configs/nixos/modules/desktop/apps/alacritty.nix

@@ -6,14 +6,13 @@
 }:
 # Alacritty as the desktop terminal.
 let
-  cfg = config.modules.desktop.apps.alacritty; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.desktop.apps.alacritty.enable =
     lib.mkEnableOption "Alacritty as the desktop terminal";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.alacritty.enable {
     home-manager.users.${user}.home.packages = [ pkgs.alacritty ];
   };
 }

configs/nixos/modules/desktop/apps/ghostty.nix

@@ -6,13 +6,12 @@
 }:
 # Ghostty as the desktop terminal.
 let
-  cfg = config.modules.desktop.apps.ghostty; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.desktop.apps.ghostty.enable = lib.mkEnableOption "Ghostty as the desktop terminal";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.ghostty.enable {
     home-manager.users.${user}.home.packages = [ pkgs.ghostty ];
   };
 }

configs/nixos/modules/desktop/apps/obsidian.nix

@@ -6,14 +6,13 @@
 }:
 # Obsidian as the desktop note-taking vault.
 let
-  cfg = config.modules.desktop.apps.obsidian; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.desktop.apps.obsidian.enable =
     lib.mkEnableOption "Obsidian as the desktop note-taking vault";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.obsidian.enable {
     home-manager.users.${user}.home.packages = [ pkgs.obsidian ];
   };
 }

configs/nixos/modules/desktop/apps/r2modman.nix

@@ -6,14 +6,13 @@
 }:
 # r2modman, a Thunderstore mod manager.
 let
-  cfg = config.modules.desktop.apps.r2modman; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.desktop.apps.r2modman.enable =
     lib.mkEnableOption "r2modman, a Thunderstore mod manager";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.r2modman.enable {
     home-manager.users.${user}.home.packages = [ pkgs.r2modman ];
   };
 }

configs/nixos/modules/desktop/apps/signal.nix

@@ -6,13 +6,12 @@
 }:
 # Signal desktop messenger.
 let
-  cfg = config.modules.desktop.apps.signal; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.desktop.apps.signal.enable = lib.mkEnableOption "Signal desktop messenger";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.signal.enable {
     home-manager.users.${user}.home.packages = [ pkgs.signal-desktop ];
   };
 }

configs/nixos/modules/desktop/apps/vencord.nix

@@ -6,14 +6,13 @@
 }:
 # Vesktop, a Discord client with Vencord built in.
 let
-  cfg = config.modules.desktop.apps.vencord; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.desktop.apps.vencord.enable =
     lib.mkEnableOption "Vesktop, a Discord client with Vencord built in";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.apps.vencord.enable {
     home-manager.users.${user}.home.packages = [ pkgs.vesktop ];
   };
 }

configs/nixos/modules/desktop/default.nix

@@ -1,14 +1,11 @@
 { config, lib, ... }:
 # The desktop aggregator: one flag brings up the whole graphical session.
-let
-  cfg = config.modules.desktop; # NOLINT(let_order)
-in
 {
   options.modules.desktop.enable = lib.mkEnableOption "the keyboard-driven Hyprland desktop";
 
   # Each piece is turned on at default priority, so a host can still override
   # any one of them while the single flag above enables the whole desktop.
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.enable {
     modules.desktop.apps.firefox.enable = lib.mkDefault true;
     modules.desktop.apps.ghostty.enable = lib.mkDefault true;
     modules.desktop.session.hyprland.enable = lib.mkDefault true;

configs/nixos/modules/desktop/session/hyprland/hyprlock.nix

@@ -6,7 +6,6 @@
 }:
 # The lock screen: a hyprlock session-lock surface the compositor owns.
 let
-  cfg = config.modules.desktop.session.hyprland.hyprlock; # NOLINT(let_order)
   user = config.user.name;
 
   # The hyprlock this module installs, used by the lock keybind below.
@@ -48,7 +47,7 @@ in
   options.modules.desktop.session.hyprland.hyprlock.enable =
     lib.mkEnableOption "the hyprlock lock screen";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.hyprland.hyprlock.enable {
     home-manager.users.${user} = {
       # Colors and the lock-screen background come from Stylix's hyprlock target,
       # so only geometry and behaviour are set here.

