nixos config

modules/apps.nix

@@ -0,0 +1,76 @@
+{ config, pkgs, ... }:
+
+let
+  # hyprpolkitagent only ships its binary under libexec/, not bin/, so it
+  # never lands on $PATH — wrap it so `exec-once = hyprpolkitagent` in
+  # hyprland.conf can find it.
+  hyprpolkitagentBin = pkgs.writeShellScriptBin "hyprpolkitagent"
+    "exec ${pkgs.hyprpolkitagent}/libexec/hyprpolkitagent";
+in
+{
+  # Every installed package — GUI apps, CLI tools, and dev toolchains alike.
+  # If it's "install X", it goes here.
+  users.users."nexoniarz".packages = with pkgs; [
+    # Hyprland desktop toolchain (Wayland-native, lightweight, squared theme)
+    kitty                     # Terminal
+    thunar                    # File manager
+    thunar-archive-plugin
+    thunar-volman
+    tumbler                   # Thumbnails (paired with services.tumbler.enable)
+    rofi                      # Launcher (Wayland support built in since 2.0)
+    quickshell                # Bar / UI shell
+    imv                       # Image viewer
+    mako                      # Notification daemon
+    grim                      # Screenshot capture
+    slurp                     # Screenshot region select
+    wl-clipboard               # Wayland clipboard
+    hyprpolkitagentBin        # Polkit authentication agent (wrapped, see `let` above)
+    hyprlock                  # Screen locker (power menu)
+    brightnessctl             # Backlight brightness (laptop panels)
+    ddcutil                   # DDC/CI brightness (external monitors)
+    lm_sensors                # sensors-detect helps ddcutil find I2C buses
+    hyprpaper                 # Wallpaper daemon, driven by the Quickshell picker (static images)
+    mpvpaper                  # Wallpaper daemon for video-loop (animated) wallpapers
+    networkmanager            # nmcli, for the Wi-Fi hotspot toggle
+    xdg-user-dirs             # Resolves localized folder names (Obrazy, not Pictures, on pl_PL)
+    bibata-cursors            # Cursor theme(s) for the cursor picker
+    xcur2png                  # Renders Xcursor files to PNG for the cursor picker's previews
+    imagemagick                # `identify`, used to pick the right cursor-preview size
+
+    # Apps
+    blender
+    gimp
+    inkscape
+    vesktop
+    tor-browser
+    ffmpeg-full
+    vlc
+    filezilla
+    chromium
+
+    # Games
+    prismlauncher
+    pkgs.osu-lazer-bin
+
+    # Dev: compilers, runtimes, languages
+    glibc
+    musl
+    cmake
+    gnumake # Provides the 'make' command
+    gcc
+    python3
+    openjdk25
+    claude-code # AI Developer Assistant
+  ];
+
+  # Global command-line utilities available everywhere
+  environment.systemPackages = with pkgs; [
+    git
+    vim
+    fastfetch
+    gparted
+    firejail
+    gnupg
+    lmstudio
+  ];
+}

