NixDaemon

README.md (26098B)

---

 # The author's laptop — NixDaemon's reference machine
 
 This is the manual for `modules/hosts/laptop/` (`nixosConfigurations.nixos`):
 one specific PCSpecialist Valeon II 17 with its fan fix, NVIDIA setup, private
 dotfiles checkout and sops secrets. **It will not build for anyone else** — it
 decrypts secrets with the author's age key and links a private dotfiles repo.
 To install NixDaemon on your own machine, use the generic host instead:
 [docs/install.md](../../../docs/install.md).
 
 Personal values (name, email, GPG key, location) are in one file,
 [`_identity.nix`](./_identity.nix). `$VAULT` below is the author's notes vault.
 
 One flake, one machine: the TongFang GM7RGxM (Ryzen 9 6900HX, Radeon 680M,
 RTX 3070 Ti, 2560×1440@240). Everything the machine is comes from here:
 the kernel modules that keep the dead GPU fan from throttling the CPU, the
 NVIDIA setup for Hyprland, the greeter, the compositor's Lua config and
 keybinds, Caelestia as bar/launcher/lock, kitty with tmux-style keys, zsh
 through the dotfiles checkout, the general tools, and the secrets. Built from
 the vault's `04Tools/NixDaemon-Migration/` material on 2026-10-07.
 
 The companion repo is `daemon-sec-dotfiles` (private, same account):
 home-manager links every dotfile from its checkout (`~/git/daemon-sec-dotfiles`)
 into `$HOME`, so editing the checkout edits the live config.
 
