hyprland/hypridle.nix

@@ -0,0 +1,68 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# hypridle: idle-triggered locking and display power management.
+let
+  cfg = config.modules.desktop.session.hyprland.hypridle;
+  user = config.user.name;
+
+  hyprctl = "${config.programs.hyprland.package}/bin/hyprctl";
+  hyprlock = "${config.home-manager.users.${user}.programs.hyprlock.package}/bin/hyprlock";
+
+  # The guard drops the call when a locker is already up, so no idle trigger
+  # stacks a second hyprlock over the first.
+  lockCmd = "${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}";
+in
+{
+  options.modules.desktop.session.hyprland.hypridle = {
+    enable = lib.mkEnableOption "hypridle idle management";
+
+    lockTimeout = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 300;
+      description = "Seconds of inactivity before the screen locks.";
+    };
+
+    screenOffTimeout = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 360;
+      description = "Seconds of inactivity before the displays are powered off.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Closing the lid suspends, and every suspend locks first through the
+    # before_sleep_cmd below, so the lid always lands at a locked screen.
+    services.logind.settings.Login.HandleLidSwitch = "suspend";
+
+    home-manager.users.${user}.services.hypridle = {
+      enable = true;
+
+      settings = {
+        general = {
+          lock_cmd = lockCmd;
+          before_sleep_cmd = "loginctl lock-session";
+          # Waking restores the displays the screen-off listener may have cut.
+          after_sleep_cmd = "${hyprctl} dispatch dpms on";
+        };
+
+        listener = [
+          # Lock on idle.
+          {
+            timeout = cfg.lockTimeout;
+            on-timeout = "loginctl lock-session";
+          }
+          # Power the displays off a little later, restoring them on any activity.
+          {
+            timeout = cfg.screenOffTimeout;
+            on-timeout = "${hyprctl} dispatch dpms off";
+            on-resume = "${hyprctl} dispatch dpms on";
+          }
+        ];
+      };
+    };
+  };
+}

configs/nixos/modules/desktop/session/hyprland/hyprlock.nix

@@ -0,0 +1,94 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# The lock screen: a hyprlock session-lock surface the compositor owns.
+let
+  cfg = config.modules.desktop.session.hyprland.hyprlock;
+  user = config.user.name;
+
+  # The hyprlock this module installs, used by the lock keybind below.
+  hyprlock = "${config.home-manager.users.${user}.programs.hyprlock.package}/bin/hyprlock";
+
+  sleepIcon = builtins.fromJSON ''"\udb81\udcb2"'';
+  sleepOffIcon = builtins.fromJSON ''"\udb81\udcb3"'';
+
+  idleLockToggle = pkgs.writeShellScript "lockscreen-idle-inhibit-toggle" ''
+    unit=lockscreen-idle-inhibit.service
+
+    refresh_waybar() {
+      ${pkgs.procps}/bin/pkill -RTMIN+9 waybar >/dev/null 2>&1 || true
+    }
+
+    if ${pkgs.systemd}/bin/systemctl --user is-active --quiet "$unit"; then
+      ${pkgs.systemd}/bin/systemctl --user stop "$unit"
+      refresh_waybar
+      ${pkgs.swayosd}/bin/swayosd-client --custom-message "${sleepIcon}"
+      exit 0
+    fi
+
+    if ${pkgs.systemd}/bin/systemd-run \
+      --user \
+      --collect \
+      --unit=lockscreen-idle-inhibit \
+      --description="Disable idle-triggered screen locking" \
+      ${pkgs.systemd}/bin/systemd-inhibit \
+      --what=idle \
+      --who=lockscreen-hotkey \
+      --why="lock screen disabled by hotkey" \
+      ${pkgs.coreutils}/bin/sleep infinity >/dev/null; then
+      refresh_waybar
+      ${pkgs.swayosd}/bin/swayosd-client --custom-message "${sleepOffIcon}"
+    fi
+  '';
+in
+{
+  options.modules.desktop.session.hyprland.hyprlock.enable = lib.mkEnableOption "the hyprlock lock screen";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user} = {
+      # Colors and the lock-screen background come from Stylix's hyprlock target,
+      # so only geometry and behaviour are set here.
+      programs.hyprlock = {
+        enable = true;
+
+        settings = {
+          general = {
+            hide_cursor = true;
+            # No progress bar flashes before the field is ready to take input.
+            disable_loading_bar = true;
+          };
+
+          # A centered password field.
+          # Its colors come from the Stylix hyprlock target.
+          input-field = {
+            size = "260, 52";
+            rounding = 8;
+            position = "0, -100";
+            halign = "center";
+            valign = "center";
+          };
+
+          # The current time, above the field.
+          label = {
+            text = "$TIME";
+            font_size = 48;
+            position = "0, 120";
+            halign = "center";
+            valign = "center";
+          };
+        };
+      };
+
+      # Lock on Super+X.
+      # The guard drops the keypress when a locker is already up, so a second
+      # hyprlock never stacks over the first.
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod, X, exec, ${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}"
+        "$mod CTRL, X, exec, ${idleLockToggle}"
+      ];
+    };
+  };
+}