modules/desktop.nix

@@ -0,0 +1,95 @@
+{ config, pkgs, ... }:
+
+{
+  # --- Hyprland: Wayland compositor ---
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+  };
+
+  # --- greetd + tuigreet: minimal TUI login manager, launches Hyprland directly ---
+  services.greetd = {
+    enable = true;
+    settings.default_session = {
+      command = "${pkgs.tuigreet}/bin/tuigreet --time --remember --remember-session --cmd Hyprland";
+      user = "greeter";
+    };
+  };
+
+  # --- XDG portals: screen share, file pickers, etc. ---
+  xdg.portal = {
+    enable = true;
+    extraPortals = [ pkgs.xdg-desktop-portal-hyprland pkgs.xdg-desktop-portal-gtk ];
+    config.common.default = [ "hyprland" "gtk" ];
+  };
+
+  security.polkit.enable = true;
+
+  # Keyboard layout for console/XWayland/greetd; Hyprland's own input block
+  # in hyprland/hyprland.conf mirrors this.
+  services.xserver.xkb = {
+    layout = "pl";
+    variant = "";
+  };
+
+  # Thunar: thumbnails, trash/volume mount integration, settings storage
+  services.tumbler.enable = true;
+  services.gvfs.enable = true;
+  programs.xfconf.enable = true;
+
+  # Native Wayland backend for Electron/Chromium-based apps
+  environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
+  # --- Dotfiles: symlink tracked configs into the user's home ---
+  # Editing /etc/nixos/hyprland or /etc/nixos/dotfiles takes effect on the
+  # next reload of the respective app (no rebuild needed for config-only
+  # tweaks; a rebuild re-runs the symlink if the target path itself changes).
+  systemd.tmpfiles.rules = [
+    "d /home/nexoniarz/.config/hypr 0755 nexoniarz users -"
+    "L+ /home/nexoniarz/.config/hypr/hyprland.conf - - - - /etc/nixos/hyprland/hyprland.conf"
+    "L+ /home/nexoniarz/.config/hypr/hyprpaper.conf - - - - /etc/nixos/hyprland/hyprpaper.conf"
+
+    "d /home/nexoniarz/.config/kitty 0755 nexoniarz users -"
+    "L+ /home/nexoniarz/.config/kitty/kitty.conf - - - - /etc/nixos/dotfiles/kitty/kitty.conf"
+    # Colors set live via the Quickshell Theme picker — see kitty.conf's
+    # `include theme.conf`. Empty by default; kitty-theme-set writes to it.
+    "f /home/nexoniarz/.config/kitty/theme.conf 0644 nexoniarz users - -"
+
+    "d /home/nexoniarz/.config/rofi 0755 nexoniarz users -"
+    "L+ /home/nexoniarz/.config/rofi/config.rasi - - - - /etc/nixos/dotfiles/rofi/config.rasi"
+    # Colors set live via the Quickshell Theme picker — see config.rasi's
+    # `@import "theme.rasi"`. Empty by default; rofi-theme-set writes to it.
+    "f /home/nexoniarz/.config/rofi/theme.rasi 0644 nexoniarz users - -"
+
+    "d /home/nexoniarz/.config/mako 0755 nexoniarz users -"
+    "L+ /home/nexoniarz/.config/mako/config - - - - /etc/nixos/dotfiles/mako/config"
+
+    # Quickshell is multi-file with relative imports, so the whole directory
+    # is symlinked rather than a single file.
+    "L+ /home/nexoniarz/.config/quickshell - - - - /etc/nixos/dotfiles/quickshell"
+
+    # $HOME/Wallpapers, not $HOME/Pictures/Wallpapers — this system's locale
+    # (pl_PL) means the real XDG Pictures dir is ~/Obrazy, not ~/Pictures.
+    # Living directly under $HOME sidesteps that entirely.
+    "d /home/nexoniarz/Wallpapers 0755 nexoniarz users -"
+    "d /home/nexoniarz/Screenshots 0755 nexoniarz users -"
+
+    # User-editable cursor theme choice (set live via the Quickshell cursor
+    # picker) — created empty if missing, never overwritten if it already
+    # has content, since it's runtime state rather than tracked config.
+    "f /home/nexoniarz/.config/hypr/cursor.conf 0644 nexoniarz users - -"
+
+    # Same deal for display settings (mode/scale/transform per monitor,
+    # set via the Quickshell display picker) — without this file backing
+    # them, they only ever applied live via hyprctl and got silently
+    # reset by hyprland.conf's generic fallback monitor rule any time
+    # Hyprland re-evaluated monitor state.
+    "f /home/nexoniarz/.config/hypr/display.conf 0644 nexoniarz users - -"
+
+    # Same deal for window border colors (accent/border, set live via the
+    # Quickshell Theme picker) — without this file, they only ever applied
+    # via hyprctl and would fall back to hyprland.conf's own general{}
+    # defaults any time Hyprland re-evaluated its config.
+    "f /home/nexoniarz/.config/hypr/theme.conf 0644 nexoniarz users - -"
+  ];
+}