 ## Structure
 
 ```text
 NixDaemon/
 ├── flake.nix                  inputs: nixpkgs (unstable), flake-parts, import-tree, wrapper-modules, home-manager,
 │                              hyprland, caelestia-shell, caelestia-cli, llm-agents, sops-nix, nvf
 │                              outputs = flake-parts.lib.mkFlake { inherit inputs; } (import-tree ./modules)
 ├── .sops.yaml, secrets/       sops-nix: the age recipient and the encrypted secrets file
 ├── scripts/wrap.sh            turns a plain module file into a flake-parts module (how the tree below was made)
 └── modules/                   every *.nix here is a flake-parts module; paths containing /_ are skipped
     ├── parts.nix              systems; the home-manager and wrapper-modules flake modules
     ├── hosts/laptop/          the machine — flake.nixosModules.laptop-* and the nixosConfiguration
     │   ├── default.nix        flake.nixosConfigurations.nixos = nixosSystem { modules = [ self.nixosModules.laptop ]; }
     │   ├── configuration.nix  self.nixosModules.laptop: imports every module below by name; daemon.desktop.* switches;
     │   │                      boot, users (zsh login shell), greetd/tuigreet, audio, fonts, portals, nix-ld, LocalSend port
     │   ├── hardware.nix       laptop-hardware (nixos-generate-config output, unchanged)
     │   ├── fan-throttle-guard.nix  laptop-fan-throttle-guard: vault gpu-fan-fix/, unchanged; fanfix + stability_guard.py beside it
     │   ├── fan-extras.nix     laptop-fan-extras: the performance power profile
     │   ├── uniwill-laptop.nix laptop-uniwill: the `uniwill` hwmon the guard reads (uniwill-laptop/_package.nix, sources)
     │   ├── nvidia.nix         laptop-nvidia: open kernel module, panel on the dGPU, colon-free DRM names for Hyprland
     │   ├── ssd.nix            laptop-ssd: Samsung 980 crypttab + /mnt/ssd
     │   ├── nix-settings.nix   laptop-nix-settings: flakes, hyprland.cachix.org, nh + weekly clean, nvd, nom
     │   ├── toolbox.nix        laptop-toolbox: envfs, ~/.local/bin first on PATH, padx udev rule
     │   ├── sops.nix           laptop-sops: secrets/secrets.yaml → /run/secrets
     │   ├── fan-cli.nix        laptop-fan-cli: fan-ec, passwordless sudo for wheel
     │   └── fan-reference/     the Arch-era captures and their README
     ├── features/              shared NixOS features, by name
     │   ├── workstation.nix    workstation: Claude Code, Claude desktop, Obsidian, gh, glab
     │   ├── home-manager.nix   home-manager: HM as a NixOS module, users.daemonsec = self.homeModules.daemonsec
     │   └── desktop/
     │       ├── options.nix    desktop-options: daemon.desktop.hyprland.enable / daemon.desktop.niri.enable (both default true)
     │       ├── hyprland.nix   desktop-hyprland: programs.hyprland (uwsm), the GTK portal — gated
     │       ├── niri.nix       packages.niri (wrapper-modules: config.kdl from Nix, binds, Rosé Pine) + desktop-niri — gated
     │       └── noctalia.nix   packages.noctalia (wrapper-modules: settings.json from Nix, Rosé Pine "Rosepine" scheme)
     │   └── pentest/           the offensive toolkit — one NixOS module per category, all toggleable
     │       ├── default.nix    nixosModules.pentest: imports every category below by name
     │       ├── options.nix    daemon.pentest.enable + the options no category owns
     │       ├── _sets.nix      mkCategory: one package list -> gated module + devShell + smoke check
     │       ├── _aliases.nix   suffix-free script aliases, collision-guarded (impacket's net/split/ping)
     │       ├── _impacket.nix  impacket + its aliases, shared by python.nix and ad.nix
     │       ├── _overlay.nix   the nixpkgs fixes the toolkit needs (python 3.12 anyio), each dated
     │       ├── _pkgs/         pinned downloads: default.nix (SharpCollection, PEASS, mimikatz, scripts) + assets.nix (the release table: potatoes, nanodump, SharpHound CE, kerbrute, static nmap/socat…)
     │       ├── nixpkgs.nix    one package set for the system and for the flake's own checks
     │       ├── core.nix       recon.nix  ad.nix  web.nix  pivot.nix  crack.nix  shells.nix
     │       ├── wordlists.nix  python.nix  bloodhound.nix  gui.nix  payloads.nix  paths.nix
     │       ├── dfir.nix       reversing.nix  cloud.nix  mobile.nix              (off by default)
     │       ├── wireless.nix  radio.nix  hardware.nix                          (off; needs hardware)
     │       ├── c2.nix        database.nix  osint.nix  social.nix              (off by default)
     │       ├── vpn.nix        htbvpn: the HTB tunnel as a systemd template unit
     │       ├── time.nix       htb-time: conflict-aware clock skew for Kerberos
     │       ├── htb.nix        htbtarget / htbtime: the box you are on, shared across terminals
     │       ├── boxes.nix     htbbox: per-box tree + box.json + writeup.md (_htbbox.py)
     │       ├── paths.nix     ~/pentesting + the $privesc/$potatoes/$ligolo… vars + htbpaths
     │       ├── casts.nix     htbcast: asciinema recordings as raw write-up material
     │       ├── devshells.nix  nix develop #pentest, and the all-category collision check
     │       └── update.nix     pentest-update: move the _pkgs pins forward, deliberately
     └── home/                  flake.homeModules.* — the user's home
         ├── default.nix        homeModules.daemonsec: imports every module below by name
         ├── hyprland.nix       Lua config wiring, helper scripts, polkit, cliphist — only with daemon.desktop.hyprland
         ├── caelestia.nix      programs.caelestia: shell.json, the CLI with both Rosé Pine schemes — same gate
         ├── terminal.nix       kitty: DMMono Nerd Font, Rosé Pine dark, tmux-style ctrl+a keys, Neovim copy mode
         ├── shell.nix          zsh wiring (ZDOTDIR → dotfiles, fzf bindings, completions), tmux plugins, secretspec
         ├── dotfiles.nix       every dotfile from ~/git/daemon-sec-dotfiles as an out-of-store symlink
         ├── tools.nix          toolbox runtime closure, python env, the general CLI tools, `ns` (package search)
         ├── cheats.nix         the cheat cards: `nix-cheat` and `gpg-cheat` (cheats/*.md)
         ├── sops.nix           sops-nix for the user; sops, age, ssh-to-age
         ├── neovim.nix         nvf: Neovim with a small Nix-built plugin set, Rosé Pine
         ├── prompt.nix         starship and fastfetch
         ├── fan.nix            `fan`: status and watch without root; max/auto with the clamp watchdog
         ├── htb-shell.nix      $TARGET/$BOX in every terminal (zsh precmd) and in the prompt
         ├── ssh.nix, gpg.nix, git.nix   keys from sops, ~/.ssh/config, gpg.conf, git identity and signing
         ├── media.nix          mpd, rmpc, mpv
         ├── yazi.nix, gtk.nix  yazi with previews and Rosé Pine; Yaru-purple icons, cursor, prefer-dark
         ├── hypr/*.lua         omarchy (shim) · core · looknfeel · defaults · bindings · lid · caelestia
         ├── kitty/, caelestia/, cheats/, gpg/, rmpc/, mpv/, yazi/   the data those modules read
 ```
 