configs/nixos/modules/desktop/session/login.nix

@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Text login: greetd running the tuigreet greeter, which starts the session
+# through the universal Wayland session manager.
+let
+  cfg = config.modules.desktop.session.login;
+in
+{
+  options.modules.desktop.session.login.enable = lib.mkEnableOption "greetd with the tuigreet text greeter";
+
+  config = lib.mkIf cfg.enable {
+    services.greetd = {
+      enable = true;
+      settings.default_session.command =
+        "${lib.getExe pkgs.tuigreet} --time --remember "
+        + "--cmd 'uwsm start -e -D Hyprland hyprland.desktop'";
+    };
+  };
+}

configs/nixos/modules/desktop/session/mako.nix

@@ -0,0 +1,44 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# mako as the notification daemon: toasts, a do-not-disturb mode, and history recall.
+let
+  cfg = config.modules.desktop.session.mako;
+  user = config.user.name;
+
+  makoctl = "${pkgs.mako}/bin/makoctl";
+in
+{
+  options.modules.desktop.session.mako.enable = lib.mkEnableOption "the mako notification daemon";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user} = {
+      # Colors and the popup font come from Stylix's mako target, so only
+      # behaviour is set here.
+      services.mako = {
+        enable = true;
+
+        settings = {
+          # Toasts auto-dismiss into history rather than lingering.
+          # mako's own default of 0 leaves every notification on screen until acted on.
+          default-timeout = 5000;
+
+          # The do-not-disturb mode.
+          # Invisible hides the toasts but still records them to history.
+          # Missed notifications can therefore be recalled.
+          "mode=dnd".invisible = true;
+        };
+      };
+
+      # Recall the last notification from history, keyboard-only like the rest
+      # of the session.
+      # $mod is defined by the compositor config these binds share.
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod, N, exec, ${makoctl} restore"
+      ];
+    };
+  };
+}

configs/nixos/modules/desktop/session/portals.nix

@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+# XDG desktop portal routing for in-app screen sharing and file dialogs.
+let
+  cfg = config.modules.desktop.session.portals;
+in
+{
+  options.modules.desktop.session.portals.enable =
+    lib.mkEnableOption "XDG desktop portals for in-app screen sharing and file dialogs";
+
+  config = lib.mkIf cfg.enable {
+    # The backend packages arrive with the compositor, so only the routing is set
+    # here.
+    # Screen sharing, screenshots, and global shortcuts need the compositor's
+    # own backend.
+    # Everything else uses GTK.
+    xdg.portal.config.common = {
+      default = [ "gtk" ];
+      "org.freedesktop.impl.portal.ScreenCast" = [ "hyprland" ];
+      "org.freedesktop.impl.portal.Screenshot" = [ "hyprland" ];
+      "org.freedesktop.impl.portal.GlobalShortcuts" = [ "hyprland" ];
+    };
+  };
+}

