From 324d40c85dd580f4391db71a4406b59f04c13f35 Mon Sep 17 00:00:00 2001
From: alexion <contact@alexion.dev>
Date: Sat, 26 Sep 2026 23:32:34 -0400
Subject: [PATCH] style(nixos): suppress cfg order findings

---
 configs/nixos/guests/actualbudget.nix                       | 2 +-
 configs/nixos/guests/copyparty.nix                          | 2 +-
 configs/nixos/guests/homepage.nix                           | 2 +-
 configs/nixos/guests/palworld.nix                           | 2 +-
 configs/nixos/guests/valheim.nix                            | 2 +-
 configs/nixos/modules/desktop/apps/alacritty.nix            | 2 +-
 configs/nixos/modules/desktop/apps/firefox.nix              | 2 +-
 configs/nixos/modules/desktop/apps/ghostty.nix              | 2 +-
 configs/nixos/modules/desktop/apps/obsidian.nix             | 2 +-
 configs/nixos/modules/desktop/apps/r2modman.nix             | 2 +-
 configs/nixos/modules/desktop/apps/signal.nix               | 2 +-
 configs/nixos/modules/desktop/apps/steam.nix                | 2 +-
 configs/nixos/modules/desktop/apps/vencord.nix              | 2 +-
 configs/nixos/modules/desktop/default.nix                   | 2 +-
 configs/nixos/modules/desktop/session/hyprland/default.nix  | 2 +-
 configs/nixos/modules/desktop/session/hyprland/hypridle.nix | 2 +-
 configs/nixos/modules/desktop/session/hyprland/hyprlock.nix | 2 +-
 configs/nixos/modules/desktop/session/login.nix             | 2 +-
 configs/nixos/modules/desktop/session/mako.nix              | 2 +-
 configs/nixos/modules/desktop/session/portals.nix           | 2 +-
 configs/nixos/modules/desktop/session/rofi.nix              | 2 +-
 configs/nixos/modules/desktop/session/waybar.nix            | 2 +-
 configs/nixos/modules/desktop/utilities/audio.nix           | 2 +-
 configs/nixos/modules/desktop/utilities/clipboard.nix       | 2 +-
 configs/nixos/modules/desktop/utilities/osd.nix             | 2 +-
 configs/nixos/modules/desktop/utilities/recording.nix       | 2 +-
 configs/nixos/modules/desktop/utilities/screenshot.nix      | 2 +-
 configs/nixos/modules/desktop/utilities/theming.nix         | 2 +-
 configs/nixos/modules/desktop/utilities/userdirs.nix        | 2 +-
 configs/nixos/modules/guest.nix                             | 2 +-
 configs/nixos/modules/host.nix                              | 2 +-
 configs/nixos/modules/monorepo.nix                          | 2 +-
 configs/nixos/modules/network/ssh.nix                       | 2 +-
 configs/nixos/modules/network/vlans.nix                     | 2 +-
 configs/nixos/modules/network/vpn-client.nix                | 2 +-
 configs/nixos/modules/services/actualbudget.nix             | 2 +-
 configs/nixos/modules/services/copyparty.nix                | 2 +-
 configs/nixos/modules/services/homepage.nix                 | 2 +-
 configs/nixos/modules/services/navidrome.nix                | 2 +-
 configs/nixos/modules/services/reverse-proxy.nix            | 2 +-
 configs/nixos/modules/shell/bazel.nix                       | 2 +-
 configs/nixos/modules/shell/direnv/default.nix              | 2 +-
 configs/nixos/modules/shell/fish/default.nix                | 2 +-
 configs/nixos/modules/shell/git.nix                         | 2 +-
 configs/nixos/modules/shell/gitea-axi.nix                   | 2 +-
 configs/nixos/modules/shell/herdr.nix                       | 2 +-
 configs/nixos/modules/shell/nvim/default.nix                | 2 +-
 configs/nixos/modules/shell/omp.nix                         | 2 +-
 configs/nixos/modules/shell/pi/default.nix                  | 2 +-
 configs/nixos/modules/shell/python.nix                      | 2 +-
 configs/nixos/modules/shell/rust.nix                        | 2 +-
 configs/nixos/modules/shell/tmux/default.nix                | 2 +-
 configs/nixos/modules/shell/yazi.nix                        | 2 +-
 configs/nixos/modules/zfs.nix                               | 2 +-
 54 files changed, 54 insertions(+), 54 deletions(-)

