network.trr.mode 2 with dns.quad9.net: DoH first, falling back to the
system resolver (systemd-resolved over DNS-over-TLS), so lookups stay
encrypted either way. Mode 5 had turned Firefox's DoH off entirely.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- nexopass and nexopass-gui (scripts.nix, with the wordlist and icon)
- AppImages run directly through appimage-run's binfmt (apps.nix)
- Firefox: full fingerprinting protection except forced light mode,
Accept-Language en-US, and its own font list without corefonts
- README updated to match
Left out as PC-only: OpenRGB, acpi_enforce_resources=lax, the
Vega 8/RTX 3060 Ti graphics setup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>