configs/nixos/modules/desktop/session/login.nix

@@ -6,14 +6,11 @@
 }:
 # Text login: greetd running the tuigreet greeter, which starts the session
 # through the universal Wayland session manager.
-let
-  cfg = config.modules.desktop.session.login; # NOLINT(let_order)
-in
 {
   options.modules.desktop.session.login.enable =
     lib.mkEnableOption "greetd with the tuigreet text greeter";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.login.enable {
     services.greetd = {
       enable = true;
       settings.default_session.command =

configs/nixos/modules/desktop/session/mako.nix

@@ -6,7 +6,6 @@
 }:
 # mako as the notification daemon: toasts, a do-not-disturb mode, and history recall.
 let
-  cfg = config.modules.desktop.session.mako; # NOLINT(let_order)
   user = config.user.name;
 
   makoctl = "${pkgs.mako}/bin/makoctl";
@@ -14,7 +13,7 @@ in
 {
   options.modules.desktop.session.mako.enable = lib.mkEnableOption "the mako notification daemon";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.mako.enable {
     home-manager.users.${user} = {
       # Colors and the popup font come from Stylix's mako target, so only
       # behaviour is set here.

configs/nixos/modules/desktop/session/portals.nix

@@ -1,13 +1,10 @@
 { config, lib, ... }:
 # XDG desktop portal routing for in-app screen sharing and file dialogs.
-let
-  cfg = config.modules.desktop.session.portals; # NOLINT(let_order)
-in
 {
   options.modules.desktop.session.portals.enable =
     lib.mkEnableOption "XDG desktop portals for in-app screen sharing and file dialogs";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.portals.enable {
     # The backend packages arrive with the compositor, so only the routing is set
     # here.
     # Screen sharing, screenshots, and global shortcuts need the compositor's

configs/nixos/modules/desktop/session/waybar.nix

@@ -6,7 +6,6 @@
 }:
 # Waybar: a top status bar reading system state at a glance.
 let
-  cfg = config.modules.desktop.session.waybar; # NOLINT(let_order)
   vpnClient = config.modules.network.vpn-client;
 
   # A Nerd Font Private-Use-Area codepoint as a literal character, decoded
@@ -102,7 +101,7 @@ in
 {
   options.modules.desktop.session.waybar.enable = lib.mkEnableOption "the Waybar status bar";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.session.waybar.enable {
     # A symbols font backs the module glyphs, so pango falls back to it for the
     # codepoints Stylix's monospace font does not carry.
     fonts.packages = [ pkgs.nerd-fonts.symbols-only ];

configs/nixos/modules/desktop/utilities/audio.nix

@@ -1,12 +1,9 @@
 { config, lib, ... }:
 # PipeWire as the desktop audio server.
-let
-  cfg = config.modules.desktop.utilities.audio; # NOLINT(let_order)
-in
 {
   options.modules.desktop.utilities.audio.enable = lib.mkEnableOption "the PipeWire audio server";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.audio.enable {
     # Realtime scheduling for the audio threads, so playback survives load.
     security.rtkit.enable = true;
 

configs/nixos/modules/desktop/utilities/clipboard.nix

@@ -6,7 +6,6 @@
 }:
 # Clipboard history: cliphist records every copy, picked back through rofi.
 let
-  cfg = config.modules.desktop.utilities.clipboard; # NOLINT(let_order)
   user = config.user.name;
 
   cliphist = "${pkgs.cliphist}/bin/cliphist";
@@ -28,7 +27,7 @@ in
   options.modules.desktop.utilities.clipboard.enable =
     lib.mkEnableOption "cliphist clipboard history";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.clipboard.enable {
     home-manager.users.${user} = {
       # wl-copy and wl-paste on PATH, so the shell can pipe into and out of the
       # clipboard.

configs/nixos/modules/desktop/utilities/osd.nix

@@ -6,14 +6,13 @@
 }:
 # SwayOSD: a transient on-screen popup for volume and brightness changes.
 let
-  cfg = config.modules.desktop.utilities.osd; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.desktop.utilities.osd.enable =
     lib.mkEnableOption "the SwayOSD volume and brightness popup";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.osd.enable {
     environment.systemPackages = [ pkgs.swayosd ];
 
