shells: guard platform-specific pcsc tools

.codex/config.toml

@@ -0,0 +1,13 @@
+[mcp_servers.nixos]
+command = "mcp-nixos"
+startup_timeout_sec = 30
+tool_timeout_sec = 60
+required = false
+
+[mcp_servers.github]
+url = "https://api.githubcopilot.com/mcp/"
+bearer_token_env_var = "GITHUB_PERSONAL_ACCESS_TOKEN"
+http_headers = { X-MCP-Readonly = "true", X-MCP-Toolsets = "repos,pull_requests,actions" }
+startup_timeout_sec = 30
+tool_timeout_sec = 60
+required = false

.github/actions/check-nixos/action.yaml

@@ -0,0 +1,15 @@
+# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/workflows/nix-build.yaml
+name: Build Linux checks
+description: Build every x86_64-linux flake check in parallel
+runs:
+  using: composite
+  steps:
+    - name: Build all Linux checks
+      shell: bash
+      run: |
+        set -euo pipefail
+        nix run .#nix-fast-build -- \
+          --flake .#checks.x86_64-linux \
+          --skip-cached \
+          --no-nom \
+          --no-link

.github/actions/setup-nix/action.yaml

@@ -0,0 +1,23 @@
+# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/actions/setup-nix/action.yaml
+name: Setup Nix
+description: Install Nix and cache the Nix store
+runs:
+  using: composite
+  steps:
+    - name: Allow unprivileged user namespaces
+      if: runner.os == 'Linux'
+      shell: bash
+      run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null || true
+    - name: Install Nix
+      uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35
+      with:
+        nix_conf: |
+          accept-flake-config = true
+          max-jobs = auto
+    - name: Cache Nix store
+      uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7.0.2
+      with:
+        primary-key: nix-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('flake.lock') }}
+        restore-prefixes-first-match: nix-${{ runner.os }}-${{ runner.arch }}-
+        gc-max-store-size-linux: 4G
+        gc-max-store-size-macos: 4G

.github/workflows/nixos.yaml

@@ -0,0 +1,204 @@
+# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/workflows/nix-build.yaml
+name: "CI: Nix"
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .gitignore
+      - AGENTS.md
+      - README.md
+      - "docs/**"
+      - flake.nix
+      - flake.lock
+      - ".codex/**"
+      - ".github/**"
+      - ".vscode/**"
+      - "flake/**"
+      - "hosts/**"
+      - "libs/**"
+      - "modules/**"
+      - "opencode.json"
+      - "overlays/**"
+      - "scripts/**"
+      - "shells/**"
+      - "skills/**"
+      - "tests/**"
+  pull_request:
+    paths:
+      - .gitignore
+      - AGENTS.md
+      - README.md
+      - "docs/**"
+      - flake.nix
+      - flake.lock
+      - ".codex/**"
+      - ".github/**"
+      - ".vscode/**"
+      - "flake/**"
+      - "hosts/**"
+      - "libs/**"
+      - "modules/**"
+      - "opencode.json"
+      - "overlays/**"
+      - "scripts/**"
+      - "shells/**"
+      - "skills/**"
+      - "tests/**"
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions:
+  contents: read
+jobs:
+  validate:
+    name: Plan, lint, and evaluate
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    outputs:
+      build_linux: ${{ steps.plan.outputs.build_linux }}
+      build_darwin: ${{ steps.plan.outputs.build_darwin }}
+      nix_validation: ${{ steps.plan.outputs.nix_validation }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Plan validation
+        id: plan
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BASE_SHA: ${{ github.event.before }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          case "${{ github.event_name }}" in
+            pull_request)
+              plan="$(nix run .#check -- plan --base "$PR_BASE_SHA" --json)"
+              ;;
+            push)
+              plan="$(nix run .#check -- plan --base "$PUSH_BASE_SHA" --json)"
+              ;;
+            *)
+              plan="$(nix run .#check -- plan --all-files --all-hosts --json)"
+              ;;
+          esac
+
+          printf '%s\n' "$plan"
+          nix_validation="$(jq -r '.requiresNixValidation' <<<"$plan")"
+
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            build_linux="$(jq -r '.nativeBuildSystems["x86_64-linux"] // false' <<<"$plan")"
+            build_darwin="$(jq -r '.nativeBuildSystems["aarch64-darwin"] // false' <<<"$plan")"
+          else
+            build_linux="$nix_validation"
+            build_darwin="$nix_validation"
+          fi
+
+          {
+            echo "nix_validation=$nix_validation"
+            echo "build_linux=$build_linux"
+            echo "build_darwin=$build_darwin"
+          } >> "$GITHUB_OUTPUT"
+      - name: Run fast checks
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BASE_SHA: ${{ github.event.before }}
+        shell: bash
+        run: |
+          set +e
+          set -uo pipefail
+          case "${{ github.event_name }}" in
+            pull_request)
+              nix run .#check -- fast --base "$PR_BASE_SHA"
+              ;;
+            push)
+              nix run .#check -- fast --base "$PUSH_BASE_SHA"
+              ;;
+            *)
+              nix run .#check -- fast --all-files
+              ;;
+          esac
+          status=$?
+          if (( status != 0 )); then
+            git diff -- .
+            exit "$status"
+          fi
+      - name: Evaluate configurations
+        if: steps.plan.outputs.nix_validation == 'true' || github.event_name == 'workflow_dispatch'
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BASE_SHA: ${{ github.event.before }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          case "${{ github.event_name }}" in
+            pull_request)
+              nix run .#check -- eval --base "$PR_BASE_SHA"
+              ;;
+            push)
+              nix run .#check -- eval --base "$PUSH_BASE_SHA" --all-systems
+              ;;
+            *)
+              nix run .#check -- eval --all-hosts --all-systems
+              ;;
+          esac
+  build-linux:
+    name: Build Linux checks
+    needs: validate
+    if: needs.validate.outputs.build_linux == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Build affected Linux checks
+        if: github.event_name == 'pull_request'
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix run .#check -- build --base "$PR_BASE_SHA"
+      - name: Build all Linux checks
+        if: github.event_name != 'pull_request'
+        uses: ./.github/actions/check-nixos
+  build-darwin:
+    name: Build Darwin checks
+    needs: validate
+    if: needs.validate.outputs.build_darwin == 'true'
+    runs-on: macos-15
+    timeout-minutes: 180
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Build affected Darwin checks
+        if: github.event_name == 'pull_request'
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix run .#check -- build --base "$PR_BASE_SHA"
+      - name: Build all Darwin checks
+        if: github.event_name != 'pull_request'
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix run .#nix-fast-build -- \
+            --flake .#checks.aarch64-darwin \
+            --skip-cached \
+            --no-nom \
+            --no-link

.github/workflows/update-flake.yaml

@@ -0,0 +1,109 @@
+# Reference: https://github.com/ryoppippi/dotfiles/blob/main/.github/workflows/update-flake.yaml
+name: "Bot: Update flake inputs"
+on:
+  schedule:
+    - cron: "0 6 * * *"
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+permissions:
+  contents: write
+  pull-requests: write
+jobs:
+  update:
+    name: Update and check Linux
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    outputs:
+      changed: ${{ steps.update.outputs.changed }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Update flake inputs
+        id: update
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix flake update
+          if git diff --quiet -- flake.lock; then
+            echo 'changed=false' >> "$GITHUB_OUTPUT"
+          else
+            echo 'changed=true' >> "$GITHUB_OUTPUT"
+          fi
+      - name: Evaluate every flake system
+        if: steps.update.outputs.changed == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix flake check \
+            --no-build \
+            --all-systems \
+            --keep-going \
+            --show-trace
+      - name: Build Linux checks
+        if: steps.update.outputs.changed == 'true'
+        uses: ./.github/actions/check-nixos
+      - name: Upload updated lock file
+        if: steps.update.outputs.changed == 'true'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: flake-lock
+          path: flake.lock
+          if-no-files-found: error
+  check-darwin:
+    name: Check Darwin
+    needs: update
+    if: needs.update.outputs.changed == 'true'
+    runs-on: macos-15
+    timeout-minutes: 180
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Download updated lock file
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: flake-lock
+          path: .
+      - name: Setup Nix
+        uses: ./.github/actions/setup-nix
+      - name: Build Darwin checks
+        shell: bash
+        run: |
+          set -euo pipefail
+          nix run .#nix-fast-build -- \
+            --flake .#checks.aarch64-darwin \
+            --skip-cached \
+            --no-nom \
+            --no-link
+  pull-request:
+    name: Create update pull request
+    needs:
+      - update
+      - check-darwin
+    if: needs.update.outputs.changed == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Download validated lock file
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: flake-lock
+          path: .
+      - name: Create update pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          add-paths: flake.lock
+          branch: automation/update-flake-lock
+          delete-branch: true
+          commit-message: "flake: update inputs"
+          title: "flake: update inputs"
+          body: |
+            Automated update of `flake.lock`.
+
+            The updated inputs passed all-system evaluation and native builds of
+            the Linux and Darwin check sets.

.gitignore

@@ -1,12 +1,17 @@
 /*
+**/__pycache__/
+*.py[cod]
 
 !.gitignore
 !README.md
 !LICENSE
 !AGENTS.md
+!/docs/
 
-!.github/
+!/.codex/
+!/.github/
 !.gitea/
+!/.vscode/
 
 !.envrc
 
@@ -14,7 +19,9 @@
 
 !/flake.nix
 !/flake.lock
+!/opencode.json
 
+!/scripts/
 !/shells/
 !/flake/
 !/overlays/
@@ -22,10 +29,11 @@
 !/images/
 !/secrets/
 
+!/windows/
+
 !/hosts/
-
 !/libs/
-
 !/modules/
 
 !/tests/
+!/skills/

.sops.yaml

@@ -0,0 +1,20 @@
+keys:
+  - &admin_yubikey1 age1yubikey1qvy5y8kxqc63y7fk0tfv43u499a8z8q332ff087lythry9cc6hdxxkznc6t
+  - &host_x1g13 age12g85cuvg4kjfr79lqf5fx2k0d82tchrgv88xgkt7ukk2cfcsw98s2rjyat
+  - &host_ops age18rtm2dq2r62zvnhwdq0gkm24hu85r7zyleyk3jqv22zpdtw064eq7ay7dl
+  - &host_internal-app-01 age1mcp5gma7y0k59equhzqfsnn0ed335ljjtn0k08ua77htlxf0x54qsravch
+  - &host_galleria age1wh7r9wnvyrgt5efjvg2324khsf4w6e9atpmz2udr4uw7frhnvvwquzcu72
+creation_rules:
+  - path_regex: ^secrets/common/[^/]+\.ya?ml$
+    key_groups:
+      - age:
+          - *admin_yubikey1
+          - *host_x1g13
+          - *host_ops
+          - *host_internal-app-01
+          - *host_galleria
+  - path_regex: ^secrets/hosts/x1g13/[^/]+\.ya?ml$
+    key_groups:
+      - age:
+          - *admin_yubikey1
+          - *host_x1g13

.vscode/settings.json

@@ -0,0 +1,28 @@
+{
+  "nix.enableLanguageServer": true,
+  "nix.serverPath": "nixd",
+  "nix.serverSettings": {
+    "nixd": {
+      "formatting": {
+        "command": ["nixfmt"]
+      },
+      "nixpkgs": {
+        "expr": "import (builtins.getFlake (builtins.toString ./.)).inputs.nixpkgs { }"
+      },
+      "options": {
+        "nixos": {
+          "expr": "(builtins.getFlake (builtins.toString ./.)).nixosConfigurations.galleria.options"
+        },
+        "home-manager-nixos": {
+          "expr": "(builtins.getFlake (builtins.toString ./.)).nixosConfigurations.galleria.options.home-manager.users.type.getSubOptions []"
+        },
+        "darwin": {
+          "expr": "(builtins.getFlake (builtins.toString ./.)).darwinConfigurations.m2.options"
+        },
+        "home-manager-darwin": {
+          "expr": "(builtins.getFlake (builtins.toString ./.)).darwinConfigurations.m2.options.home-manager.users.type.getSubOptions []"
+        }
+      }
+    }
+  }
+}

AGENTS.md

@@ -7,6 +7,10 @@ flake. `flake.nix` defines inputs and delegates flake outputs through
 flake-parts. Keep configuration with the component that owns it, rather than in
 the root flake or an unrelated host.
 
+This file documents the current repository contract, not a hypothetical future
+layout. When a structural, ownership, profile, host-role, or validation change
+makes any statement here stale, update `AGENTS.md` in the same change.
+
 | Path                    | Responsibility                                                                                                    |
 | ----------------------- | ----------------------------------------------------------------------------------------------------------------- |
 | `modules/applications/` | One software component, including GUI applications, window managers, desktop environments, CLI tools, and editors |
@@ -15,59 +19,81 @@ the root flake or an unrelated host.
 | `modules/hardwares/`    | Reusable drivers, hardware families, and VM or WSL guest configuration                                            |
 | `modules/users/`        | User identity and the user's NixOS-, nix-darwin-, and Home Manager-specific definitions                           |
 | `modules/profiles/`     | Purpose- or form-factor-oriented compositions of multiple units                                                   |
-| `hosts/`                | Machine-specific facts and the profiles or applications selected for each machine                                 |
+| `hosts/`                | Machine-specific facts and the profiles selected for each machine; direct unit selections are exceptional         |
 | `libs/`                 | Registry, unit discovery, and host construction logic                                                             |
 | `overlays/`             | Package replacements and additions                                                                                |
 | `shells/`               | Development shells                                                                                                |
 | `flake/`                | Supporting flake outputs such as formatters, checks, and Git hooks                                                |
+| `skills/`               | Repository-specific Codex workflows that enforce this contract for recurring changes                              |
+
+Before adding or materially extending an application or service, read and
+follow `skills/add-application-or-service/SKILL.md`. `AGENTS.md` remains the
+authoritative contract when the skill and repository ever disagree.
 
 Use **unit** as the generic internal term for a Registry-managed component and
 **profile** for a unit that composes multiple units. Do not introduce a
 `features/` layer. Window managers and desktop environments such as niri and
-GNOME belong in `modules/applications/`; do not create a separate `desktop/`
+labwc belong in `modules/applications/`; do not create a separate `desktop/`
 module category.
 
 Before adding configuration, decide whether it is owned by an application,
 system foundation, service, hardware family, user, profile, or individual host.
 Prefer the following placements:
 
-| Configuration                                        | Placement                                        |
+| Configuration                                        | Placement                                                 |
-| ---------------------------------------------------- | ------------------------------------------------ |
+| ---------------------------------------------------- | --------------------------------------------------------- |
-| Nix settings shared by every system host             | `modules/systems/nix/common.nix`                 |
+| Nix settings shared by every system host             | `modules/systems/nix/common.nix`                          |
-| NixOS-only boot configuration                        | `modules/systems/boot/.../nixos.nix`             |
+| NixOS-only boot configuration                        | `modules/systems/boot/.../nixos.nix`                      |
-| Ghostty-specific configuration                       | `modules/applications/ghostty/`                  |
+| Disko NixOS module and CLI                           | `modules/systems/disko/`                                  |
-| niri-specific configuration                          | `modules/applications/niri/`                     |
+| macOS-wide input, document, and dialog defaults      | `modules/systems/macos-defaults/darwin.nix`               |
-| Applications selected for the niri environment       | `modules/profiles/interface/niri/meta.nix`       |
+| macOS Dock defaults                                  | `modules/systems/dock/darwin.nix`                         |
-| GNOME itself                                         | `modules/applications/gnome/`                    |
+| macOS trackpad defaults                              | `modules/systems/trackpad/darwin.nix`                     |
-| Docker daemon and Docker group membership            | `modules/services/docker/nixos.nix`              |
+| Finder-specific preferences                          | `modules/applications/finder/darwin.nix`                  |
-| Reusable ThinkPad-family configuration               | `modules/hardwares/thinkpad/`                    |
+| Ghostty-specific configuration                       | `modules/applications/ghostty/`                           |
-| The laptop unit composition                          | `modules/profiles/platform/laptop/meta.nix`      |
+| niri-specific configuration                          | `modules/applications/niri/`                              |
-| The development-environment unit composition         | `modules/profiles/workload/development/meta.nix` |
+| Desktop applications shared by labwc and niri        | `modules/profiles/interface/linux-desktop/meta.nix`       |
-| A user's OS- and Home Manager-specific configuration | `modules/users/<name>/`                          |
+| Applications and services specific to niri           | `modules/profiles/interface/niri/meta.nix`                |
-| x1g13-specific monitor layout                        | `hosts/x1g13/home.nix`                           |
+| labwc and its session configuration                  | `modules/applications/labwc/`                             |
-| x1g13-specific disk UUID                             | `hosts/x1g13/nixos.nix`                          |
+| A Linux package plus its macOS Homebrew cask         | `modules/applications/<name>/home.nix` and `darwin.nix`   |
-| Package replacement or addition                      | `overlays/`                                      |
+| Docker daemon and Docker group membership            | `modules/services/docker/nixos.nix`                       |
-| Formatter, checks, or Git hooks                      | `flake/`                                         |
+| The laptop unit composition                          | `modules/profiles/platform/laptop/meta.nix`               |
+| The Intel ThinkPad X1 composition                    | `modules/profiles/platform/thinkpad-x1/meta.nix`          |
+| The Intel/NVIDIA desktop composition                 | `modules/profiles/platform/intel-nvidia-desktop/meta.nix` |
+| NVIDIA GPU driver configuration                      | `modules/hardwares/nvidia/`                               |
+| The development-environment unit composition         | `modules/profiles/workload/development/meta.nix`          |
+| Cross-platform fingerprint selection                 | `modules/profiles/security/fingerprint/meta.nix`          |
+| A user's OS- and Home Manager-specific configuration | `modules/users/<name>/`                                   |
+| Host-specific monitor layout                         | `hosts/<name>/home.nix`                                   |
+| Generated host disk UUIDs                            | `hosts/<name>/hardware-configuration.nix`                 |
+| Package replacement or addition                      | `overlays/`                                               |
+| Formatter, checks, or Git hooks                      | `flake/`                                                  |
 
 ## Unit Discovery and Identity
 
-A directory below `modules/` is a unit if, and only if, it directly contains at
+A directory below `modules/` is a unit if, and only if, it contains at least one
-least one reserved file. Directories used only for classification, such as
+reserved root file or reserved Home Manager fragment. Directories used only for
-`modules/applications/` or `modules/profiles/interface/`, are namespaces rather
+classification, such as `modules/applications/` or
-than units when they have no reserved file of their own.
+`modules/profiles/interface/`, are namespaces rather than units when they have
+no reserved fragment of their own.
 
