refactor(hyprland): inline module aliases

configs/nixos/AGENTS.md

@@ -2,10 +2,10 @@
 
 ## Desktop
 
-- When adding a graphical application, register its workspace icon in `registry.window-icon`.
+- TODO: Verify this path after the NixOS configuration is migrated.
+  When adding a graphical application, add a `window-rewrite` icon mapping in `modules/desktop/session/waybar.nix`.
   The workspace indicator uses this mapping to show an application icon instead of the generic default glyph.
   Match the mapping on the window class.
-  Store the icon as the rendered string.
   Run `hyprctl clients -j | jq -r '.[].class' | sort -u` to list classes in the running session.
 - TODO: Verify this path after the NixOS configuration is migrated.
   Set Hyprland session environment variables in `modules/desktop/session/hyprland/default.nix` with `env = KEY,VALUE`.

configs/nixos/hosts/neogaia/default.nix

@@ -1,6 +1,5 @@
 {
   inputs,
-  util,
   ...
 }:
 # neogaia — Dell XPS 13 9380 laptop.
@@ -15,7 +14,8 @@
 
   modules.host.cachyos.enable = true;
 
-  modules.network.enable = true;
+  # So wifi can be joined from the console.
+  networking.networkmanager.enable = true;
 
   registry.address.neogaia.self = "10.23.50.146";
 
@@ -40,23 +40,4 @@
   modules.desktop.apps.obsidian.enable = true;
   modules.desktop.apps.steam.enable = true;
 
-  registry.waybar.neogaia.battery = {
-    order = 70;
-    settings = {
-      format = "{icon} {capacity}%";
-      format-charging = "${util.glyph "f0e7"} {capacity}%";
-      format-icons = [
-        (util.glyph "f244")
-        (util.glyph "f243")
-        (util.glyph "f242")
-        (util.glyph "f241")
-        (util.glyph "f240")
-      ];
-      states = {
-        warning = 20;
-        critical = 10;
-      };
-    };
-  };
-
 }

configs/nixos/hosts/zeus/default.nix

@@ -21,7 +21,7 @@
     enable32Bit = true;
   };
 
-  modules.network.enable = true;
+  networking.networkmanager.enable = true;
 
   services.logind.settings.Login = {
     HandlePowerKey = "ignore";
@@ -52,14 +52,14 @@
     {
       output = "HDMI-A-1";
       mode = "1920x1080@120";
-      position = "-1080x0";
+      position = "0x0";
       scale = 1;
       transform = 3;
     }
     {
       output = "DP-3";
       mode = "2560x1440@239.96";
-      position = "0x0";
+      position = "1080x0";
       scale = 1;
     }
   ];

configs/nixos/modules/desktop/apps/firefox.nix

@@ -3,7 +3,6 @@
   inputs,
   lib,
   pkgs,
-  util,
   ...
 }:
 # Configures Firefox as the desktop browser.
@@ -27,11 +26,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    registry.window-icon.${config.networking.hostName}.firefox = {
-      class = ".*[Ff]irefox.*";
-      icon = util.glyph "f269";
-    };
-
     home-manager.users.${config.user.name} = hm: {
       programs.firefox = {
         enable = true;

configs/nixos/modules/desktop/apps/ghostty.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  util,
   ...
 }:
 # Ghostty as the desktop terminal.
@@ -13,19 +12,6 @@ in
   options.modules.desktop.apps.ghostty.enable = lib.mkEnableOption "Ghostty as the desktop terminal";
 
   config = lib.mkIf config.modules.desktop.apps.ghostty.enable {
-    registry.keybind.${config.networking.hostName}.ghostty = {
-      keys = "SUPER + Return";
-      action = {
-        kind = "exec";
-        command = lib.getExe pkgs.ghostty;
-      };
-    };
-
-    registry.window-icon.${config.networking.hostName}.ghostty = {
-      class = "com.mitchellh.ghostty";
-      icon = util.glyph "f120";
-    };
-
     home-manager.users.${user}.home.packages = [ pkgs.ghostty ];
   };
 }

configs/nixos/modules/desktop/apps/obsidian.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  util,
   ...
 }:
 # Obsidian as the desktop note-taking vault.
@@ -15,10 +14,5 @@ in
 
   config = lib.mkIf config.modules.desktop.apps.obsidian.enable {
     home-manager.users.${user}.home.packages = [ pkgs.obsidian ];
-
-    registry.window-icon.${config.networking.hostName}.obsidian = {
-      class = "obsidian";
-      icon = util.glyph "f02d";
-    };
   };
 }

configs/nixos/modules/desktop/apps/signal.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  util,
   ...
 }:
 # Signal desktop messenger.
@@ -14,10 +13,5 @@ in
 
   config = lib.mkIf config.modules.desktop.apps.signal.enable {
     home-manager.users.${user}.home.packages = [ pkgs.signal-desktop ];
-
-    registry.window-icon.${config.networking.hostName}.signal = {
-      class = "[Ss]ignal";
-      icon = util.glyph "f4ad";
-    };
   };
 }

configs/nixos/modules/desktop/apps/steam.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  util,
   ...
 }:
 # Steam game launcher and runtime integration.
@@ -24,10 +23,5 @@
     environment.systemPackages = [
       pkgs.gamescope
     ];
-
-    registry.window-icon.${config.networking.hostName}.steam = {
-      class = "[Ss]team";
-      icon = util.glyph "f1b6";
-    };
   };
 }

configs/nixos/modules/desktop/apps/vencord.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  util,
   ...
 }:
 # Vesktop, a Discord client with Vencord built in.
@@ -15,10 +14,5 @@ in
 
   config = lib.mkIf config.modules.desktop.apps.vencord.enable {
     home-manager.users.${user}.home.packages = [ pkgs.vesktop ];
-
-    registry.window-icon.${config.networking.hostName}.vesktop = {
-      class = "[Vv]esktop";
-      icon = util.glyph "f1ff";
-    };
   };
 }

configs/nixos/modules/desktop/default.nix

@@ -23,6 +23,5 @@
     modules.desktop.utilities.screenshot.enable = lib.mkDefault true;
     modules.desktop.utilities.theming.enable = lib.mkDefault true;
     modules.desktop.utilities.userdirs.enable = lib.mkDefault true;
-    registry.env.${config.networking.hostName}.NIXOS_OZONE_WL = "1";
   };
 }

configs/nixos/modules/desktop/session/hyprland/default.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  util,
   ...
 }:
 # The Hyprland compositor.
@@ -9,7 +8,6 @@
   options.modules.desktop.session.hyprland.enable = lib.mkEnableOption "the Hyprland compositor";
 
   config = lib.mkIf config.modules.desktop.session.hyprland.enable {
-
     # This program integration owns the session, portals, and polkit, launched
     # through the universal Wayland session manager.
     programs.hyprland = {
@@ -34,211 +32,16 @@
       configType = "lua";
 
       settings = {
-        config = {
-          input = {
-            kb_layout = config.services.xserver.xkb.layout;
-            repeat_delay = 250;
-            repeat_rate = 45;
-            accel_profile = "flat";
-            touchpad = {
-              natural_scroll = true;
-              tap_to_click = true;
-              disable_while_typing = true;
-            };
-          };
+        config.general.layout = "dwindle";
 