modules/drivers.nix

@@ -0,0 +1,48 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Enable graphics driver support and 32-bit acceleration (for Steam/gaming)
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+
+  #OpenTabletDriver
+  hardware.opentabletdriver.enable = true;
+  hardware.uinput.enable = true;
+  boot.kernelModules = [ "uinput" "v4l2loopback" ];
+
+  # Virtual webcam device so ffmpeg (fed by the GoPro's stream) can appear
+  # as a normal camera to apps like Discord. exclusive_caps=1 is required
+  # for Chromium/WebRTC-based apps to recognize it as a real capture device.
+  boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
+  boot.extraModprobeConfig = ''
+    options v4l2loopback devices=1 video_nr=10 card_label="GoPro Webcam" exclusive_caps=1
+    # PS4/PS5 controllers (e.g. DualSense) connect over Bluetooth then
+    # immediately disconnect — a well-known Linux Bluetooth stack issue
+    # where many adapters' Enhanced Retransmission Mode implementation is
+    # broken. Disabling ERTM is the standard, widely-documented fix.
+    options bluetooth disable_ertm=1
+  '';
+
+  # I2C bus, for DDC/CI monitor control (brightness) via ddcutil — this
+  # machine has no laptop backlight, only external DisplayPort monitors.
+  hardware.i2c.enable = true;
+
+  # Load NVIDIA driver for X11 and Wayland
+  services.xserver.videoDrivers = [ "nvidia" ];
+
+  hardware.nvidia = {
+    # Required settings
+    modesetting.enable = true;
+
+    # Enable NVIDIA Open GPU Kernel Modules (Turing architecture or newer)
+    open = true;
+
+    # Enable the NVIDIA settings menu
+    nvidiaSettings = true;
+
+    # Use the stable driver package matching current kernel
+    package = config.boot.kernelPackages.nvidiaPackages.stable;
+  };
+}

modules/scripts.nix

@@ -0,0 +1,45 @@
+{ config, pkgs, ... }:
+
+let
+  # Wrap external shell scripts into system executables
+  vaultToggle = pkgs.writeShellScriptBin "vault-toggle" (builtins.readFile ./scripts/vault-toggle.sh);
+  stripMetadata = pkgs.writeShellScriptBin "strip-metadata" (builtins.readFile ./scripts/strip-metadata.sh);
+  brightnessCtl = pkgs.writeShellScriptBin "brightness-ctl" (builtins.readFile ./scripts/brightness-ctl.sh);
+  showDesktopToggle = pkgs.writeShellScriptBin "show-desktop-toggle" (builtins.readFile ./scripts/show-desktop-toggle.sh);
+  wallpaperSet = pkgs.writeShellScriptBin "wallpaper-set" (builtins.readFile ./scripts/wallpaper-set.sh);
+  wallpaperDelete = pkgs.writeShellScriptBin "wallpaper-delete" (builtins.readFile ./scripts/wallpaper-delete.sh);
+  displaySet = pkgs.writeShellScriptBin "display-set" (builtins.readFile ./scripts/display-set.sh);
+  hyprThemeSet = pkgs.writeShellScriptBin "hypr-theme-set" (builtins.readFile ./scripts/hypr-theme-set.sh);
+  gtkThemeSet = pkgs.writeShellScriptBin "gtk-theme-set" (builtins.readFile ./scripts/gtk-theme-set.sh);
+  kittyThemeSet = pkgs.writeShellScriptBin "kitty-theme-set" (builtins.readFile ./scripts/kitty-theme-set.sh);
+  rofiThemeSet = pkgs.writeShellScriptBin "rofi-theme-set" (builtins.readFile ./scripts/rofi-theme-set.sh);
+  listCursorThemes = pkgs.writeShellScriptBin "list-cursor-themes" (builtins.readFile ./scripts/list-cursor-themes.sh);
+  cursorPreviewAll = pkgs.writeShellScriptBin "cursor-preview-all" (builtins.readFile ./scripts/cursor-preview-all.sh);
+  cursorSet = pkgs.writeShellScriptBin "cursor-set" (builtins.readFile ./scripts/cursor-set.sh);
+  screenshot = pkgs.writeShellScriptBin "screenshot" (builtins.readFile ./scripts/screenshot.sh);
+  hotspotStart = pkgs.writeShellScriptBin "hotspot-start" (builtins.readFile ./scripts/hotspot-start.sh);
+in
+{
+  # Install CLI dependencies required by the scripts
+  environment.systemPackages = with pkgs; [
+    gocryptfs
+    exiftool
+    jq
+    vaultToggle
+    stripMetadata
+    brightnessCtl
+    showDesktopToggle
+    wallpaperSet
+    wallpaperDelete
+    displaySet
+    hyprThemeSet
+    gtkThemeSet
+    kittyThemeSet
+    rofiThemeSet
+    listCursorThemes
+    cursorPreviewAll
+    cursorSet
+    screenshot
+    hotspotStart
+  ];
+}