configs/nixos/modules/desktop/session/rofi.nix

@@ -0,0 +1,52 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# rofi as the desktop launcher and dmenu-style menu frontend.
+let
+  cfg = config.modules.desktop.session.rofi;
+  user = config.user.name;
+
+  # A session menu built on the same themed rofi, so the power actions look
+  # like every other menu the launcher drives.
+  powerMenu = pkgs.writeShellScript "rofi-power-menu" ''
+    chosen=$(printf '%s\n' Lock Suspend 'Log out' Reboot 'Shut down' \
+      | ${pkgs.rofi}/bin/rofi -dmenu -i -p Power)
+    case "$chosen" in
+      Lock) ${pkgs.systemd}/bin/loginctl lock-session ;;
+      Suspend) ${pkgs.systemd}/bin/systemctl suspend ;;
+      'Log out') ${pkgs.systemd}/bin/loginctl terminate-session "$XDG_SESSION_ID" ;;
+      Reboot) ${pkgs.systemd}/bin/systemctl reboot ;;
+      'Shut down') ${pkgs.systemd}/bin/systemctl poweroff ;;
+    esac
+  '';
+in
+{
+  options.modules.desktop.session.rofi.enable = lib.mkEnableOption "the rofi launcher";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user} = {
+      # No theme is set here: Stylix's rofi target supplies the Nord one.
+      programs.rofi = {
+        enable = true;
+
+        # Application launch is the only mode, kept minimal so the prompt opens
+        # as fast as rofi can read the desktop entries.
+        # Icons are off: resolving one per entry is the bulk of drun's startup.
+        extraConfig = {
+          modi = "drun";
+          show-icons = false;
+        };
+      };
+
+      # The launcher and the session menu, kept next to the tool they drive.
+      # $mod is defined by the compositor config these binds share.
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod, R, exec, ${pkgs.rofi}/bin/rofi -show drun"
+        "$mod SHIFT, X, exec, ${powerMenu}"
+      ];
+    };
+  };
+}