-          general = {
-            gaps_in = 4;
-            gaps_out = 8;
-            border_size = 2;
-            layout = "dwindle";
-          };
-
-          decoration = {
-            rounding = 6;
-            blur.enabled = false;
-          };
-
-          xwayland.force_zero_scaling = true;
-
-          dwindle.preserve_split = true;
-        };
-
-        env = lib.mapAttrsToList (name: value: {
-          _args = [
-            name
-            value
-          ];
-        }) (lib.attrByPath [ config.networking.hostName ] { } config.registry.env);
-
-        bind = lib.mapAttrsToList (_name: keybind: {
-          _args = [
-            keybind.keys
-            (lib.generators.mkLuaInline (
-              {
-                exec = "hl.dsp.exec_cmd(${lib.generators.toLua { } keybind.action.command})";
-                focus = "hl.dsp.focus(${
-                  lib.generators.toLua { } { inherit (keybind.action) direction workspace; }
-                })";
-                "move-window" = "hl.dsp.window.move(${
-                  lib.generators.toLua { } { inherit (keybind.action) direction workspace; }
-                })";
-                "resize-window" = "hl.dsp.window.resize(${
-                  lib.generators.toLua { } (
-                    {
-                      down = {
-                        x = 0;
-                        y = 10;
-                        relative = true;
-                      };
-                      left = {
-                        x = -10;
-                        y = 0;
-                        relative = true;
-                      };
-                      right = {
-                        x = 10;
-                        y = 0;
-                        relative = true;
-                      };
-                      up = {
-                        x = 0;
-                        y = -10;
-                        relative = true;
-                      };
-                    }
-                    .${keybind.action.direction}
-                  )
-                })";
-                "toggle-floating" = ''hl.dsp.window.float({ action = "toggle" })'';
-                "toggle-fullscreen" = "hl.dsp.window.fullscreen()";
-                "close-window" = "hl.dsp.window.close()";
-              }
-              .${keybind.action.kind}
-            ))
-          ]
-          ++ lib.optional keybind.repeating {
-            repeating = true;
-          }
-          ++ lib.optional keybind.locked {
-            locked = true;
-          };
-        }) (lib.attrByPath [ config.networking.hostName ] { } config.registry.keybind);
-      };
-    };
-    registry.keybind.${config.networking.hostName} = lib.mkMerge [
-      # Generate numeric workspace keybinds.
-      (lib.listToAttrs (
-        lib.concatMap (workspace: [
+        bind = [
           {
-            name = "hyprland-workspace-${toString workspace}";
-            value = {
-              keys = "SUPER + ${toString workspace}";
-              action = {
-                kind = "focus";
-                inherit workspace;
-              };
-            };
+            _args = [
+              "SUPER + Return"
+              (lib.generators.mkLuaInline ''hl.dsp.exec_cmd("ghostty")'')
+            ];
           }
-          {
-            name = "hyprland-move-to-workspace-${toString workspace}";
-            value = {
-              keys = "SUPER + SHIFT + ${toString workspace}";
-              action = {
-                kind = "move-window";
-                inherit workspace;
-              };
-            };
-          }
-        ]) (lib.range 1 9)
-      ))
-
-      # Generate directional keybinds.
-      (lib.listToAttrs (
-        lib.concatMap
-          (
-            { direction, key }:
-            [
-              {
-                name = "hyprland-focus-${direction}";
-                value = {
-                  keys = "SUPER + ${key}";
-                  action = {
-                    kind = "focus";
-                    inherit direction;
-                  };
-                };
-              }
-              {
-                name = "hyprland-move-${direction}";
-                value = {
-                  keys = "SUPER + SHIFT + ${key}";
-                  action = {
-                    kind = "move-window";
-                    inherit direction;
-                  };
-                };
-              }
-              {
-                name = "hyprland-resize-${direction}";
-                value = {
-                  keys = "SUPER + ALT + ${key}";
-                  repeating = true;
-                  action = {
-                    kind = "resize-window";
-                    inherit direction;
-                  };
-                };
-              }
-            ]
-          )
-          [
-            {
-              key = "H";
-              direction = "left";
-            }
-            {
-              key = "J";
-              direction = "down";
-            }
-            {
-              key = "K";
-              direction = "up";
-            }
-            {
-              key = "L";
-              direction = "right";
-            }
-          ]
-      ))
-      {
-        hyprland-toggle-floating = {
-          keys = "SUPER + Space";
-          action.kind = "toggle-floating";
-        };
-
-        hyprland-toggle-fullscreen = {
-          keys = "SUPER + F";
-          action.kind = "toggle-fullscreen";
-        };
-
-        hyprland-close-window = {
-          keys = "SUPER + SHIFT + Q";
-          action.kind = "close-window";
-        };
-      }
-    ];
-
-    registry.waybar.${config.networking.hostName}."hyprland/workspaces" = {
-      position = "left";
-      order = 10;
-      settings = {
-        format = "{id} {windows}";
-        format-window-separator = " ";
-        window-rewrite-default = util.glyph "f2d0";
-        window-rewrite = lib.mapAttrs' (
-          _name: windowIcon: lib.nameValuePair "class<${windowIcon.class}>" windowIcon.icon
-        ) (lib.attrByPath [ config.networking.hostName ] { } config.registry.window-icon);
+        ];
       };
     };
   };

configs/nixos/modules/desktop/session/hyprland/hypridle.nix

@@ -5,32 +5,50 @@
   ...
 }:
 # hypridle: idle-triggered locking and display power management.
-{
-  options.modules.desktop.session.hyprland.hypridle.enable =
-    lib.mkEnableOption "hypridle idle management";
+let
+  cfg = config.modules.desktop.session.hyprland.hypridle; # NOLINT(let_order)
 
-  config = lib.mkIf config.modules.desktop.session.hyprland.hypridle.enable {
+  # The guard drops the call when a locker is already up, so no idle trigger
+  # stacks a second hyprlock over the first.
+  lockCmd = "${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}";
+  user = config.user.name;
+
+  hyprctl = "${config.programs.hyprland.package}/bin/hyprctl";
+  hyprlock = "${config.home-manager.users.${user}.programs.hyprlock.package}/bin/hyprlock";
+
+in
+{
+  options.modules.desktop.session.hyprland.hypridle = {
+    enable = lib.mkEnableOption "hypridle idle management";
+
+    lockTimeout = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 300;
+      description = "Seconds of inactivity before the screen locks.";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
     # Closing the lid suspends, and every suspend locks first through the
     # before_sleep_cmd below, so the lid always lands at a locked screen.
     services.logind.settings.Login.HandleLidSwitch = "suspend";
 
-    home-manager.users.${config.user.name}.services.hypridle = {
+    home-manager.users.${user}.services.hypridle = {
       enable = true;
 
       settings = {
         general = {
-          # The guard drops the call when a locker is already up, so no idle
-          # trigger stacks a second hyprlock over the first.
-          lock_cmd = "${lib.getExe' pkgs.procps "pidof"} hyprlock || ${lib.getExe pkgs.hyprlock}";
+          lock_cmd = lockCmd;
           before_sleep_cmd = "loginctl lock-session";
           # Waking pokes the compositor in case firmware leaves displays dark.
-          after_sleep_cmd = "${lib.getExe' config.programs.hyprland.package "hyprctl"} dispatch 'hl.dsp.dpms({ action = \"enable\" })'";
+          after_sleep_cmd = "${hyprctl} dispatch dpms on";
         };
 
         listener = [
           # Lock on idle.
           {
-            timeout = 300;
+            timeout = cfg.lockTimeout;
             on-timeout = "loginctl lock-session";
           }
         ];

configs/nixos/modules/desktop/session/hyprland/hyprlock.nix

@@ -2,54 +2,44 @@
   config,
   lib,
   pkgs,
-  util,
   ...
 }:
 # The lock screen: a hyprlock session-lock surface the compositor owns.
 let
-  sleepIcon = util.glyph [
-    "db81"
-    "dcb2"
-  ];
-  sleepOffIcon = util.glyph [
-    "db81"
-    "dcb3"
-  ];
+  user = config.user.name;
+
+  # The hyprlock this module installs, used by the lock keybind below.
+  hyprlock = "${config.home-manager.users.${user}.programs.hyprlock.package}/bin/hyprlock";
+
+  sleepIcon = builtins.fromJSON ''"\udb81\udcb2"'';
+  sleepOffIcon = builtins.fromJSON ''"\udb81\udcb3"'';
 
   idleLockToggle = pkgs.writeShellScript "lockscreen-idle-inhibit-toggle" ''
     unit=lockscreen-idle-inhibit.service
 
     refresh_waybar() {
-      ${lib.getExe' pkgs.procps "pkill"} -RTMIN+9 waybar >/dev/null 2>&1 || true
+      ${pkgs.procps}/bin/pkill -RTMIN+9 waybar >/dev/null 2>&1 || true
     }
 