-The Registry recognizes exactly these five reserved filenames:
+The Registry recognizes exactly these eight reserved paths relative to a unit:
 
-| File         | Target and responsibility                                                        |
+| File              | Target and responsibility                                                        |
-| ------------ | -------------------------------------------------------------------------------- |
+| ----------------- | -------------------------------------------------------------------------------- |
-| `common.nix` | System-side configuration fragment shared by NixOS and nix-darwin                |
+| `common.nix`      | System-side configuration fragment shared by NixOS and nix-darwin                |
-| `nixos.nix`  | NixOS-only configuration fragment                                                |
+| `nixos.nix`       | NixOS-only system configuration fragment                                         |
-| `darwin.nix` | nix-darwin-only configuration fragment                                           |
+| `darwin.nix`      | nix-darwin-only system configuration fragment                                    |
-| `home.nix`   | Home Manager configuration fragment                                              |
+| `home.nix`        | Home Manager fragment shared by NixOS and nix-darwin                             |
-| `meta.nix`   | Registry descriptor for dependencies, external modules, and descriptive metadata |
+| `home/common.nix` | Home Manager fragment shared by NixOS and nix-darwin                             |
+| `home/nixos.nix`  | Home Manager fragment loaded only on NixOS                                       |
+| `home/darwin.nix` | Home Manager fragment loaded only on nix-darwin                                  |
+| `meta.nix`        | Registry descriptor for dependencies, external modules, and descriptive metadata |
 
-`common.nix` is never applied to Home Manager. OS-independent Home Manager
+Root `common.nix` is never applied to Home Manager. `home.nix` and
-configuration still belongs in `home.nix`.
+`home/common.nix` have identical dispatch semantics; use either or both when a
+useful file split exists. The `home/` directory is a reserved fragment directory
+of its parent unit when it contains `common.nix`, `nixos.nix`, or `darwin.nix`;
+it is not discovered as a child unit in that case.
 
 The Registry derives a unit ID from the path relative to `modules/`, joining
 path components with dots. Category names remain plural. It also derives the
@@ -123,10 +149,13 @@ of the following are valid units:
 # Home Manager only
 modules/applications/ghostty/
 ├── home.nix
+├── home/
+│   ├── nixos.nix
+│   └── darwin.nix
 └── settings.nix
 
 # NixOS only
-modules/applications/gnome/
+modules/services/docker/
 └── nixos.nix
 
 # nix-darwin only
@@ -150,16 +179,16 @@ modules/systems/nix/
 └── common.nix
 ```
 
-If a unit has no `home.nix`, do not generate or apply a Home Manager module for
+Each fragment is optional and registered independently. A unit may therefore
-it. The same rule applies independently to `common.nix`, `nixos.nix`, and
+contain only `home/nixos.nix` or `home/darwin.nix`; it does not need a
-`darwin.nix`.
+placeholder `home.nix` or `home/common.nix`.
 
 ### Configuration fragments
 
-`common.nix`, `nixos.nix`, `darwin.nix`, and `home.nix` are configuration
+Every reserved path except `meta.nix` is a configuration fragment to which the
-fragments to which the Registry adds the enable condition. They return the
+Registry adds the enable condition. These fragments return the configuration
-configuration for their class directly and must not define top-level `imports`,
+for their class directly and must not define top-level `imports`, `options`, or
-`options`, or `config` attributes:
+`config` attributes:
 
 ```nix
 # modules/services/docker/nixos.nix
@@ -194,9 +223,9 @@ fragment.
 
 ### Helper files and directories
 
-Every filename other than the five reserved names is an ordinary helper,
+Every path other than the eight reserved paths is an ordinary helper, regardless
-regardless of its extension. The Registry neither discovers nor automatically
+of its extension. The Registry neither discovers nor automatically imports
-imports helper files such as `settings.nix`, `keybindings.nix`, `packages.nix`,
+helper files such as `settings.nix`, `keybindings.nix`, `packages.nix`,
 `colors.nix`, `rules.nix`, or `helpers.nix`. Import a helper explicitly from the
 reserved fragment that uses it:
 
@@ -239,9 +268,10 @@ modules/applications/niri/
 ```
 
 Here `parts/` is not a unit because it directly contains no reserved file. A
-helper directory that directly contains `home.nix` or another reserved file is
+helper directory that directly contains a root reserved file is itself
-itself discovered as a unit, so never use reserved filenames inside a directory
+discovered as a unit, so never use reserved filenames inside a directory that
-that is intended to contain helpers only.
+is intended to contain helpers only. The reserved `home/` fragment directory is
+the sole exception to ordinary recursive child-unit discovery.
 
 ### Registry metadata
 
@@ -283,12 +313,11 @@ use fully qualified unit IDs:
 # modules/profiles/interface/niri/meta.nix
 {
   includes = [
+    "profiles.interface.linux-desktop"
     "applications.niri"
-    "applications.ghostty"
     "applications.noctalia"
-    "applications.vicinae"
+    "services.ly"
-    "applications.nautilus"
+    "services.swayidle"
-    "services.xdg-portal"
   ];
 }
 ```
@@ -301,41 +330,99 @@ in `meta.includes`.
 
 Application metadata should include only dependencies technically required for
 the application to work. A profile owns the user's choice to adopt several
-otherwise independent applications together. For example, niri may include the
+otherwise independent applications together. For example, the niri application
-Wayland foundation and xdg-desktop-portal as technical dependencies, while
+includes the Wayland foundation as a technical dependency. The
-`profiles.interface.niri` selects Ghostty, Vicinae, Noctalia, and Nautilus.
+`profiles.interface.linux-desktop` profile selects Ghostty and Nautilus because
-Ghostty must not depend on niri, and niri-specific keybindings remain owned by
+both labwc and niri use them, while the cross-platform `profiles.interface.gui`
-the niri unit.
+profile selects Vicinae for graphical hosts. The labwc and niri profiles select
+their compositor, Noctalia, and the session services they require. Ghostty and
+Vicinae must not depend on either compositor, and compositor-specific
+keybindings remain owned by the corresponding application unit.
 
 ## Profiles
 
 Profiles compose units by purpose or form factor; they do not replace clear
-application, system, service, or hardware ownership. Suitable profile namespaces
+application, system, service, or hardware ownership. The current profile
-include:
+structure is:
 
 ```text
 modules/profiles/
+├── README.md
 ├── base/
 ├── interface/
-│   ├── niri/
+│   ├── cli/
-│   ├── gnome/
+│   ├── gui/
-│   ├── cli-minimal/
+│   ├── macos/
-│   └── cli-interactive/
+│   ├── linux-desktop/
+│   ├── labwc/
+│   └── niri/
+├── networking/
+│   ├── tailscale-client/
+│   └── tailscale-subnet-router/
 ├── platform/
+│   ├── nixos/
+│   ├── intel-nvidia-desktop/
 │   ├── laptop/
-│   ├── thinkpad/
+│   ├── thinkpad-x1/
 │   ├── desktop/
-│   ├── vm/
+│   └── vm/
-│   └── wsl/
 ├── workload/
 │   ├── development/
 │   ├── personal/
 │   ├── server/
-│   └── remote/
+│   └── remote-access/
 └── security/
-    └── secure-boot/
+    ├── fingerprint/
+    ├── secrets/
+    ├── secure-boot/
+    └── tpm-storage/
 ```
 
+`modules/profiles/README.md` is the compatibility inventory for this structure.
+Whenever a profile is added, removed, renamed, changes host-class support, or
+changes meaning, update that README and every affected `hosts/default.nix`
+selection in the same change. Remove stale profile directories and references;
+do not retain compatibility aliases.
+
+The profile layers have these responsibilities:
+
+- `base` contains only invariants required by every supported host. It includes
+  `systems.nix` and the universal Atuin, tealdeer, trippy, and xh CLI tools;
+  optional secrets, interface, hardware, and workloads do not belong there.
+- `interface` describes how the host is operated. `interface.cli` is shared by
+  NixOS and macOS and includes `tio`. `interface.gui` owns cross-platform
+  graphical interface applications such as Vicinae. `interface.macos` owns the
+  macOS Finder, Dock, trackpad, and shared default preferences and includes
+  `interface.gui`.
+  `interface.linux-desktop` owns the common labwc/niri desktop selection,
+  including Ghostty and Nautilus, and also includes `interface.gui`. Labwc and
+  niri remain independently selectable and do not imply CLI or personal
+  workloads.
+- `platform` describes NixOS foundations and physical or virtual form factors.
+  macOS does not need an empty symmetric platform profile.
+- `workload` describes optional host uses. `workload.development` and
+  `workload.personal` are cross-platform profiles, not `*-linux` variants.
+- `networking` describes network roles and topology rather than user workloads.
+- `security` describes optional security policies. Select
+  `security.fingerprint` instead of listing `systems.fingerprint` directly in a
+  host. The underlying `systems.fingerprint` unit owns NixOS fingerprint
+  authentication and macOS Touch ID sudo configuration through its class
+  fragments.
+
+Do not split a semantic profile into `*-linux` and cross-platform variants merely
+because an application is installed differently on each OS. Keep the semantic
+profile cross-platform when its purpose is shared, and implement OS differences
+inside the owning application unit. For example, Chrome, Vesktop, draw.io,
+Slack, and Zoom use Linux Home Manager configuration in `home.nix` and macOS
+Homebrew casks in `darwin.nix`. Guard a Linux-only Home Manager package with the
+host platform when the same unit also has a Darwin implementation.
+
+An explicitly OS-specific profile is appropriate when the composition itself is
+OS-specific, such as `interface.macos`, `interface.linux-desktop`,
+`platform.nixos`, or a NixOS
+subnet-router. Do not create an OS suffix for a thin package difference that the
+owning application unit can express.
+
 The `desktop/` name above is a form-factor profile under `profiles/platform/`,
 not a top-level module category.
 
@@ -352,6 +439,10 @@ conditions holds:
 - Other units depend on it.
 - It involves a daemon, permissions, or user groups.
 
+`security.tpm-storage` intentionally does not own a disk identifier. A host that
+selects it must define `boot.initrd.luks.devices.cryptroot.device` in its own
+NixOS module.
+
 ## Registry Responsibilities
 
 Implement unit discovery with Nix standard functionality such as
@@ -360,8 +451,10 @@ mechanism, and do not design the repository around `import-tree`. Registry logic
 has these responsibilities:
 
 1. Recursively visit directories below `modules/`.
-2. Check only the five reserved filenames directly within each directory.
+2. Check the five reserved root filenames and the three reserved filenames
-3. Register a directory as a unit when at least one reserved file exists there.
+   directly inside the unit's `home/` fragment directory.
+3. Register a directory as a unit when at least one reserved fragment exists
+   there, including a unit that has only a reserved `home/` fragment.
 4. Derive the unit ID from the path relative to `modules/`.
 5. Record only class fragments that exist.
 6. Evaluate `meta.nix` as a descriptor only when it exists.
@@ -370,7 +463,8 @@ has these responsibilities:
 9. Enable included units from `meta.includes`.
 10. Raise a clear evaluation error for a reference to a missing unit ID.
 11. Apply only the fragments appropriate to the current host class.
-12. Pass `home.nix` to Home Manager only for hosts that enable Home Manager.
+12. Pass `home.nix`, `home/common.nix`, and the matching OS-specific Home
+    Manager fragment only for hosts that enable Home Manager.
 
 A unit record may conceptually look like this; the implementation need not use
 this exact representation:
@@ -385,6 +479,9 @@ this exact representation:
     nixos = null;
     darwin = null;
     home = ./applications/ghostty/home.nix;
+    homeCommon = null;
+    homeNixos = ./applications/ghostty/home/nixos.nix;
+    homeDarwin = ./applications/ghostty/home/darwin.nix;
   };
 
   meta = { };
@@ -409,58 +506,162 @@ host-owned data includes:
 - Kernel parameters required by one machine only.
 - `system.stateVersion`.
 - Host-specific secret references.
-- The profiles, applications, and other units enabled on that host.
+- The profiles enabled on that host and, only in exceptional cases, direct
+  application or other unit selections that cannot be expressed by a coherent
+  reusable profile.
 
 A host registry may use a specification like this:
 
 ```nix
 # hosts/default.nix
 {
+  nix-example = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./nix-example;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.development"
+      "workload.remote-access"
+    ];
+  };
+
+  ops = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./ops;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.remote-access"
+    ];
+  };
+
+  internal-app-01 = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./internal-app-01;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.server"
+    ];
+  };
+
+  installer = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./installer;
+    homeManager = false;
+
+    profiles = [ "base" ];
+  };
+
+  x1g9 = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./x1g9;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "interface.labwc"
+      "interface.niri"
+      "platform.thinkpad-x1"
+      "security.fingerprint"
+      "workload.personal"
+    ];
+  };
+
   x1g13 = {
     system = "x86_64-linux";
+    stateVersion = "26.05";
     user = "moons";
     path = ./x1g13;
 
     profiles = [
       "base"
-      "platform.thinkpad"
+      "interface.cli"
+      "interface.labwc"
       "interface.niri"
-      "interface.gnome"
+      "networking.tailscale-client"
+      "platform.thinkpad-x1"
+      "security.fingerprint"
+      "security.secrets"
+      "security.secure-boot"
+      "security.tpm-storage"
       "workload.development"
       "workload.personal"
-      "security.secure-boot"
-    ];
-
-    applications = [
-      "codex-desktop"
-    ];
-
-    units = [
-      "services.tailscale"
     ];
   };
 
-  macbook = {
+  galleria = {
-    system = "aarch64-darwin";
+    system = "x86_64-linux";
+    stateVersion = "26.05";
     user = "moons";
-    path = ./macbook;
+    path = ./galleria;
 
     profiles = [
       "base"
-      "platform.laptop"
+      "interface.cli"
+      "interface.labwc"
+      "interface.niri"
+      "platform.intel-nvidia-desktop"
+      "security.secrets"
+      "security.secure-boot"
+      "security.tpm-storage"
       "workload.development"
+      "workload.game"
       "workload.personal"
     ];
+  };
 
-    applications = [
+  m2 = {
-      "ghostty"
+    system = "aarch64-darwin";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./m2;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "interface.macos"
+      "security.fingerprint"
+      "workload.development"
+      "workload.personal"
     ];
   };
 }
 ```
 
-Treat entries in `profiles` and `applications` as IDs relative to their
+The current role assignment is intentional: nix-example is the development VM;
-respective category roots. Add the category prefixes during host construction:
+ops is the remote-access VM with host-specific static networking;
+internal-app-01 is the container server VM; and installer builds the minimal
+installation ISO without Home Manager. x1g9 is a full NixOS desktop with niri,
+labwc, ly, the shared Linux desktop applications, and the personal workload.
+x1g13 is the secure NixOS development and personal ThinkPad, with the same
+desktop sessions plus Tailscale client, SOPS, Secure Boot, and TPM-backed disk
+unlock. galleria is the Intel/NVIDIA physical desktop shared with Windows; it
+uses dedicated NixOS partitions, LUKS, Secure Boot, and TPM-backed disk unlock.
+m2 is the daily-use macOS development and personal machine with the macOS
+interface defaults. Keep the desktop sessions independently selectable, and
+keep the development and personal profiles usable across NixOS and Darwin.
+
+Treat entries in `profiles` and the exceptional `applications` field as IDs
+relative to their respective category roots. Add the category prefixes during
+host construction:
 
 ```nix
 selectedUnits =
@@ -470,36 +671,72 @@ selectedUnits =
   ++ spec.units or [ ];
 ```
 
-`units` is an escape hatch for fully qualified service, system, hardware, or
+`applications` and `units` are escape hatches, not normal host composition.
-other unit IDs. Prefer profiles for the main composition; do not make hosts list
+Do not add either field when an existing profile expresses the concern, when an
-large numbers of low-level units directly.
+existing profile can coherently include the unit, or when the concern is
+reusable enough to deserve a small profile. For example, add a development tool
+to `workload.development` and select `security.fingerprint`; do not write
+`applications = [ "ghostty" ];` or `units = [ "systems.fingerprint" ];` in a
+host. A direct selection is permitted only for a genuinely exceptional,
+machine-specific unit that would make every reasonable profile misleading; add
+an adjacent comment explaining that exception. Prefer profiles for host
+composition and omit both escape-hatch fields by default.
 
