Bring over the PC config's changes: NexoPass, AppImages, Firefox privacy

- nexopass and nexopass-gui (scripts.nix, with the wordlist and icon)
- AppImages run directly through appimage-run's binfmt (apps.nix)
- Firefox: full fingerprinting protection except forced light mode,
  Accept-Language en-US, and its own font list without corefonts
- README updated to match

Left out as PC-only: OpenRGB, acpi_enforce_resources=lax, the
Vega 8/RTX 3060 Ti graphics setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

modules/apps.nix

@@ -122,4 +122,9 @@ in
     libxrandr libxcursor libxcb libxkbcommon
     alsa-lib mesa zlib stdenv.cc.cc
   ];
+
+  # Registers AppImages with binfmt_misc, so ./Foo.AppImage (or a double-click
+  # in Dolphin) runs straight through appimage-run's FHS environment.
+  programs.appimage.enable = true;
+  programs.appimage.binfmt = true;
 }

modules/firefox.nix

@@ -1,8 +1,33 @@
 { config, pkgs, ... }:
 
+let
+  # Firefox's own font setup: every system font except the Microsoft core
+  # fonts. Sites measure which fonts are installed to fingerprint you, and
+  # Comic Sans, Impact, Georgia, Verdana... made that list 1 in 9,000.
+  # Only Firefox is affected: other apps still have corefonts. In Firefox,
+  # Arial, Times New Roman and Courier New render as Liberation (same
+  # letter widths), the rest fall back to Noto.
+  firefoxFonts = pkgs.writeText "firefox-fonts.conf" ''
+    <?xml version="1.0"?>
+    <!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+    <fontconfig>
+      <include ignore_missing="no">/etc/fonts/fonts.conf</include>
+      <selectfont>
+        <rejectfont>
+          <glob>${pkgs.corefonts}/*</glob>
+        </rejectfont>
+      </selectfont>
+    </fontconfig>
+  '';
+in
 {
   programs.firefox = {
     enable = true;
+    # The wrapper sets FONTCONFIG_FILE when Firefox starts. (overrideAttrs
+    # keeps the package overridable, so the autoConfig below still applies.)
+    package = pkgs.firefox.overrideAttrs (old: {
+      makeWrapperArgs = old.makeWrapperArgs ++ [ "--set" "FONTCONFIG_FILE" "${firefoxFonts}" ];
+    });
     # Not locked: values are reapplied on every Firefox start, but can be
     # changed in the UI for the current session. (Read as text: the module
     # doesn't copy autoConfigFiles paths into the store.)

modules/scripts.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 let
   vaultToggle = pkgs.writeShellScriptBin "vault-toggle" (builtins.readFile ./scripts/vault-toggle.sh);
@@ -7,6 +7,37 @@ let
   hotspotStart = pkgs.writeShellScriptBin "hotspot-start" (builtins.readFile ./scripts/hotspot-start.sh);
   systemTelemetry = pkgs.writeShellScriptBin "system-telemetry" (builtins.readFile ./scripts/system-telemetry.sh);
   weatherFetch = pkgs.writeShellScriptBin "weather-fetch" (builtins.readFile ./scripts/weather-fetch.sh);
+
+  nexopass = pkgs.writeShellApplication {
+    name = "nexopass";
+    runtimeInputs = with pkgs; [ libargon2 gnupg wl-clipboard keyutils coreutils gnused ];
+    runtimeEnv.NEXOPASS_WORDLIST = "${./scripts/eff_large_wordlist.txt}";
+    text = builtins.readFile ./scripts/nexopass.sh;
+  };
+
+  # NexoPass window (github.com/Nexoniarz/NexoPass). Shares accounts, site
+  # lists and the app password with the nexopass command above.
+  nexopassGuiVersion = "1.3.1";
+  nexopassGuiJar = pkgs.fetchurl {
+    url = "https://github.com/Nexoniarz/NexoPass/releases/download/v${nexopassGuiVersion}/NexoPass-linux-x64-${nexopassGuiVersion}.jar";
+    hash = "sha256-WeUixuz+aLPsMDj+a0Gs09gfikMYYCf8uuZIN89CqVo=";
+  };
+  nexopassGuiLibs = with pkgs; [ libGL libx11 libxext libxrender libxtst libxi libxrandr libxcursor fontconfig freetype ];
+  nexopassGuiDesktop = pkgs.makeDesktopItem {
+    name = "nexopass";
+    desktopName = "NexoPass";
+    comment = "Passwords derived from a master";
+    exec = "nexopass-gui";
+    icon = "nexopass";
+    categories = [ "Utility" "Security" ];
+  };
+  nexopassGui = pkgs.runCommand "nexopass-gui-${nexopassGuiVersion}" { nativeBuildInputs = [ pkgs.makeWrapper ]; } ''
+    makeWrapper ${pkgs.jdk17}/bin/java $out/bin/nexopass-gui \
+      --add-flags "-Xmx1g -jar ${nexopassGuiJar}" \
+      --prefix LD_LIBRARY_PATH : /run/opengl-driver/lib:${lib.makeLibraryPath nexopassGuiLibs}
+    install -Dm644 ${./scripts/nexopass.png} $out/share/icons/hicolor/512x512/apps/nexopass.png
+    install -Dm644 ${nexopassGuiDesktop}/share/applications/nexopass.desktop $out/share/applications/nexopass.desktop
+  '';
 in
 {
   environment.systemPackages = with pkgs; [
@@ -19,5 +50,7 @@ in
     hotspotStart
     systemTelemetry
     weatherFetch
+    nexopass
+    nexopassGui
   ];
 }