diff --git a/configs/nixos/guests/actualbudget.nix b/configs/nixos/guests/actualbudget.nix
index 10a973a..5bd3157 100644
--- a/configs/nixos/guests/actualbudget.nix
+++ b/configs/nixos/guests/actualbudget.nix
@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.guests.actualbudget;
+  cfg = config.guests.actualbudget; # NOLINT(let_order)
   dataDir = "/data";
 in
 {
diff --git a/configs/nixos/guests/copyparty.nix b/configs/nixos/guests/copyparty.nix
index 63c57f3..fd4d9b7 100644
--- a/configs/nixos/guests/copyparty.nix
+++ b/configs/nixos/guests/copyparty.nix
@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.guests.copyparty;
+  cfg = config.guests.copyparty; # NOLINT(let_order)
 
   volumeType = lib.types.submodule {
     options = {
diff --git a/configs/nixos/guests/homepage.nix b/configs/nixos/guests/homepage.nix
index da3e0b8..7461642 100644
--- a/configs/nixos/guests/homepage.nix
+++ b/configs/nixos/guests/homepage.nix
@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.guests.homepage;
+  cfg = config.guests.homepage; # NOLINT(let_order)
   environmentFile = "/run/secrets/homepage.env";
 in
 {
diff --git a/configs/nixos/guests/palworld.nix b/configs/nixos/guests/palworld.nix
index 9ae2208..057a90b 100644
--- a/configs/nixos/guests/palworld.nix
+++ b/configs/nixos/guests/palworld.nix
@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.guests.palworld;
+  cfg = config.guests.palworld; # NOLINT(let_order)
   steamDir = "/data/steamcmd";
   installDir = "/data/server";
   stateDir = "/data/state";
diff --git a/configs/nixos/guests/valheim.nix b/configs/nixos/guests/valheim.nix
index 6c38233..c1085d1 100644
--- a/configs/nixos/guests/valheim.nix
+++ b/configs/nixos/guests/valheim.nix
@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.guests.valheim;
+  cfg = config.guests.valheim; # NOLINT(let_order)
   steamDir = "/data/steamcmd";
   installDir = "/data/server";
   stateDir = "/data/state";
diff --git a/configs/nixos/modules/desktop/apps/alacritty.nix b/configs/nixos/modules/desktop/apps/alacritty.nix
index 785a71e..f8ce8d5 100644
--- a/configs/nixos/modules/desktop/apps/alacritty.nix
+++ b/configs/nixos/modules/desktop/apps/alacritty.nix
@@ -6,7 +6,7 @@
 }:
 # Alacritty as the desktop terminal.
 let
-  cfg = config.modules.desktop.apps.alacritty;
+  cfg = config.modules.desktop.apps.alacritty; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/desktop/apps/firefox.nix b/configs/nixos/modules/desktop/apps/firefox.nix
index d47e3bd..4693a03 100644
--- a/configs/nixos/modules/desktop/apps/firefox.nix
+++ b/configs/nixos/modules/desktop/apps/firefox.nix
@@ -7,7 +7,7 @@
 }:
 # Firefox as the desktop browser: stock mainline, hardened and de-monetized by policy.
 let
-  cfg = config.modules.desktop.apps.firefox;
+  cfg = config.modules.desktop.apps.firefox; # NOLINT(let_order)
   user = config.user.name;
   firefoxAddons = inputs.firefox-addons.packages.${pkgs.stdenv.hostPlatform.system};
 in
diff --git a/configs/nixos/modules/desktop/apps/ghostty.nix b/configs/nixos/modules/desktop/apps/ghostty.nix
index c39451e..a3b7853 100644
--- a/configs/nixos/modules/desktop/apps/ghostty.nix
+++ b/configs/nixos/modules/desktop/apps/ghostty.nix
@@ -6,7 +6,7 @@
 }:
 # Ghostty as the desktop terminal.
 let
-  cfg = config.modules.desktop.apps.ghostty;
+  cfg = config.modules.desktop.apps.ghostty; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/desktop/apps/obsidian.nix b/configs/nixos/modules/desktop/apps/obsidian.nix
index 38b0deb..bc1f190 100644
--- a/configs/nixos/modules/desktop/apps/obsidian.nix
+++ b/configs/nixos/modules/desktop/apps/obsidian.nix