-    if ${lib.getExe' pkgs.systemd "systemctl"} --user is-active --quiet "$unit"; then
-      ${lib.getExe' pkgs.systemd "systemctl"} --user stop "$unit"
+    if ${pkgs.systemd}/bin/systemctl --user is-active --quiet "$unit"; then
+      ${pkgs.systemd}/bin/systemctl --user stop "$unit"
       refresh_waybar
-      ${lib.getExe' pkgs.swayosd "swayosd-client"} --custom-message "${sleepIcon}"
+      ${pkgs.swayosd}/bin/swayosd-client --custom-message "${sleepIcon}"
       exit 0
     fi
 
-    if ${lib.getExe' pkgs.systemd "systemd-run"} \
+    if ${pkgs.systemd}/bin/systemd-run \
       --user \
       --collect \
       --unit=lockscreen-idle-inhibit \
       --description="Disable idle-triggered screen locking" \
-      ${lib.getExe' pkgs.systemd "systemd-inhibit"} \
+      ${pkgs.systemd}/bin/systemd-inhibit \
       --what=idle \
       --who=lockscreen-hotkey \
       --why="lock screen disabled by hotkey" \
-      ${lib.getExe' pkgs.coreutils "sleep"} infinity >/dev/null; then
+      ${pkgs.coreutils}/bin/sleep infinity >/dev/null; then
       refresh_waybar
-      ${lib.getExe' pkgs.swayosd "swayosd-client"} --custom-message "${sleepOffIcon}"
-    fi
-  '';
-
-  idleLockStatus = pkgs.writeShellScript "waybar-idle-lock-status" ''
-    if ${lib.getExe' pkgs.systemd "systemctl"} --user is-active --quiet lockscreen-idle-inhibit.service; then
-      printf '{"text":"${sleepOffIcon}","tooltip":"Idle locking inhibited","class":"inhibited"}\n'
-    else
-      printf '{"text":"","class":"idle"}\n'
+      ${pkgs.swayosd}/bin/swayosd-client --custom-message "${sleepOffIcon}"
     fi
   '';
 in
@@ -58,7 +48,7 @@ in
     lib.mkEnableOption "the hyprlock lock screen";
 
   config = lib.mkIf config.modules.desktop.session.hyprland.hyprlock.enable {
-    home-manager.users.${config.user.name} = {
+    home-manager.users.${user} = {
       # Colors and the lock-screen background come from Stylix's hyprlock target,
       # so only geometry and behaviour are set here.
       programs.hyprlock = {
@@ -91,36 +81,16 @@ in
           };
         };
       };
-    };
 
-    registry.keybind.${config.networking.hostName} = {
-      hyprlock-lock = {
-        keys = "SUPER + X";
-        action = {
-          kind = "exec";
-          # The guard drops the call when a locker is already up, so no manual
-          # trigger stacks a second hyprlock over the first.
-          command = "${lib.getExe' pkgs.procps "pidof"} hyprlock || ${lib.getExe pkgs.hyprlock}";
-        };
-      };
-
-      hyprlock-toggle-idle-inhibit = {
-        keys = "SUPER + CTRL + X";
-        action = {
-          kind = "exec";
-          command = "${idleLockToggle}";
-        };
-      };
-    };
-
-    registry.waybar.${config.networking.hostName}."custom/idle-lock" = {
-      order = 20;
-      settings = {
-        return-type = "json";
-        exec = "${idleLockStatus}";
-        interval = "once";
-        signal = 9;
-      };
+      # Lock on Super+X.
+      # The guard drops the keypress when a locker is already up, so a second
+      # hyprlock never stacks over the first.
+      /*
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod, X, exec, ${pkgs.procps}/bin/pidof hyprlock || ${hyprlock}"
+        "$mod CTRL, X, exec, ${idleLockToggle}"
+      ];
+      */
     };
   };
 }

configs/nixos/modules/desktop/session/login.nix

@@ -13,13 +13,9 @@
   config = lib.mkIf config.modules.desktop.session.login.enable {
     services.greetd = {
       enable = true;
-      settings.default_session.command = lib.escapeShellArgs [
-        (lib.getExe pkgs.tuigreet)
-        "--time"
-        "--remember"
-        "--cmd"
-        "${lib.getExe config.programs.uwsm.package} start -e -D Hyprland hyprland.desktop"
-      ];
+      settings.default_session.command =
+        "${lib.getExe pkgs.tuigreet} --time --remember "
+        + "--cmd 'uwsm start -e -D Hyprland hyprland.desktop'";
     };
   };
 }

configs/nixos/modules/desktop/session/mako.nix

@@ -2,29 +2,19 @@
   config,
   lib,
   pkgs,
-  util,
   ...
 }:
 # mako as the notification daemon: toasts, a do-not-disturb mode, and history recall.
 let
-  dndStatus = pkgs.writeShellScript "waybar-dnd-status" ''
-    if ${lib.getExe' pkgs.mako "makoctl"} mode 2>/dev/null | ${lib.getExe pkgs.gnugrep} -qx dnd; then
-      printf '{"text":"${util.glyph "f1f6"}","tooltip":"Do not disturb: on","class":"dnd"}\n'
-    else
-      printf '{"text":"${util.glyph "f0f3"}","tooltip":"Notifications on","class":"active"}\n'
-    fi
-  '';
+  user = config.user.name;
 
-  dndToggle = pkgs.writeShellScript "waybar-dnd-toggle" ''
-    ${lib.getExe' pkgs.mako "makoctl"} mode -t dnd >/dev/null 2>&1
-    ${lib.getExe' pkgs.procps "pkill"} -RTMIN+8 waybar
-  '';
+  makoctl = "${pkgs.mako}/bin/makoctl";
 in
 {
   options.modules.desktop.session.mako.enable = lib.mkEnableOption "the mako notification daemon";
 
   config = lib.mkIf config.modules.desktop.session.mako.enable {
-    home-manager.users.${config.user.name} = {
+    home-manager.users.${user} = {
       # Colors and the popup font come from Stylix's mako target, so only
       # behaviour is set here.
       services.mako = {
@@ -41,25 +31,15 @@ in
           "mode=dnd".invisible = true;
         };
       };
-    };
 
