16 files changed, 167 insertions, 69 deletions
diff --git a/nixos/docs/ADDING_PACKAGES.md b/nixos/docs/ADDING_PACKAGES.md
index fa5ea02..d1b5eba 100644
--- a/nixos/docs/ADDING_PACKAGES.md
+++ b/nixos/docs/ADDING_PACKAGES.md
@@ -1,10 +1,11 @@
 # Dendritic Pattern
-Dendritic is the way to organize your packages in NixOS -- around features. https://github.com/mightyiam/dendritic this is a good example!
+
+Dendritic is the way to organize your packages in NixOS — around features. https://github.com/mightyiam/dendritic this is a good example!
 
 # Adding Packages
 
 This configuration is composed from `hosts/opus/default.nix` and focused modules
-under `modules/system/` and `modules/features/`. There is no central package list.
+under `modules/features/`. There is no central package list.
 
 ## Where a package belongs
 
@@ -13,15 +14,23 @@ under `modules/system/` and `modules/features/`. There is no central package lis
 | Terminal | `modules/features/terminals/default.nix` |
 | CLI tool (incl. shell prompts like starship) | `modules/features/cli-tools/default.nix` |
 | Editor or IDE | `modules/features/editors/default.nix` |
-| Desktop application | `modules/features/desktop-apps/default.nix` |
 | Compiler, linter, language tool | `modules/features/dev-tools/default.nix` |
 | File manager or archive tool (incl. drag & drop tools) | `modules/features/file-managers/default.nix` |
 | Wayland clipboard, screenshot, or input tool | `modules/features/wayland-tools/default.nix` |
 | Audio application | `modules/features/audio-tools/default.nix` |
+| Media recording or streaming tool | `modules/features/media-tools/default.nix` |
 | System monitor or fetch tool | `modules/features/monitoring/default.nix` |
 | Font | `modules/features/fonts/default.nix` |
 | GStreamer plugin | `modules/features/gst-codecs/default.nix` |
 | Runtime library for external binaries | `modules/features/binary-compat/default.nix` |
+| Web browser | `modules/features/browsers/default.nix` |
+| Messaging or communication app | `modules/features/messaging/default.nix` |
+| Office suite, note-taking app, or document viewer/editor | `modules/features/productivity/default.nix` |
+| Password manager or encryption tool | `modules/features/security/default.nix` |
+| Gaming app, game launcher, or gaming service (Steam, etc.) | `modules/features/gaming/default.nix` |
+| P2P or torrent client | `modules/features/p2p/default.nix` |
+| Language dictionary or spell-check data | `modules/features/language-tools/default.nix` |
+| Desktop application (catch-all for GUI apps without a fitting category) | `modules/features/desktop-apps/default.nix` |
 
 First use an existing category. Create a new feature module only if the package is
 its own service, subsystem, or a group of related packages without a fitting category.
@@ -63,6 +72,44 @@ fonts.packages = with pkgs; [
 ];
 ```
 
+## Language dictionaries are different
+
+Spell-check dictionaries, transliteration data, and other language data belong in
+`modules/features/language-tools/default.nix` under `environment.systemPackages`, not
+in `fonts.packages` or a general-purpose module:
+
+```nix
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    hunspellDicts.ru_RU
+  ];
+}
+```
+
+## Gaming services live in the gaming module
+
+Gaming-related services and packages — Steam configuration, game launchers, Wine-based
+app runners — belong in `modules/features/gaming/default.nix`. This keeps the host file
+lean and makes the gaming stack reusable across hosts:
+
+```nix
+{ pkgs, ... }:
+
+{
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    pkgs.lutris
+    pkgs.prismlauncher
+  ];
+}
+```
+
 ## Create a new feature module
 
 1. Create `modules/features/<category>/default.nix`:
@@ -89,13 +136,13 @@ fonts.packages = with pkgs; [
 ## Host-only packages
 
 For a package that is truly specific to this desktop, add it to the small
-`environment.systemPackages` list in `hosts/opus/default.nix`. Gaming is the current
-example. If that list starts to represent a reusable category, extract a feature module.
+`environment.systemPackages` list in `hosts/opus/default.nix`. If that list starts to
+represent a reusable category, extract a feature module.
 
 ## Packages from flake inputs
 
 Packages provided by a flake input use `inputs` and the host platform, following
-`modules/features/desktop-apps/default.nix`:
+`modules/features/browsers/default.nix`:
 