configs/nixos/modules/desktop/session/waybar.nix

@@ -0,0 +1,179 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Waybar: a top status bar reading system state at a glance.
+let
+  cfg = config.modules.desktop.session.waybar;
+  user = config.user.name;
+
+  # A Nerd Font Private-Use-Area codepoint as a literal character, decoded
+  # through JSON so the glyph survives as bytes rather than an editor paste.
+  g = code: builtins.fromJSON ''"\u${code}"'';
+  sleepOffIcon = builtins.fromJSON ''"\udb81\udcb3"'';
+
+  # Renders and toggles mako's do-not-disturb mode.
+  # With no mako daemon answering, the status reads "notifications on", keeping
+  # the widget inert rather than broken.
+  dndStatus = pkgs.writeShellScript "waybar-dnd-status" ''
+    if ${pkgs.mako}/bin/makoctl mode 2>/dev/null | ${pkgs.gnugrep}/bin/grep -qx dnd; then
+      printf '{"text":"${g "f1f6"}","tooltip":"Do not disturb: on","class":"dnd"}\n'
+    else
+      printf '{"text":"${g "f0f3"}","tooltip":"Notifications on","class":"active"}\n'
+    fi
+  '';
+
+  dndToggle = pkgs.writeShellScript "waybar-dnd-toggle" ''
+    ${pkgs.mako}/bin/makoctl mode -t dnd >/dev/null 2>&1
+    ${pkgs.procps}/bin/pkill -RTMIN+8 waybar
+  '';
+
+  # Lit while a wf-recorder capture is running.
+  # Empty text collapses the widget when idle, so it shows nothing until then.
+  recStatus = pkgs.writeShellScript "waybar-recording-status" ''
+    if ${pkgs.procps}/bin/pgrep -x wf-recorder >/dev/null; then
+      printf '{"text":"${g "f03d"}","tooltip":"Recording","class":"recording"}\n'
+    else
+      printf '{"text":"","class":"idle"}\n'
+    fi
+  '';
+
+  idleLockStatus = pkgs.writeShellScript "waybar-idle-lock-status" ''
+    if ${pkgs.systemd}/bin/systemctl --user is-active --quiet lockscreen-idle-inhibit.service; then
+      printf '{"text":"${sleepOffIcon}","tooltip":"Idle locking inhibited","class":"inhibited"}\n'
+    else
+      printf '{"text":"","class":"idle"}\n'
+    fi
+  '';
+in
+{
+  options.modules.desktop.session.waybar.enable = lib.mkEnableOption "the Waybar status bar";
+
+  config = lib.mkIf cfg.enable {
+    # A symbols font backs the module glyphs, so pango falls back to it for the
+    # codepoints Stylix's monospace font does not carry.
+    fonts.packages = [ pkgs.nerd-fonts.symbols-only ];
+
+    home-manager.users.${user}.programs.waybar = {
+      enable = true;
+
+      # A user service bound to graphical-session.target, which uwsm activates,
+      # so the bar comes up with the session and no compositor exec-once.
+      systemd.enable = true;
+
+      settings.mainBar = {
+        layer = "top";
+        position = "top";
+        height = 30;
+
+        modules-left = [ "hyprland/workspaces" ];
+        modules-center = [ "clock" ];
+        modules-right = [
+          "custom/recording"
+          "custom/idle-lock"
+          "mpris"
+          "wireplumber"
+          "network"
+          "battery"
+          "custom/dnd"
+        ];
+
+        # Per-application icons for the windows on each workspace, mapped from
+        # window class with a neutral glyph for anything unlisted.
+        "hyprland/workspaces" = {
+          on-click = "activate";
+          format = "{id} {windows}";
+          format-window-separator = " ";
+          window-rewrite-default = g "f2d0";
+          window-rewrite = {
+            "class<Alacritty>" = g "f120";
+            "class<com.mitchellh.ghostty>" = g "f120";
+            "class<.*[Ff]irefox.*>" = g "f269";
+            "class<chromium.*>" = g "f268";
+            "class<[Cc]ode>" = g "f121";
+            "class<obsidian>" = g "f02d";
+            "class<[Ss]team>" = g "f1b6";
+          };
+        };
+
+        clock = {
+          format = "{:%a %d %b  %H:%M}";
+          tooltip-format = "<tt>{calendar}</tt>";
+          calendar = {
+            mode = "month";
+            # Underline the current day so it stands out in the grid.
+            format.today = "<b><u>{}</u></b>";
+          };
+        };
+
+        mpris = {
+          format = "${g "f001"} {title}";
+          format-paused = "${g "f04c"} {title}";
+          max-length = 40;
+          on-click = "play-pause";
+          on-scroll-up = "next";
+          on-scroll-down = "previous";
+        };
+
+        wireplumber = {
+          format = "{icon} {volume}%";
+          format-muted = "${g "f026"} muted";
+          format-icons = [
+            (g "f026")
+            (g "f027")
+            (g "f028")
+          ];
+          on-click = "${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+        };
+
+        network = {
+          format-wifi = "${g "f1eb"} {essid}";
+          format-ethernet = "${g "f796"} {ifname}";
+          format-disconnected = "${g "f127"} off";
+          tooltip-format = "{ipaddr} via {gwaddr}";
+        };
+
+        battery = {
+          format = "{icon} {capacity}%";
+          format-charging = "${g "f0e7"} {capacity}%";
+          format-icons = [
+            (g "f244")
+            (g "f243")
+            (g "f242")
+            (g "f241")
+            (g "f240")
+          ];
+          states = {
+            warning = 20;
+            critical = 10;
+          };
+        };
+
+        "custom/dnd" = {
+          return-type = "json";
+          exec = "${dndStatus}";
+          on-click = "${dndToggle}";
+          interval = "once";
+          signal = 8;
+        };
+
+        # Recording state has no event to hook, so the widget samples the
+        # wf-recorder process once a second.
+        "custom/recording" = {
+          return-type = "json";
+          exec = "${recStatus}";
+          interval = 1;
+        };
+
+        "custom/idle-lock" = {
+          return-type = "json";
+          exec = "${idleLockStatus}";
+          interval = "once";
+          signal = 9;
+        };
+      };
+    };
+  };
+}