@@ -6,7 +6,7 @@
 }:
 # Obsidian as the desktop note-taking vault.
 let
-  cfg = config.modules.desktop.apps.obsidian;
+  cfg = config.modules.desktop.apps.obsidian; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/desktop/apps/r2modman.nix b/configs/nixos/modules/desktop/apps/r2modman.nix
index 6607dfd..326f6b6 100644
--- a/configs/nixos/modules/desktop/apps/r2modman.nix
+++ b/configs/nixos/modules/desktop/apps/r2modman.nix
@@ -6,7 +6,7 @@
 }:
 # r2modman, a Thunderstore mod manager.
 let
-  cfg = config.modules.desktop.apps.r2modman;
+  cfg = config.modules.desktop.apps.r2modman; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/desktop/apps/signal.nix b/configs/nixos/modules/desktop/apps/signal.nix
index 2c534d4..8d92ef4 100644
--- a/configs/nixos/modules/desktop/apps/signal.nix
+++ b/configs/nixos/modules/desktop/apps/signal.nix
@@ -6,7 +6,7 @@
 }:
 # Signal desktop messenger.
 let
-  cfg = config.modules.desktop.apps.signal;
+  cfg = config.modules.desktop.apps.signal; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/desktop/apps/steam.nix b/configs/nixos/modules/desktop/apps/steam.nix
index 0bafc21..f2ca917 100644
--- a/configs/nixos/modules/desktop/apps/steam.nix
+++ b/configs/nixos/modules/desktop/apps/steam.nix
@@ -6,7 +6,7 @@
 }:
 # Steam game launcher and runtime integration.
 let
-  cfg = config.modules.desktop.apps.steam;
+  cfg = config.modules.desktop.apps.steam; # NOLINT(let_order)
 in
 {
   options.modules.desktop.apps.steam.enable = lib.mkEnableOption "Steam game launcher";
diff --git a/configs/nixos/modules/desktop/apps/vencord.nix b/configs/nixos/modules/desktop/apps/vencord.nix
index 53b6ecf..95a7f2c 100644
--- a/configs/nixos/modules/desktop/apps/vencord.nix
+++ b/configs/nixos/modules/desktop/apps/vencord.nix
@@ -6,7 +6,7 @@
 }:
 # Vesktop, a Discord client with Vencord built in.
 let
-  cfg = config.modules.desktop.apps.vencord;
+  cfg = config.modules.desktop.apps.vencord; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/desktop/default.nix b/configs/nixos/modules/desktop/default.nix
index c9bf014..43e53a2 100644
--- a/configs/nixos/modules/desktop/default.nix
+++ b/configs/nixos/modules/desktop/default.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
 # The desktop aggregator: one flag brings up the whole graphical session.
 let
-  cfg = config.modules.desktop;
+  cfg = config.modules.desktop; # NOLINT(let_order)
 in
 {
   options.modules.desktop.enable = lib.mkEnableOption "the keyboard-driven Hyprland desktop";
diff --git a/configs/nixos/modules/desktop/session/hyprland/default.nix b/configs/nixos/modules/desktop/session/hyprland/default.nix
index 445f293..cdb462a 100644
--- a/configs/nixos/modules/desktop/session/hyprland/default.nix
+++ b/configs/nixos/modules/desktop/session/hyprland/default.nix
@@ -6,7 +6,7 @@
 }:
 # The Hyprland compositor.
 let
-  cfg = config.modules.desktop.session.hyprland;
+  cfg = config.modules.desktop.session.hyprland; # NOLINT(let_order)
   user = config.user.name;
   cursor = config.stylix.cursor;
 
diff --git a/configs/nixos/modules/desktop/session/hyprland/hypridle.nix b/configs/nixos/modules/desktop/session/hyprland/hypridle.nix
index 96411e3..e87b078 100644
--- a/configs/nixos/modules/desktop/session/hyprland/hypridle.nix
+++ b/configs/nixos/modules/desktop/session/hyprland/hypridle.nix
@@ -6,7 +6,7 @@
 }:
 # hypridle: idle-triggered locking and display power management.
 let
-  cfg = config.modules.desktop.session.hyprland.hypridle;
+  cfg = config.modules.desktop.session.hyprland.hypridle; # NOLINT(let_order)
   user = config.user.name;
 