modules/scripts/brightness-ctl.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Brightness control abstraction: prefers the kernel backlight class (laptop
+# panels, via brightnessctl); falls back to DDC/CI over I2C (external
+# monitors, via ddcutil) when no backlight device exists. Keeps the rest of
+# the config (Quickshell's brightness popup) hardware-agnostic.
+set -euo pipefail
+
+has_backlight() {
+    [ -n "$(ls -A /sys/class/backlight 2>/dev/null)" ]
+}
+
+case "${1:-get}" in
+    get)
+        if has_backlight; then
+            brightnessctl -m | cut -d, -f4 | tr -d '%'
+        else
+            ddcutil getvcp 10 --brief 2>/dev/null | awk '{print $4}'
+        fi
+        ;;
+    set)
+        pct="${2:?usage: brightness-ctl set <0-100>}"
+        if has_backlight; then
+            brightnessctl set "${pct}%" > /dev/null
+        else
+            ddcutil setvcp 10 "$pct" > /dev/null
+        fi
+        ;;
+    *)
+        echo "usage: brightness-ctl [get|set <0-100>]" >&2
+        exit 1
+        ;;
+esac

modules/scripts/cursor-preview-all.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Extracts a small preview PNG (closest to 32px) for every installed
+# cursor theme's "left_ptr" cursor into a cache directory, one per theme
+# named "<theme>.png". Xcursor files are a binary format QML's Image
+# element can't decode directly, so this is a one-time render step —
+# already-cached themes are skipped.
+#
+# usage: cursor-preview-all <cache-dir>
+set -euo pipefail
+
+cache_dir="${1:?usage: cursor-preview-all <cache-dir>}"
+mkdir -p "$cache_dir"
+
+dirs=(
+    "$HOME/.icons"
+    "$HOME/.local/share/icons"
+    "/run/current-system/sw/share/icons"
+    "/etc/profiles/per-user/$USER/share/icons"
+)
+
+render_one() {
+    local theme="$1"
+    local src="$2"
+    local out="$cache_dir/$theme.png"
+    [ -e "$out" ] && return 0
+
+    local tmp
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' RETURN
+
+    xcur2png -q -d "$tmp" -c "$tmp/conf" -i 1 "$src" > /dev/null 2>&1 || return 0
+
+    local best=""
+    local best_diff=999999
+    for png in "$tmp"/*.png; do
+        [ -e "$png" ] || continue
+        local w
+        w=$(identify -format "%w" "$png" 2>/dev/null || echo 0)
+        local diff=$(( w > 32 ? w - 32 : 32 - w ))
+        if [ "$diff" -lt "$best_diff" ]; then
+            best_diff=$diff
+            best="$png"
+        fi
+    done
+    [ -n "$best" ] && cp "$best" "$out"
+}
+
+for d in "${dirs[@]}"; do
+    [ -d "$d" ] || continue
+    for theme_dir in "$d"/*/; do
+        [ -f "${theme_dir}cursors/left_ptr" ] || continue
+        render_one "$(basename "$theme_dir")" "${theme_dir}cursors/left_ptr"
+    done
+done

