- modules/remote.nix: OpenSSH with keys only (no passwords, no root), ports 22 and
8080 (zvm_node) opened for 192.168.1.0/24 only; /etc/hosts names for both machines
(DNS goes over TLS, so the router's *.lan names don't resolve)
- the laptop accepts the PC's key; the PC's list is ready for the laptop's
- hostName: nixos -> nexo-laptop
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Back to trr.mode 5: systemd-resolved already encrypts DNS (DNS-over-TLS
to Cloudflare and Quad9), so Firefox doesn't need its own DoH.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
network.trr.mode 2 with dns.quad9.net: DoH first, falling back to the
system resolver (systemd-resolved over DNS-over-TLS), so lookups stay
encrypted either way. Mode 5 had turned Firefox's DoH off entirely.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- nexopass and nexopass-gui (scripts.nix, with the wordlist and icon)
- AppImages run directly through appimage-run's binfmt (apps.nix)
- Firefox: full fingerprinting protection except forced light mode,
Accept-Language en-US, and its own font list without corefonts
- README updated to match
Left out as PC-only: OpenRGB, acpi_enforce_resources=lax, the
Vega 8/RTX 3060 Ti graphics setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Configures Pantheon (LightDM + gala) for daily use on this ASUS TUF
Gaming A15 (FA507NU), and drops everything that only existed to serve
the previous Hyprland/Quickshell setup:
- desktop.nix: services.desktopManager.pantheon instead of
programs.hyprland + greetd; comfy laptop touchpad defaults.
- drivers.nix: NVIDIA PRIME render offload between the AMD Radeon 680M
(drives the panel) and the RTX 4050 Max-Q (offload-only), using this
machine's real PCI bus IDs; asusd/supergfxd for ASUS-specific laptop
control.
- apps.nix / scripts.nix: removed Hyprland/Quickshell-only packages and
scripts (kitty, rofi, quickshell, mako, hyprlock, hyprpaper/mpvpaper,
the Quickshell theme-picker scripts, cursor/wallpaper/display
helpers) — Pantheon ships its own Files/Terminal/Screenshot/
notifications/theming natively. Kept the DE-agnostic scripts (vault
toggle, metadata stripping, brightness control, Wi-Fi hotspot,
telemetry, weather).
- theme.nix and default-apps.nix deleted entirely — Pantheon owns
GTK/icon theming itself, no more live dconf/CSS generation pipeline
needed.
- Deleted hyprland/ and dotfiles/ (kitty, mako, quickshell, rofi).
Verified with `nixos-rebuild build`.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RpiovBQL6k5MTDMN3Ln9nL