   hyprctl = "${config.programs.hyprland.package}/bin/hyprctl";
diff --git a/configs/nixos/modules/desktop/session/hyprland/hyprlock.nix b/configs/nixos/modules/desktop/session/hyprland/hyprlock.nix
index 50a9782..ce7e8ec 100644
--- a/configs/nixos/modules/desktop/session/hyprland/hyprlock.nix
+++ b/configs/nixos/modules/desktop/session/hyprland/hyprlock.nix
@@ -6,7 +6,7 @@
 }:
 # The lock screen: a hyprlock session-lock surface the compositor owns.
 let
-  cfg = config.modules.desktop.session.hyprland.hyprlock;
+  cfg = config.modules.desktop.session.hyprland.hyprlock; # NOLINT(let_order)
   user = config.user.name;
 
   # The hyprlock this module installs, used by the lock keybind below.
diff --git a/configs/nixos/modules/desktop/session/login.nix b/configs/nixos/modules/desktop/session/login.nix
index d3f6cfd..b1aa8fb 100644
--- a/configs/nixos/modules/desktop/session/login.nix
+++ b/configs/nixos/modules/desktop/session/login.nix
@@ -7,7 +7,7 @@
 # Text login: greetd running the tuigreet greeter, which starts the session
 # through the universal Wayland session manager.
 let
-  cfg = config.modules.desktop.session.login;
+  cfg = config.modules.desktop.session.login; # NOLINT(let_order)
 in
 {
   options.modules.desktop.session.login.enable =
diff --git a/configs/nixos/modules/desktop/session/mako.nix b/configs/nixos/modules/desktop/session/mako.nix
index fc1829f..0c4703c 100644
--- a/configs/nixos/modules/desktop/session/mako.nix
+++ b/configs/nixos/modules/desktop/session/mako.nix
@@ -6,7 +6,7 @@
 }:
 # mako as the notification daemon: toasts, a do-not-disturb mode, and history recall.
 let
-  cfg = config.modules.desktop.session.mako;
+  cfg = config.modules.desktop.session.mako; # NOLINT(let_order)
   user = config.user.name;
 
   makoctl = "${pkgs.mako}/bin/makoctl";
diff --git a/configs/nixos/modules/desktop/session/portals.nix b/configs/nixos/modules/desktop/session/portals.nix
index cd156a8..6132146 100644
--- a/configs/nixos/modules/desktop/session/portals.nix
+++ b/configs/nixos/modules/desktop/session/portals.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
 # XDG desktop portal routing for in-app screen sharing and file dialogs.
 let
-  cfg = config.modules.desktop.session.portals;
+  cfg = config.modules.desktop.session.portals; # NOLINT(let_order)
 in
 {
   options.modules.desktop.session.portals.enable =
diff --git a/configs/nixos/modules/desktop/session/rofi.nix b/configs/nixos/modules/desktop/session/rofi.nix
index 8a62c56..a39d0d3 100644
--- a/configs/nixos/modules/desktop/session/rofi.nix
+++ b/configs/nixos/modules/desktop/session/rofi.nix
@@ -6,7 +6,7 @@
 }:
 # rofi as the desktop launcher and dmenu-style menu frontend.
 let
-  cfg = config.modules.desktop.session.rofi;
+  cfg = config.modules.desktop.session.rofi; # NOLINT(let_order)
   user = config.user.name;
 
   # A session menu built on the same themed rofi, so the power actions look
diff --git a/configs/nixos/modules/desktop/session/waybar.nix b/configs/nixos/modules/desktop/session/waybar.nix
index 330903f..d13ba8d 100644
--- a/configs/nixos/modules/desktop/session/waybar.nix
+++ b/configs/nixos/modules/desktop/session/waybar.nix
@@ -6,7 +6,7 @@
 }:
 # Waybar: a top status bar reading system state at a glance.
 let
-  cfg = config.modules.desktop.session.waybar;
+  cfg = config.modules.desktop.session.waybar; # NOLINT(let_order)
   vpnClient = config.modules.network.vpn-client;
   user = config.user.name;
 