 ## What runs
 
 | Layer | Choice | Where |
 |---|---|---|
 | Boot, login | systemd-boot · greetd + tuigreet (remembers user and session) | modules/hosts/laptop/configuration.nix |
 | Compositor | Hyprland 0.56 under uwsm, configured in Lua; springy overshoot animations, square corners, blur | modules/home/hypr/, modules/home/hyprland.nix |
 | Shell UI | Caelestia Shell: bar, launcher, dashboard, sidebar, lock, OSD, notifications. Rosé Pine dark, framed bar, 340 px panels | modules/home/caelestia.nix, modules/home/caelestia/ |
 | Second desktop | Niri + Noctalia Shell (Rosé Pine "Rosepine"), both as wrapped packages: `nix run ~/NixDaemon#niri` / `#noctalia`. Pick the session in tuigreet; `daemon.desktop.{hyprland,niri}.enable` in configuration.nix drop one | modules/features/desktop/ |
 | Terminal | kitty, DMMono Nerd Font, Rosé Pine dark, `ctrl+a` tmux-style prefix, copy mode in Neovim | modules/home/terminal.nix |
 | Shell | zsh as login shell; config = the dotfiles' `~/.dotfiles` tree (autosuggestions, syntax highlighting, fzf-tab, zoxide, atuin). Prompt and fetch are Nix-managed | modules/home/shell.nix, prompt.nix |
 | Dotfiles | symlinked from `~/git/daemon-sec-dotfiles/home` | modules/home/dotfiles.nix |
 | Editor | Neovim via nvf: treesitter, LSP, blink completion, telescope, oil, gitsigns, which-key, Rosé Pine | modules/home/neovim.nix |
 | Tools | uv, nodejs, btop, yazi, lazygit, tmux, ripgrep/fd/fzf/bat/eza, delta, tldr, LocalSend, … | modules/home/tools.nix |
 | Secrets | sops-nix (age) for the repo; secretspec (keyring) for projects | modules/hosts/laptop/sops.nix, modules/home/sops.nix, shell.nix |
 | GPU | NVIDIA open module, panel on the RTX; Aquamarine told the GPUs by colon-free udev symlinks | modules/hosts/laptop/nvidia.nix |
 | Fan | `fan-throttle-guard`: 3.2 GHz floor, EC auto fan, `uniwill` hwmon from a 6.19 driver. `fan` command: status, watch, max/auto with a clamp watchdog | modules/hosts/laptop/fan-*.nix, uniwill-laptop/, modules/home/fan.nix |
 | Pentest | 23 toggleable categories (`daemon.pentest.<category>.enable`, every one listed in `configuration.nix`): recon, AD, web, pivoting, cracking, shells, wordlists, payloads, BloodHound, GUI on; DFIR, reversing, wireless, radio (SDR/BT/RFID), hardware (JTAG/flash/CAN), C2, database, cloud, OSINT, social, mobile off. Tools go to `environment.systemPackages`, so `sudo nmap -sS` works. Every category carries a smoke check: `nix flake check` | modules/features/pentest/ |
 | HTB workflow | `htbvpn up/down/list` (systemd template unit), `htbtarget` (shared across terminals via zsh precmd; writes `/etc/hosts` for Kerberos), `htbtime` (clock skew, restores exactly what it changed), `htbbox new <name> <ip> <os> <difficulty> [hosts]` (positional any-order, or flags, or gum prompts; scaffolds recon/enum/creds/loot/exploit/serve/casts + `box.json` + `writeup.md`; also `htbbox use/set/host/cred/flag/note/ports/json`), `htbcast` (asciinema v3 session recording → `txt` transcript for an agent, `gif` preview via agg), `payload-serve` (binds the tunnel only, refuses when the VPN is down), `pentest-cheat` | modules/features/pentest/{vpn,time,htb,boxes}.nix |
 | Arsenal | `~/pentesting/` with permanent `$privesc $potatoes $creds $ad $ligolo $fscan $nmapbin $shells …` vars and `htbpaths` to navigate. ligolo-ng/chisel/fscan/pspy cross-compiled from source for every OS/arch; mimikatz (2 builds), the full potato family, nanodump, SharpHound CE, SharpCollection, static nmap/socat, kerbrute, PEASS — pinned by hash | modules/features/pentest/{payloads,paths}.nix, _pkgs/ |
 | Nix | flakes, Hyprland cache, `nh` with weekly `clean all --keep 5 --keep-since 14d` | modules/hosts/laptop/nix-settings.nix |
 