     # The udev rule chgrps each backlight's brightness node to `video` and adds

configs/nixos/modules/desktop/utilities/recording.nix

@@ -6,7 +6,6 @@
 }:
 # Keybound screen recording: pick a region, then toggle a video-only capture.
 let
-  cfg = config.modules.desktop.utilities.recording; # NOLINT(let_order)
   user = config.user.name;
 
   slurp = "${pkgs.slurp}/bin/slurp";
@@ -44,7 +43,7 @@ in
   options.modules.desktop.utilities.recording.enable =
     lib.mkEnableOption "wf-recorder screen recording";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.recording.enable {
     home-manager.users.${user} = {
       # $mod is defined by the compositor config these binds share.
       wayland.windowManager.hyprland.settings.bind = [

configs/nixos/modules/desktop/utilities/screenshot.nix

@@ -7,7 +7,6 @@
 # Keyboard-driven screenshots copy to the clipboard before Satty opens for
 # annotation. Satty copies annotated screenshots when it saves them.
 let
-  cfg = config.modules.desktop.utilities.screenshot; # NOLINT(let_order)
   user = config.user.name;
 
   grimblast = "${pkgs.grimblast}/bin/grimblast";
@@ -37,7 +36,7 @@ in
   options.modules.desktop.utilities.screenshot.enable =
     lib.mkEnableOption "screenshots via grimblast and satty";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.screenshot.enable {
     home-manager.users.${user} = {
       # satty is a one-shot annotation surface, so float it rather than letting
       # it claim a tile in the layout.

configs/nixos/modules/desktop/utilities/theming.nix

@@ -6,7 +6,6 @@
 }:
 # Nord theming for the graphical layer, driven from one base16 scheme by Stylix.
 let
-  cfg = config.modules.desktop.utilities.theming; # NOLINT(let_order)
 
   # A single static Nord wallpaper, drawn as a vertical gradient across the
   # Polar Night shades so it needs no committed binary and no network fetch.
@@ -21,7 +20,7 @@ in
   options.modules.desktop.utilities.theming.enable =
     lib.mkEnableOption "Nord theming of the graphical layer via Stylix";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.theming.enable {
     stylix = {
       enable = true;
 

configs/nixos/modules/desktop/utilities/userdirs.nix

@@ -2,13 +2,12 @@
 # Declares the XDG user directories, so a tool that queries them lands in a
 # well-known folder a host can relocate from one place.
 let
-  cfg = config.modules.desktop.utilities.userdirs; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.desktop.utilities.userdirs.enable = lib.mkEnableOption "XDG user directories";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.desktop.utilities.userdirs.enable {
     # Write ~/.config/user-dirs.dirs from the option defaults.
     home-manager.users.${user}.xdg.userDirs.enable = true;
   };

configs/nixos/modules/guest.nix

@@ -1,11 +1,8 @@
 { config, lib, ... }:
-let
-  cfg = config.modules.guest; # NOLINT(let_order)
-in
 {
   options.modules.guest.enable = lib.mkEnableOption "nested guest configuration";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.guest.enable {
     modules.network.ssh.enable = lib.mkDefault false;
     modules.network.ssh.hostKeys.restore = lib.mkDefault false;
   };

configs/nixos/modules/monorepo.nix

@@ -4,13 +4,10 @@
   ...
 }:
 # Tools for developing this monorepo.
-let
-  cfg = config.modules.monorepo; # NOLINT(let_order)
-in
 {
   options.modules.monorepo.enable = lib.mkEnableOption "tools for developing this monorepo";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.monorepo.enable {
     modules.shell.bazel.enable = true;
     modules.shell.python.enable = true;
     modules.shell.rust.enable = true;

configs/nixos/modules/services/reverse-proxy.nix

@@ -5,7 +5,6 @@
   ...
 }:
 let
-  cfg = config.modules.services.reverse-proxy; # NOLINT(let_order)
 
   generatedUdpStreams = lib.concatLists (
     lib.mapAttrsToList (
@@ -125,7 +124,7 @@ in
     enable = lib.mkEnableOption "the public edge reverse proxy";
   };
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.services.reverse-proxy.enable {
     networking.firewall.allowedTCPPorts = [
       80
       443

configs/nixos/modules/shell/bazel.nix

@@ -6,14 +6,13 @@
 }:
 # Bazel for the primary user's shell environment.
 let
-  cfg = config.modules.shell.bazel; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.shell.bazel.enable =
     lib.mkEnableOption "Bazel for the primary user's shell environment";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.bazel.enable {
     home-manager.users.${user}.home.packages = [ pkgs.bazel ];
   };
 }

configs/nixos/modules/shell/direnv/default.nix

@@ -5,14 +5,13 @@
 }:
 # direnv for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.direnv; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.shell.direnv.enable =
     lib.mkEnableOption "direnv for the primary user, with nix-direnv shell caching";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.direnv.enable {
     home-manager.users.${user}.programs.direnv = {
       enable = true;
       silent = true;

configs/nixos/modules/shell/git.nix

@@ -5,14 +5,13 @@
 }:
 # git for the primary user, configured through home-manager.
 let
-  cfg = config.modules.shell.git; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.shell.git.enable =
     lib.mkEnableOption "git for the primary user, carrying the operator's commit identity";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.git.enable {
     home-manager.users.${user}.programs.git = {
       enable = true;
 