diff --git a/configs/nixos/modules/desktop/utilities/audio.nix b/configs/nixos/modules/desktop/utilities/audio.nix
index 0412bc9..375060b 100644
--- a/configs/nixos/modules/desktop/utilities/audio.nix
+++ b/configs/nixos/modules/desktop/utilities/audio.nix
@@ -1,7 +1,7 @@
 { config, lib, ... }:
 # PipeWire as the desktop audio server.
 let
-  cfg = config.modules.desktop.utilities.audio;
+  cfg = config.modules.desktop.utilities.audio; # NOLINT(let_order)
 in
 {
   options.modules.desktop.utilities.audio.enable = lib.mkEnableOption "the PipeWire audio server";
diff --git a/configs/nixos/modules/desktop/utilities/clipboard.nix b/configs/nixos/modules/desktop/utilities/clipboard.nix
index 612255f..981426b 100644
--- a/configs/nixos/modules/desktop/utilities/clipboard.nix
+++ b/configs/nixos/modules/desktop/utilities/clipboard.nix
@@ -6,7 +6,7 @@
 }:
 # Clipboard history: cliphist records every copy, picked back through rofi.
 let
-  cfg = config.modules.desktop.utilities.clipboard;
+  cfg = config.modules.desktop.utilities.clipboard; # NOLINT(let_order)
   user = config.user.name;
 
   cliphist = "${pkgs.cliphist}/bin/cliphist";
diff --git a/configs/nixos/modules/desktop/utilities/osd.nix b/configs/nixos/modules/desktop/utilities/osd.nix
index d6227c5..031fa7c 100644
--- a/configs/nixos/modules/desktop/utilities/osd.nix
+++ b/configs/nixos/modules/desktop/utilities/osd.nix
@@ -6,7 +6,7 @@
 }:
 # SwayOSD: a transient on-screen popup for volume and brightness changes.
 let
-  cfg = config.modules.desktop.utilities.osd;
+  cfg = config.modules.desktop.utilities.osd; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/desktop/utilities/recording.nix b/configs/nixos/modules/desktop/utilities/recording.nix
index 7fa9ccc..15102a6 100644
--- a/configs/nixos/modules/desktop/utilities/recording.nix
+++ b/configs/nixos/modules/desktop/utilities/recording.nix
@@ -6,7 +6,7 @@
 }:
 # Keybound screen recording: pick a region, then toggle a video-only capture.
 let
-  cfg = config.modules.desktop.utilities.recording;
+  cfg = config.modules.desktop.utilities.recording; # NOLINT(let_order)
   user = config.user.name;
 
   slurp = "${pkgs.slurp}/bin/slurp";
diff --git a/configs/nixos/modules/desktop/utilities/screenshot.nix b/configs/nixos/modules/desktop/utilities/screenshot.nix
index ba18c98..ff33392 100644
--- a/configs/nixos/modules/desktop/utilities/screenshot.nix
+++ b/configs/nixos/modules/desktop/utilities/screenshot.nix
@@ -7,7 +7,7 @@
 # Keyboard-driven screenshots that open in satty for annotation, then land in
 # both the clipboard and a dated file.
 let
-  cfg = config.modules.desktop.utilities.screenshot;
+  cfg = config.modules.desktop.utilities.screenshot; # NOLINT(let_order)
   user = config.user.name;
 
   grimblast = "${pkgs.grimblast}/bin/grimblast";
diff --git a/configs/nixos/modules/desktop/utilities/theming.nix b/configs/nixos/modules/desktop/utilities/theming.nix
index 6c7768d..2fb9f80 100644
--- a/configs/nixos/modules/desktop/utilities/theming.nix
+++ b/configs/nixos/modules/desktop/utilities/theming.nix
@@ -6,7 +6,7 @@
 }:
 # Nord theming for the graphical layer, driven from one base16 scheme by Stylix.
 let
-  cfg = config.modules.desktop.utilities.theming;
+  cfg = config.modules.desktop.utilities.theming; # NOLINT(let_order)
   user = config.user.name;
 