 ## Setting it up
 
 ### Day to day (this machine)
 
 ```sh
 nh os switch                 # build, nvd diff, sudo, activate; = sudo nixos-rebuild switch --flake ~/NixDaemon#nixos
 nh os boot                   # same, but activate on next boot (kernel / driver changes)
 nix-cheat                    # the full card: rebuild, remote, nh, home, search, update, rollback, clean, …
 nix-cheat nh                 # one section
 ns kitty                     # fuzzy search nixpkgs + NixOS/home-manager options, with descriptions
 pentest-cheat                # the offensive toolkit card: htb, recon, ad, pivot, transfer, crack, web, dfir
 pentest-cheat ad             # one section
 nix flake check              # every pentest category's smoke check, plus the VM tests
 nix develop ~/NixDaemon#pentest   # the whole toolkit without installing it
 ```
 
 home-manager is a NixOS module here, so one rebuild does both; there is no
 separate `home-manager switch`. New files must be `git add`ed before nix sees
 them (the repo is jj, colocated with git; `nix-cheat repo`).
 
 ### From the repo, without a checkout
 
 The repo is private, so the reference is the ssh form:
 
 ```sh
 REPO='git+ssh://git@gitlab.com/DAEMON-404/NixDaemon.git'
 sudo nixos-rebuild switch --flake "$REPO#nixos"
 nh os switch "$REPO"
 nix flake show "$REPO"
 ```
 
 ### Fresh install
 
 1. Boot the NixOS live ISO, partition and mount at `/mnt`; generate
    `hardware-configuration.nix` with `nixos-generate-config --root /mnt` and
    compare it with `modules/hosts/laptop/hardware.nix` (UUIDs).
 2. `git clone git@gitlab.com:DAEMON-404/NixDaemon.git && cd NixDaemon`, paste
    the generated file's body into `modules/hosts/laptop/hardware.nix` (inside
    the `flake.nixosModules.laptop-hardware =` wrapper). Do not drop a raw
    `hardware-configuration.nix` into `modules/`: import-tree would load it as a
    flake-parts module and evaluation would fail.
 3. `sudo nixos-install --flake .#nixos`, reboot, log in at tuigreet, pick
    **Hyprland (UWSM)** once.
 4. Clone the dotfiles to `~/git/daemon-sec-dotfiles` (the links in
    `modules/home/dotfiles.nix` point there) and the toolbox to `~/.local/bin`.
 5. Restore the age key to `~/.config/sops/age/keys.txt` and copy it for the
    system (see Secrets), then the Samsung SSD key (below).
 
 ### The staged migration this repo was built for (2026-10-07, done)
 
 History, kept as a record. Stage A (`#bootstrap`, built from `nixpkgs-stable`)
 no longer exists: the dendritic rewrite of 2026-10-08 removed it, so none of
 the `#bootstrap` commands below work any more.
 