 Host modules use normal Nix module semantics and are not Registry-guarded
 configuration fragments. For example:
 
 ```text
-hosts/x1g13/
+hosts/
-├── nixos.nix
+├── installer/
-├── home.nix
+│   └── nixos.nix
-├── hardware-configuration.nix
+├── internal-app-01/
-└── disko.nix
+│   ├── nixos.nix
+│   └── hardware-configuration.nix
+├── nix-example/
+│   ├── nixos.nix
+│   └── hardware-configuration.nix
+├── ops/
+│   ├── nixos.nix
+│   └── hardware-configuration.nix
+├── galleria/
+│   ├── disk-identifiers.nix
+│   ├── disko.nix
+│   ├── hardware-configuration.nix
+│   └── nixos.nix
+├── x1g9/
+│   ├── nixos.nix
+│   └── hardware-configuration.nix
+├── x1g13/
+│   ├── nixos.nix
+│   ├── home.nix
+│   ├── disko.nix
+│   └── hardware-configuration.nix
+└── m2/
+    └── darwin.nix
 ```
 
-`hosts/x1g13/nixos.nix` may explicitly load `hardware-configuration.nix` and
+`hosts/x1g9/nixos.nix` explicitly loads `hardware-configuration.nix` with the
-`disko.nix` with the normal top-level Nix module `imports`. Do not confuse these
+normal top-level Nix module `imports`. `hosts/x1g13/nixos.nix` loads its
-host imports with the prohibition on top-level `imports` in unit configuration
+generated hardware configuration and host-local `disko.nix` the same way. Do
-fragments.
+not confuse these host imports with the prohibition on top-level `imports` in
+unit configuration fragments. `hosts/galleria/disko.nix` manages only the two
+dedicated NixOS partitions by PARTUUID and deliberately excludes the Windows
+disk, Windows partitions, and the Windows EFI System Partition.
 
 Derive the system class from the host's `system`:
 
 - A Linux NixOS host receives `common.nix` and `nixos.nix`.
 - A nix-darwin host receives `common.nix` and `darwin.nix`.
-- A host with integrated Home Manager additionally receives `home.nix`.
+- A NixOS host with integrated Home Manager additionally receives `home.nix`,
+  `home/common.nix`, and `home/nixos.nix`.
+- A nix-darwin host with integrated Home Manager additionally receives
+  `home.nix`, `home/common.nix`, and `home/darwin.nix`.
 
 Home Manager is additive, not a system class mutually exclusive with NixOS or
-nix-darwin. The supported combinations are NixOS plus Home Manager and
+nix-darwin. Normal machine configurations combine NixOS or nix-darwin with Home
-nix-darwin plus Home Manager. If standalone Home Manager is supported later, add
+Manager; the installer ISO explicitly sets `homeManager = false`. If standalone
-an explicit host kind because `system` alone cannot distinguish it from NixOS.
+Home Manager is supported later, add an explicit host kind because `system`
+alone cannot distinguish it from NixOS.
 
 Do not duplicate reusable settings in hosts, but do not force genuinely
 machine-specific values into a common unit merely to remove a host-local line.
@@ -522,11 +759,23 @@ When implementing or modifying modules:
   unit's enable option from a class fragment.
 - Do not assume any non-reserved file is discovered or loaded automatically.
 - Do not require an `_` prefix for helper or private files.
-- Do not create unused `common.nix`, `nixos.nix`, `darwin.nix`, `home.nix`, or
+- Do not create unused reserved fragments, including placeholder files under the
-  `meta.nix` files.
+  reserved `home/` fragment directory.
 - Do not override a path-derived unit ID from `meta.nix`.
 - Keep technical application dependencies separate from the applications a
   personal environment chooses to combine in a profile.
+- Keep cross-platform profile names semantic. Put Linux package installation in
+  an application's `home.nix` and the corresponding macOS Homebrew cask in its
+  `darwin.nix`; do not create a thin `*-linux` profile for that difference.
+- Keep shared labwc/niri selections in `profiles.interface.linux-desktop` and
+  session-specific applications or services in the respective labwc or niri
+  profile.
+- Keep `modules/profiles/README.md`, the profile directories, and host profile
+  selections synchronized whenever any of them changes.
+- Do not select applications or units directly in `hosts/default.nix` unless
+  they meet the documented exceptional, machine-specific escape-hatch rule.
+  Prefer adding the unit to an existing coherent profile or creating a small,
+  justified reusable profile.
 - Do not rely on module-list ordering to override values. Use Nix module
   priorities such as `lib.mkDefault`, `lib.mkForce`, `lib.mkBefore`, or
   `lib.mkAfter` explicitly when required.
@@ -563,6 +812,25 @@ dependency closure through `meta.includes`, missing-unit errors, and class
 dispatch. Verify that helper files are ignored until explicitly imported and
 that directories without a directly contained reserved file remain namespaces.
 
+For profile changes, additionally:
+
+- Check for stale profile IDs after every add, removal, or rename.
+- Evaluate every affected real host without switching it.
+- Evaluate a cross-platform profile on both NixOS and nix-darwin, even when only
+  one current host selects it.
+- Confirm `modules/profiles/README.md` accurately states compatibility and any
+  required host-owned values.
+- When adding a Darwin application fragment, verify the resulting
+  `homebrew.casks` selection as well as module evaluation.
+- Preserve the intended host roles: nix-example remains the development VM;
+  ops remains the statically networked remote-access VM; internal-app-01 remains
+  the container server VM; installer remains the Home Manager-free installation
+  ISO; x1g9 provides niri, labwc, ly, and the personal application set; x1g13
+  additionally provides the development, Tailscale client, secrets, Secure Boot,
+  and TPM storage roles; galleria remains the Intel/NVIDIA dual-boot desktop
+  with LUKS, Secure Boot, and TPM storage; m2 remains the daily-use development
+  and personal machine.
+
 ## Commit and Pull Request Guidelines
 
 Recent history favors short, lowercase, imperative subjects such as `fix` and

README.md

@@ -1,3 +1,6 @@
 # moons14 dotfiles
 
-My NixOS + Home Manager configurations build with flake.
+My NixOS, nix-darwin, and Home Manager configurations built with flakes.
+
+See [Coding-agent validation](docs/coding-agents.md) for the non-activating,
+change-aware validation workflow used by Codex, OpenCode, and CI.

docs/coding-agents.md

@@ -0,0 +1,86 @@
+# Coding-agent workflow
+
+This repository exposes deterministic validation and narrowly scoped research
+tools for Codex, OpenCode, and editor agents. Live system activation is outside
+this workflow.
+
+## Validation commands
+
+Use task-owned paths during the edit loop:
+
+```console
+nix run .#check -- plan --paths modules/applications/example/home.nix --json
+nix run .#check -- fast --paths modules/applications/example/home.nix
+nix run .#check -- eval --paths modules/applications/example/home.nix
+nix run .#check -- build --paths modules/applications/example/home.nix
+nix run .#check -- all --paths modules/applications/example/home.nix
+```
+
+For a committed pull-request range, replace `--paths ...` with
+`--base <base-sha>`. `full` is reserved for CI, scheduled maintenance, or an
+explicit repository-wide audit:
+
+```console
+nix run .#check -- full
+```
+
+The stages have distinct meanings:
+
+- `plan` maps changed paths to Registry units, reverse `meta.includes`
+  dependencies, real hosts, and compatible build systems.
+- `fast` parses changed Nix files, validates JSON, TOML, Python, and Agent Skill
+  frontmatter, checks whitespace, and runs configured hooks only for the
+  selected files.
+- `eval` instantiates affected NixOS and nix-darwin configurations. Flake-wide,
+  validation-tool, shell, overlay, and test changes additionally evaluate every
+  flake system.
+- `build` realizes affected configurations supported by the current platform
+  with no result link. Incompatible targets remain evaluation-only until a
+  matching runner handles them.
+- `all` performs task-scoped file checks, all-system evaluation, and compatible
+  targeted builds.
+- `full` runs all-file hooks, all-system evaluation, and every check for the
+  current platform through `nix-fast-build`.
+
+The validation app constructs a filtered temporary `path:` flake from the
+committed `HEAD` tree and overlays only task-owned changed paths. This isolates
+unrelated worktree changes, makes new untracked Registry fragments visible to
+Nix without staging them, and avoids copying ignored state such as `.direnv`.
+
+None of these commands runs `nh os switch`, `nixos-rebuild switch`,
+`darwin-rebuild switch`, `home-manager switch`, or another activation command.
+The user performs activation separately.
+
+## Agent Skills
+
+Read `AGENTS.md` first. Use the repository skills as follows:
+
+- `validate-nix-change` controls validation scope and evidence.
+- `debug-nix-failure` classifies parse, evaluation, build, test, activation-log,
+  and runtime failures before proposing a correction.
+- `test-nixos-service` adds a `pkgs.testers.runNixOSTest` check when a build
+  cannot prove service behavior.
+- `update-flake-input` limits lock-file updates and validates them without
+  activating a host.
+- `add-application-or-service` preserves Registry ownership and delegates
+  validation to `validate-nix-change`.
+
+## MCP and language-server setup
+
+The development workload installs `mcp-nixos`, `nixd`, `nix-fast-build`, and
+`nix-tree`.
+
+Project-local Codex and OpenCode configuration exposes:
+
+- `mcp-nixos` for current NixOS, Home Manager, nix-darwin, package, and Nix
+  documentation queries;
+- GitHub's remote MCP endpoint for Codex and OpenCode in read-only mode,
+  restricted to repository, pull-request, and Actions toolsets.
+
+Set `GITHUB_PERSONAL_ACCESS_TOKEN` in the launching environment when GitHub MCP
+access is needed. Do not commit the token or put it in a Nix expression because
+that would expose it through source control or the Nix store.
+
+The workspace VS Code settings use `nixd` and expose option sets for the
+`galleria` NixOS configuration, its integrated Home Manager configuration, the
+`m2` nix-darwin configuration, and its integrated Home Manager configuration.

docs/fingerprint.md

@@ -0,0 +1,68 @@
+# Fingerprint Commands
+
+This note covers the basic `fprintd` commands used by the fingerprint module.
+
+## Enroll a new fingerprint
+
+Register a fingerprint for the current user:
+
+```sh
+fprintd-enroll $USER
+```
+
+To enroll a specific finger, pass the finger name:
+
+```sh
+fprintd-enroll -f right-index-finger $USER
+```
+
+Common finger names include:
+
+- `left-thumb`
+- `left-index-finger`
+- `right-thumb`
+- `right-index-finger`
+
+Follow the prompts and swipe or touch the sensor until enrollment completes.
+
+## List enrolled fingerprints
+
+Show fingerprints registered for the current user:
+
+```sh
+fprintd-list $USER
+```
+
+You can also list fingerprints for another user:
+
+```sh
+fprintd-list <username>
+```
+
+## Delete fingerprints
+
+Delete one enrolled fingerprint for the current user:
+
+```sh
+fprintd-delete
+```
+
+Delete all enrolled fingerprints for the current user:
+
+```sh
+fprintd-delete $USER
+```
+
+Delete fingerprints for another user:
+
+```sh
+fprintd-delete <username>
+```
+
+## Verify authentication
+
+Test fingerprint authentication for the current user:
+
+```sh
+fprintd-verify
+```

docs/install.md

@@ -0,0 +1,157 @@
+# NixOSインストール手順
+
+## 事前準備
+
+1. [ISOビルド](iso-build.md)を参照してISOを作成
+2. USBに書き込んで対象マシンでブート
+
+## ネットワーク接続
+
+### 有線LAN
+
+DHCPで自動設定される。
+
+### WiFi（有線が使えない場合）
+
+```bash
+nmcli device wifi connect <SSID> --ask
+```
+
+## SSH接続
+
+コンソールに表示されたIPアドレスに接続：
+
+```bash
+ssh root@<ip-address>
+```
+
+## インストール手順
+
+### 1. dotfilesのクローン
+
+```bash
+git clone [email protected]:moons-14/dotfiles.git ~/dotfiles
+```
+
+### 2. SSHホストキーの生成
+
+新しいホスト用のSSHホストキーを生成：
+
+```bash
+ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N ""
+```
+
+### 3. age公開鍵の取得
+
+SSHホストキーからage公開鍵を取得：
+
+```bash
+ssh-to-age -i /tmp/ssh_host_ed25519_key.pub
+```
+
+出力されたage公開鍵をコピー。
+
+### 4. .sops.yamlの編集
+
+```bash
+cd ~/dotfiles
+vim .sops.yaml
+```
+
+以下を追加：
+
+```yaml
+keys:
+  - &host_<hostname> <age公開鍵>
+
+creation_rules:
+  - path_regex: ^secrets/hosts/<hostname>/[^/]+\.ya?ml$
+    key_groups:
+      - age:
+          - *admin_yubikey1
+          - *host_<hostname>
+```
+
+### 5. シークレットの再暗号化
+
+```bash
+sops updatekeys secrets/common/system.yaml
+sops updatekeys secrets/hosts/<hostname>/*.yaml
+```
+
+### 6. disko設定の作成
+
+新しいホスト用の`hosts/<hostname>/disko.nix`を作成。
+
+#### シンプル構成（暗号化なし）
+
+```nix
+_:
+{
+  disko.enableConfig = true;
+
+  disko.devices.disk.main = {
+    type = "disk";
+    device = "/dev/sda";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+          };
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+}
+```
+
+#### LUKS暗号化 + btrfs
+
+`hosts/x1g13/disko.nix`を参照。
+
+### 7. ディスクのパーティション
+
+```bash
+cd ~/dotfiles
+nix run github:nix-community/disko -- --mode disko hosts/<hostname>/disko.nix
+```
+
+### 8. ホストキーのコピー
+
+```bash
+mkdir -p /mnt/etc/ssh
+cp /tmp/ssh_host_ed25519_key* /mnt/etc/ssh/
+chmod 600 /mnt/etc/ssh/ssh_host_ed25519_key
+```
+
+### 9. NixOSインストール
+
+```bash
+nixos-install --flake ~/dotfiles#<hostname>
+```
+
+### 10. 再起動
+
+```bash
+reboot
+```
+
+## インストール後の確認
+
+- SSHでログインできるか
+- sopsシークレットが復号できるか
+- diskoでパーティションが正しく設定されているか

docs/iso-build.md

@@ -0,0 +1,26 @@
+# カスタムISOビルド
+
+## ビルド
+
+```bash
+nix build .#nixosConfigurations.installer.config.system.build.isoImage
+```
+
+## ISO書き込み
+
+```bash
+# USBデバイスの確認
+lsblk
+
+# 書き込み（/dev/sdXは実際のデバイスに置き換える）
+sudo dd if=./result/nixos-minimal-*.iso of=/dev/sdX bs=4M status=progress
+sync
+```
+
+## ISOの特徴
+
+- SSH鍵認証でrootログイン可能
+- 有線LANはDHCPで自動設定
+- WiFiは`nmcli`で手動設定可能
+- disko/sops/ageなどのツールを内蔵
+- ブート時にIPアドレスとヘルプを表示

docs/sops-key.md

@@ -0,0 +1,17 @@
+# Generate Sops key file
+
+```bash
+mkdir -p ~/.config/sops/age
+chmod 700 ~/.config/sops/age
+
+age-plugin-yubikey --identity --slot 1 \
+  > ~/.config/sops/age/yubikey-identity.txt
+
+chmod 600 ~/.config/sops/age/yubikey-identity.txt
+```
+
+## Edit sops file
+
+```bash
+sops secrets/common/system.yaml
+```

flake.nix

@@ -23,6 +23,11 @@
     # Desktop
     niri-flake.url = "github:sodiboo/niri-flake";
 
+    nix-hazkey = {
+      url = "github:aster-void/nix-hazkey";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     stylix = {
       url = "github:nix-community/stylix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -30,7 +35,13 @@
 
     # Terminal
     ghostty = {
-      url = "github:moons-14/ghostty";
+      url = "github:ghostty-org/ghostty";
+    };
+
+    # Speech to text
+    handy = {
+      url = "github:cjpais/Handy";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     # Shell / Launcher
@@ -41,10 +52,7 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    noctalia = {
+    noctalia.url = "github:noctalia-dev/noctalia/cachix";
-      url = "github:noctalia-dev/noctalia";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
 