 ```nix
 { pkgs, inputs, ... }:
diff --git a/nixos/hosts/opus/default.nix b/nixos/hosts/opus/default.nix
index b0bf347..2b4fe7b 100644
--- a/nixos/hosts/opus/default.nix
+++ b/nixos/hosts/opus/default.nix
@@ -23,7 +23,7 @@
     ../../modules/features/nvidia
     ../../modules/features/appimage
     ../../modules/features/mpd
-    ../../modules/features/swingmusic
+#    ../../modules/features/swingmusic
     ../../modules/features/monitoring
     ../../modules/features/terminals
     ../../modules/features/cli-tools
@@ -35,10 +35,18 @@
     ../../modules/features/gst-codecs
     ../../modules/features/fonts
     ../../modules/features/desktop-apps
-     ../../modules/features/dev-tools
-     ../../modules/features/vpn-utils
-     ../../modules/features/wireshark
-     ../../modules/features/mouse
+    ../../modules/features/browsers
+    ../../modules/features/messaging
+    ../../modules/features/productivity
+    ../../modules/features/security
+    ../../modules/features/media-tools
+    ../../modules/features/p2p
+    ../../modules/features/language-tools
+    ../../modules/features/gaming
+    ../../modules/features/dev-tools
+    ../../modules/features/vpn-utils
+    ../../modules/features/wireshark
+    ../../modules/features/mouse
   ];
 
   # ────────────────────────────────────────────────────────────────────────
@@ -74,22 +82,5 @@
     QT_SCREEN_SCALE_FACTORS = "1.5";
   };
 
-  # ────────────────────────────────────────────────────────────────────────
-  # Gaming composition (was attrs/gaming)
-  # Host-only desktop apps that don't (yet) deserve their own feature module.
-  # ────────────────────────────────────────────────────────────────────────
-  # Steam: remote play and dedicated servers need open firewall ports.
-  programs.steam = {
-    enable = true;
-    remotePlay.openFirewall = true;
-    dedicatedServer.openFirewall = true;
-  };
-   # Wine-based launchers for Windows games & apps.
-  environment.systemPackages = with pkgs; [
-    pkgs.lutris
-    pkgs.prismlauncher
-    pkgs.bottles
-  ];
-
   system.stateVersion = "26.05";
 }
diff --git a/nixos/modules/features/browsers/default.nix b/nixos/modules/features/browsers/default.nix
new file mode 100644
index 0000000..2551221
--- /dev/null
+++ b/nixos/modules/features/browsers/default.nix
@@ -0,0 +1,9 @@
+{ pkgs, inputs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    inputs.helium-browser.packages.${pkgs.stdenv.hostPlatform.system}.helium
+    librewolf
+    chromium
+  ];
+}
diff --git a/nixos/modules/features/cli-tools/default.nix b/nixos/modules/features/cli-tools/default.nix
index ef13ddd..c2ee448 100644
--- a/nixos/modules/features/cli-tools/default.nix
+++ b/nixos/modules/features/cli-tools/default.nix
@@ -18,6 +18,9 @@
     smartmontools
     amneziawg-tools
     amneziawg-go
+    secretspec
+    claude-code
+    opencode
   ];
 
   # Cross-shell prompt; its config lives in the dotfiles repo, not NixOS.
diff --git a/nixos/modules/features/desktop-apps/default.nix b/nixos/modules/features/desktop-apps/default.nix
index e4fcd05..b74384f 100644
--- a/nixos/modules/features/desktop-apps/default.nix
+++ b/nixos/modules/features/desktop-apps/default.nix
@@ -1,27 +1,6 @@
 { pkgs, inputs, ... }:
 