-    registry.keybind.${config.networking.hostName}.mako-history = {
-      keys = "SUPER + N";
-      action = {
-        kind = "exec";
-        command = "${lib.getExe' pkgs.mako "makoctl"} restore";
-      };
-    };
-
-    registry.waybar.${config.networking.hostName}."custom/dnd" = {
-      order = 80;
-      settings = {
-        return-type = "json";
-        exec = "${dndStatus}";
-        on-click = "${dndToggle}";
-        interval = "once";
-        signal = 8;
-      };
+      # Recall the last notification from history, keyboard-only like the rest
+      # of the session.
+      # $mod is defined by the compositor config these binds share.
+      /*
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod, N, exec, ${makoctl} restore"
+      ];
+      */
     };
   };
 }

configs/nixos/modules/desktop/session/rofi.nix

@@ -6,17 +6,19 @@
 }:
 # rofi as the desktop launcher and dmenu-style menu frontend.
 let
+  user = config.user.name;
+
   # A session menu built on the same themed rofi, so the power actions look
   # like every other menu the launcher drives.
   powerMenu = pkgs.writeShellScript "rofi-power-menu" ''
     chosen=$(printf '%s\n' Lock Suspend 'Log out' Reboot 'Shut down' \
-      | ${lib.getExe pkgs.rofi} -dmenu -i -p Power)
+      | ${pkgs.rofi}/bin/rofi -dmenu -i -p Power)
     case "$chosen" in
-      Lock) ${lib.getExe' pkgs.systemd "loginctl"} lock-session ;;
-      Suspend) ${lib.getExe' pkgs.systemd "systemctl"} suspend ;;
-      'Log out') ${lib.getExe' pkgs.systemd "loginctl"} terminate-session "$XDG_SESSION_ID" ;;
-      Reboot) ${lib.getExe' pkgs.systemd "systemctl"} reboot ;;
-      'Shut down') ${lib.getExe' pkgs.systemd "systemctl"} poweroff ;;
+      Lock) ${pkgs.systemd}/bin/loginctl lock-session ;;
+      Suspend) ${pkgs.systemd}/bin/systemctl suspend ;;
+      'Log out') ${pkgs.systemd}/bin/loginctl terminate-session "$XDG_SESSION_ID" ;;
+      Reboot) ${pkgs.systemd}/bin/systemctl reboot ;;
+      'Shut down') ${pkgs.systemd}/bin/systemctl poweroff ;;
     esac
   '';
 in
@@ -24,11 +26,10 @@ in
   options.modules.desktop.session.rofi.enable = lib.mkEnableOption "the rofi launcher";
 
   config = lib.mkIf config.modules.desktop.session.rofi.enable {
-    home-manager.users.${config.user.name} = hm: {
-      # Stylix supplies the Nord theme.
+    home-manager.users.${user} = {
+      # No theme is set here: Stylix's rofi target supplies the Nord one.
       programs.rofi = {
         enable = true;
-        font = lib.mkForce "JetBrains Mono 12";
 
         # Application launch is the only mode, kept minimal so the prompt opens
         # as fast as rofi can read the desktop entries.
@@ -37,31 +38,16 @@ in
           modi = "drun";
           show-icons = false;
         };
-
-        theme.window = {
-          border = hm.config.lib.formats.rasi.mkLiteral "2px";
-          border-color = hm.config.lib.formats.rasi.mkLiteral "#FFFFFF";
-          border-radius = hm.config.lib.formats.rasi.mkLiteral "8px";
-        };
-      };
-    };
-
-    registry.keybind.${config.networking.hostName} = {
-      rofi-launcher = {
-        keys = "SUPER + R";
-        action = {
-          kind = "exec";
-          command = "${lib.getExe pkgs.rofi} -show drun";
-        };
       };
 
-      rofi-power-menu = {
-        keys = "SUPER + SHIFT + X";
-        action = {
-          kind = "exec";
-          command = "${powerMenu}";
-        };
-      };
+      # The launcher and the session menu, kept next to the tool they drive.
+      # $mod is defined by the compositor config these binds share.
+      /*
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod, R, exec, ${pkgs.rofi}/bin/rofi -show drun"
+        "$mod SHIFT, X, exec, ${powerMenu}"
+      ];
+      */
     };
   };
 }

configs/nixos/modules/desktop/session/waybar.nix

@@ -6,19 +6,97 @@
 }:
 # Waybar: a top status bar reading system state at a glance.
 let
-  moduleNames =
-    position:
-    map (entry: entry.name) (
-      lib.sort (left: right: left.module.order < right.module.order) (
-        lib.filter (entry: entry.module.position == position) moduleEntries
-      )
-    );
+  vpnClient = config.modules.network.vpn-client;
 
-  moduleEntries = lib.mapAttrsToList (name: module: {
-    inherit name module;
-  }) modules;
+  # A Nerd Font Private-Use-Area codepoint as a literal character, decoded
+  # through JSON so the glyph survives as bytes rather than an editor paste.
+  g = code: builtins.fromJSON ''"\u${code}"'';
+  user = config.user.name;
 
-  modules = lib.attrByPath [ config.networking.hostName ] { } config.registry.waybar;
+  sleepOffIcon = builtins.fromJSON ''"\udb81\udcb3"'';
+
+  # Renders and toggles mako's do-not-disturb mode.
+  # With no mako daemon answering, the status reads "notifications on", keeping
+  # the widget inert rather than broken.
+  dndStatus = pkgs.writeShellScript "waybar-dnd-status" ''
+    if ${pkgs.mako}/bin/makoctl mode 2>/dev/null | ${pkgs.gnugrep}/bin/grep -qx dnd; then
+      printf '{"text":"${g "f1f6"}","tooltip":"Do not disturb: on","class":"dnd"}\n'
+    else
+      printf '{"text":"${g "f0f3"}","tooltip":"Notifications on","class":"active"}\n'
+    fi
+  '';
+
+  dndToggle = pkgs.writeShellScript "waybar-dnd-toggle" ''
+    ${pkgs.mako}/bin/makoctl mode -t dnd >/dev/null 2>&1
+    ${pkgs.procps}/bin/pkill -RTMIN+8 waybar
+  '';
+
+  # Lit while a wf-recorder capture is running.
+  # Empty text collapses the widget when idle, so it shows nothing until then.
+  recStatus = pkgs.writeShellScript "waybar-recording-status" ''
+    if ${pkgs.procps}/bin/pgrep -x wf-recorder >/dev/null; then
+      printf '{"text":"${g "f03d"}","tooltip":"Recording","class":"recording"}\n'
+    else
+      printf '{"text":"","class":"idle"}\n'
+    fi
+  '';
+
+  idleLockStatus = pkgs.writeShellScript "waybar-idle-lock-status" ''
+    if ${pkgs.systemd}/bin/systemctl --user is-active --quiet lockscreen-idle-inhibit.service; then
+      printf '{"text":"${sleepOffIcon}","tooltip":"Idle locking inhibited","class":"inhibited"}\n'
+    else
+      printf '{"text":"","class":"idle"}\n'
+    fi
+  '';
+
+  vpnStatus = pkgs.writeShellScript "waybar-vpn-status" ''
+    interface=${lib.escapeShellArg vpnClient.interface}
+
+    if ! ${pkgs.iproute2}/bin/ip link show dev "$interface" >/dev/null 2>&1; then
+      printf '{"text":"","class":"idle"}\n'
+      exit 0
+    fi
+
+    ipaddr=$(${pkgs.iproute2}/bin/ip -4 -o addr show dev "$interface" | ${pkgs.gawk}/bin/awk '{ print $4; exit }')
+
+    ${pkgs.jq}/bin/jq -cn \
+      --arg text "󰲝" \
+      --arg tooltip "VPN $interface: ''${ipaddr:-no IPv4}" \
+      --arg class "active" \
+      '{ text: $text, tooltip: $tooltip, class: $class }'
+  '';
+
+  networkStatus = pkgs.writeShellScript "waybar-network-status" ''
+    active=$(
+      ${pkgs.networkmanager}/bin/nmcli -t -f DEVICE,TYPE,STATE,CONNECTION device status \
+        | ${pkgs.gawk}/bin/awk -F: '$3 == "connected" && $2 != "loopback" { print; exit }'
+    )
+
+    if [ -z "$active" ]; then
+      ${pkgs.jq}/bin/jq -cn \
+        --arg text "${g "f127"} off" \
+        --arg tooltip "Network disconnected" \
+        --arg class "disconnected" \
+        '{ text: $text, tooltip: $tooltip, class: $class }'
+      exit 0
+    fi
+
+    IFS=: read -r device type _state connection <<< "$active"
+
+    case "$type" in
+      wifi) icon="${g "f1eb"}" ;;
+      ethernet) icon="LAN" ;;
+      *) icon="NET" ;;
+    esac
+
+    ipaddr=$(${pkgs.iproute2}/bin/ip -4 -o addr show dev "$device" | ${pkgs.gawk}/bin/awk '{ print $4; exit }')
+
+    ${pkgs.jq}/bin/jq -cn \
+      --arg text "$icon $connection" \
+      --arg tooltip "$device: ''${ipaddr:-no IPv4}" \
+      --arg class "$type" \
+      '{ text: $text, tooltip: $tooltip, class: $class }'
+  '';
 in
 {
   options.modules.desktop.session.waybar.enable = lib.mkEnableOption "the Waybar status bar";
@@ -28,34 +106,64 @@ in
     # codepoints Stylix's monospace font does not carry.
     fonts.packages = [ pkgs.nerd-fonts.symbols-only ];
 
