,

9 files changed, 52 insertions, 16 deletions

diff --git a/nixos/modules/system/audio/default.nix b/nixos/modules/system/audio/default.nix
index 140b08c..66ab087 100644
--- a/nixos/modules/system/audio/default.nix
+++ b/nixos/modules/system/audio/default.nix
@@ -1,7 +1,11 @@
 { pkgs, ... }:
 
 {
+  # Real-time scheduling grants for the audio stack.
   security.rtkit.enable = true;
+
+  # PipeWire is the desktop audio server; the PulseAudio shim keeps old
+  # clients (e.g. MPD's "pulse" output) working without a real PulseAudio.
   services.pipewire = {
     enable = true;
     alsa.enable = true;
diff --git a/nixos/modules/system/boot/default.nix b/nixos/modules/system/boot/default.nix
index df64426..54cb1e6 100644
--- a/nixos/modules/system/boot/default.nix
+++ b/nixos/modules/system/boot/default.nix
@@ -1,15 +1,15 @@
 { pkgs, ... }:
 
 {
+  # systemd-boot on UEFI
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  # EDID firmware loading is kept here because it's a kernel-level boot concern.
-  # Commented kernel params from the original config are preserved.
-  # boot.kernelParams = [
-  #   "drm.edid_firmware=DP-1:edid/mi_edid.bin"
-  #   "video=DP-1:2560x1440@180"
-  # ];
+  # EDID firmware (monitor identity) is exposed to the kernel as firmware so
+  # the display can be driven at its native resolution; mi_edid.bin lives at
+  # the repo root next to hardware-configuration.nix.
+  # NOTE: the matching --kernel-params (drm.edid_firmware / video=) are kept
+  # commented out because they hard-pin a specific DP output name.
   hardware.firmware = [
     (pkgs.runCommand "custom-edid" {} ''
       mkdir -p $out/lib/firmware/edid
diff --git a/nixos/modules/system/hardware/default.nix b/nixos/modules/system/hardware/default.nix
index bad717c..b3f1bbb 100644
--- a/nixos/modules/system/hardware/default.nix
+++ b/nixos/modules/system/hardware/default.nix
@@ -1,16 +1,20 @@
 { config, pkgs, ... }:
 
 {
+  # Secondary data drive, mounted as a regular user (rw, no root needed).
   fileSystems."/mnt/giga" = {
     device = "/dev/disk/by-uuid/bfed3a37-05e1-465b-a4b7-d74cd31bf937";
     fsType = "ext4";
     options = [ "defaults" "user" "rw" ];
   };
 
+  # Mesa graphics stack (needed even on NVIDIA for software fallbacks / GL).
   hardware.graphics = {
     enable = true;
     enable32Bit = true;
   };
 
+  # The actual NVIDIA driver is configured in modules/features/nvidia; this
+  # just tells the X server legacy path to prefer the nvidia driver name.
   services.xserver.videoDrivers = [ "nvidia" ];
 }
\ No newline at end of file
diff --git a/nixos/modules/system/locale/default.nix b/nixos/modules/system/locale/default.nix
index 4c07d59..f95ba12 100644
--- a/nixos/modules/system/locale/default.nix
+++ b/nixos/modules/system/locale/default.nix
@@ -1,8 +1,10 @@
 { ... }:
 
 {
+  # Etc/GMT-7 is the Posix name for UTC+7 (no DST).
   time.timeZone = "Etc/GMT-7";
 
+  # Swiss German by default; only LC_TIME uses American English.
   i18n.defaultLocale = "de_CH.UTF-8";
   i18n.extraLocaleSettings = {
     LC_ADDRESS = "de_CH.UTF-8";
diff --git a/nixos/modules/system/network/default.nix b/nixos/modules/system/network/default.nix
index a862235..5601ff8 100644
--- a/nixos/modules/system/network/default.nix
+++ b/nixos/modules/system/network/default.nix
@@ -5,22 +5,29 @@
   networking.networkmanager.enable = true;
   programs.amnezia-vpn.enable = true;
 
-  # Primary DNS via Mullvad DoT (Base mode)
+  # Primary DNS via Mullvad DoT (Base mode).
+  # When systemd-resolved is enabled, these servers are fed into its
+  # `Resolve.DNS` list. The `#server` suffix is systemd-resolved's
+  # DoT (DNS-over-TLS) syntax and is ignored by non-resolved consumers.
   networking.nameservers = [
     "194.242.2.4#base.dns.mullvad.net"
     "194.242.2.2#dns.mullvad.net"
   ];
 