modules/scripts/cursor-set.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Applies a cursor theme immediately (hyprctl) and persists it across
+# restarts by writing env vars to a file hyprland.conf sources on startup.
+set -euo pipefail
+
+theme="${1:?usage: cursor-set <theme-name> [size]}"
+size="${2:-24}"
+
+hyprctl setcursor "$theme" "$size" > /dev/null
+
+mkdir -p "$HOME/.config/hypr"
+cat > "$HOME/.config/hypr/cursor.conf" <<EOF
+env = HYPRCURSOR_THEME,$theme
+env = XCURSOR_THEME,$theme
+env = XCURSOR_SIZE,$size
+EOF

modules/scripts/display-set.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Applies a monitor mode/position/scale/transform immediately (hyprctl)
+# AND persists it into ~/.config/hypr/display.conf, which hyprland.conf
+# sources — without that file, hyprland.conf's generic fallback rule
+# ("monitor = , preferred, auto, 1") is the only thing on record, and
+# ANYTHING that makes Hyprland re-evaluate monitor state (observed: even
+# changing the cursor theme via `hyprctl setcursor` does this) reapplies
+# that fallback, silently dropping back to "preferred" refresh rate
+# instead of whatever the user actually picked.
+set -euo pipefail
+
+mon="${1:?usage: display-set <monitor> <mode> <x> <y> <scale> [transform]}"
+mode="${2:?mode required}"
+x="${3:?x required}"
+y="${4:?y required}"
+scale="${5:?scale required}"
+transform="${6:-0}"
+
+descriptor="$mon,$mode,${x}x${y},$scale"
+[ "$transform" != "0" ] && descriptor="$descriptor,transform,$transform"
+
+conf="$HOME/.config/hypr/display.conf"
+mkdir -p "$(dirname "$conf")"
+touch "$conf"
+
+line="monitor = $descriptor"
+if grep -q "^monitor = $mon," "$conf" 2>/dev/null; then
+    tmp=$(mktemp)
+    awk -v prefix="monitor = $mon," -v newline="$line" '
+        index($0, prefix) == 1 { print newline; next } { print }
+    ' "$conf" > "$tmp"
+    mv "$tmp" "$conf"
+else
+    echo "$line" >> "$conf"
+fi
+
+hyprctl keyword monitor "$descriptor" > /dev/null