-    home-manager.users.${config.user.name}.programs.waybar = {
+    home-manager.users.${user}.programs.waybar = {
       enable = true;
 
       # A user service bound to graphical-session.target, which uwsm activates,
       # so the bar comes up with the session and no compositor exec-once.
       systemd.enable = true;
 
-      settings.mainBar = lib.mkMerge [
-        {
-          layer = "top";
-          position = "top";
-          height = 30;
-          spacing = 8;
-          margin-right = 8;
-
-          modules-left = moduleNames "left";
-          modules-center = moduleNames "center";
-          modules-right = moduleNames "right";
+      style = ''
+        .modules-right {
+          margin-right: 8px;
         }
-        (lib.mapAttrs (_name: module: module.settings) modules)
-      ];
-    };
 
-    registry.waybar.${config.networking.hostName} = {
-      clock = {
-        position = "center";
-        order = 10;
-        settings = {
+        #custom-dnd {
+          margin-right: 8px;
+        }
+      '';
+
+      settings.mainBar = {
+        layer = "top";
+        position = "top";
+        height = 30;
+        spacing = 8;
+
+        modules-left = [ "hyprland/workspaces" ];
+        modules-center = [ "clock" ];
+        modules-right = [
+          "custom/recording"
+          "custom/idle-lock"
+          "mpris"
+          "wireplumber"
+        ]
+        ++ lib.optional vpnClient.enable "custom/vpn"
+        ++ [
+          "custom/network"
+          "battery"
+          "custom/dnd"
+        ];
+
+        # Per-application icons for the windows on each workspace, mapped from
+        # window class with a neutral glyph for anything unlisted.
+        "hyprland/workspaces" = {
+          on-click = "activate";
+          format = "{id} {windows}";
+          format-window-separator = " ";
+          window-rewrite-default = g "f2d0";
+          window-rewrite = {
+            "class<com.mitchellh.ghostty>" = g "f120";
+            "class<.*[Ff]irefox.*>" = g "f269";
+            "class<chromium.*>" = g "f268";
+            "class<[Cc]ode>" = g "f121";
+            "class<obsidian>" = g "f02d";
+            "class<[Ss]ignal>" = g "f4ad";
+            "class<[Ss]team>" = g "f1b6";
+            "class<[Vv]esktop>" = g "f1ff";
+          };
+        };
+
+        clock = {
           format = "{:%a %d %b  %H:%M}";
           tooltip-format = "<tt>{calendar}</tt>";
           calendar = {
@@ -64,6 +172,77 @@ in
             format.today = "<b><u>{}</u></b>";
           };
         };
+
+        mpris = {
+          format = "${g "f001"} {title}";
+          format-paused = "${g "f04c"} {title}";
+          max-length = 40;
+          on-click = "play-pause";
+          on-scroll-up = "next";
+          on-scroll-down = "previous";
+        };
+
+        wireplumber = {
+          format = "{icon} {volume}%";
+          format-muted = "${g "f026"} muted";
+          format-icons = [
+            (g "f026")
+            (g "f027")
+            (g "f028")
+          ];
+          on-click = "${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+        };
+
+        "custom/vpn" = {
+          return-type = "json";
+          exec = "${vpnStatus}";
+          interval = 5;
+        };
+
+        "custom/network" = {
+          return-type = "json";
+          exec = "${networkStatus}";
+          interval = 5;
+        };
+
+        battery = {
+          format = "{icon} {capacity}%";
+          format-charging = "${g "f0e7"} {capacity}%";
+          format-icons = [
+            (g "f244")
+            (g "f243")
+            (g "f242")
+            (g "f241")
+            (g "f240")
+          ];
+          states = {
+            warning = 20;
+            critical = 10;
+          };
+        };
+
+        "custom/dnd" = {
+          return-type = "json";
+          exec = "${dndStatus}";
+          on-click = "${dndToggle}";
+          interval = "once";
+          signal = 8;
+        };
+
+        # Recording state has no event to hook, so the widget samples the
+        # wf-recorder process once a second.
+        "custom/recording" = {
+          return-type = "json";
+          exec = "${recStatus}";
+          interval = 1;
+        };
+
+        "custom/idle-lock" = {
+          return-type = "json";
+          exec = "${idleLockStatus}";
+          interval = "once";
+          signal = 9;
+        };
       };
     };
   };

configs/nixos/modules/desktop/utilities/audio.nix

@@ -1,21 +1,5 @@
-{
-  config,
-  lib,
-  pkgs,
-  util,
-  ...
-}:
+{ config, lib, ... }:
 # PipeWire as the desktop audio server.
-let
-  mediaKey = keys: command: {
-    inherit keys;
-    locked = true;
-    action = {
-      kind = "exec";
-      command = "${lib.getExe pkgs.playerctl} ${command}";
-    };
-  };
-in
 {
   options.modules.desktop.utilities.audio.enable = lib.mkEnableOption "the PipeWire audio server";
 
@@ -28,39 +12,5 @@ in
       alsa.enable = true;
       pulse.enable = true;
     };
-
-    registry.keybind.${config.networking.hostName} = {
-      media-play = mediaKey "XF86AudioPlay" "play-pause";
-      media-next = mediaKey "XF86AudioNext" "next";
-      media-previous = mediaKey "XF86AudioPrev" "previous";
-    };
-
-    registry.waybar.${config.networking.hostName} = {
-      mpris = {
-        order = 30;
-        settings = {
-          format = "${util.glyph "f001"} {title}";
-          format-paused = "${util.glyph "f04c"} {title}";
-          max-length = 40;
-          on-click = "play-pause";
-          on-scroll-up = "next";
-          on-scroll-down = "previous";
-        };
-      };
-
-      wireplumber = {
-        order = 40;
-        settings = {
-          format = "{icon} {volume}%";
-          format-muted = "${util.glyph "f026"} muted";
-          format-icons = [
-            (util.glyph "f026")
-            (util.glyph "f027")
-            (util.glyph "f028")
-          ];
-          on-click = "${lib.getExe' pkgs.wireplumber "wpctl"} set-mute @DEFAULT_AUDIO_SINK@ toggle";
-        };
-      };
-    };
   };
 }