 **Stage A: fan fix now, on the GNOME install.** Small switch (fan module,
 driver, toolbox prerequisites, Hyprland cache). The new kernel modules only
 load from the booted system, hence the reboot.
 
 ```sh
 sudo nixos-rebuild switch --flake ~/NixDaemon#bootstrap && sudo reboot   # or: nh os switch -H bootstrap
 ```
 
 First-boot check (vault README and gpu-fan-fix/README.md):
 
 ```sh
 fanfix status            # cap 3200 MHz · boost 1 · profile performance · fan line present
 sudo fanfix fan status   # fan-abnormal=1 is expected; universal-fan-ctrl / custom-tables show the live EC path
 fanfix test 30           # all-core stress: expect 0 throttle events, peak < 75 °C
 systemctl status motherboard-stability fanfix-fan fanfix-performance-profile
 cat /run/motherboard-stability/status.json   # limit_mhz 3200, thermal_stage 0, board_gpu_c and main_fan_rpm present
 ```
 
 `fanfix status` will say "cap is not persisted": on NixOS the floor is the
 `systemd.tmpfiles.rules` line in the module, not `/etc/tmpfiles.d/99-cpu-freq-cap.conf`.
 Treat `fanfix install` / `uninstall` / `fan setup` as no-ops here; change
 `capKhz` in the module instead (gpu-fan-fix README). `fanfix-fan` is expected
 inactive: its manual fan mode makes the EC clamp all cores to 399 MHz under
 load; EC auto fan with the 3.2 GHz floor passed `fanfix test 30` at 61 °C.
 
 **Stage B: the desktop.**
 
 ```sh
 sudo nixos-rebuild boot --flake ~/NixDaemon#nixos && sudo reboot          # or: nh os boot
 ```
 
 tuigreet appears on tty1; pick `Hyprland (UWSM)` once, it is remembered.
 Then the keybind diff against the vault capture:
 
 ```sh
 hyprctl binds -j | python3 -I -c 'import json,sys
 M={1:"SHIFT",4:"CTRL",8:"ALT",64:"SUPER"}
 for x in json.load(sys.stdin):
     print(x.get("submap",""),"|","+".join(n for v,n in sorted(M.items()) if x["modmask"]&v),"|",x["key"],"|",x.get("description",""))' | sort > /tmp/binds.new
 cut -d'|' -f1-4 $VAULT/04Tools/NixDaemon-Migration/shortcuts/keybinds.txt | sort | diff - /tmp/binds.new
 ```
 
 Expected differences: the keycode binds (workspaces, resize, bar panels,
 group windows) show `code:0` in the capture and an empty key here; the keys
 caelestia.lua takes over carry their Caelestia descriptions; the stock
 Obsidian and YouTube lines are gone because vault-open and bakx own those
 keys; the two webcam-overlay binds were not carried (keycodes unknown).
 
 `hosts/bootstrap/` and the `nixpkgs-stable` input were deleted on 2026-10-08.
 
 **Samsung SSD key** (vault samsung-ssd.md, section 2; needs the gpg passphrase):
 
 ```sh
 cd $VAULT/04Tools/NixDaemon-Migration
 sudo mkdir -p -m 700 /etc/secrets
 gpg -d --pinentry-mode loopback ssd.key.gpg | sudo tee /etc/secrets/ssd.key >/dev/null
 sudo chmod 400 /etc/secrets/ssd.key
 sudo systemctl restart systemd-cryptsetup@ssd.service mnt-ssd.mount   # or just reboot
 ```
 
 Until then the drive stays locked; both units are `nofail`, so boot is
 unaffected. The sops way: `sops set secrets/secrets.yaml '["ssd.key"]' "\"$(gpg -d ssd.key.gpg)\""`,
 then `sops.secrets."ssd.key".path = "/etc/secrets/ssd.key";` in modules/hosts/laptop/sops.nix.
 
 ## The shell
 
 zsh is the login shell (modules/hosts/laptop/configuration.nix) and its configuration is
 the dotfiles checkout's `home/.dotfiles` tree, reached through a Nix-managed
 `~/.zshenv` that sets `ZDOTDIR=~/.dotfiles` (modules/home/shell.nix). The
 plugins (autosuggestions, syntax highlighting, zsh-completions, fzf-tab,
 history-substring-search, you-should-use) are the copies vendored in that
 tree; starship, zoxide, atuin and fzf come from nixpkgs. Edit
 `~/git/daemon-sec-dotfiles/home/.dotfiles/config/*.zsh` and open a new shell.
 