     # Editor
     nixvim = {
@@ -96,7 +104,15 @@
     };
 
     # Systems
-    systems.url = "github:nix-systems/default-linux";
+    systems.url = "github:nix-systems/default";
+
+    browser-previews = {
+      url = "github:nix-community/browser-previews";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    nani-translate-linux.url = "git+https://github.com/zunoser/nani-translate-linux.git";
+
   };
 
   outputs =

flake/default.nix

@@ -3,5 +3,6 @@
     ./formatter.nix
     ./git-hooks.nix
     ./registry.nix
+    ./validation.nix
   ];
 }

flake/git-hooks.nix

@@ -34,7 +34,9 @@
             ];
           };
 
+          actionlint.enable = true;
           deadnix.enable = true;
+          ruff.enable = true;
           statix.enable = true;
           shellcheck.enable = true;
         };

flake/registry.nix

@@ -25,18 +25,61 @@ let
     else
       { };
   configurations = dotfilesLib.hosts.mkConfigurations hostSpecs;
+
+  validationMetadata = {
+    schemaVersion = 1;
+
+    hosts = lib.mapAttrs (
+      name: spec:
+      let
+        isDarwin = lib.hasSuffix "-darwin" spec.system;
+      in
+      {
+        inherit (spec) system user;
+        kind = if isDarwin then "darwin" else "nixos";
+        homeManager = spec.homeManager or true;
+        selectedUnits = dotfilesLib.hosts.selectedUnits spec;
+        buildAttr =
+          if isDarwin then
+            "darwinConfigurations.${name}.system"
+          else
+            "nixosConfigurations.${name}.config.system.build.toplevel";
+      }
+    ) hostSpecs;
+
+    units = lib.mapAttrs (_id: unit: {
+      inherit (unit) id relativePath;
+      directory = "modules/${lib.concatStringsSep "/" unit.relativePath}";
+      includes = unit.meta.includes;
+      fragments = builtins.attrNames (lib.filterAttrs (_: value: value != null) unit.fragments);
+    }) dotfilesLib.registry.units;
+  };
 in
 {
   flake = {
     inherit (configurations) darwinConfigurations nixosConfigurations;
-    lib = dotfilesLib;
+    lib = dotfilesLib // {
+      inherit validationMetadata;
+    };
   };
 
   perSystem =
-    { pkgs, ... }:
+    { pkgs, system, ... }:
+    let
+      nixosChecks =
+        lib.mapAttrs' (name: nixos: lib.nameValuePair "nixos-${name}" nixos.config.system.build.toplevel)
+          (lib.filterAttrs (name: _: hostSpecs.${name}.system == system) configurations.nixosConfigurations);
+      darwinChecks = lib.mapAttrs' (name: darwin: lib.nameValuePair "darwin-${name}" darwin.system) (
+        lib.filterAttrs (name: _: hostSpecs.${name}.system == system) configurations.darwinConfigurations
+      );
+    in
     {
-      checks.registry = import ../tests/registry.nix {
+      checks = {
-        inherit inputs lib pkgs;
+        registry = import ../tests/registry.nix {
-      };
+          inherit inputs lib pkgs;
+        };
+      }
+      // nixosChecks
+      // darwinChecks;
     };
 }

flake/validation.nix

@@ -0,0 +1,51 @@
+_: {
+  perSystem =
+    { pkgs, config, ... }:
+    let
+      script = pkgs.writeText "dotfiles-check.py" (builtins.readFile ../scripts/dotfiles-check.py);
+      dotfilesCheck = pkgs.writeShellApplication {
+        name = "dotfiles-check";
+        runtimeInputs = [
+          pkgs.git
+          pkgs.nix
+          pkgs.python3
+        ];
+        text = ''
+          exec python3 ${script} "$@"
+        '';
+      };
+    in
+    {
+      apps = {
+        check = {
+          type = "app";
+          program = "${dotfilesCheck}/bin/dotfiles-check";
+        };
+        nix-fast-build = {
+          type = "app";
+          program = "${pkgs.nix-fast-build}/bin/nix-fast-build";
+        };
+      };
+
+      packages = {
+        dotfiles-check = dotfilesCheck;
+        inherit (pkgs) nix-fast-build;
+      };
+
+      devShells.validation = config.pre-commit.devShell;
+
+      checks = {
+        validation-tool =
+          pkgs.runCommand "dotfiles-check-self-test"
+            {
+              nativeBuildInputs = [ dotfilesCheck ];
+            }
+            ''
+              dotfiles-check self-test
+              touch "$out"
+            '';
+
+        dotnix-shell = config.devShells.dotnix;
+      };
+    };
+}

hosts/default.nix

@@ -1,13 +1,136 @@
 {
+  nix-example = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./nix-example;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.development"
+      "workload.remote-access"
+    ];
+  };
+
+  ops = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./ops;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.remote-access"
+    ];
+  };
+
+  internal-app-01 = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./internal-app-01;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "platform.vm"
+      "workload.server"
+    ];
+  };
+
+  installer = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./installer;
+    homeManager = false;
+
+    profiles = [ "base" ];
+  };
+
   x1g9 = {
     system = "x86_64-linux";
+    stateVersion = "26.05";
     user = "moons";
     path = ./x1g9;
 
     profiles = [
       "base"
-      "interface.cli-minimal"
+      "interface.cli"
-      "platform.laptop"
+      "interface.labwc"
+      "interface.niri"
+      "platform.thinkpad-x1"
+      "security.fingerprint"
+      # "security.secrets"
+      "workload.personal"
+    ];
+  };
+
+  x1g13 = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./x1g13;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "interface.labwc"
+      "interface.niri"
+      "networking.tailscale-client"
+      "platform.thinkpad-x1"
+      "security.fingerprint"
+      "security.secrets"
+      "security.secure-boot"
+      "security.tpm-storage"
+      "workload.development"
+      "workload.game"
+      "workload.personal"
+    ];
+  };
+
+  galleria = {
+    system = "x86_64-linux";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./galleria;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "interface.labwc"
+      "interface.niri"
+      "interface.wallpaperengine"
+      "platform.intel-nvidia-desktop"
+      "security.secrets"
+      "security.secure-boot"
+      "security.tpm-storage"
+      "security.fingerprint"
+      "workload.development"
+      "workload.game"
+      "workload.personal"
+    ];
+  };
+
+  m2 = {
+    system = "aarch64-darwin";
+    stateVersion = "26.05";
+    user = "moons";
+    path = ./m2;
+
+    profiles = [
+      "base"
+      "interface.cli"
+      "interface.macos"
+      "security.fingerprint"
+      # "security.secrets"
+      "workload.development"
+      "workload.game"
+      "workload.personal"
     ];
   };
 }

hosts/galleria/disko.nix

@@ -0,0 +1,91 @@
+_:
+let
+  espPart = "/dev/disk/by-partuuid/008b04ef-9c06-4049-bffb-3906f5c3a9c1";
+  nixosPart = "/dev/disk/by-partuuid/04295552-cbb8-4511-ac1e-1171ec20f8d1";
+
+  btrfsMountOptions = [
+    "compress=zstd"
+    "noatime"
+    "ssd"
+    "space_cache=v2"
+  ];
+in
+{
+  disko.enableConfig = true;
+
+  # These are deliberately partition paths, not the whole Windows disk. Disko
+  # must never own or destroy the disk's GPT or any Windows partition.
+  disko.devices.disk = {
+    esp = {
+      type = "disk";
+      device = espPart;
+      destroy = false;
+
+      content = {
+        type = "filesystem";
+        format = "vfat";
+        mountpoint = "/boot";
+        mountOptions = [ "umask=0077" ];
+      };
+    };
+
+    nixos = {
+      type = "disk";
+      device = nixosPart;
+      destroy = false;
+
+      content = {
+        type = "luks";
+        name = "cryptroot";
+        askPassword = true;
+        settings.allowDiscards = true;
+
+        extraFormatArgs = [
+          "--type"
+          "luks2"
+          "--pbkdf"
+          "argon2id"
+          "--label"
+          "NixOS-LUKS"
+        ];
+
+        content = {
+          type = "btrfs";
+          extraArgs = [
+            "-f"
+            "-L"
+            "NixOS"
+          ];
+
+          subvolumes = {
+            "@root" = {
+              mountpoint = "/";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@home" = {
+              mountpoint = "/home";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@nix" = {
+              mountpoint = "/nix";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@log" = {
+              mountpoint = "/var/log";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@swap" = {
+              mountpoint = "/.swapvol";
+              mountOptions = [ "noatime" ];
+              swap.swapfile.size = "32G";
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/galleria/hardware-configuration.nix

@@ -0,0 +1,30 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/galleria/home.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  services.kanshi = {
+    enable = true;
+
+    settings = [
+      {
+        profile = {
+          name = "galleria";
+
+          outputs = [
+            {
+              criteria = "HDMI-A-1";
+              status = "enable";
+              position = "0,0";
+              scale = 1.5;
+            }
+            {
+              criteria = "DP-1";
+              status = "enable";
+              position = "2560,0";
+            }
+            {
+              criteria = "DP-2";
+              status = "enable";
+              position = "5120,0";
+              scale = 1.5;
+            }
+          ];
+        };
+      }
+    ];
+  };
+
+  home.file.".wallpapers" = {
+    source = lib.mkForce (
+      config.lib.file.mkOutOfStoreSymlink "${config.home.homeDirectory}/Pictures/wallpapers"
+    );
+
+    recursive = lib.mkForce false;
+  };
+}

hosts/galleria/nixos.nix

@@ -0,0 +1,14 @@
+{ inputs, pkgs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disko.nix
+  ];
+
+  boot.initrd.luks.devices.cryptroot.device =
+    "/dev/disk/by-partuuid/04295552-cbb8-4511-ac1e-1171ec20f8d1";
+
+  environment.systemPackages = with inputs.browser-previews.packages.${pkgs.system}; [
+    google-chrome-beta
+  ];
+}

hosts/installer/nixos.nix

@@ -0,0 +1,194 @@
+{
+  pkgs,
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [ "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix" ];
+
+  boot.zfs.forceImportRoot = false;
+
+  networking = {
+    hostName = "nixos-installer";
+
+    networkmanager = {
+      enable = true;
+      wifi.powersave = false;
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PubkeyAuthentication = "yes";
+    };
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKhxDkucmeCor6CKoXAua7DgDSzuXrZOtpdkyzQxz5+aAAAABHNzaDo= moons@moons14.com"
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIN6hZJyng/5LgFKPjR6uZAd/00UkO0vN0uQOoIvfSELdAAAABHNzaDo= moons@moons14.com"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    git
+    disko
+    sops
+    age
+    ssh-to-age
+    age-plugin-yubikey
+    yubikey-manager
+    pcsc-tools
+    mkpasswd
+    rsync
+    vim
+    wget
+    curl
+    jq
+    parted
+    cryptsetup
+    btrfs-progs
+    efibootmgr
+    pciutils
+    sbctl
+    tpm2-tools
+    util-linux
+  ];
+
+  services.pcscd.enable = true;
+
+  environment.etc."installer-help.txt".text = ''
+
+    ╔══════════════════════════════════════════════════════════════╗
+    ║                    NixOS Installer ISO                       ║
+    ╠══════════════════════════════════════════════════════════════╣
+    ║                                                              ║
+    ║  SSH Access:                                                 ║
+    ║    ssh root@<ip-address>                                     ║
+    ║                                                              ║
+    ║  Network Setup:                                              ║
+    ║    Wired:   Auto-configured via DHCP                         ║
+    ║    WiFi:    nmcli device wifi connect <SSID> --ask           ║
+    ║                                                              ║
+    ║  Installation Workflow:                                      ║
+    ║                                                              ║
+    ║  1. Clone dotfiles:                                          ║
+    ║     git clone git@github.com:moons-14/dotfiles.git ~/dotfiles║
+    ║                                                              ║
+    ║  2. Generate SSH host key for new host:                      ║
+    ║     ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -N "" ║
+    ║                                                              ║
+    ║  3. Get age public key from SSH host key:                    ║
+    ║     ssh-to-age -i /tmp/ssh_host_ed25519_key.pub              ║
+    ║                                                              ║
+    ║  4. Add age key to .sops.yaml:                               ║
+    ║     cd ~/dotfiles                                            ║
+    ║     # Edit .sops.yaml and add the age key                    ║
+    ║     # Add new host entry to creation_rules                   ║
+    ║                                                              ║
+    ║  5. Re-encrypt secrets:                                      ║
+    ║     sops updatekeys secrets/common/system.yaml               ║
+    ║     sops updatekeys secrets/hosts/<host>/*.yaml              ║
+    ║                                                              ║
+    ║  6. Create disko.nix for new host:                           ║
+    ║     # Check disk devices                                     ║
+    ║     lsblk -f                                                 ║
+    ║                                                              ║
+    ║     # Create hosts/<host>/disko.nix                          ║
+    ║     # Example: LUKS + btrfs                                  ║
+    ║     # See hosts/x1g13/disko.nix for reference                ║
+    ║                                                              ║
+    ║  7. Partition disk with disko:                               ║
+    ║     nix run github:nix-community/disko -- \                  ║
+    ║       --mode disko hosts/<host>/disko.nix                    ║
+    ║                                                              ║
+    ║  8. Copy host key to installed system:                       ║
+    ║     mkdir -p /mnt/etc/ssh                                    ║
+    ║     cp /tmp/ssh_host_ed25519_key* /mnt/etc/ssh/              ║
+    ║     chmod 600 /mnt/etc/ssh/ssh_host_ed25519_key              ║
+    ║                                                              ║
+    ║  9. Install NixOS:                                           ║
+    ║     nixos-install --flake ~/dotfiles#<host>                  ║
+    ║                                                              ║
+    ║  Disko Configuration Examples:                               ║
+    ║                                                              ║
+    ║  Simple (no encryption):                                     ║
+    ║    disko.devices.disk.main = {                               ║
+    ║      type = "disk";                                          ║
+    ║      device = "/dev/sda";                                    ║
+    ║      content = {                                             ║
+    ║        type = "gpt";                                         ║
+    ║        partitions = {                                        ║
+    ║          ESP = { size = "512M"; type = "EF00";              ║
+    ║            content = { type = "filesystem";                  ║
+    ║              format = "vfat"; mountpoint = "/boot"; }; };   ║
+    ║          root = { size = "100%";                             ║
+    ║            content = { type = "filesystem";                  ║
+    ║              format = "ext4"; mountpoint = "/"; }; };       ║
+    ║        };                                                    ║
+    ║      };                                                      ║
+    ║    };                                                        ║
+    ║                                                              ║
+    ║  LUKS + btrfs (see hosts/x1g13/disko.nix):                  ║
+    ║    - Use partuuid for device path                            ║
+    ║    - Set askPassword = true for LUKS                         ║
+    ║    - Configure btrfs subvolumes                              ║
+    ║                                                              ║
+    ╚══════════════════════════════════════════════════════════════╝
+
+  '';
+
+  systemd.services.installer-banner = {
+    description = "Display installer help on console";
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${pkgs.coreutils}/bin/cat /etc/installer-help.txt";
+      StandardOutput = "tty";
+      TTYPath = "/dev/tty1";
+    };
+  };
+
+  systemd.services.display-ip = {
+    description = "Display IP address on console";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = pkgs.writeShellScript "display-ip" ''
+        sleep 2
+        echo ""
+        echo "=== Network Interfaces ==="
+        ${pkgs.iproute2}/bin/ip -4 addr show | ${pkgs.gnugrep}/bin/grep inet
+        echo ""
+        echo "=== SSH Access ==="
+        for ip in $(${pkgs.iproute2}/bin/ip -4 addr show | ${pkgs.gnugrep}/bin/grep -oP 'inet \K[\d.]+' | ${pkgs.gnugrep}/bin/grep -v '127.0.0.1'); do
+          echo "  ssh root@$ip"
+        done
+        echo ""
+      '';
+      StandardOutput = "tty";
+      TTYPath = "/dev/tty1";
+    };
+  };
+
+  nix = {
+    settings = {
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      trusted-users = [ "root" ];
+    };
+
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/internal-app-01/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file! It was generated by `nixos-generate-config` and may
+# be overwritten by future invocations.
+{ lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/1b12ab98-2537-4207-a3f4-bb8ba7b53b00";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/8365-C778";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/internal-app-01/nixos.nix

@@ -0,0 +1,3 @@
+{
+  imports = [ ./hardware-configuration.nix ];
+}

hosts/m2/darwin.nix

@@ -0,0 +1,10 @@
+{ hostName, ... }:
+{
+  # networking.hostName and networking.localHostName are derived from the
+  # registry name; computerName controls the user-visible macOS name.
+  networking.computerName = hostName;
+
+  # Keep this value stable after the first activation. It is independent of
+  # the Home Manager stateVersion in hosts/default.nix.
+  system.stateVersion = 7;
+}

hosts/nix-example/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file! It was generated by `nixos-generate-config` and may
+# be overwritten by future invocations.
+{ lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/8f0eaec6-5dc9-4821-aa8d-fb6809b5a5bf";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/201C-961B";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/nix-example/nixos.nix