configs/nixos/modules/desktop/utilities/clipboard.nix

@@ -6,15 +6,21 @@
 }:
 # Clipboard history: cliphist records every copy, picked back through rofi.
 let
+  user = config.user.name;
+
+  cliphist = "${pkgs.cliphist}/bin/cliphist";
+  rofi = "${pkgs.rofi}/bin/rofi";
+  wl-copy = "${pkgs.wl-clipboard}/bin/wl-copy";
+
   # The picker reuses the themed rofi, so history looks like every other menu
   # the launcher drives.
   # decode is needed because list emits id-prefixed lines rather than the copied
   # bytes, so the chosen id has to be resolved back before it can be re-copied.
   picker = pkgs.writeShellScript "clipboard-picker" ''
-    ${lib.getExe pkgs.cliphist} list \
-      | ${lib.getExe pkgs.rofi} -dmenu -i -p Clipboard \
-      | ${lib.getExe pkgs.cliphist} decode \
-      | ${lib.getExe' pkgs.wl-clipboard "wl-copy"}
+    ${cliphist} list \
+      | ${rofi} -dmenu -i -p Clipboard \
+      | ${cliphist} decode \
+      | ${wl-copy}
   '';
 in
 {
@@ -22,7 +28,7 @@ in
     lib.mkEnableOption "cliphist clipboard history";
 
   config = lib.mkIf config.modules.desktop.utilities.clipboard.enable {
-    home-manager.users.${config.user.name} = {
+    home-manager.users.${user} = {
       # wl-copy and wl-paste on PATH, so the shell can pipe into and out of the
       # clipboard.
       # The watchers and picker above reach wl-clipboard by store path, so this
@@ -32,14 +38,13 @@ in
       # Two watchers record text and images to history, bound to the graphical
       # session so uwsm starts and stops them with it.
       services.cliphist.enable = true;
-    };
 
-    registry.keybind.${config.networking.hostName}.clipboard-history = {
-      keys = "SUPER + SHIFT + V";
-      action = {
-        kind = "exec";
-        command = "${picker}";
-      };
+      # $mod is defined by the compositor config these binds share.
+      /*
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod SHIFT, V, exec, ${picker}"
+      ];
+      */
     };
   };
 }

configs/nixos/modules/desktop/utilities/osd.nix

@@ -13,53 +13,6 @@ in
     lib.mkEnableOption "the SwayOSD volume and brightness popup";
 
   config = lib.mkIf config.modules.desktop.utilities.osd.enable {
-    registry.keybind.${config.networking.hostName} = {
-      volume-up = {
-        keys = "XF86AudioRaiseVolume";
-        repeating = true;
-        action = {
-          kind = "exec";
-          command = "${pkgs.swayosd}/bin/swayosd-client --output-volume raise --max-volume 100";
-        };
-      };
-
-      volume-down = {
-        keys = "XF86AudioLowerVolume";
-        repeating = true;
-        action = {
-          kind = "exec";
-          command = "${pkgs.swayosd}/bin/swayosd-client --output-volume lower";
-        };
-      };
-
-      brightness-up = {
-        keys = "XF86MonBrightnessUp";
-        repeating = true;
-        action = {
-          kind = "exec";
-          command = "${pkgs.swayosd}/bin/swayosd-client --brightness raise";
-        };
-      };
-
-      brightness-down = {
-        keys = "XF86MonBrightnessDown";
-        repeating = true;
-        action = {
-          kind = "exec";
-          command = "${pkgs.swayosd}/bin/swayosd-client --brightness lower";
-        };
-      };
-
-      mute = {
-        keys = "XF86AudioMute";
-        locked = true;
-        action = {
-          kind = "exec";
-          command = "${pkgs.swayosd}/bin/swayosd-client --output-volume mute-toggle";
-        };
-      };
-    };
-
     environment.systemPackages = [ pkgs.swayosd ];
 
     # The udev rule chgrps each backlight's brightness node to `video` and adds

configs/nixos/modules/desktop/utilities/recording.nix

@@ -2,11 +2,21 @@
   config,
   lib,
   pkgs,
-  util,
   ...
 }:
 # Keybound screen recording: pick a region, then toggle a video-only capture.
 let
+  user = config.user.name;
+
+  slurp = "${pkgs.slurp}/bin/slurp";
+  wf-recorder = "${pkgs.wf-recorder}/bin/wf-recorder";
+  notify-send = "${pkgs.libnotify}/bin/notify-send";
+  pgrep = "${pkgs.procps}/bin/pgrep";
+  pkill = "${pkgs.procps}/bin/pkill";
+  date = "${pkgs.coreutils}/bin/date";
+  mkdir = "${pkgs.coreutils}/bin/mkdir";
+  xdgUserDir = "${pkgs.xdg-user-dirs}/bin/xdg-user-dir";
+
   # A single key both starts and stops.
   # A running wf-recorder is stopped with SIGINT so it finalises the file.
   # Otherwise slurp picks a region and wf-recorder runs in the foreground until
@@ -14,29 +24,19 @@ let
   # reports it saved.
   # No -a means no audio is captured.
   toggle = pkgs.writeShellScript "screen-record-toggle" ''
-    if ${lib.getExe' pkgs.procps "pgrep"} -x wf-recorder >/dev/null; then
-      ${lib.getExe' pkgs.procps "pkill"} -INT -x wf-recorder
+    if ${pgrep} -x wf-recorder >/dev/null; then
+      ${pkill} -INT -x wf-recorder
       exit 0
     fi
 
-    region=$(${lib.getExe pkgs.slurp}) || exit 0
-    dir="$(${lib.getExe' pkgs.xdg-user-dirs "xdg-user-dir"} VIDEOS)/Recordings"
-    ${lib.getExe' pkgs.coreutils "mkdir"} -p "$dir"
-    file="$dir/recording-$(${lib.getExe' pkgs.coreutils "date"} +%Y%m%d-%H%M%S).mp4"
+    region=$(${slurp}) || exit 0
+    dir="$(${xdgUserDir} VIDEOS)/Recordings"
+    ${mkdir} -p "$dir"
+    file="$dir/recording-$(${date} +%Y%m%d-%H%M%S).mp4"
 
-    ${lib.getExe' pkgs.libnotify "notify-send"} -a "Screen recording" "Recording started" "Region capture, no audio."
-    ${lib.getExe pkgs.wf-recorder} -g "$region" -f "$file"
-    ${lib.getExe' pkgs.libnotify "notify-send"} -a "Screen recording" "Recording saved" "$file"
-  '';
-
-  # Lit while a wf-recorder capture is running.
-  # Empty text collapses the widget when idle, so it shows nothing until then.
-  recordingStatus = pkgs.writeShellScript "waybar-recording-status" ''
-    if ${lib.getExe' pkgs.procps "pgrep"} -x wf-recorder >/dev/null; then
-      printf '{"text":"${util.glyph "f03d"}","tooltip":"Recording","class":"recording"}\n'
-    else
-      printf '{"text":"","class":"idle"}\n'
-    fi
+    ${notify-send} -a "Screen recording" "Recording started" "Region capture, no audio."
+    ${wf-recorder} -g "$region" -f "$file"
+    ${notify-send} -a "Screen recording" "Recording saved" "$file"
   '';
 in
 {
@@ -44,21 +44,13 @@ in
     lib.mkEnableOption "wf-recorder screen recording";
 