 Things the shell modules want that this build provides: `~/.fzf.zsh` (fzf's
 key bindings from the store, core.zsh only knows the Arch paths), the tool
 configs linked into `~/.config` by dotfiles.nix (bat theme, atuin, crossfetch
 for the splash animation, cheats, eza, btop, yazi, lazygit, carapace, and the
 rest of the checkout's .config; the starship prompt and the fastfetch card are
 Nix-managed in modules/home/prompt.nix), `~/.tmux.conf` with
 its plugins from nixpkgs behind a TPM stand-in, and the binaries modern.zsh
 aliases (btop, dust, duf, procs, delta, tldr, hyperfine, glow, onefetch,
 lazygit, yazi, neovim). Not carried: `mise` (its downloaded runtimes
 duplicate nixpkgs; `nix-ld` is on so `uv`'s managed Pythons work), and the
 repo's git config (it turns on commit signing with a key that is not on this
 machine; `~/.gitconfig` stays).
 
 ## The dotfiles
 
 `modules/home/dotfiles.nix` mirrors `~/git/daemon-sec-dotfiles/home/` into
 `$HOME` with out-of-store symlinks: editing the checkout edits the live
 config, and a rebuild is only needed to add or remove a path in the list.
 The header of that file names what is deliberately not linked (hypr and
 kitty are Nix-managed, the omarchy trees, the systemd units, mimeapps,
 git's signing config, the bash rc files, `.claude`/`.codex`, the toolbox
 `bin` directories) and why.
 
 ## The toolbox
 
 `~/.local/bin` is the vault's `bin/` copied flat and `git init`ed (remote
 `gitlab` → `DAEMON-404/daemon-bin`, not pushed). NixOS puts it first on PATH
 and envfs resolves the `#!/bin/bash` and `#!/usr/bin/python3` shebangs.
 `install.sh` there reports the environment. Notes:
 
 - `dropterm`, `winsnap`, `vault-open`, `lid-control` call
   `hyprctl dispatch 'hl.dsp…'`: that is Hyprland 0.56's Lua dispatch syntax,
   so they work unchanged.
 - `winsnap` looks for an `omarchy-bar` layer to avoid the bar; Caelestia's
   layers are `caelestia-*`, so snaps ignore the bar's reserved edge for now.
 - `lid-control` still calls a few `omarchy-*` helpers (tolerated: they fail
   quietly); `clipboard-backup` and `omarchy-menu-tmux-keybindings` are bound
   but not in the carried `bin/`.
 - The cheat popups (`omarchy-menu-kitty`, …) pipe into `omarchy-menu-select`,
   provided here as a fuzzel wrapper (modules/home/hyprland.nix). `nix-cheat`
   and `gpg-cheat` are this repo's own cards, in the same style.
 
 ## Secrets
 
 Two tools. **sops-nix** keeps secrets *in this repo*, encrypted with age
 (`.sops.yaml` names the recipient, `secrets/secrets.yaml` holds the values)
 and decrypts them at activation: `/run/secrets/NAME` for the system
 (modules/hosts/laptop/sops.nix), `~/.config/sops-nix/secrets/NAME` for the user
 (modules/home/sops.nix). The age key is `~/.config/sops/age/keys.txt`,
 created on 2026-10-08 and **not in the repo**; back it up (vault) and give
 the system its copy once:
 
 ```sh
 sudo install -D -m 600 -o root -g root ~/.config/sops/age/keys.txt /var/lib/sops-nix/key.txt
 ```
 
 Edit with `sops secrets/secrets.yaml`, declare with `sops.secrets.NAME = { };`,
 rebuild. `nix-cheat secrets` has the commands.
 
 What the file holds today: `ssh_id_ed25519` (the SSH private key, used by
 modules/home/ssh.nix), `gpg_main_secret` (the armored GPG secret key, still
 under its own passphrase, imported by modules/home/gpg.nix on first
 activation), and `example`. So a fresh install needs exactly one secret
 restored by hand, the age key; ssh, gpg and git then come up from the flake.
 