-  # systemd-resolved: Mullvad primary, Quad9 fallback
+  # systemd-resolved: Mullvad primary, Quad9 fallback.
+  # Options live under `settings.Resolve` (the flat `services.resolved.*`
+  # aliases were removed upstream — they now emit deprecation warnings).
   services.resolved = {
     enable = true;
-    dnsovertls = "opportunistic";
-    dnssec = "false";
-    domains = [ "~." ];
-    fallbackDns = [
-      "9.9.9.9#dns.quad9.net"
-      "149.112.112.112#dns.quad9.net"
-    ];
+    settings.Resolve = {
+      DNSOverTLS = "opportunistic";
+      DNSSEC = "false";
+      Domains = [ "~." ];
+      FallbackDNS = [
+        "9.9.9.9#dns.quad9.net"
+        "149.112.112.112#dns.quad9.net"
+      ];
+    };
   };
 
   # Avahi (Printer / Network Discovery)
diff --git a/nixos/modules/system/nix/default.nix b/nixos/modules/system/nix/default.nix
index 8f33990..9cefbf5 100644
--- a/nixos/modules/system/nix/default.nix
+++ b/nixos/modules/system/nix/default.nix
@@ -1,16 +1,20 @@
 { config, pkgs, lib, inputs, ... }:
 
 {
+  # Nix itself: enable the flake + nix-command features this config relies on.
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   nixpkgs.config.allowUnfree = true;
 
+  # Automatic garbage collection — drop builds older than a week.
   nix.gc = {
     automatic = true;
     dates = "weekly";
     options = "--delete-older-than 7d";
   };
 
-  programs.nix-ld.enable = true;
+  # envfs is the modern replacement for nix-ld: it mounts a FUSE filesystem
+  # on /usr/bin and /bin that resolves shebangs (e.g. #!/usr/bin/env) to the
+  # executables on the caller's PATH. It supersedes programs.nix-ld entirely.
   services.envfs.enable = true;
   security.polkit.enable = true;
 
diff --git a/nixos/modules/system/printing/default.nix b/nixos/modules/system/printing/default.nix
index 26ceb03..91828b2 100644
--- a/nixos/modules/system/printing/default.nix
+++ b/nixos/modules/system/printing/default.nix
@@ -1,6 +1,8 @@
 { pkgs, ... }:
 
 {
+  # CUPS printing with drivers for common Brother (brlaser) and generic
+  # printers (gutenprint); cups-filters provides the filter backends.
   services.printing = {
     enable = true;
     drivers = with pkgs; [
diff --git a/nixos/modules/system/services/default.nix b/nixos/modules/system/services/default.nix
index 0f06931..74ac531 100644
--- a/nixos/modules/system/services/default.nix
+++ b/nixos/modules/system/services/default.nix
@@ -1,11 +1,15 @@
 { ... }:
 
 {
+  # File indexer (gvfs) + thumbnailer (tumbler) for the desktop shell.
   services.gvfs.enable = true;
   services.tumbler.enable = true;
+  # GNOME Keyring: stores secrets for Chrome/keepassxc seams etc.
   services.gnome.gnome-keyring.enable = true;
+  # dconf is the config DB used by GSettings-backed apps (nautilus, etc.).
   programs.dconf.enable = true;
 
+  # Keep the journal bounded so it can't fill the root partition.
   services.journald.extraConfig = ''
     SystemMaxUse=50M
     MaxRetentionSec=1month
diff --git a/nixos/modules/system/users/default.nix b/nixos/modules/system/users/default.nix
index f43149d..6eafd7c 100644
--- a/nixos/modules/system/users/default.nix
+++ b/nixos/modules/system/users/default.nix
@@ -1,16 +1,20 @@
 { pkgs, ... }:
 
 {
+  # Main desktop user.
   users.users."seraphim" = {
     isNormalUser = true;
     description = "seraphim";
     shell = pkgs.zsh;
+    # wheel for sudo/doas, networkmanager to manage connections itself.
     extraGroups = [ "networkmanager" "wheel" ];
     packages = with pkgs; [];
   };
 
+  # doas (simpler sudo replacement)
   security.doas = {
     enable = true;
+    # Give seraphim persistent passwordless-ish privileges, keeping the env.
     extraRules = [
       {
         users = [ "seraphim" ];
@@ -20,12 +24,15 @@
     ];
   };
 
+  # ZSH + completion, oh-my-zsh, autosuggestions, and fzf key bindings.
   programs.zsh = {
     enable = true;
     enableCompletion = true;
+    ohMyZsh.enable = true;
     autosuggestions = {
       enable = true;
       highlightStyle = "fg=#6c7086";
+      strategy = [ "history" "completion" ];
     };
     interactiveShellInit = ''
       source ${pkgs.fzf}/share/fzf/key-bindings.zsh
@@ -34,6 +41,8 @@
     shellAliases = {
       ls = "eza -al --icons=auto";
       ll = "eza -al --icons=auto";
+      sudo = "doas";
+      open = "xdg-open";
     };
   };
 }