 {
-  # Desktop GUI applications
   environment.systemPackages = with pkgs; [
-    # Packaged from a flake input (see flake.nix)
-    inputs.helium-browser.packages.${pkgs.stdenv.hostPlatform.system}.helium
-    secretspec
-    claude-code
-    cryptomator
-    keepassxc
-    libreoffice
-    hunspellDicts.ru_RU
-    opencode
-    pkgs.ayugram-desktop
-    pkgs.legcord
-    pkgs.vesktop
-    obsidian
-    obs-studio
-    pkgs.qbittorrent
-    evince
-    pkgs.masterpdfeditor
-    librewolf
-    chromium
-    anytype
   ];
 }
diff --git a/nixos/modules/features/gaming/default.nix b/nixos/modules/features/gaming/default.nix
new file mode 100644
index 0000000..fe3938a
--- /dev/null
+++ b/nixos/modules/features/gaming/default.nix
@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+
+{
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true;
+    dedicatedServer.openFirewall = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    pkgs.lutris
+    pkgs.prismlauncher
+    pkgs.bottles
+  ];
+}
diff --git a/nixos/modules/features/language-tools/default.nix b/nixos/modules/features/language-tools/default.nix
new file mode 100644
index 0000000..338d26b
--- /dev/null
+++ b/nixos/modules/features/language-tools/default.nix
@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    hunspellDicts.ru_RU
+  ];
+}
diff --git a/nixos/modules/features/media-tools/default.nix b/nixos/modules/features/media-tools/default.nix
new file mode 100644
index 0000000..00a16da
--- /dev/null
+++ b/nixos/modules/features/media-tools/default.nix
@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    obs-studio
+  ];
+}
diff --git a/nixos/modules/features/messaging/default.nix b/nixos/modules/features/messaging/default.nix
new file mode 100644
index 0000000..55354c2
--- /dev/null
+++ b/nixos/modules/features/messaging/default.nix
@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    pkgs.ayugram-desktop
+    pkgs.legcord
+    pkgs.vesktop
+  ];
+}
diff --git a/nixos/modules/features/mouse/default.nix b/nixos/modules/features/mouse/default.nix
index e0f44a8..c984fbb 100644
--- a/nixos/modules/features/mouse/default.nix
+++ b/nixos/modules/features/mouse/default.nix
@@ -7,4 +7,4 @@
     piper
     input-remapper
   ];
-}
-\ No newline at end of file
+}
diff --git a/nixos/modules/features/noctalia-shell/default.nix b/nixos/modules/features/noctalia-shell/default.nix
index 251ccff..c9bc20c 100644
--- a/nixos/modules/features/noctalia-shell/default.nix
+++ b/nixos/modules/features/noctalia-shell/default.nix
@@ -9,4 +9,4 @@
     inputs.noctalia.packages.${stdenv.hostPlatform.system}.default
     noctalia-shell
   ];
-}
-\ No newline at end of file
+}
diff --git a/nixos/modules/features/p2p/default.nix b/nixos/modules/features/p2p/default.nix
new file mode 100644
index 0000000..af05afe
--- /dev/null
+++ b/nixos/modules/features/p2p/default.nix
@@ -0,0 +1,7 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    pkgs.qbittorrent
+  ];
+}
diff --git a/nixos/modules/features/productivity/default.nix b/nixos/modules/features/productivity/default.nix
new file mode 100644
index 0000000..2b14ff6
--- /dev/null
+++ b/nixos/modules/features/productivity/default.nix
@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    libreoffice
+    obsidian
+    anytype
+    evince
+    pkgs.masterpdfeditor
+  ];
+}
diff --git a/nixos/modules/features/security/default.nix b/nixos/modules/features/security/default.nix
new file mode 100644
index 0000000..935ef22
--- /dev/null
+++ b/nixos/modules/features/security/default.nix
@@ -0,0 +1,8 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    keepassxc
+    cryptomator
+  ];
+}
diff --git a/nixos/modules/features/swingmusic/default.nix b/nixos/modules/features/swingmusic/default.nix
index e666b72..389e3c8 100644
--- a/nixos/modules/features/swingmusic/default.nix
+++ b/nixos/modules/features/swingmusic/default.nix
@@ -1,21 +1,21 @@
-{ ... }:
+#{ ... }:
 
 {
   # Swing Music: self-hosted local music server. Built separately and placed
   # in the user's home; this unit just turns it into a managed session service.
-  systemd.user.services.swingmusic = {
-    description = "Swing Music Local Server";
-    wantedBy = [ "graphical-session.target" ];
-    after = [ "graphical-session.target" ];
-    serviceConfig = {
-      ExecStart = "/home/seraphim/.swingmusic/swingmusic";
-      Restart = "on-failure";
-      WorkingDirectory = "/home/seraphim";
-      NoNewPrivileges = true;
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = "false";
-      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
-    };
-  };
-}
-\ No newline at end of file
+#  systemd.user.services.swingmusic = {
+#    description = "Swing Music Local Server";
+#    wantedBy = [ "graphical-session.target" ];
+#    after = [ "graphical-session.target" ];
+#    serviceConfig = {
+#      ExecStart = "/home/seraphim/.swingmusic/swingmusic";
+#      Restart = "on-failure";
+#      WorkingDirectory = "/home/seraphim";
+#      NoNewPrivileges = true;
+#      PrivateTmp = true;
+#      ProtectSystem = "strict";
+#      ProtectHome = "false";
+#      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+#    };
+#  };
+#}
diff --git a/nixos/modules/system/nix/default.nix b/nixos/modules/system/nix/default.nix
index 9cefbf5..a02cb6f 100644
--- a/nixos/modules/system/nix/default.nix
+++ b/nixos/modules/system/nix/default.nix
@@ -3,7 +3,12 @@
 {
   # Nix itself: enable the flake + nix-command features this config relies on.
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  nixpkgs.config.allowUnfree = true;
+  nixpkgs.config = {
+    allowUnfree = true;
+    permittedInsecurePackages = [
+      "electron-39.8.10"
+    ];
+  };
 
   # Automatic garbage collection — drop builds older than a week.
   nix.gc = {