@@ -0,0 +1,3 @@
+{
+  imports = [ ./hardware-configuration.nix ];
+}

hosts/ops/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file! It was generated by `nixos-generate-config` and may
+# be overwritten by future invocations.
+{ lib, modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/69fa2193-1e4f-438a-8898-5de8a3f36e5b";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/D09B-4277";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/ops/nixos.nix

@@ -0,0 +1,51 @@
+{
+  imports = [ ./hardware-configuration.nix ];
+
+  networking = {
+    useDHCP = false;
+
+    interfaces = {
+      ens18 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "10.50.128.20";
+            prefixLength = 24;
+          }
+        ];
+      };
+
+      ens19 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "10.50.7.101";
+            prefixLength = 24;
+          }
+        ];
+      };
+
+      ens20 = {
+        useDHCP = false;
+        ipv4.routes = [
+          {
+            address = "10.50.64.0";
+            prefixLength = 24;
+            via = "10.50.82.1";
+          }
+        ];
+        ipv4.addresses = [
+          {
+            address = "10.50.82.10";
+            prefixLength = 24;
+          }
+        ];
+      };
+    };
+
+    defaultGateway = {
+      address = "10.50.128.1";
+      interface = "ens18";
+    };
+  };
+}

hosts/x1g13/disko.nix

@@ -0,0 +1,89 @@
+_:
+let
+  espPart = "/dev/disk/by-partuuid/a53e3b19-67de-40de-9ded-3eac3117689a";
+  nixosPart = "/dev/disk/by-partuuid/311d0f9c-f35f-42e6-b6fc-a4d67dd21b2e";
+
+  btrfsMountOptions = [
+    "compress=zstd"
+    "noatime"
+    "ssd"
+    "space_cache=v2"
+  ];
+in
+{
+  disko.enableConfig = true;
+
+  disko.devices.disk = {
+    esp = {
+      type = "disk";
+      device = espPart;
+      destroy = false;
+
+      content = {
+        type = "filesystem";
+        format = "vfat";
+        mountpoint = "/boot";
+        mountOptions = [ "umask=0077" ];
+      };
+    };
+
+    nixos = {
+      type = "disk";
+      device = nixosPart;
+      destroy = false;
+
+      content = {
+        type = "luks";
+        name = "cryptroot";
+        askPassword = true;
+        settings.allowDiscards = true;
+
+        extraFormatArgs = [
+          "--type"
+          "luks2"
+          "--pbkdf"
+          "argon2id"
+          "--label"
+          "NixOS-LUKS"
+        ];
+
+        content = {
+          type = "btrfs";
+          extraArgs = [
+            "-f"
+            "-L"
+            "NixOS"
+          ];
+
+          subvolumes = {
+            "@root" = {
+              mountpoint = "/";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@home" = {
+              mountpoint = "/home";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@nix" = {
+              mountpoint = "/nix";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@log" = {
+              mountpoint = "/var/log";
+              mountOptions = btrfsMountOptions;
+            };
+
+            "@swap" = {
+              mountpoint = "/.swapvol";
+              mountOptions = [ "noatime" ];
+              swap.swapfile.size = "32G";
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/x1g13/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file! It was generated by `nixos-generate-config`
+# and may be overwritten by future invocations. Make changes in nixos.nix.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  swapDevices = [ ];
+
+  networking.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/x1g13/home.nix

@@ -0,0 +1,22 @@
+{
+  services.kanshi = {
+    enable = true;
+
+    settings = [
+      {
+        profile = {
+          name = "x1g13";
+
+          outputs = [
+            {
+              criteria = "eDP-1";
+              status = "enable";
+              position = "0,0";
+              scale = 1.5;
+            }
+          ];
+        };
+      }
+    ];
+  };
+}

hosts/x1g13/nixos.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./disko.nix
+  ];
+
+  boot.initrd.luks.devices.cryptroot.device =
+    "/dev/disk/by-partuuid/311d0f9c-f35f-42e6-b6fc-a4d67dd21b2e";
+}

hosts/x1g9/hardware-configuration.nix

@@ -0,0 +1,52 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "thunderbolt"
+    "nvme"
+    "usb_storage"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/16b29578-6836-414b-a5e1-863bc21c5fc3";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/209A-C8C9";
+    fsType = "vfat";
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/x1g9/hardware.nix

@@ -1 +0,0 @@
-{ }

hosts/x1g9/nixos.nix

@@ -1,7 +1,5 @@
 {
   imports = [
-    ./hardware.nix
+    ./hardware-configuration.nix
   ];
-
-  system.stateVersion = "26.05";
 }

libs/hosts.nix

@@ -37,16 +37,25 @@ let
                 "${name}: path must name an existing host directory"
                 (
                   ensure
-                    (lib.all
+                    (
-                      (field: builtins.isList (spec.${field} or [ ]) && lib.all builtins.isString (spec.${field} or [ ]))
+                      spec ? stateVersion
-                      [
+                      && builtins.isString spec.stateVersion
-                        "profiles"
+                      && builtins.match "[0-9][0-9]\\.[0-9][0-9]" spec.stateVersion != null
-                        "applications"
+                    )
-                        "units"
+                    "${name}: stateVersion is required and must have the form YY.MM"
-                      ]
+                    (
+                      ensure
+                        (lib.all
+                          (field: builtins.isList (spec.${field} or [ ]) && lib.all builtins.isString (spec.${field} or [ ]))
+                          [
+                            "profiles"
+                            "applications"
+                            "units"
+                          ]
+                        )
+                        "${name}: profiles, applications, and units must be lists of strings"
+                        (ensure (builtins.isBool (spec.homeManager or true)) "${name}: homeManager must be a boolean" spec)
                     )
-                    "${name}: profiles, applications, and units must be lists of strings"
-                    (ensure (builtins.isBool (spec.homeManager or true)) "${name}: homeManager must be a boolean" spec)
                 )
             )
           )
@@ -65,8 +74,12 @@ let
     let
       homePath = hostFile spec "home.nix";
       homeModules = [
-        (registry.mkModule { class = "home"; })
+        (registry.mkModule {
+          class = "home";
+          systemClass = "nixos";
+        })
         (registry.mkSelectionModule selected)
+        { home.stateVersion = spec.stateVersion; }
       ]
       ++ lib.optional (homePath != null) homePath;
     in
@@ -86,8 +99,12 @@ let
     let
       homePath = hostFile spec "home.nix";
       homeModules = [
-        (registry.mkModule { class = "home"; })
+        (registry.mkModule {
+          class = "home";
+          systemClass = "darwin";
+        })
         (registry.mkSelectionModule selected)
+        { home.stateVersion = spec.stateVersion; }
       ]
       ++ lib.optional (homePath != null) homePath;
     in
@@ -111,7 +128,10 @@ let
       modules = [
         (registry.mkModule { class = "nixos"; })
         (registry.mkSelectionModule selected)
-        { networking.hostName = lib.mkDefault name; }
+        {
+          networking.hostName = lib.mkDefault name;
+          system.stateVersion = spec.stateVersion;
+        }
       ]
       ++ lib.optional (spec.homeManager or true) (mkHomeManagerModule name spec selected)
       ++ lib.optional (nixosPath != null) nixosPath;
@@ -131,7 +151,10 @@ let
       modules = [
         (registry.mkModule { class = "darwin"; })
         (registry.mkSelectionModule selected)
-        { networking.hostName = lib.mkDefault name; }
+        {
+          networking.hostName = lib.mkDefault name;
+          system.primaryUser = lib.mkDefault spec.user;
+        }
       ]
       ++ lib.optional (spec.homeManager or true) (mkDarwinHomeManagerModule name spec selected)
       ++ lib.optional (darwinPath != null) darwinPath;

libs/registry.nix

@@ -4,7 +4,7 @@
   modulesRoot,
 }:
 let
-  reservedFiles = {
+  rootFragmentFiles = {
     common = "common.nix";
     nixos = "nixos.nix";
     darwin = "darwin.nix";
@@ -12,6 +12,14 @@ let
     meta = "meta.nix";
   };
 
+  homeFragmentFiles = {
+    homeCommon = "common.nix";
+    homeNixos = "nixos.nix";
+    homeDarwin = "darwin.nix";
+  };
+
+  fragmentFileNames = rootFragmentFiles // lib.mapAttrs (_: name: "home/${name}") homeFragmentFiles;
+
   isFile = kind: kind == "regular" || kind == "symlink";
 
   ensure =
@@ -103,13 +111,17 @@ let
       );
 
   makeUnit =
-    relativePath: entries:
+    relativePath: entries: homeEntries:
     let
       directory = pathFor relativePath;
       id = lib.concatStringsSep "." relativePath;
-      fragments = lib.mapAttrs (
+      rootFragments = lib.mapAttrs (
         _class: fileName: if entryIsFile entries fileName then directory + "/${fileName}" else null
-      ) reservedFiles;
+      ) rootFragmentFiles;
+      homeFragments = lib.mapAttrs (
+        _class: fileName: if entryIsFile homeEntries fileName then directory + "/home/${fileName}" else null
+      ) homeFragmentFiles;
+      fragments = rootFragments // homeFragments;
       baseUnit = {
         inherit
           id
@@ -138,11 +150,22 @@ let
     let
       directory = pathFor relativePath;
       entries = builtins.readDir directory;
-      hasReservedFile = lib.any (fileName: entryIsFile entries fileName) (
+      homeEntries =
-        builtins.attrValues reservedFiles
+        if relativePath != [ ] && (entries.home or null) == "directory" then
+          builtins.readDir (directory + "/home")
+        else
+          { };
+      hasRootFragment = lib.any (fileName: entryIsFile entries fileName) (
+        builtins.attrValues rootFragmentFiles
       );
-      childDirectories = lib.filter (name: entries.${name} == "directory") (builtins.attrNames entries);
+      hasHomeFragment = lib.any (fileName: entryIsFile homeEntries fileName) (
-      current = lib.optional hasReservedFile (makeUnit relativePath entries);
+        builtins.attrValues homeFragmentFiles
+      );
+      hasFragment = hasRootFragment || hasHomeFragment;
+      childDirectories = lib.filter (
+        name: entries.${name} == "directory" && !(name == "home" && hasHomeFragment)
+      ) (builtins.attrNames entries);
+      current = lib.optional hasFragment (makeUnit relativePath entries homeEntries);
       children = lib.concatMap (name: walk (relativePath ++ [ name ])) childDirectories;
     in
     current ++ children;
@@ -208,12 +231,44 @@ let
       "common"
       "darwin"
     ];
-    home = [ "home" ];
+    home = {
+      nixos = [
+        "home"
+        "homeCommon"
+        "homeNixos"
+      ];
+      darwin = [
+        "home"
+        "homeCommon"
+        "homeDarwin"
+      ];
+    };
   };
 
+  fragmentClassesFor =
+    {
+      class,
+      systemClass,
+    }:
+    ensure (builtins.hasAttr class fragmentClasses) "unsupported module class '${class}'" (
+      if class == "home" then
+        ensure
+          (builtins.elem systemClass [
+            "nixos"
+            "darwin"
+          ])
+          "the home module class requires systemClass to be 'nixos' or 'darwin'"
+          fragmentClasses.home.${systemClass}
+      else
+        ensure (
+          systemClass == null
+        ) "systemClass is only supported for the home module class" fragmentClasses.${class}
+    );
+
   applyFragment =
     {
       config,
+      fragmentName,
       fragmentPath,
       options,
       specialArgs,
@@ -244,8 +299,7 @@ let
       );
       resultValue = if builtins.isFunction fragment then fragment fragmentArgs else fragment;
       result =
-        ensure (builtins.isAttrs resultValue)
+        ensure (builtins.isAttrs resultValue) "${unit.id}: ${fragmentName} must return an attribute set"
-          "${unit.id}: ${builtins.baseNameOf fragmentPath} must return an attribute set"
           resultValue;
       forbiddenKeys = lib.filter (name: builtins.hasAttr name result) [
         "imports"
@@ -254,14 +308,20 @@ let
       ];
     in
     ensure (forbiddenKeys == [ ])
-      "${unit.id}: ${builtins.baseNameOf fragmentPath} is a configuration fragment and cannot define top-level ${lib.concatStringsSep ", " forbiddenKeys}"
+      "${unit.id}: ${fragmentName} is a configuration fragment and cannot define top-level ${lib.concatStringsSep ", " forbiddenKeys}"
       result;
 
   externalImports = class: lib.concatMap (unit: unit.meta.imports.${class}) discoveredUnits;
 
   mkModule =
-    { class }:
+    {
-    ensure (builtins.hasAttr class fragmentClasses) "unsupported module class '${class}'" (
+      class,
+      systemClass ? null,
+    }:
+    let
+      selectedFragmentClasses = fragmentClassesFor { inherit class systemClass; };
+    in
+    builtins.seq selectedFragmentClasses (
       builtins.seq dependencyValidation (
         {
           config,
@@ -277,6 +337,7 @@ let
               map (
                 fragmentClass:
                 let
+                  fragmentName = fragmentFileNames.${fragmentClass};
                   fragmentPath = unit.fragments.${fragmentClass};
                 in
                 if fragmentPath == null then
@@ -285,13 +346,14 @@ let
                   lib.mkIf (enabled config unit) (applyFragment {
                     inherit
                       config
+                      fragmentName
                       fragmentPath
                       options
                       specialArgs
                       unit
                       ;
                   })
-              ) fragmentClasses.${class}
+              ) selectedFragmentClasses
             )
           ) discoveredUnits;
         in

modules/applications/1password/common.nix

@@ -0,0 +1,4 @@
+_: {
+  programs._1password-gui.enable = true;
+  programs._1password.enable = true;
+}

modules/applications/1password/nixos.nix

@@ -0,0 +1,9 @@
+{ primaryUser, lib, ... }:
+{
+  programs._1password-gui.polkitPolicyOwners = [ primaryUser ];
+
+  # 1Password SSH Agentと競合するagentを無効化
+  programs.ssh.startAgent = lib.mkForce false;
+  programs.gnupg.agent.enableSSHSupport = lib.mkForce false;
+  services.gnome.gcr-ssh-agent.enable = lib.mkForce false;
+}

modules/applications/activitywatch/darwin.nix

@@ -0,0 +1,8 @@
+{
+  homebrew.casks = [ "activitywatch" ];
+
+  launchd.agents.activitywatch = {
+    command = "/usr/bin/open -gja ActivityWatch";
+    serviceConfig.RunAtLoad = true;
+  };
+}

modules/applications/activitywatch/home/nixos.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  services.activitywatch = {
+    enable = true;
+
+    watchers.aw-awatcher = {
+      package = pkgs.awatcher;
+      executable = "awatcher";
+    };
+  };
+}

modules/applications/activitywatch/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "ActivityWatch automated time tracker";
+}

modules/applications/arduino/home.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.arduino-cli ];
+}

modules/applications/arduino/nixos.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+let
+  arduinoIdeX11 = pkgs.arduino-ide.overrideAttrs (old: {
+    nativeBuildInputs = (old.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
+
+    postFixup = (old.postFixup or "") + ''
+      wrapProgram $out/bin/arduino-ide \
+        --add-flags "--ozone-platform=x11"
+    '';
+  });
+in
+{
+  environment.systemPackages = [ arduinoIdeX11 ];
+}

modules/applications/atuin/home.nix

@@ -0,0 +1,9 @@
+{
+  programs.atuin = {
+    enable = true;
+
+    enableZshIntegration = true;
+    enableBashIntegration = true;
+    enableFishIntegration = true;
+  };
+}

modules/applications/baobab/home.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.baobab ];
+}

modules/applications/celluloid/home/nixos.nix

@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.celluloid ];
+
+  xdg.mimeApps = {
+    enable = true;
+    defaultApplicationPackages = [ pkgs.celluloid ];
+    defaultApplications = builtins.listToAttrs (
+      map
+        (mime: {
+          name = mime;
+          value = [ "io.github.celluloid_player.Celluloid.desktop" ];
+        })
+        [
+          "video/3gpp"
+          "video/3gpp2"
+          "video/mp2t"
+          "video/mp4"
+          "video/mpeg"
+          "video/ogg"
+          "video/quicktime"
+          "video/webm"
+          "video/x-flv"
+          "video/x-m4v"
+          "video/x-matroska"
+          "video/x-msvideo"
+          "video/x-ms-wmv"
+        ]
+    );
+  };
+}

modules/applications/chrome/darwin.nix

@@ -0,0 +1,6 @@
+{
+  homebrew = {
+    enable = true;
+    casks = [ "google-chrome" ];
+  };
+}

modules/applications/chrome/home/nixos.nix

@@ -0,0 +1,19 @@
+_: {
+  programs.google-chrome = {
+    enable = true;
+
+    commandLineArgs = [
+      "--enable-features=MiddleClickAutoscroll"
+    ];
+  };
+
+  xdg.mimeApps = {
+    enable = true;
+
+    defaultApplications = {
+      "text/html" = "google-chrome.desktop";
+      "x-scheme-handler/http" = "google-chrome.desktop";
+      "x-scheme-handler/https" = "google-chrome.desktop";
+    };
+  };
+}