configs/nixos/modules/desktop/utilities/audio.nix

@@ -0,0 +1,19 @@
+{ config, lib, ... }:
+# PipeWire as the desktop audio server.
+let
+  cfg = config.modules.desktop.utilities.audio;
+in
+{
+  options.modules.desktop.utilities.audio.enable = lib.mkEnableOption "the PipeWire audio server";
+
+  config = lib.mkIf cfg.enable {
+    # Realtime scheduling for the audio threads, so playback survives load.
+    security.rtkit.enable = true;
+
+    services.pipewire = {
+      enable = true;
+      alsa.enable = true;
+      pulse.enable = true;
+    };
+  };
+}

configs/nixos/modules/desktop/utilities/clipboard.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Clipboard history: cliphist records every copy, picked back through rofi.
+let
+  cfg = config.modules.desktop.utilities.clipboard;
+  user = config.user.name;
+
+  cliphist = "${pkgs.cliphist}/bin/cliphist";
+  rofi = "${pkgs.rofi}/bin/rofi";
+  wl-copy = "${pkgs.wl-clipboard}/bin/wl-copy";
+
+  # The picker reuses the themed rofi, so history looks like every other menu
+  # the launcher drives.
+  # decode is needed because list emits id-prefixed lines rather than the copied
+  # bytes, so the chosen id has to be resolved back before it can be re-copied.
+  picker = pkgs.writeShellScript "clipboard-picker" ''
+    ${cliphist} list \
+      | ${rofi} -dmenu -i -p Clipboard \
+      | ${cliphist} decode \
+      | ${wl-copy}
+  '';
+in
+{
+  options.modules.desktop.utilities.clipboard.enable = lib.mkEnableOption "cliphist clipboard history";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user} = {
+      # wl-copy and wl-paste on PATH, so the shell can pipe into and out of the
+      # clipboard.
+      # The watchers and picker above reach wl-clipboard by store path, so this
+      # is for interactive use alone.
+      home.packages = [ pkgs.wl-clipboard ];
+
+      # Two watchers record text and images to history, bound to the graphical
+      # session so uwsm starts and stops them with it.
+      services.cliphist.enable = true;
+
+      # $mod is defined by the compositor config these binds share.
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod SHIFT, V, exec, ${picker}"
+      ];
+    };
+  };
+}

configs/nixos/modules/desktop/utilities/osd.nix

@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# SwayOSD: a transient on-screen popup for volume and brightness changes.
+let
+  cfg = config.modules.desktop.utilities.osd;
+  user = config.user.name;
+in
+{
+  options.modules.desktop.utilities.osd.enable = lib.mkEnableOption "the SwayOSD volume and brightness popup";
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.swayosd ];
+
+    # The udev rule chgrps each backlight's brightness node to `video` and adds
+    # group write, so the server dims the panel without root.
+    # Membership below grants the running session that access.
+    services.udev.packages = [ pkgs.swayosd ];
+    users.users.${user}.extraGroups = [ "video" ];
+
+    # The server draws the popups, so it runs for the whole graphical session.
+    # It binds to the target uwsm activates.
+    home-manager.users.${user}.systemd.user.services.swayosd = {
+      Unit = {
+        Description = "SwayOSD on-screen display server";
+        PartOf = [ "graphical-session.target" ];
+        After = [ "graphical-session.target" ];
+      };
+      Service = {
+        ExecStart = "${pkgs.swayosd}/bin/swayosd-server";
+        Restart = "on-failure";
+      };
+      Install.WantedBy = [ "graphical-session.target" ];
+    };
+  };
+}