configs/nixos/modules/shell/gitea-axi.nix

@@ -6,14 +6,13 @@
 }:
 # gitea-axi for the primary user, installed through its own home-manager module.
 let
-  cfg = config.modules.shell.gitea-axi; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.shell.gitea-axi.enable =
     lib.mkEnableOption "gitea-axi, an agent-ergonomic CLI for Gitea issues and pull requests";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.gitea-axi.enable {
     home-manager.sharedModules = [ inputs.gitea-axi.homeModules.default ];
     home-manager.users.${user}.programs.gitea-axi.enable = true;
   };

configs/nixos/modules/shell/herdr.nix

@@ -6,14 +6,13 @@
 }:
 # Herdr, a terminal multiplexer for coding agents.
 let
-  cfg = config.modules.shell.herdr; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.shell.herdr.enable =
     lib.mkEnableOption "Herdr, a terminal multiplexer for coding agents";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.herdr.enable {
     registry.shell-shortcut.${config.networking.hostName}.hs = "herdr --session";
 
     home-manager.users.${user} = lib.mkMerge [

configs/nixos/modules/shell/nvim/default.nix

@@ -7,14 +7,13 @@
 }:
 # Neovim for the primary user, configured declaratively through nixvim.
 let
-  cfg = config.modules.shell.nvim; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.shell.nvim.enable =
     lib.mkEnableOption "Neovim, configured declaratively via nixvim";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.nvim.enable {
     registry.shell-shortcut.${config.networking.hostName} = {
       vi = "nvim";
       vim = "nvim";

configs/nixos/modules/shell/omp.nix

@@ -6,7 +6,6 @@
 }:
 # Oh My Pi, installed alongside upstream Pi as the `omp` command.
 let
-  cfg = config.modules.shell.omp; # NOLINT(let_order)
   user = config.user.name;
 in
 {
@@ -14,7 +13,7 @@ in
     enable = lib.mkEnableOption "Oh My Pi, a batteries-included fork of Pi";
   };
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.omp.enable {
     home-manager.users.${user}.home.packages = [ pkgs.omp ];
   };
 }

configs/nixos/modules/shell/python.nix

@@ -6,14 +6,13 @@
 }:
 # Python tools for the primary user's shell environment.
 let
-  cfg = config.modules.shell.python; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.shell.python.enable =
     lib.mkEnableOption "Python tools for the primary user's shell environment";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.python.enable {
     home-manager.users.${user}.home = {
       sessionVariables.PYTHON_TOOLCHAIN_ROOT = "${pkgs.python3}";
       packages = [ pkgs.python3 ];

configs/nixos/modules/shell/rust.nix

@@ -6,7 +6,6 @@
 }:
 # Rust tools for the primary user's shell environment.
 let
-  cfg = config.modules.shell.rust; # NOLINT(let_order)
   toolchain = pkgs.symlinkJoin {
     name = "rust-toolchain";
     paths = with pkgs; [
@@ -23,7 +22,7 @@ in
   options.modules.shell.rust.enable =
     lib.mkEnableOption "Rust tools for the primary user's shell environment";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.rust.enable {
     home-manager.users.${user} = {
       home.sessionVariables.RUST_TOOLCHAIN_ROOT = "${toolchain}";
 

configs/nixos/modules/shell/tmux/default.nix

@@ -6,13 +6,12 @@
 # tmux for the primary user, configured through home-manager.
 # Settings without a home-manager option are read from ./extra.conf.
 let
-  cfg = config.modules.shell.tmux; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.shell.tmux.enable = lib.mkEnableOption "tmux, configured via home-manager";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.tmux.enable {
     registry.shell-shortcut.${config.networking.hostName}.tmx = "tmux new-session -A -s";
 
     home-manager.users.${user}.programs.tmux = {

configs/nixos/modules/shell/yazi.nix

@@ -6,13 +6,12 @@
 }:
 # Yazi, a terminal file manager.
 let
-  cfg = config.modules.shell.yazi; # NOLINT(let_order)
   user = config.user.name;
 in
 {
   options.modules.shell.yazi.enable = lib.mkEnableOption "Yazi, a terminal file manager";
 
-  config = lib.mkIf cfg.enable {
+  config = lib.mkIf config.modules.shell.yazi.enable {
     home-manager.users.${user}.programs.yazi = {
       enable = true;
       enableFishIntegration = true;