modules/applications/codex-desktop/darwin.nix

@@ -0,0 +1,8 @@
+{
+  # The former Codex app cask is deprecated in favor of ChatGPT, whose desktop
+  # application includes the current Codex experience on macOS.
+  homebrew = {
+    enable = true;
+    casks = [ "chatgpt" ];
+  };
+}

modules/applications/codex-desktop/meta.nix

@@ -0,0 +1,10 @@
+{ inputs, ... }:
+{
+  description = "Codex Desktop for Linux";
+
+  includes = [ "applications.codex" ];
+
+  imports.nixos = [
+    inputs.codex-desktop-linux.nixosModules.default
+  ];
+}

modules/applications/codex-desktop/nixos.nix

@@ -0,0 +1,18 @@
+{
+  inputs,
+  pkgs,
+  ...
+}:
+{
+  programs.codexDesktopLinux = {
+    enable = true;
+    cliPackage = inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex;
+    remoteControl.enable = true;
+    remoteMobileControl.enable = true;
+    computerUseUi.enable = false;
+    linuxFeatures = [
+      "appshots"
+      "open-target-discovery"
+    ];
+  };
+}

modules/applications/codex/home.nix

@@ -0,0 +1,6 @@
+{ inputs, pkgs, ... }:
+{
+  home.packages = [
+    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.codex
+  ];
+}

modules/applications/direnv/home.nix

@@ -0,0 +1,10 @@
+{
+  programs.direnv = {
+    enable = true;
+    nix-direnv.enable = true;
+
+    config.global = {
+      warn_timeout = "10s";
+    };
+  };
+}

modules/applications/discord/home.nix

@@ -0,0 +1,95 @@
+_: {
+  programs.vesktop = {
+    enable = true;
+
+    settings = {
+      discordBranch = "stable";
+
+      hardwareAcceleration = true;
+      hardwareVideoAcceleration = true;
+
+      tray = true;
+      minimizeToTray = true;
+
+      # Discord Rich Presence
+      arRPC = true;
+
+      openLinksWithElectron = false;
+
+      spellCheckLanguages = [
+        "ja-JP"
+        "en-US"
+      ];
+    };
+
+    vencord = {
+      useSystem = false;
+
+      settings = {
+        autoUpdate = true;
+        autoUpdateNotification = false;
+
+        useQuickCss = false;
+
+        cloud.settingsSync = false;
+
+        notifications = {
+          position = "bottom-right";
+          useNative = "not-focused";
+          timeout = 5000;
+          logLimit = 50;
+        };
+
+        plugins = {
+          # プライバシー・安全性
+          NoTrack.enabled = true;
+          ClearURLs.enabled = true;
+
+          # 設定・セッション
+          BetterSettings.enabled = true;
+          BetterSessions.enabled = true;
+
+          # 画像・添付ファイル
+          FixImagesQuality.enabled = true;
+          ImageZoom.enabled = true;
+          ViewIcons.enabled = true;
+          CopyFileContents.enabled = true;
+
+          # メッセージ操作
+          QuickReply.enabled = true;
+          SendTimestamps.enabled = true;
+          FullSearchContext.enabled = true;
+          MessageLinkEmbeds.enabled = true;
+          Unindent.enabled = true;
+          ValidReply.enabled = true;
+
+          # 通知・誤操作対策
+          ReadAllNotificationsButton.enabled = true;
+          NoReplyMention.enabled = true;
+          NotificationVolume.enabled = true;
+
+          # UI・パフォーマンス
+          NoTypingAnimation.enabled = true;
+          FavoriteEmojiFirst.enabled = true;
+          KeepCurrentChannel.enabled = true;
+
+          # サーバー・権限確認
+          PermissionsViewer.enabled = true;
+          MemberCount.enabled = true;
+
+          # ボイス・アクティビティ
+          CallTimer.enabled = true;
+          GameActivityToggle.enabled = true;
+
+          # Vesktop向け
+          WebKeybinds.enabled = true;
+          WebScreenShareFixes.enabled = true;
+
+          # Message history
+          MessageLogger.enabled = true;
+          ShowHiddenChannels.enabled = true;
+        };
+      };
+    };
+  };
+}

modules/applications/docker/darwin.nix

@@ -0,0 +1,6 @@
+{
+  homebrew = {
+    enable = true;
+    casks = [ "orbstack" ];
+  };
+}

modules/applications/docker/home/common.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  home.packages = [
+    pkgs.docker-client
+  ];
+}

modules/applications/docker/home/nixos.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  home.packages = [
+    pkgs.oxker
+  ];
+}

modules/applications/docker/meta.nix

@@ -0,0 +1,5 @@
+{
+  description = "Docker command-line client and NixOS daemon";
+
+  includes = [ "services.docker" ];
+}

modules/applications/drawio/home.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.drawio ];
+}

modules/applications/easyeffects/home/nixos.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.easyeffects ];
+}

modules/applications/fcitx5/config

@@ -1,69 +0,0 @@
-[Hotkey]
-# トリガーキーを押すたびに切り替える
-EnumerateWithTriggerKeys=False
-# 一時的に第1入力メソッドに切り替える
-AltTriggerKeys=
-# 切り替え時は第1入力メソッドをスキップする
-EnumerateSkipFirst=False
-# Time limit in milliseconds for triggering modifier key shortcuts
-ModifierOnlyKeyTimeout=250
-
-[Hotkey/TriggerKeys]
-1=Zenkaku_Hankaku
-
-[Hotkey/ActivateKeys]
-0=Henkan
-
-[Hotkey/DeactivateKeys]
-0=Muhenkan
-
-[Hotkey/PrevPage]
-0=Up
-
-[Hotkey/NextPage]
-0=Down
-
-[Hotkey/PrevCandidate]
-0=Shift+Tab
-
-[Hotkey/NextCandidate]
-0=Tab
-
-[Hotkey/TogglePreedit]
-0=Control+Alt+P
-
-[Behavior]
-# デフォルトで有効にする
-ActiveByDefault=False
-# フォーカス時に状態をリセット
-resetStateWhenFocusIn=No
-# 入力状態を共有する
-ShareInputState=No
-# アプリケーションにプリエディットを表示する
-PreeditEnabledByDefault=True
-# 入力メソッドを切り替える際に入力メソッドの情報を表示する
-ShowInputMethodInformation=True
-# フォーカスを変更する際に入力メソッドの情報を表示する
-showInputMethodInformationWhenFocusIn=False
-# 入力メソッドの情報をコンパクトに表示する
-CompactInputMethodInformation=True
-# 第1入力メソッドの情報を表示する
-ShowFirstInputMethodInformation=True
-# デフォルトのページサイズ
-DefaultPageSize=5
-# XKB オプションより優先する
-OverrideXkbOption=False
-# カスタム XKB オプション
-CustomXkbOption=
-# Force Enabled Addons
-EnabledAddons=
-# Force Disabled Addons
-DisabledAddons=
-# Preload input method to be used by default
-PreloadInputMethod=True
-# パスワード欄に入力メソッドを許可する
-AllowInputMethodForPassword=False
-# パスワード入力時にプリエディットテキストを表示する
-ShowPreeditForPassword=False
-# ユーザーデータを保存する間隔（分）
-AutoSavePeriod=30

modules/applications/fcitx5/home/nixos.nix

@@ -0,0 +1,82 @@
+{ inputs, pkgs, ... }:
+{
+
+  services.hazkey = {
+    enable = true;
+    server.package =
+      inputs.nix-hazkey.packages.${pkgs.stdenv.hostPlatform.system}.hazkey-server.override
+        { enableVulkan = true; };
+  };
+
+  i18n.inputMethod = {
+    enable = true;
+    type = "fcitx5";
+
+    fcitx5 = {
+      waylandFrontend = true;
+
+      addons = with pkgs; [
+        fcitx5-gtk
+        kdePackages.fcitx5-qt
+        qt6Packages.fcitx5-configtool
+      ];
+
+      settings = {
+        inputMethod = {
+          GroupOrder."0" = "Default";
+
+          "Groups/0" = {
+            Name = "Default";
+            "Default Layout" = "jp";
+            DefaultIM = "hazkey";
+          };
+
+          "Groups/0/Items/0" = {
+            Name = "keyboard-jp";
+          };
+
+          "Groups/0/Items/1" = {
+            Name = "hazkey";
+          };
+        };
+
+        globalOptions = {
+          Hotkey = {
+            EnumerateWithTriggerKeys = false;
+            EnumerateSkipFirst = false;
+            ModifierOnlyKeyTimeout = 250;
+          };
+
+          "Hotkey/TriggerKeys"."1" = "Zenkaku_Hankaku";
+          "Hotkey/ActivateKeys"."0" = "Henkan";
+          "Hotkey/DeactivateKeys"."0" = "Muhenkan";
+          "Hotkey/PrevPage"."0" = "Up";
+          "Hotkey/NextPage"."0" = "Down";
+          "Hotkey/PrevCandidate"."0" = "Shift+Tab";
+          "Hotkey/NextCandidate"."0" = "Tab";
+          "Hotkey/TogglePreedit"."0" = "Control+Alt+P";
+
+          Behavior = {
+            ActiveByDefault = false;
+            resetStateWhenFocusIn = "No";
+            ShareInputState = "No";
+            PreeditEnabledByDefault = true;
+            ShowInputMethodInformation = true;
+            showInputMethodInformationWhenFocusIn = false;
+            CompactInputMethodInformation = true;
+            ShowFirstInputMethodInformation = true;
+            DefaultPageSize = 5;
+            OverrideXkbOption = false;
+            CustomXkbOption = "";
+            EnabledAddons = "";
+            DisabledAddons = "";
+            PreloadInputMethod = true;
+            AllowInputMethodForPassword = false;
+            ShowPreeditForPassword = false;
+            AutoSavePeriod = 30;
+          };
+        };
+      };
+    };
+  };
+}

modules/applications/fcitx5/meta.nix

@@ -0,0 +1,6 @@
+{ inputs, ... }:
+{
+  description = "Fcitx 5 input method framework with Hazkey Japanese input";
+
+  imports.home = [ inputs.nix-hazkey.homeModules.hazkey ];
+}

modules/applications/finder/darwin.nix

@@ -0,0 +1,15 @@
+{
+  system.defaults.finder = {
+    AppleShowAllExtensions = true;
+    AppleShowAllFiles = false;
+    ShowPathbar = true;
+    ShowStatusBar = true;
+    _FXShowPosixPathInTitle = true;
+    _FXSortFoldersFirst = true;
+    FXDefaultSearchScope = "SCcf";
+    FXPreferredViewStyle = "Nlsv";
+    NewWindowTarget = "Home";
+    FXEnableExtensionChangeWarning = true;
+    FXRemoveOldTrashItems = true;
+  };
+}

modules/applications/gamemode/nixos.nix

@@ -0,0 +1,17 @@
+{
+  programs.gamemode = {
+    enable = true;
+    enableRenice = true;
+
+    settings = {
+      general = {
+        softrealtime = "auto";
+        renice = 10;
+      };
+      custom = {
+        start = "notify-send -a 'Gamemode' 'Optimizations activated'";
+        end = "notify-send -a 'Gamemode' 'Optimizations deactivated'";
+      };
+    };
+  };
+}

modules/applications/gamescope/nixos.nix

@@ -0,0 +1,6 @@
+{
+  programs.gamescope = {
+    enable = true;
+    capSysNice = true;
+  };
+}

modules/applications/ghostty/darwin.nix

@@ -0,0 +1,6 @@
+{
+  homebrew = {
+    enable = true;
+    casks = [ "ghostty" ];
+  };
+}

modules/applications/ghostty/home/common.nix

@@ -0,0 +1,39 @@
+_: {
+  programs.ghostty = {
+    enable = true;
+
+    settings = {
+      theme = "dracula";
+      background-blur-radius = 20;
+      background-opacity = 0.9;
+      background-opacity-cells = true;
+      font-family = "BlexMono Nerd Font Mono";
+      mouse-hide-while-typing = true;
+      window-decoration = "auto";
+
+      keybind = [
+        "performable:ctrl+shift+c=copy_to_clipboard"
+        "ctrl+shift+v=paste_from_clipboard"
+        "ctrl+shift+t=new_tab"
+        "ctrl+alt+left_bracket=previous_tab"
+        "ctrl+alt+right_bracket=next_tab"
+        "alt+q=close_window"
+        "global:alt+space=toggle_quick_terminal"
+        "global:alt+t=new_window"
+        "ctrl+shift+semicolon=increase_font_size:1"
+        "ctrl+shift+minus=decrease_font_size:1"
+      ];
+
+      quick-terminal-screen = "mouse";
+      quick-terminal-position = "top";
+      quick-terminal-size = "98%,100%";
+      quick-terminal-autohide = false;
+      quick-terminal-keyboard-interactivity = "on-demand";
+      gtk-quick-terminal-layer = "top";
+      quit-after-last-window-closed = false;
+      shell-integration-features = "no-ssh-env,no-ssh-terminfo";
+    };
+  };
+
+  xdg.configFile."ghostty/themes/dracula".source = ./dracula.theme;
+}

modules/applications/ghostty/home/darwin.nix

@@ -0,0 +1,17 @@
+_: {
+  # Global Ghostty keybindings are handled by the running app. Start it hidden
+  # at login so Option+T and Option+Space work before opening a terminal.
+  launchd.agents.ghostty-global-keybindings = {
+    enable = true;
+    config = {
+      ProgramArguments = [
+        "/usr/bin/open"
+        "-gja"
+        "Ghostty"
+      ];
+      RunAtLoad = true;
+    };
+  };
+
+  programs.ghostty.package = null;
+}

modules/applications/ghostty/home/dracula.theme

@@ -0,0 +1,44 @@
+# MIT License
+#
+# Copyright (c) 2023 Dracula Theme
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+palette = 0=#21222c
+palette = 1=#ff5555
+palette = 2=#50fa7b
+palette = 3=#f1fa8c
+palette = 4=#bd93f9
+palette = 5=#ff79c6
+palette = 6=#8be9fd
+palette = 7=#f8f8f2
+palette = 8=#6272a4
+palette = 9=#ff6e6e
+palette = 10=#69ff94
+palette = 11=#ffffa5
+palette = 12=#d6acff
+palette = 13=#ff92df
+palette = 14=#a4ffff
+palette = 15=#ffffff
+background = #282a36
+foreground = #f8f8f2
+cursor-color = #f8f8f2
+cursor-text = #282a36
+selection-foreground = #f8f8f2
+selection-background = #44475a

modules/applications/ghostty/home/nixos.nix

@@ -0,0 +1,6 @@
+{ inputs, system, ... }: {
+  programs.ghostty = {
+    systemd.enable = true;
+    package = inputs.ghostty.packages.${system}.default;
+  };
+}

modules/applications/git/home.nix

@@ -0,0 +1,78 @@
+{ pkgs, ... }:
+let
+  signingKeyPath = ".ssh/1password-git-signing.pub";
+  signingKeyFile = "~/${signingKeyPath}";
+
+  gitSshSign = pkgs.writeShellScript "git-ssh-sign" ''
+    one_password_sock="$HOME/.1password/agent.sock"
+
+    if { [ -n "''${SSH_CONNECTION:-}" ] || [ -n "''${SSH_CLIENT:-}" ]; } \
+      && [ -n "''${SSH_AUTH_SOCK:-}" ] \
+      && [ -S "$SSH_AUTH_SOCK" ]; then
+      exec ${pkgs.openssh}/bin/ssh-keygen "$@"
+    fi
+
+    if [ -S "$one_password_sock" ]; then
+      export SSH_AUTH_SOCK="$one_password_sock"
+      exec ${pkgs.openssh}/bin/ssh-keygen "$@"
+    fi
+
+    if [ -n "''${SSH_AUTH_SOCK:-}" ] && [ -S "$SSH_AUTH_SOCK" ]; then
+      exec ${pkgs.openssh}/bin/ssh-keygen "$@"
+    fi
+
+    echo "git ssh signing failed: no forwarded SSH agent or 1Password agent socket found" >&2
+    echo "expected: forwarded SSH_AUTH_SOCK or $one_password_sock" >&2
+    exit 1
+  '';
+in
+{
+  home.packages = [ pkgs.gh ];
+
+  home.file.${signingKeyPath}.text = ''
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing
+  '';
+
+  programs.git = {
+    enable = true;
+
+    ignores = [
+      ".direnv/"
+      ".envrc"
+      "!.envrc.example"
+    ];
+
+    signing = {
+      key = signingKeyFile;
+      format = "ssh";
+      signByDefault = true;
+    };
+
+    settings = {
+      user = {
+        name = "moons";
+        email = "moons@moons14.com";
+      };
+
+      push.default = "simple";
+      credential.helper = "cache --timeout=7200";
+      init.defaultBranch = "main";
+      log.decorate = "full";
+      log.date = "iso";
+      merge.conflictStyle = "diff3";
+
+      gpg.ssh.program = "${gitSshSign}";
+
+      alias = {
+        br = "branch --sort=-committerdate";
+        co = "checkout";
+        df = "diff";
+        com = "commit -a";
+        gs = "stash";
+        gp = "pull";
+        lg = "log --graph --pretty=format:'%Cred%h%Creset - %C(yellow)%d%Creset %s %C(green)(%cr)%C(bold blue) <%an>%Creset' --abbrev-commit";
+        st = "status";
+      };
+    };
+  };
+}