configs/nixos/modules/desktop/utilities/recording.nix

@@ -0,0 +1,54 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Keybound screen recording: pick a region, then toggle a video-only capture.
+let
+  cfg = config.modules.desktop.utilities.recording;
+  user = config.user.name;
+
+  slurp = "${pkgs.slurp}/bin/slurp";
+  wf-recorder = "${pkgs.wf-recorder}/bin/wf-recorder";
+  notify-send = "${pkgs.libnotify}/bin/notify-send";
+  pgrep = "${pkgs.procps}/bin/pgrep";
+  pkill = "${pkgs.procps}/bin/pkill";
+  date = "${pkgs.coreutils}/bin/date";
+  mkdir = "${pkgs.coreutils}/bin/mkdir";
+  xdgUserDir = "${pkgs.xdg-user-dirs}/bin/xdg-user-dir";
+
+  # A single key both starts and stops.
+  # A running wf-recorder is stopped with SIGINT so it finalises the file.
+  # Otherwise slurp picks a region and wf-recorder runs in the foreground until
+  # that stop arrives, so this instance lives for the whole recording and then
+  # reports it saved.
+  # No -a means no audio is captured.
+  toggle = pkgs.writeShellScript "screen-record-toggle" ''
+    if ${pgrep} -x wf-recorder >/dev/null; then
+      ${pkill} -INT -x wf-recorder
+      exit 0
+    fi
+
+    region=$(${slurp}) || exit 0
+    dir="$(${xdgUserDir} VIDEOS)/Recordings"
+    ${mkdir} -p "$dir"
+    file="$dir/recording-$(${date} +%Y%m%d-%H%M%S).mp4"
+
+    ${notify-send} -a "Screen recording" "Recording started" "Region capture, no audio."
+    ${wf-recorder} -g "$region" -f "$file"
+    ${notify-send} -a "Screen recording" "Recording saved" "$file"
+  '';
+in
+{
+  options.modules.desktop.utilities.recording.enable = lib.mkEnableOption "wf-recorder screen recording";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user} = {
+      # $mod is defined by the compositor config these binds share.
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod SHIFT, R, exec, ${toggle}"
+      ];
+    };
+  };
+}

configs/nixos/modules/desktop/utilities/screenshot.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Keyboard-driven screenshots that open in satty for annotation, then land in
+# both the clipboard and a dated file.
+let
+  cfg = config.modules.desktop.utilities.screenshot;
+  user = config.user.name;
+
+  grimblast = "${pkgs.grimblast}/bin/grimblast";
+  satty = "${pkgs.satty}/bin/satty";
+  wl-copy = "${pkgs.wl-clipboard}/bin/wl-copy";
+  xdgUserDir = "${pkgs.xdg-user-dirs}/bin/xdg-user-dir";
+
+  # satty's copy action also saves, so one keystroke lands the shot in both the
+  # clipboard and a file.
+  capture =
+    target:
+    pkgs.writeShellScript "screenshot-${target}" ''
+      dir="$(${xdgUserDir} PICTURES)/Screenshots"
+      mkdir -p "$dir"
+      ${grimblast} save ${target} - \
+        | ${satty} --filename - \
+          --output-filename "$dir/screenshot-%Y%m%d-%H%M%S.png" \
+          --copy-command ${wl-copy} \
+          --save-after-copy \
+          --early-exit \
+          --actions-on-enter save-to-clipboard
+    '';
+in
+{
+  options.modules.desktop.utilities.screenshot.enable = lib.mkEnableOption "screenshots via grimblast and satty";
+
+  config = lib.mkIf cfg.enable {
+    home-manager.users.${user} = {
+      # satty is a one-shot annotation surface, so float it rather than letting
+      # it claim a tile in the layout.
+      # windowrule v3 syntax: space-separated field/value tokens, comma
+      # separated, with matchers under a match: prefix and effects bare.
+      wayland.windowManager.hyprland.settings.windowrule = [
+        "float 1, match:class ^(com\\.gabm\\.satty)$"
+      ];
+
+      # Print with plain/Shift/Ctrl for region/window/full.
+      # Super+L is already the hjkl focus and movement bind, so screenshots take
+      # the Print key instead.
+      wayland.windowManager.hyprland.settings.bind = [
+        ", Print, exec, ${capture "area"}"
+        "SHIFT, Print, exec, ${capture "active"}"
+        "CTRL, Print, exec, ${capture "screen"}"
+      ];
+    };
+  };
+}