   # A single static Nord wallpaper, drawn as a vertical gradient across the
diff --git a/configs/nixos/modules/desktop/utilities/userdirs.nix b/configs/nixos/modules/desktop/utilities/userdirs.nix
index 7909f10..0b7a0f0 100644
--- a/configs/nixos/modules/desktop/utilities/userdirs.nix
+++ b/configs/nixos/modules/desktop/utilities/userdirs.nix
@@ -2,7 +2,7 @@
 # Declares the XDG user directories, so a tool that queries them lands in a
 # well-known folder a host can relocate from one place.
 let
-  cfg = config.modules.desktop.utilities.userdirs;
+  cfg = config.modules.desktop.utilities.userdirs; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/guest.nix b/configs/nixos/modules/guest.nix
index b786050..588614e 100644
--- a/configs/nixos/modules/guest.nix
+++ b/configs/nixos/modules/guest.nix
@@ -1,6 +1,6 @@
 { config, lib, ... }:
 let
-  cfg = config.modules.guest;
+  cfg = config.modules.guest; # NOLINT(let_order)
 in
 {
   options.modules.guest.enable = lib.mkEnableOption "nested-guest base configuration";
diff --git a/configs/nixos/modules/host.nix b/configs/nixos/modules/host.nix
index ca4ce4d..3805c92 100644
--- a/configs/nixos/modules/host.nix
+++ b/configs/nixos/modules/host.nix
@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.modules.host;
+  cfg = config.modules.host; # NOLINT(let_order)
   inherit (config) user;
   hostSecrets = ../secrets + "/${config.networking.hostName}.yaml";
   passwordSecret = "${user.name}-password";
diff --git a/configs/nixos/modules/monorepo.nix b/configs/nixos/modules/monorepo.nix
index 38c963e..b46806a 100644
--- a/configs/nixos/modules/monorepo.nix
+++ b/configs/nixos/modules/monorepo.nix
@@ -5,7 +5,7 @@
 }:
 # Tools for developing this monorepo.
 let
-  cfg = config.modules.monorepo;
+  cfg = config.modules.monorepo; # NOLINT(let_order)
 in
 {
   options.modules.monorepo.enable = lib.mkEnableOption "tools for developing this monorepo";
diff --git a/configs/nixos/modules/network/ssh.nix b/configs/nixos/modules/network/ssh.nix
index 45e8e75..1571352 100644
--- a/configs/nixos/modules/network/ssh.nix
+++ b/configs/nixos/modules/network/ssh.nix
@@ -6,7 +6,7 @@
 }:
 # SSH on this machine, in both directions.
 let
-  cfg = config.modules.network.ssh;
+  cfg = config.modules.network.ssh; # NOLINT(let_order)
   user = config.user.name;
 
   inherit (lib)
diff --git a/configs/nixos/modules/network/vlans.nix b/configs/nixos/modules/network/vlans.nix
index c945821..25d75de 100644
--- a/configs/nixos/modules/network/vlans.nix
+++ b/configs/nixos/modules/network/vlans.nix
@@ -6,7 +6,7 @@
 }:
 # The host networking foundation: per-VLAN bridges over a tagged trunk.
 let
-  cfg = config.modules.network.vlans;
+  cfg = config.modules.network.vlans; # NOLINT(let_order)
 
   inherit (util) bridgeName;
 
diff --git a/configs/nixos/modules/network/vpn-client.nix b/configs/nixos/modules/network/vpn-client.nix
index 495b95a..19d4669 100644
--- a/configs/nixos/modules/network/vpn-client.nix
+++ b/configs/nixos/modules/network/vpn-client.nix
@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.modules.network.vpn-client;
+  cfg = config.modules.network.vpn-client; # NOLINT(let_order)
 in
 {
   options.modules.network.vpn-client = {
diff --git a/configs/nixos/modules/services/actualbudget.nix b/configs/nixos/modules/services/actualbudget.nix
index 73e7bdd..eaddda6 100644
--- a/configs/nixos/modules/services/actualbudget.nix
+++ b/configs/nixos/modules/services/actualbudget.nix
@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.actualbudget;
+  cfg = config.modules.services.actualbudget; # NOLINT(let_order)
 in
 {
   options.modules.services.actualbudget = {
diff --git a/configs/nixos/modules/services/copyparty.nix b/configs/nixos/modules/services/copyparty.nix
index e1d0ce3..488ec45 100644
--- a/configs/nixos/modules/services/copyparty.nix
+++ b/configs/nixos/modules/services/copyparty.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.copyparty;
+  cfg = config.modules.services.copyparty; # NOLINT(let_order)
 