modules/applications/gnome-disk-utility/home/nixos.nix

@@ -0,0 +1,4 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.gnome-disk-utility ];
+}

modules/applications/gnome-text-editor/home/nixos.nix

@@ -0,0 +1,24 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.gnome-text-editor ];
+
+  dconf.settings."org/gnome/TextEditor" = {
+    style-variant = "follow";
+    wrap-text = true;
+    spellcheck = true;
+    restore-session = true;
+    show-line-numbers = false;
+    show-right-margin = false;
+    show-map = false;
+    highlight-current-line = false;
+    auto-indent = false;
+    discover-settings = false;
+    enable-snippets = false;
+    keybindings = "default";
+  };
+
+  xdg.mimeApps = {
+    enable = true;
+    defaultApplicationPackages = [ pkgs.gnome-text-editor ];
+  };
+}

modules/applications/gnupg/home.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+{
+  home.packages = [ pkgs.gnupg ];
+
+  services.gpg-agent = {
+    enable = false;
+    enableSshSupport = false;
+  };
+}

modules/applications/gnupg/nixos.nix

@@ -0,0 +1,6 @@
+{
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = false;
+  };
+}

modules/applications/grok/home.nix

@@ -0,0 +1,6 @@
+{ inputs, pkgs, ... }:
+{
+  home.packages = [
+    inputs.llm-agents.packages.${pkgs.stdenv.hostPlatform.system}.grok
+  ];
+}

modules/applications/gtk/home.nix

@@ -0,0 +1,22 @@
+{ pkgs, ... }:
+{
+  gtk = {
+    enable = true;
+    theme = {
+      name = "Dracula";
+      package = pkgs.dracula-theme;
+    };
+    cursorTheme = {
+      package = pkgs.adwaita-icon-theme;
+      name = "Adwaita";
+    };
+    iconTheme = {
+      package = pkgs.papirus-icon-theme;
+      name = "Papirus-Dark";
+    };
+  };
+
+  dconf.settings."org/gnome/desktop/wm/preferences" = {
+    button-layout = ":minimize,maximize,close";
+  };
+}

modules/applications/gtk/nixos.nix

@@ -0,0 +1,6 @@
+{
+  programs.dconf.enable = true;
+  programs.seahorse.enable = true;
+  services.gnome.gnome-keyring.enable = true;
+  security.pam.services.ly.enableGnomeKeyring = true;
+}

modules/applications/handy/darwin.nix

@@ -0,0 +1,8 @@
+{
+  homebrew.casks = [ "handy" ];
+
+  launchd.agents.handy = {
+    command = "/usr/bin/open -gja Handy --args --start-hidden";
+    serviceConfig.RunAtLoad = true;
+  };
+}

modules/applications/handy/home/nixos.nix

@@ -0,0 +1,74 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  handy = inputs.handy.packages.${pkgs.stdenv.hostPlatform.system}.handy;
+  settingsFile = "${config.xdg.configHome}/com.pais.handy/settings_store.json";
+in
+{
+  home.packages = [
+    handy
+    pkgs.wtype
+  ];
+
+  # Handy has no disabled-shortcut setting. Empty bindings are rejected before
+  # registration, leaving niri and labwc as the sole owners of Ctrl+Space.
+  home.activation.disableHandyGlobalShortcuts = {
+    after = [ "writeBoundary" ];
+    before = [ ];
+    data = ''
+      settingsFile=${lib.escapeShellArg settingsFile}
+      mkdir -p "$(dirname "$settingsFile")"
+
+      if [ -f "$settingsFile" ]; then
+        ${lib.getExe pkgs.jq} \
+          '.settings.bindings.transcribe.current_binding = ""
+          | .settings.bindings.transcribe_with_post_process.current_binding = ""' \
+          "$settingsFile" > "$settingsFile.tmp"
+      else
+        ${lib.getExe pkgs.jq} -n '
+          {
+            settings: {
+              bindings: {
+                transcribe: {
+                  id: "transcribe",
+                  name: "Transcribe",
+                  description: "Converts your speech into text.",
+                  default_binding: "ctrl+space",
+                  current_binding: ""
+                },
+                transcribe_with_post_process: {
+                  id: "transcribe_with_post_process",
+                  name: "Transcribe with Post-Processing",
+                  description: "Converts your speech into text and applies AI post-processing.",
+                  default_binding: "ctrl+shift+space",
+                  current_binding: ""
+                }
+              }
+            }
+          }
+        ' > "$settingsFile.tmp"
+      fi
+
+      mv "$settingsFile.tmp" "$settingsFile"
+    '';
+  };
+
+  systemd.user.services.handy = {
+    Unit = {
+      Description = "Handy speech-to-text";
+      After = [ "graphical-session.target" ];
+      PartOf = [ "graphical-session.target" ];
+    };
+    Service = {
+      ExecStart = "${lib.getExe handy} --start-hidden";
+      Restart = "on-failure";
+      RestartSec = 5;
+    };
+    Install.WantedBy = [ "graphical-session.target" ];
+  };
+}

modules/applications/handy/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "Handy offline speech-to-text";
+}

modules/applications/java/home.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  programs.java = {
+    enable = true;
+    package = pkgs.jdk25;
+  };
+
+  home.packages = with pkgs; [
+    maven
+    gradle
+  ];
+}

modules/applications/kde/darwin.nix

@@ -0,0 +1,6 @@
+{
+  homebrew = {
+    enable = true;
+    casks = [ "kde-connect" ];
+  };
+}

modules/applications/kde/nixos.nix

@@ -0,0 +1,3 @@
+{
+  programs.kdeconnect.enable = true;
+}

modules/applications/labwc/home.nix

@@ -0,0 +1,228 @@
+{ lib, pkgs, ... }:
+let
+  systemctl = lib.getExe' pkgs.systemd "systemctl";
+
+  keybind = key: actionAttrs: {
+    "@key" = key;
+    action = actionAttrs;
+  };
+
+  action =
+    key: name:
+    keybind key {
+      "@name" = name;
+    };
+
+  execute =
+    key: command:
+    keybind key {
+      "@name" = "Execute";
+      "@command" = command;
+    };
+
+  snapToEdge =
+    key: direction:
+    keybind key {
+      "@name" = "SnapToEdge";
+      "@direction" = direction;
+      "@combine" = "yes";
+    };
+
+  confirmAction = key: message: name: {
+    "@key" = key;
+    action = {
+      "@name" = "If";
+      prompt."@message" = message;
+      "then".action."@name" = name;
+    };
+  };
+
+  menuExecute = label: command: {
+    inherit label;
+    action = {
+      name = "Execute";
+      inherit command;
+    };
+  };
+
+  showMenu = button: menu: {
+    "@button" = button;
+    "@action" = "Press";
+    action = {
+      "@name" = "ShowMenu";
+      "@menu" = menu;
+    };
+  };
+
+  menuAction = label: name: {
+    inherit label;
+    action.name = name;
+  };
+in
+{
+  wayland.windowManager.labwc = {
+    enable = true;
+    # NixOS owns the package so Home Manager only generates the user config.
+    package = null;
+
+    systemd = {
+      enable = true;
+
+      variables = [
+        "DISPLAY"
+        "WAYLAND_DISPLAY"
+        "XDG_CURRENT_DESKTOP"
+        "XDG_SESSION_TYPE"
+      ];
+    };
+
+    menu = [
+      {
+        menuId = "root-menu";
+        items = [
+          (menuExecute "ターミナル" "ghostty")
+          (menuExecute "Vicinae" "vicinae toggle")
+          (menuExecute "ファイル" "nautilus --new-window")
+
+          { separator = true; }
+
+          (menuAction "Reconfigure" "Reconfigure")
+          (menuAction "Exit" "Exit")
+        ];
+      }
+    ];
+
+    rc = {
+
+      keyboard = {
+        default = true;
+        numlock = "on";
+        keybind = [
+          # labwc window management
+          (action "W-q" "Close")
+          (action "W-f" "ToggleMaximize")
+          (action "W-c" "Iconify")
+          (execute "W-Tab" "window-overview")
+          (execute "W-S-Tab" "window-overview --reverse")
+          (action "W-Up" "Lower")
+          (action "W-Down" "Raise")
+          (action "W-Left" "NextWindow")
+          (action "W-Right" "PreviousWindow")
+          (snapToEdge "W-C-Left" "left")
+          (snapToEdge "W-C-Right" "right")
+          (snapToEdge "W-C-Up" "up")
+          (snapToEdge "W-C-Down" "down")
+          (confirmAction "W-S-e" "Exit labwc?" "Exit")
+          (execute "Print" "screenshot region")
+          (execute "C-Print" "screenshot output")
+          (execute "A-Print" "screenshot all")
+
+          # spawn applications (sync with niri modules/applications/niri/home.nix)
+          (execute "W-t" "ghostty")
+          (execute "W-d" "vicinae toggle")
+          (execute "W-s" "noctalia msg panel-toggle launcher")
+          (execute "W-e" "nautilus --new-window")
+          (execute "W-l" "loginctl lock-session")
+          (execute "W-v" "vicinae vicinae://launch/clipboard/history?toggle=true")
+          (execute "W-j" "nani-translate-primary")
+          (execute "W-S-j" "nani-translate-ocr")
+          (execute "W-C-j" "${lib.getExe' pkgs.xdg-utils "xdg-open"} naniapp://translate")
+          (execute "W-space" "ghostty +toggle-quick-terminal")
+          (execute "W-p" "wdisplays")
+          (execute "W-z" "wl-find-cursor -c 0xCCFF453A -s 160 -d 1200")
+          (execute "C-space" "handy --toggle-transcription")
+
+          # Function keys (sync with niri modules/applications/niri/home.nix)
+          (execute "XF86AudioRaiseVolume" "noctalia msg volume-up")
+          (execute "XF86AudioLowerVolume" "noctalia msg volume-down")
+          (execute "XF86AudioMute" "noctalia msg volume-mute")
+          (execute "XF86AudioMicMute" "noctalia msg mic-mute")
+          (execute "XF86MonBrightnessUp" "noctalia msg brightness-up")
+          (execute "XF86MonBrightnessDown" "noctalia msg brightness-down")
+          (execute "XF86Favorites" "noctalia msg caffeine-toggle")
+          (execute "XF86AudioPlay" "playerctl play-pause")
+          (execute "XF86AudioPause" "playerctl play-pause")
+          (execute "XF86AudioStop" "playerctl stop")
+          (execute "XF86AudioPrev" "playerctl previous")
+          (execute "XF86AudioNext" "playerctl next")
+          (execute "XF86Display" "wdisplays")
+        ];
+      };
+
+      core = {
+        decoration = "client";
+        gap = 10;
+        autoEnableOutputs = "yes";
+        reuseOutputMode = "yes";
+      };
+
+      theme = {
+        name = "Dracula";
+        cornerRadius = 8;
+        dropShadows = "yes";
+        dropShadowsOnTiled = "yes";
+      };
+
+      windowSwitcher = {
+        "@preview" = "yes";
+        "@outlines" = "yes";
+        osd = {
+          "@style" = "thumbnail";
+        };
+      };
+
+      focus = {
+        followMouse = "yes";
+        followMouseRequiresMovement = "yes";
+        raiseOnFocus = "no";
+      };
+
+      desktops = {
+        "@number" = 1;
+        "@popupTime" = 500;
+        "@prefix" = "Workspace";
+      };
+
+      mouse = {
+        default = true;
+
+        context = {
+          "@name" = "Desktop";
+
+          mousebind = [
+            (showMenu "Right" "root-menu")
+            (showMenu "Middle" "client-list-combined-menu")
+          ];
+        };
+      };
+
+      libinput.device = [
+        {
+          "@category" = "touchpad";
+          naturalScroll = "yes";
+          tap = "yes";
+          tapAndDrag = "yes";
+          dragLock = "yes";
+          clickMethod = "clickfinger";
+          scrollMethod = "twoFinger";
+          scrollFactor = "4.0";
+          disableWhileTyping = "yes";
+        }
+        {
+          "@category" = "non-touch";
+          pointerSpeed = "-0.1";
+          accelProfile = "flat";
+        }
+      ];
+    };
+
+    environment = [
+      "XKB_DEFAULT_LAYOUT=jp"
+      "XKB_DEFAULT_OPTIONS=ctrl:nocaps"
+    ];
+  };
+
+  xdg.configFile."labwc/shutdown".text = lib.mkAfter ''
+    ${systemctl} --user stop graphical-session.target
+  '';
+}

modules/applications/labwc/meta.nix

@@ -0,0 +1,9 @@
+{
+  description = "labwc Wayland stacking compositor";
+
+  includes = [
+    "systems.wayland"
+    "applications.screenshot"
+    "applications.wl-find-cursor"
+  ];
+}

modules/applications/labwc/nixos.nix

@@ -0,0 +1,62 @@
+{
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  unstable = inputs.nixpkgs-unstable.legacyPackages.${pkgs.stdenv.hostPlatform.system};
+  labwc = unstable.labwc.overrideAttrs (oldAttrs: {
+    patches = (oldAttrs.patches or [ ]) ++ [
+      ./patches/remove-ext-workspace-output-on-destroy.patch
+    ];
+  });
+in
+{
+  programs.labwc = {
+    enable = true;
+    package = labwc;
+  };
+
+  xdg.portal.config.labwc.default = [
+    "wlr"
+    "gtk"
+  ];
+
+  # xdg-desktop-portal-wlr implements screencasting for wlroots compositors.
+  # Keep it with Labwc: Niri uses xdg-desktop-portal-gnome instead.
+  xdg.portal.wlr = {
+    enable = true;
+    settings.screencast = {
+      chooser_type = "dmenu";
+      chooser_cmd = "${pkgs.fuzzel}/bin/fuzzel --dmenu";
+    };
+  };
+
+  # NixOS decides whether a graphical session manages graphical-session.target
+  # itself by checking XDG_CURRENT_DESKTOP against a hard-coded list. Labwc is
+  # currently absent from that list, so NixOS starts
+  # nixos-fake-graphical-session.target before Labwc is ready.
+  #
+  # This configuration uses Home Manager's Labwc systemd integration, which
+  # imports the Wayland environment and starts labwc-session.target correctly.
+  # Mark the Labwc session as systemd-aware before the display-manager wrapper
+  # performs its hard-coded check. Otherwise services such as Fcitx5 can start
+  # before WAYLAND_DISPLAY is available.
+  #
+  # Despite the services.xserver namespace, this session wrapper is also used
+  # for Wayland sessions by display managers such as Ly.
+  services.xserver.displayManager.sessionCommands = lib.mkAfter ''
+    case ":''${XDG_CURRENT_DESKTOP:-}:" in
+      *:labwc:*)
+        case ":$XDG_CURRENT_DESKTOP:" in
+          *:X-NIXOS-SYSTEMD-AWARE:*)
+            ;;
+          *)
+            export XDG_CURRENT_DESKTOP="$XDG_CURRENT_DESKTOP:X-NIXOS-SYSTEMD-AWARE"
+            ;;
+        esac
+        ;;
+    esac
+  '';
+}