   config = lib.mkIf config.modules.desktop.utilities.recording.enable {
-    registry.keybind.${config.networking.hostName}.recording-toggle = {
-      keys = "SUPER + SHIFT + R";
-      action = {
-        kind = "exec";
-        command = "${toggle}";
-      };
-    };
-
-    registry.waybar.${config.networking.hostName}."custom/recording" = {
-      order = 10;
-      settings = {
-        return-type = "json";
-        exec = "${recordingStatus}";
-        interval = 1;
-      };
+    home-manager.users.${user} = {
+      # $mod is defined by the compositor config these binds share.
+      /*
+      wayland.windowManager.hyprland.settings.bind = [
+        "$mod SHIFT, R, exec, ${toggle}"
+      ];
+      */
     };
   };
 }

configs/nixos/modules/desktop/utilities/screenshot.nix

@@ -37,42 +37,27 @@ in
     lib.mkEnableOption "screenshots via grimblast and satty";
 
   config = lib.mkIf config.modules.desktop.utilities.screenshot.enable {
-    registry.keybind.${config.networking.hostName} = {
-      screenshot-area = {
-        keys = "Print";
-        action = {
-          kind = "exec";
-          command = "${capture "area"}";
-        };
-      };
-
-      screenshot-active = {
-        keys = "SHIFT + Print";
-        action = {
-          kind = "exec";
-          command = "${capture "active"}";
-        };
-      };
-
-      screenshot-screen = {
-        keys = "CTRL + Print";
-        action = {
-          kind = "exec";
-          command = "${capture "screen"}";
-        };
-      };
-    };
-
     home-manager.users.${user} = {
       # satty is a one-shot annotation surface, so float it rather than letting
       # it claim a tile in the layout.
-      wayland.windowManager.hyprland.settings.window_rule = [
-        {
-          match.class = "^(com\\.gabm\\.satty)$";
-          float = true;
-        }
+      # windowrule v3 syntax: space-separated field/value tokens, comma
+      # separated, with matchers under a match: prefix and effects bare.
+      /*
+      wayland.windowManager.hyprland.settings.windowrule = [
+        "float 1, match:class ^(com\\.gabm\\.satty)$"
       ];
+      */
 
+      # Print with plain/Shift/Ctrl for region/window/full.
+      # Super+L is already the hjkl focus and movement bind, so screenshots take
+      # the Print key instead.
+      /*
+      wayland.windowManager.hyprland.settings.bind = [
+        ", Print, exec, ${capture "area"}"
+        "SHIFT, Print, exec, ${capture "active"}"
+        "CTRL, Print, exec, ${capture "screen"}"
+      ];
+      */
     };
   };
 }

configs/nixos/modules/desktop/utilities/theming.nix

@@ -58,10 +58,6 @@ in
         };
       };
     };
-    registry.env.${config.networking.hostName} = {
-      HYPRCURSOR_THEME = config.stylix.cursor.name;
-      HYPRCURSOR_SIZE = toString config.stylix.cursor.size;
-    };
 
     home-manager.users.${user} = {
       # Stylix drives the cursor through home-manager's pointer-cursor config,

configs/nixos/modules/host/default.nix

@@ -30,6 +30,7 @@ in
     modules.network.ssh.userKey.sopsFile = hostSecrets;
 
     services.xserver.xkb.layout = "us";
+    services.xserver.xkb.options = "caps:escape_shifted_capslock";
     console.useXkbConfig = true;
 
     sops.defaultSopsFile = ../../secrets/shared.yaml;
@@ -53,7 +54,6 @@ in
         home.username = config.user.name;
         home.homeDirectory = "/home/${config.user.name}";
         home.stateVersion = config.system.stateVersion;
-        home.sessionVariables = lib.attrByPath [ config.networking.hostName ] { } config.registry.env;
         home.packages = with pkgs; [
           eza
           unzip

configs/nixos/modules/network/default.nix

@@ -1,57 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  util,
-  ...
-}:
-# NetworkManager-managed networking.
-let
-  networkStatus = pkgs.writeShellScript "waybar-network-status" ''
-    active=$(
-      ${lib.getExe' pkgs.networkmanager "nmcli"} -t -f DEVICE,TYPE,STATE,CONNECTION device status \
-        | ${lib.getExe' pkgs.gawk "awk"} -F: '$3 == "connected" && $2 != "loopback" { print; exit }'
-    )
-
-    if [ -z "$active" ]; then
-      ${lib.getExe pkgs.jq} -cn \
-        --arg text "${util.glyph "f127"} off" \
-        --arg tooltip "Network disconnected" \
-        --arg class "disconnected" \
-        '{ text: $text, tooltip: $tooltip, class: $class }'
-      exit 0
-    fi
-
-    IFS=: read -r device type _state connection <<< "$active"
-
-    case "$type" in
-      wifi) icon="${util.glyph "f1eb"}" ;;
-      ethernet) icon="LAN" ;;
-      *) icon="NET" ;;
-    esac
-
-    ipaddr=$(${lib.getExe' pkgs.iproute2 "ip"} -4 -o addr show dev "$device" | ${lib.getExe' pkgs.gawk "awk"} '{ print $4; exit }')
-
-    ${lib.getExe pkgs.jq} -cn \
-      --arg text "$icon $connection" \
-      --arg tooltip "$device: ''${ipaddr:-no IPv4}" \
-      --arg class "$type" \
-      '{ text: $text, tooltip: $tooltip, class: $class }'
-  '';
-in
-{
-  options.modules.network.enable = lib.mkEnableOption "NetworkManager-managed networking";
-
-  config = lib.mkIf config.modules.network.enable {
-    networking.networkmanager.enable = true;
-
-    registry.waybar.${config.networking.hostName}."custom/network" = {
-      order = 60;
-      settings = {
-        return-type = "json";
-        exec = "${networkStatus}";
-        interval = 5;
-      };
-    };
-  };
-}

configs/nixos/modules/network/vpn-client.nix

@@ -1,34 +1,10 @@
 {
   config,
   lib,
-  pkgs,
-  util,
   ...
 }:
 let
   cfg = config.modules.network.vpn-client; # NOLINT(let_order)
-
-  vpnIcon = util.glyph [
-    "db83"
-    "dc9d"
-  ];
-
-  vpnStatus = pkgs.writeShellScript "waybar-vpn-status" ''
-    interface=${lib.escapeShellArg cfg.interface}
-
-    if ! ${lib.getExe' pkgs.iproute2 "ip"} link show dev "$interface" >/dev/null 2>&1; then
-      printf '{"text":"","class":"idle"}\n'
-      exit 0
-    fi
-
-    ipaddr=$(${lib.getExe' pkgs.iproute2 "ip"} -4 -o addr show dev "$interface" | ${lib.getExe' pkgs.gawk "awk"} '{ print $4; exit }')
-
-    ${lib.getExe pkgs.jq} -cn \
-      --arg text "${vpnIcon}" \
-      --arg tooltip "VPN $interface: ''${ipaddr:-no IPv4}" \
-      --arg class "active" \
-      '{ text: $text, tooltip: $tooltip, class: $class }'
-  '';
 in
 {
   options.modules.network.vpn-client = {
@@ -81,15 +57,6 @@ in
       vpn-off = "sudo systemctl stop 'wireguard-${cfg.interface}*.service' wireguard-${cfg.interface}.target";
     };
 