   volumeType = lib.types.submodule {
     options = {
diff --git a/configs/nixos/modules/services/homepage.nix b/configs/nixos/modules/services/homepage.nix
index 4017f88..9d63977 100644
--- a/configs/nixos/modules/services/homepage.nix
+++ b/configs/nixos/modules/services/homepage.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.homepage;
+  cfg = config.modules.services.homepage; # NOLINT(let_order)
 
   mkRegistryPath =
     registryName: host: entry:
diff --git a/configs/nixos/modules/services/navidrome.nix b/configs/nixos/modules/services/navidrome.nix
index 9bcacaa..c90fac5 100644
--- a/configs/nixos/modules/services/navidrome.nix
+++ b/configs/nixos/modules/services/navidrome.nix
@@ -4,7 +4,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.navidrome;
+  cfg = config.modules.services.navidrome; # NOLINT(let_order)
 in
 {
   options.modules.services.navidrome = {
diff --git a/configs/nixos/modules/services/reverse-proxy.nix b/configs/nixos/modules/services/reverse-proxy.nix
index 8ce9fb4..806187c 100644
--- a/configs/nixos/modules/services/reverse-proxy.nix
+++ b/configs/nixos/modules/services/reverse-proxy.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  cfg = config.modules.services.reverse-proxy;
+  cfg = config.modules.services.reverse-proxy; # NOLINT(let_order)
 