modules/applications/labwc/patches/remove-ext-workspace-output-on-destroy.patch

@@ -0,0 +1,103 @@
+From: Codex <[email protected]>
+Subject: [PATCH] output: detach destroyed outputs from protocol handles
+
+The DRM backend destroys and recreates outputs when a session is paused and
+resumed. Remove the output from the ext-workspace group and the foreign
+toplevel handles before wlroots finishes it. Both protocols attach bind
+listeners to the output; leaving either listener behind makes
+wlr_output_finish() abort.
+
+---
+ src/foreign-toplevel/foreign.c     | 14 ++++++++++++++
+ src/output.c                        |  6 ++++++
+ include/foreign-toplevel/foreign.h  |  2 ++
+ 3 files changed, 22 insertions(+)
+
+diff --git a/src/output.c b/src/output.c
+index 2eab8ec..6f6e7ef 100644
+--- a/src/output.c
++++ b/src/output.c
+@@ -27,8 +27,9 @@
+ #include "common/macros.h"
+ #include "common/mem.h"
+ #include "common/scene-helpers.h"
+ #include "common/string-helpers.h"
+ #include "config/rcxml.h"
++#include "foreign-toplevel/foreign.h"
+ #include "labwc.h"
+ #include "layers.h"
+ #include "node.h"
+@@ -276,7 +277,15 @@ handle_output_destroy(struct wl_listener *listener, void *data)
+ 	struct output *output = wl_container_of(listener, output, destroy);
+ 	struct seat *seat = &server.seat;
+ 	regions_evacuate_output(output);
+ 	regions_destroy(seat, &output->regions);
++	wlr_ext_workspace_group_handle_v1_output_leave(
++		server.workspaces.ext_group, output->wlr_output);
++
++	struct view *view;
++	wl_list_for_each(view, &server.views, link) {
++		foreign_toplevel_remove_output(view->foreign_toplevel, output->wlr_output);
++	}
++
+ 	if (seat->overlay.active.output == output) {
+ 		overlay_finish(seat);
+ 	}
+@@ -297,7 +305,6 @@ handle_output_destroy(struct wl_listener *listener, void *data)
+ 		output->workspace_osd = NULL;
+ 	}
+ 
+-	struct view *view;
+ 	wl_list_for_each(view, &server.views, link) {
+ 		if (view->output == output) {
+ 			view_on_output_destroy(view);
+diff --git a/include/foreign-toplevel/foreign.h b/include/foreign-toplevel/foreign.h
+index 69a340a..d8ec9b4 100644
+--- a/include/foreign-toplevel/foreign.h
++++ b/include/foreign-toplevel/foreign.h
+@@ -3,11 +3,14 @@
+ #define LABWC_FOREIGN_TOPLEVEL_H
+ 
+ struct view;
++struct wlr_output;
+ struct foreign_toplevel;
+ 
+ struct foreign_toplevel *foreign_toplevel_create(struct view *view);
+ void foreign_toplevel_set_parent(struct foreign_toplevel *toplevel,
+ 	struct foreign_toplevel *parent);
++void foreign_toplevel_remove_output(struct foreign_toplevel *toplevel,
++	struct wlr_output *output);
+ void foreign_toplevel_destroy(struct foreign_toplevel *toplevel);
+ 
+ #endif /* LABWC_FOREIGN_TOPLEVEL_H */
+diff --git a/src/foreign-toplevel/foreign.c b/src/foreign-toplevel/foreign.c
+index 7f1ec8d..0f628a3 100644
+--- a/src/foreign-toplevel/foreign.c
++++ b/src/foreign-toplevel/foreign.c
+@@ -1,4 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ #include "foreign-toplevel/foreign.h"
++#include <wlr/types/wlr_foreign_toplevel_management_v1.h>
+ #include <assert.h>
+ #include "common/mem.h"
+@@ -34,6 +34,18 @@ foreign_toplevel_set_parent(struct foreign_toplevel *toplevel, struct foreign_to
+ 		parent ? &parent->wlr_toplevel : NULL);
+ }
+ 
++void
++foreign_toplevel_remove_output(struct foreign_toplevel *toplevel,
++	struct wlr_output *output)
++{
++	if (!toplevel || !toplevel->wlr_toplevel.handle) {
++		return;
++	}
++
++	wlr_foreign_toplevel_handle_v1_output_leave(
++		toplevel->wlr_toplevel.handle, output);
++}
++
+ void
+ foreign_toplevel_destroy(struct foreign_toplevel *toplevel)
+ {
+-- 
+2.51.0

modules/applications/linux-wallpaperengine/home/controller.sh

@@ -0,0 +1,167 @@
+# shellcheck shell=bash
+
+set -o errexit -o nounset -o pipefail
+
+playlist_file="$1"
+default_id="$2"
+configuration_id="$3"
+shift 3
+
+state_dir="${XDG_RUNTIME_DIR:?}/linux-wallpaperengine"
+state_file="$state_dir/current"
+
+usage() {
+  printf '%s\n' \
+    'Usage: wallpaperengine-wallpaper COMMAND [ID]' \
+    '' \
+    'Commands:' \
+    '  select ID Select a declaratively configured ID for this session' \
+    '  next      Select the next configured ID' \
+    '  previous  Select the previous configured ID' \
+    '  list      List configured IDs and mark the selected one' \
+    '  current   Print the selected ID' \
+    '  restart   Restart the selected wallpaper' \
+    '  stop      Stop Wallpaper Engine for this session'
+}
+
+load_playlist() {
+  mapfile -t wallpaper_ids < <(awk '/^[0-9]+$/ && !seen[$0]++' "$playlist_file")
+  if [ "${#wallpaper_ids[@]}" -eq 0 ]; then
+    echo "wallpaperengine-wallpaper: no wallpaper IDs are configured in settings.nix" >&2
+    exit 1
+  fi
+}
+
+contains_id() {
+  local candidate="$1"
+  local id
+
+  for id in "${wallpaper_ids[@]}"; do
+    [ "$id" = "$candidate" ] && return 0
+  done
+  return 1
+}
+
+current_id() {
+  local saved_configuration=""
+  local saved_id=""
+  local -a saved_state=()
+
+  if [ -s "$state_file" ]; then
+    mapfile -t saved_state <"$state_file"
+    saved_configuration="${saved_state[0]:-}"
+    saved_id="${saved_state[1]:-}"
+  fi
+
+  if [ "$saved_configuration" = "$configuration_id" ] && contains_id "$saved_id"; then
+    printf '%s\n' "$saved_id"
+  else
+    printf '%s\n' "$default_id"
+  fi
+}
+
+select_id() {
+  local id="$1"
+
+  if ! contains_id "$id"; then
+    echo "wallpaperengine-wallpaper: ID is not declared in settings.nix: $id" >&2
+    exit 2
+  fi
+
+  mkdir -p "$state_dir"
+  printf '%s\n%s\n' "$configuration_id" "$id" >"$state_file"
+  systemctl --user restart linux-wallpaperengine.service
+}
+
+cycle() {
+  local step="$1"
+  local current
+  local index=0
+  local next_index
+
+  current=$(current_id)
+  for i in "${!wallpaper_ids[@]}"; do
+    if [ "${wallpaper_ids[$i]}" = "$current" ]; then
+      index="$i"
+      break
+    fi
+  done
+
+  next_index=$(((index + step + ${#wallpaper_ids[@]}) % ${#wallpaper_ids[@]}))
+  select_id "${wallpaper_ids[$next_index]}"
+}
+
+load_playlist
+
+command="${1:-}"
+if [ -z "$command" ]; then
+  usage
+  exit 2
+fi
+shift
+
+case "$command" in
+select)
+  [ "$#" -eq 1 ] || {
+    usage >&2
+    exit 2
+  }
+  select_id "$1"
+  ;;
+next)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  cycle 1
+  ;;
+previous)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  cycle -1
+  ;;
+list)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  current=$(current_id)
+  for id in "${wallpaper_ids[@]}"; do
+    if [ "$id" = "$current" ]; then
+      printf '* %s\n' "$id"
+    else
+      printf '  %s\n' "$id"
+    fi
+  done
+  ;;
+current)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  current_id
+  ;;
+restart)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  systemctl --user restart linux-wallpaperengine.service
+  ;;
+stop)
+  [ "$#" -eq 0 ] || {
+    usage >&2
+    exit 2
+  }
+  systemctl --user stop linux-wallpaperengine.service
+  ;;
+help | -h | --help)
+  usage
+  ;;
+*)
+  usage >&2
+  exit 2
+  ;;
+esac

modules/applications/linux-wallpaperengine/home/launcher.sh

@@ -0,0 +1,57 @@
+# shellcheck shell=bash
+
+set -o errexit -o nounset -o pipefail
+
+playlist_file="$1"
+default_id="$2"
+configuration_id="$3"
+assets_dir="$4"
+workshop_dir="$5"
+scaling="$6"
+shift 6
+
+state_file="${XDG_RUNTIME_DIR:?}/linux-wallpaperengine/current"
+wallpaper_id="$default_id"
+saved_configuration=""
+saved_id=""
+saved_state=()
+outputs=()
+
+if [ -s "$state_file" ]; then
+  mapfile -t saved_state <"$state_file"
+  saved_configuration="${saved_state[0]:-}"
+  saved_id="${saved_state[1]:-}"
+
+  if [ "$saved_configuration" = "$configuration_id" ] &&
+    awk -v id="$saved_id" '$0 == id { found = 1 } END { exit !found }' "$playlist_file"; then
+    wallpaper_id="$saved_id"
+  fi
+fi
+
+wallpaper_path="$workshop_dir/$wallpaper_id"
+if [ ! -d "$wallpaper_path" ]; then
+  echo "linux-wallpaperengine: missing declared wallpaper: $wallpaper_path" >&2
+  exit 1
+fi
+
+if [ ! -d "$assets_dir" ]; then
+  echo "linux-wallpaperengine: missing Wallpaper Engine assets: $assets_dir" >&2
+  exit 1
+fi
+
+mapfile -t outputs < <(wlr-randr --json | jq -r '.[] | select(.enabled == true) | .name')
+if [ "${#outputs[@]}" -eq 0 ]; then
+  echo "linux-wallpaperengine: no enabled Wayland outputs were detected" >&2
+  exit 1
+fi
+
+engine_args=("$@" --assets-dir "$assets_dir")
+for output in "${outputs[@]}"; do
+  engine_args+=(
+    --screen-root "$output"
+    --bg "$wallpaper_path"
+    --scaling "$scaling"
+  )
+done
+
+exec linux-wallpaperengine "${engine_args[@]}"

modules/applications/linux-wallpaperengine/home/nixos.nix

@@ -0,0 +1,229 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  settings = import ../settings.nix;
+  inherit (settings)
+    assetsDirectory
+    fps
+    mute
+    scaling
+    selectedWallpaperId
+    switchIntervalSeconds
+    wallpaperIds
+    workshopDirectory
+    ;
+
+  resolveHomePath =
+    path:
+    if lib.hasPrefix "~/" path then
+      "${config.home.homeDirectory}/${lib.removePrefix "~/" path}"
+    else if lib.hasPrefix "/" path then
+      path
+    else
+      "${config.home.homeDirectory}/${path}";
+
+  hasWallpapers = wallpaperIds != [ ];
+  defaultWallpaperId =
+    if selectedWallpaperId != null then
+      selectedWallpaperId
+    else if hasWallpapers then
+      lib.head wallpaperIds
+    else
+      "";
+  configurationId = builtins.hashString "sha256" (builtins.toJSON settings);
+  resolvedAssetsDirectory = resolveHomePath assetsDirectory;
+  resolvedWorkshopDirectory = resolveHomePath workshopDirectory;
+  playlist = pkgs.writeText "linux-wallpaperengine-playlist" (
+    lib.concatMapStringsSep "\n" (id: id) wallpaperIds + "\n"
+  );
+  engineArguments = lib.optional mute "--silent" ++ [
+    "--fps"
+    (toString fps)
+  ];
+
+  controller = pkgs.writeShellApplication {
+    name = "wallpaperengine-wallpaper";
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.gawk
+      pkgs.systemd
+    ];
+    text = ''
+      exec ${lib.getExe pkgs.bash} ${./controller.sh} \
+        ${lib.escapeShellArg playlist} \
+        ${lib.escapeShellArg defaultWallpaperId} \
+        ${lib.escapeShellArg configurationId} \
+        "$@"
+    '';
+  };
+
+  mkVicinaeScript =
+    {
+      name,
+      title,
+      description,
+      command,
+      mode ? "compact",
+      message ? null,
+    }:
+    {
+      name = "vicinae/scripts/wallpaper-engine/${name}";
+      value = {
+        executable = true;
+        text = ''
+          #!${lib.getExe pkgs.bash}
+          # @vicinae.schemaVersion 1
+          # @vicinae.title ${title}
+          # @vicinae.description ${description}
+          # @vicinae.mode ${mode}
+          # @vicinae.icon 🖼️
+
+          ${lib.getExe controller} ${lib.escapeShellArg command}
+          ${lib.optionalString (message != null) "printf '%s\\n' ${lib.escapeShellArg message}"}
+        '';
+      };
+    };
+
+  launcher = pkgs.writeShellApplication {
+    name = "linux-wallpaperengine-launcher";
+    runtimeInputs = [
+      pkgs.coreutils
+      pkgs.gawk
+      pkgs.jq
+      pkgs.linux-wallpaperengine
+      pkgs.wlr-randr
+    ];
+    text = ''
+      exec ${lib.getExe pkgs.bash} ${./launcher.sh} \
+        ${lib.escapeShellArg playlist} \
+        ${lib.escapeShellArg defaultWallpaperId} \
+        ${lib.escapeShellArg configurationId} \
+        ${lib.escapeShellArg resolvedAssetsDirectory} \
+        ${lib.escapeShellArg resolvedWorkshopDirectory} \
+        ${lib.escapeShellArg scaling} \
+        ${lib.escapeShellArgs engineArguments}
+    '';
+  };
+in
+assert lib.assertMsg (lib.all (
+  id: builtins.isString id && builtins.match "[0-9]+" id != null
+) wallpaperIds) "linux-wallpaperengine: wallpaperIds must contain only numeric strings";
+assert lib.assertMsg (
+  lib.unique wallpaperIds == wallpaperIds
+) "linux-wallpaperengine: wallpaperIds must not contain duplicates";
+assert lib.assertMsg (
+  selectedWallpaperId == null || builtins.elem selectedWallpaperId wallpaperIds
+) "linux-wallpaperengine: selectedWallpaperId must be null or a member of wallpaperIds";
+assert lib.assertMsg (
+  switchIntervalSeconds == null || (builtins.isInt switchIntervalSeconds && switchIntervalSeconds > 0)
+) "linux-wallpaperengine: switchIntervalSeconds must be null or a positive integer";
+assert lib.assertMsg (
+  builtins.isInt fps && fps > 0
+) "linux-wallpaperengine: fps must be a positive integer";
+assert lib.assertMsg (
+  builtins.isString assetsDirectory && assetsDirectory != ""
+) "linux-wallpaperengine: assetsDirectory must be a non-empty string";
+assert lib.assertMsg (
+  builtins.isString workshopDirectory && workshopDirectory != ""
+) "linux-wallpaperengine: workshopDirectory must be a non-empty string";
+assert lib.assertMsg (builtins.elem scaling [
+  "default"
+  "fill"
+  "fit"
+  "stretch"
+]) "linux-wallpaperengine: scaling must be default, fill, fit, or stretch";
+{
+  home.packages = [
+    controller
+    pkgs.linux-wallpaperengine
+  ];
+
+  xdg.dataFile = builtins.listToAttrs [
+    (mkVicinaeScript {
+      name = "reload";
+      title = "Reload Wallpaper Engine";
+      description = "Restart the active Wallpaper Engine background";
+      command = "restart";
+      message = "Wallpaper Engine reloaded";
+    })
+    (mkVicinaeScript {
+      name = "next";
+      title = "Next Wallpaper Engine Wallpaper";
+      description = "Switch to the next configured Wallpaper Engine background";
+      command = "next";
+      message = "Switched to the next Wallpaper Engine wallpaper";
+    })
+    (mkVicinaeScript {
+      name = "previous";
+      title = "Previous Wallpaper Engine Wallpaper";
+      description = "Switch to the previous configured Wallpaper Engine background";
+      command = "previous";
+      message = "Switched to the previous Wallpaper Engine wallpaper";
+    })
+    (mkVicinaeScript {
+      name = "list";
+      title = "List Wallpaper Engine Wallpapers";
+      description = "Show the configured Wallpaper Engine backgrounds";
+      command = "list";
+      mode = "fullOutput";
+    })
+    (mkVicinaeScript {
+      name = "current";
+      title = "Current Wallpaper Engine Wallpaper";
+      description = "Show the active Wallpaper Engine background";
+      command = "current";
+    })
+    (mkVicinaeScript {
+      name = "stop";
+      title = "Stop Wallpaper Engine";
+      description = "Stop Wallpaper Engine for this session";
+      command = "stop";
+      message = "Wallpaper Engine stopped";
+    })
+  ];
+
+  systemd.user.services = lib.optionalAttrs hasWallpapers {
+    linux-wallpaperengine = {
+      Unit = {
+        Description = "Linux Wallpaper Engine";
+        After = [ "graphical-session.target" ];
+        PartOf = [ "graphical-session.target" ];
+      };
+      Service = {
+        ExecStart = lib.getExe launcher;
+        Restart = "on-abnormal";
+      };
+      Install.WantedBy = [ "graphical-session.target" ];
+    };
+
+    linux-wallpaperengine-switch = {
+      Unit.Description = "Switch Linux Wallpaper Engine wallpaper";
+      Service = {
+        Type = "oneshot";
+        ExecStart = "${lib.getExe controller} next";
+      };
+    };
+  };
+
+  systemd.user.timers =
+    lib.optionalAttrs
+      (hasWallpapers && builtins.length wallpaperIds > 1 && switchIntervalSeconds != null)
+      {
+        linux-wallpaperengine-switch = {
+          Unit = {
+            Description = "Periodically switch Linux Wallpaper Engine wallpaper";
+            PartOf = [ "graphical-session.target" ];
+          };
+          Timer = {
+            OnActiveSec = "${toString switchIntervalSeconds}s";
+            OnUnitActiveSec = "${toString switchIntervalSeconds}s";
+            Unit = "linux-wallpaperengine-switch.service";
+          };
+          Install.WantedBy = [ "graphical-session.target" ];
+        };
+      };
+}

modules/applications/linux-wallpaperengine/meta.nix

@@ -0,0 +1,3 @@
+{
+  description = "Wallpaper Engine backgrounds for Linux";
+}