configs/nixos/modules/desktop/utilities/theming.nix

@@ -0,0 +1,73 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+# Nord theming for the graphical layer, driven from one base16 scheme by Stylix.
+let
+  cfg = config.modules.desktop.utilities.theming;
+  user = config.user.name;
+
+  # A single static Nord wallpaper, drawn as a vertical gradient across the
+  # Polar Night shades so it needs no committed binary and no network fetch.
+  wallpaper = pkgs.runCommand "nord-wallpaper.png" { } ''
+    ${pkgs.imagemagick}/bin/magick \
+      -size 2560x1440 gradient:'#2E3440'-'#3B4252' \
+      "$out"
+  '';
+in
+{
+  options.modules.desktop.utilities.theming.enable =
+    lib.mkEnableOption "Nord theming of the graphical layer via Stylix";
+
+  config = lib.mkIf cfg.enable {
+    stylix = {
+      enable = true;
+
+      # Nord is a dark scheme.
+      # The polarity steers Stylix's contrast choices.
+      polarity = "dark";
+      base16Scheme = "${pkgs.base16-schemes}/share/themes/nord.yaml";
+
+      image = wallpaper;
+
+      # Regreet is not enabled, so its styling target stays off.
+      targets.regreet.enable = false;
+
+      cursor = {
+        package = pkgs.bibata-cursors;
+        # Solid white with a dark outline, so it stays easy to spot against the
+        # dark Nord wallpaper.
+        name = "Bibata-Modern-Ice";
+        size = 24;
+      };
+
+      fonts = {
+        monospace = {
+          package = pkgs.jetbrains-mono;
+          name = "JetBrains Mono";
+        };
+
+        # A step below Stylix's defaults (applications 12, desktop/popups 10,
+        # terminal 12), which read oversized on this display.
+        sizes = {
+          applications = 10;
+          desktop = 9;
+          popups = 9;
+          terminal = 10;
+        };
+      };
+    };
+
+    home-manager.users.${user} = {
+      # Stylix drives the cursor through home-manager's pointer-cursor config,
+      # whose generation must be switched on explicitly.
+      home.pointerCursor.enable = true;
+
+      # nvim keeps its dedicated Nord colorscheme, which is richer than the
+      # base16 mapping Stylix would apply, so its target stays off.
+      stylix.targets.nixvim.enable = false;
+    };
+  };
+}

configs/nixos/modules/desktop/utilities/userdirs.nix

@@ -0,0 +1,15 @@
+{ config, lib, ... }:
+# Declares the XDG user directories, so a tool that queries them lands in a
+# well-known folder a host can relocate from one place.
+let
+  cfg = config.modules.desktop.utilities.userdirs;
+  user = config.user.name;
+in
+{
+  options.modules.desktop.utilities.userdirs.enable = lib.mkEnableOption "XDG user directories";
+
+  config = lib.mkIf cfg.enable {
+    # Write ~/.config/user-dirs.dirs from the option defaults.
+    home-manager.users.${user}.xdg.userDirs.enable = true;
+  };
+}