   mkRegistryPath =
     registryName: host: entry:
diff --git a/configs/nixos/modules/shell/bazel.nix b/configs/nixos/modules/shell/bazel.nix
index e984bec..c97cf99 100644
--- a/configs/nixos/modules/shell/bazel.nix
+++ b/configs/nixos/modules/shell/bazel.nix
@@ -6,7 +6,7 @@
 }:
 # Bazel for the primary user's shell environment.
 let
-  cfg = config.modules.shell.bazel;
+  cfg = config.modules.shell.bazel; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/shell/direnv/default.nix b/configs/nixos/modules/shell/direnv/default.nix
index c88953c..418093b 100644
--- a/configs/nixos/modules/shell/direnv/default.nix
+++ b/configs/nixos/modules/shell/direnv/default.nix
@@ -5,7 +5,7 @@
 }:
 # direnv for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.direnv;
+  cfg = config.modules.shell.direnv; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/shell/fish/default.nix b/configs/nixos/modules/shell/fish/default.nix
index 4f8ef12..b3122de 100644
--- a/configs/nixos/modules/shell/fish/default.nix
+++ b/configs/nixos/modules/shell/fish/default.nix
@@ -6,7 +6,7 @@
 }:
 # fish for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.fish;
+  cfg = config.modules.shell.fish; # NOLINT(let_order)
   user = config.user.name;
   shortcuts = lib.attrByPath [ config.networking.hostName ] { } config.registry.shell-shortcut;
   envVars = lib.attrByPath [ config.networking.hostName ] { } config.registry.env-var;
diff --git a/configs/nixos/modules/shell/git.nix b/configs/nixos/modules/shell/git.nix
index 88b6bcf..6e59530 100644
--- a/configs/nixos/modules/shell/git.nix
+++ b/configs/nixos/modules/shell/git.nix
@@ -5,7 +5,7 @@
 }:
 # git for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.git;
+  cfg = config.modules.shell.git; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/shell/gitea-axi.nix b/configs/nixos/modules/shell/gitea-axi.nix
index b35d4e6..98c9ed5 100644
--- a/configs/nixos/modules/shell/gitea-axi.nix
+++ b/configs/nixos/modules/shell/gitea-axi.nix
@@ -6,7 +6,7 @@
 }:
 # gitea-axi for the primary user, installed through its own home-manager module.
 let
-  cfg = config.modules.shell.gitea-axi;
+  cfg = config.modules.shell.gitea-axi; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/shell/herdr.nix b/configs/nixos/modules/shell/herdr.nix
index b91e03c..9849be4 100644
--- a/configs/nixos/modules/shell/herdr.nix
+++ b/configs/nixos/modules/shell/herdr.nix
@@ -6,7 +6,7 @@
 }:
 # Herdr, a terminal multiplexer for coding agents.
 let
-  cfg = config.modules.shell.herdr;
+  cfg = config.modules.shell.herdr; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/shell/nvim/default.nix b/configs/nixos/modules/shell/nvim/default.nix
index 97dfa1e..9defd01 100644
--- a/configs/nixos/modules/shell/nvim/default.nix
+++ b/configs/nixos/modules/shell/nvim/default.nix
@@ -7,7 +7,7 @@
 }:
 # Neovim for the primary user, configured declaratively through nixvim.
 let
-  cfg = config.modules.shell.nvim;
+  cfg = config.modules.shell.nvim; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/shell/omp.nix b/configs/nixos/modules/shell/omp.nix
index 557bf25..db599f5 100644
--- a/configs/nixos/modules/shell/omp.nix
+++ b/configs/nixos/modules/shell/omp.nix
@@ -6,7 +6,7 @@
 }:
 # Oh My Pi, installed alongside upstream Pi as the `omp` command.
 let
-  cfg = config.modules.shell.omp;
+  cfg = config.modules.shell.omp; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/shell/pi/default.nix b/configs/nixos/modules/shell/pi/default.nix
index 26be720..60e9340 100644
--- a/configs/nixos/modules/shell/pi/default.nix
+++ b/configs/nixos/modules/shell/pi/default.nix
@@ -8,7 +8,7 @@
 # home-manager, which ships the package and manages global settings.
 # The login credential is left unmanaged, so it survives rebuilds.
 let
-  cfg = config.modules.shell.pi;
+  cfg = config.modules.shell.pi; # NOLINT(let_order)
   user = config.user.name;
   piDir = "${config.users.users.${user}.home}/.pi/agent";
   vendoredPi = pkgs.pi-coding-agent.overrideAttrs {
diff --git a/configs/nixos/modules/shell/python.nix b/configs/nixos/modules/shell/python.nix
index c1c5f43..b33bedf 100644
--- a/configs/nixos/modules/shell/python.nix
+++ b/configs/nixos/modules/shell/python.nix
@@ -6,7 +6,7 @@
 }:
 # Python tools for the primary user's shell environment.
 let
-  cfg = config.modules.shell.python;
+  cfg = config.modules.shell.python; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/shell/rust.nix b/configs/nixos/modules/shell/rust.nix
index 0d12702..766015b 100644
--- a/configs/nixos/modules/shell/rust.nix
+++ b/configs/nixos/modules/shell/rust.nix
@@ -6,7 +6,7 @@
 }:
 # Rust tools for the primary user's shell environment.
 let
-  cfg = config.modules.shell.rust;
+  cfg = config.modules.shell.rust; # NOLINT(let_order)
   user = config.user.name;
   toolchain = pkgs.symlinkJoin {
     name = "rust-toolchain";
diff --git a/configs/nixos/modules/shell/tmux/default.nix b/configs/nixos/modules/shell/tmux/default.nix
index 1ff81d3..3b9bbfc 100644
--- a/configs/nixos/modules/shell/tmux/default.nix
+++ b/configs/nixos/modules/shell/tmux/default.nix
@@ -6,7 +6,7 @@
 # tmux for the primary user, configured through home-manager.
 # Settings without a home-manager option are read from ./extra.conf.
 let
-  cfg = config.modules.shell.tmux;
+  cfg = config.modules.shell.tmux; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/shell/yazi.nix b/configs/nixos/modules/shell/yazi.nix
index 8e57089..382fcc9 100644
--- a/configs/nixos/modules/shell/yazi.nix
+++ b/configs/nixos/modules/shell/yazi.nix
@@ -6,7 +6,7 @@
 }:
 # Yazi, a terminal file manager.
 let
-  cfg = config.modules.shell.yazi;
+  cfg = config.modules.shell.yazi; # NOLINT(let_order)
   user = config.user.name;
 in
 {
diff --git a/configs/nixos/modules/zfs.nix b/configs/nixos/modules/zfs.nix
index 728641a..8c340d8 100644
--- a/configs/nixos/modules/zfs.nix
+++ b/configs/nixos/modules/zfs.nix
@@ -5,7 +5,7 @@
 }:
 # The host-level ZFS pool import: durable service state a host mounts, never rebuilds.
 let
-  cfg = config.modules.zfs;
+  cfg = config.modules.zfs; # NOLINT(let_order)
 in
 {
   options.modules.zfs = {
-- 
2.47.3