 **secretspec** is for a project's runtime secrets: declared next to the
 project in `secretspec.toml`, values in the system keyring
 (`~/.config/secretspec/config.toml`: provider `keyring`, profile `default`;
 gnome-keyring is unlocked at login by PAM). `secretspec init`, `secretspec
 add NAME`, `secretspec check`, `secretspec run -- cmd`.
 
 ## Look and keys
 
 - **Caelestia in Rosé Pine dark** (main), translucent over blur, with its
   framed bar: a 10 px border with 25 px rounded inner corners, clock and
   tray in pills, filled occupied workspaces, the Nix snowflake as the logo.
   Sidebar, utilities and notification panels are narrower than stock
   (`modules/home/caelestia/shell-tokens.json`). A Dawn mapping is registered too:
   `caelestia scheme set -n rose-pine -f rose-pine-dawn`.
 - **Bar shows the program**, not the window title: a small patch to the
   shell's ActiveWindow component (`modules/home/caelestia/active-window-program-name.patch`,
   applied in caelestia.nix) makes compact mode use the desktop entry's name
   for the window class. The shell compiles locally because of it.
 - **More shell**: desktop clock on the wallpaper (bottom right), audio
   visualiser along the bottom while something plays, weather on the
   dashboard (location in `_identity.nix`), audio and microphone status icons, lock screen over
   the wallpaper, a toast on track change, vim keys in the launcher, and
   idle: lock after 15 min, screen off after 20 (audio or an inhibitor holds
   both off).
 - **Springy windows**: `modules/home/hypr/looknfeel.lua` carries the dotfiles'
   animation rice (overshoot curves on move/resize/open, shadows, blur
   tuning, drag snapping, swallow, 3-finger workspace swipe, 4-finger-up
   fullscreen). Loaded after core.lua.
 - **kitty, tmux-style** (`ctrl+a` prefix; table in modules/home/terminal.nix):
   `c` tab, `-`/`|` splits, `hjkl` panes, `z` zoom, `[` copy mode in Neovim
   (`v` select, `y` copy, Enter copy and leave, `q`), `]` paste, `1..9` tabs,
   `ctrl+a ctrl+a` sends a real ctrl+a to the shell.
 - `CTRL+SUPER+SPACE` opens the Caelestia launcher in its wallpaper grid
   (helper `wallpaper-picker`); `>wallpaper name` filters. The directory is
   `paths.wallpaperDir` in modules/home/caelestia.nix.
 - Keys to try first: SUPER+RETURN terminal, SUPER+SPACE launcher,
   SUPER+ESCAPE session menu, SUPER+K keybindings list, SUPER+M window mode,
   SUPER+` dropdown terminal, PRINT screenshot.
 
 ## Why `uniwill-laptop` is built here
 
 `stability_guard.py` reads the `uniwill` hwmon (board GPU temperature, main
 fan rpm) and falls back to a permanent 1.8 GHz ceiling without it. The driver
 was merged upstream in Linux 6.19; nixpkgs' 6.18 kernel predates it and the
 7.2 kernel config leaves its Kconfig submenu off. `modules/hosts/laptop/uniwill-laptop/`
 holds the v6.19 sources and builds them as an out-of-tree module against
 whatever kernel is selected (verified on 6.18.55). Revisit when the default
 NixOS kernel ships it.
 
 ## Parked for the owner
 
 - **ANSI green**: Rosé Pine puts pine (#31748f) in the green slot; the rule
   says pine is never ink. kitty uses foam (#9ccfd8) for color2/color10
   meanwhile; one variable in modules/home/terminal.nix.
 - **Display manager**: greetd + tuigreet chosen (text greeter, remembers
   user and session). sddm would be a one-file swap.
 - **GPU / MUX**: configured for what the firmware presents, the panel on the
   RTX 3070 Ti (discrete). The hybrid alternative is a commented block in
   nvidia.nix; it only applies after changing the MUX in the BIOS.
 - **Hostname** stays `nixos` (the installer's). The flake output is also `nixos`.
 - Stock Omarchy keys whose program is still not installed (spotify,
   1password, signal) show a notification saying so. Add packages to
   modules/home/tools.nix when wanted.
 
 ---
 
 <p align="center">☧ · <a href="https://rosepinetheme.com/">Rosé Pine</a> all the way down · built with Claude Code</p>