-    registry.waybar.${config.networking.hostName}."custom/vpn" = {
-      order = 50;
-      settings = {
-        return-type = "json";
-        exec = "${vpnStatus}";
-        interval = 5;
-      };
-    };
-
     systemd.targets."wireguard-${cfg.interface}".wantedBy = lib.mkForce [ ];
 
     networking.wireguard.interfaces.${cfg.interface} = {

configs/nixos/modules/shell/python.nix

@@ -13,8 +13,9 @@ in
     lib.mkEnableOption "Python tools for the primary user's shell environment";
 
   config = lib.mkIf config.modules.shell.python.enable {
-    registry.env.${config.networking.hostName}.PYTHON_TOOLCHAIN_ROOT = "${pkgs.python3}";
-
-    home-manager.users.${user}.home.packages = [ pkgs.python3 ];
+    home-manager.users.${user}.home = {
+      sessionVariables.PYTHON_TOOLCHAIN_ROOT = "${pkgs.python3}";
+      packages = [ pkgs.python3 ];
+    };
   };
 }

configs/nixos/modules/shell/rust.nix

@@ -23,9 +23,9 @@ in
     lib.mkEnableOption "Rust tools for the primary user's shell environment";
 
   config = lib.mkIf config.modules.shell.rust.enable {
-    registry.env.${config.networking.hostName}.RUST_TOOLCHAIN_ROOT = "${toolchain}";
-
     home-manager.users.${user} = {
+      home.sessionVariables.RUST_TOOLCHAIN_ROOT = "${toolchain}";
+
       home.packages = [
         toolchain
         pkgs.rust-analyzer

configs/nixos/registry/env.nix

@@ -1,4 +0,0 @@
-{ lib, ... }:
-{
-  type = lib.types.str;
-}

configs/nixos/registry/keybind.nix

@@ -1,112 +0,0 @@
-{ lib, util, ... }:
-{
-  checks = [
-    {
-      assertion = util.registry.predicates.uniquePerHost (entry: entry.value.keys);
-      message = "Desktop keybinds must use unique key chords per host.";
-    }
-    {
-      assertion =
-        entries:
-        lib.all (
-          entry:
-          (entry.value.action.kind == "exec" && entry.value.action.command != null)
-          || (
-            builtins.elem entry.value.action.kind [
-              "focus"
-              "move-window"
-            ]
-            && lib.xor (entry.value.action.direction != null) (entry.value.action.workspace != null)
-          )
-          || (
-            entry.value.action.kind == "resize-window"
-            && entry.value.action.direction != null
-            && entry.value.action.workspace == null
-          )
-          || (
-            builtins.elem entry.value.action.kind [
-              "toggle-floating"
-              "toggle-fullscreen"
-              "close-window"
-            ]
-            && entry.value.action.command == null
-            && entry.value.action.direction == null
-            && entry.value.action.workspace == null
-          )
-        ) entries;
-      message = "Desktop keybind actions must set the fields their kind requires.";
-    }
-  ];
-
-  type = lib.types.submodule {
-    options = {
-      keys = lib.mkOption {
-        description = "Sets the key chord for this desktop keybind.";
-        type = lib.types.str;
-        example = "SUPER + Return";
-      };
-
-      repeating = lib.mkOption {
-        description = "Repeats the keybind action while the key chord is held.";
-        type = lib.types.bool;
-        default = false;
-        example = true;
-      };
-
-      locked = lib.mkOption {
-        description = "Allows the keybind action while the session is locked.";
-        type = lib.types.bool;
-        default = false;
-        example = true;
-      };
-
-      action = lib.mkOption {
-        description = "Declares the action this keybind runs.";
-        type = lib.types.submodule {
-          options = {
-            kind = lib.mkOption {
-              description = "Selects the keybind action kind.";
-              type = lib.types.enum [
-                "exec"
-                "focus"
-                "move-window"
-                "resize-window"
-                "toggle-floating"
-                "toggle-fullscreen"
-                "close-window"
-              ];
-            };
-
-            command = lib.mkOption {
-              description = "Command executed by an exec keybind.";
-              type = lib.types.nullOr lib.types.str;
-              default = null;
-              example = "ghostty";
-            };
-
-            direction = lib.mkOption {
-              description = "Direction targeted by a keybind action.";
-              type = lib.types.nullOr (
-                lib.types.enum [
-                  "down"
-                  "left"
-                  "right"
-                  "up"
-                ]
-              );
-              default = null;
-              example = "left";
-            };
-
-            workspace = lib.mkOption {
-              description = "Workspace targeted by a keybind action.";
-              type = lib.types.nullOr lib.types.int;
-              default = null;
-              example = 1;
-            };
-          };
-        };
-      };
-    };
-  };
-}

configs/nixos/registry/waybar.nix

@@ -1,29 +0,0 @@
-{ lib, ... }:
-{
-  type = lib.types.submodule {
-    options = {
-      position = lib.mkOption {
-        type = lib.types.enum [
-          "left"
-          "center"
-          "right"
-        ];
-        default = "right";
-        description = "Selects the Waybar section that shows the module.";
-      };
-
-      order = lib.mkOption {
-        type = lib.types.int;
-        default = 100;
-        example = 50;
-        description = "Sorts the module within its Waybar section.";
-      };
-
-      settings = lib.mkOption {
-        type = lib.types.attrsOf lib.types.anything;
-        default = { };
-        description = "Sets the Waybar module configuration.";
-      };
-    };
-  };
-}

configs/nixos/registry/window-icon.nix

@@ -1,19 +0,0 @@
-{ lib, ... }:
-{
-
-  type = lib.types.submodule {
-    options = {
-      class = lib.mkOption {
-        description = "Matches the window class reported by the compositor.";
-        type = lib.types.str;
-        example = ".*[Ff]irefox.*";
-      };
-
-      icon = lib.mkOption {
-        description = "Sets the icon shown for matching windows.";
-        type = lib.types.str;
-        example = "";
-      };
-    };
-  };
-}

src/dotfiles/util.nix

@@ -16,31 +16,14 @@ let
           [ ]
       ) (builtins.readDir dir)
     );
-
-  uniqueValue =
-    value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
 in
 {
   inherit collectNixFiles;
 
   removeNixSuffix = path: lib.removeSuffix ".nix" (builtins.baseNameOf path);
 
-  glyph =
-    code:
-    builtins.fromJSON (
-      "\""
-      + (if builtins.isList code then lib.concatMapStrings (part: "\\u${part}") code else "\\u${code}")
-      + "\""
-    );
-
-  registry.predicates.uniqueValue = uniqueValue;
-
-  registry.predicates.uniquePerHost =
-    value:
-    uniqueValue (entry: {
-      inherit (entry) host;
-      value = value entry;
-    });
+  registry.predicates.uniqueValue =
+    value: entries: builtins.length (lib.unique (map value entries)) == builtins.length entries;
 
   bridgeName = id: "br-vlan${toString id}";
 

src/skills/style/nix/rules/general.md

@@ -21,32 +21,3 @@ Do not call `lib.removeSuffix ".nix"` outside the utility definition.
 ### Rationale
 
 The utility centralizes Nix file-name normalization.
-
-## Use executable helpers for package commands
-
-### Rule
-
-Use `lib.getExe` for a package's main executable.
-Use `lib.getExe'` for a package's non-main executable.
-Do not build executable paths with `"${pkg}/bin/name"` when an executable helper names the target.
-Use `lib.getExe' config.programs.<name>.package "tool"` when a command follows a configured package option.
-
-### Rationale
-
-Executable helpers select the package output that contains binaries.
-They make package ownership explicit.
-`lib.getExe'` prevents calls to a package's main executable when code needs another tool.
-
-## Prefer NixOS package ownership for commands
-
-### Rule
-
-Use `pkgs.<name>` for Home Manager tools.
-Use `config.programs.<name>.package` when a NixOS module owns the package selection.
-Do not read `config.home-manager.users.<user>.programs.<name>.package` for command paths.
-
-### Rationale
-
-Home Manager uses the NixOS package set in this repository.
-`pkgs.<name>` avoids dependency paths through the user tree under Home Manager.
-Configured NixOS package options preserve package selection when a module owns the tool.