modules/scripts/gtk-theme-set.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Regenerates GTK3/4 CSS + settings.ini to match the current Quickshell
+# theme (accent color + dark/light mode). These used to be static,
+# Nix-rebuild-only files (symlinked straight into the store) — this makes
+# them live-editable instead, the same way cursor.conf/display.conf work,
+# so the Theme picker can actually reach GTK apps like Thunar.
+set -euo pipefail
+
+accent="${1:?usage: gtk-theme-set <accent> <bg> <bgAlt> <fg> <fgDim> <border> <dark:1|0>}"
+bg="${2:?bg required}"
+bg_alt="${3:?bgAlt required}"
+fg="${4:?fg required}"
+fg_dim="${5:?fgDim required}"
+border="${6:?border required}"
+dark="${7:?dark required}"
+
+dir3="$HOME/.config/gtk-3.0"
+dir4="$HOME/.config/gtk-4.0"
+mkdir -p "$dir3" "$dir4"
+
+css_file=$(mktemp)
+cat > "$css_file" <<EOF
+/* Squared corners + accent colors, generated by gtk-theme-set from the
+   Quickshell Theme picker — GTK's CSS is a subset of real CSS: no
+   !important, and zero still needs a unit.
+
+   The @define-color block matters more than it looks: plain selector
+   overrides (window, .background, .view, ...) only get you so far —
+   Thunar's icon-view content area and sidebar tree view turned out to
+   pull their actual fill color from these named theme variables
+   internally, not from the generic background-color cascade. Verified
+   live: without redefining theme_base_color specifically, the sidebar
+   and file grid stayed white no matter how broad the selector list got. */
+@define-color theme_bg_color $bg;
+@define-color theme_base_color $bg;
+@define-color theme_fg_color $fg;
+@define-color theme_text_color $fg;
+@define-color theme_selected_bg_color $accent;
+@define-color theme_selected_fg_color $bg;
+@define-color borders $border;
+
+* {
+  border-radius: 0px;
+  -gtk-outline-radius: 0px;
+}
+window, .background, .view, iconview, treeview, treeview.view, list, row,
+notebook, notebook > stack, scrolledwindow, viewport {
+  background-color: $bg;
+  color: $fg;
+}
+iconview.cell, iconview text {
+  background-color: $bg;
+  color: $fg;
+}
+treeview.view:selected, row:selected, iconview:selected {
+  background-color: $accent;
+  color: $bg;
+}
+headerbar, .titlebar {
+  background-color: $bg_alt;
+  color: $fg;
+  border-color: $border;
+  box-shadow: none;
+}
+button {
+  border-color: $border;
+}
+button:hover {
+  background-color: $bg_alt;
+}
+selection, *:selected {
+  background-color: $accent;
+  color: $bg;
+}
+EOF
+
+cp "$css_file" "$dir3/gtk.css"
+cp "$css_file" "$dir4/gtk.css"
+rm -f "$css_file"
+
+prefer_dark="false"
+theme_name="Adwaita"
+icon_theme="Gruvbox-Plus-Light"
+if [ "$dark" = "1" ]; then
+    prefer_dark="true"
+    theme_name="Adwaita-dark"
+    icon_theme="Gruvbox-Plus-Dark"
+fi
+
+ini_file=$(mktemp)
+cat > "$ini_file" <<EOF
+[Settings]
+gtk-application-prefer-dark-theme=$prefer_dark
+gtk-theme-name=$theme_name
+gtk-icon-theme-name=$icon_theme
+gtk-font-name=Noto Sans, 10
+gtk-enable-animations=true
+EOF
+
+cp "$ini_file" "$dir3/settings.ini"
+cp "$ini_file" "$dir4/settings.ini"
+rm -f "$ini_file"
+
+# settings.ini alone isn't enough: GTK3 binds gtk-theme-name/icon-theme-name
+# to org.gnome.desktop.interface via GSettings whenever that schema and a
+# dconf backend are present (they are here — dconf-service was already
+# running), and that binding wins over settings.ini unconditionally. This
+# machine's dconf database had hard values left over (gtk-theme='Breeze',
+# icon-theme='breeze') that silently overrode every settings.ini edit —
+# which is why neither accent/dark-mode nor the Gruvbox icon switch ever
+# reached Thunar. Writing the same values to dconf keeps both sources in
+# sync so it doesn't matter which one GTK actually reads from.
+if command -v dconf >/dev/null 2>&1; then
+    color_scheme="default"
+    [ "$dark" = "1" ] && color_scheme="prefer-dark"
+    dconf write /org/gnome/desktop/interface/gtk-theme "'$theme_name'"
+    dconf write /org/gnome/desktop/interface/icon-theme "'$icon_theme'"
+    dconf write /org/gnome/desktop/interface/color-scheme "'$color_scheme'"
+fi

modules/scripts/hotspot-start.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Starts a Wi-Fi hotspot with explicit security/band control — the simple
+# `nmcli device wifi hotspot` one-liner doesn't expose those.
+#   hotspot-start <ssid> <password> <wpa2|wpa3> <auto|bg|a>
+set -euo pipefail
+
+ssid="${1:?usage: hotspot-start <ssid> <password> <wpa2|wpa3> <auto|bg|a>}"
+password="${2:?password required}"
+security="${3:-wpa2}"
+band="${4:-auto}"
+
+iface=$(nmcli -t -f DEVICE,TYPE device | awk -F: '$2=="wifi"{print $1; exit}')
+if [ -z "$iface" ]; then
+    echo "No Wi-Fi device found" >&2
+    exit 1
+fi
+
+# Idempotent: drop any previous Hotspot profile from an earlier run first.
+nmcli connection delete Hotspot >/dev/null 2>&1 || true
+
+key_mgmt="wpa-psk"
+[ "$security" = "wpa3" ] && key_mgmt="sae"
+
+nmcli connection add type wifi ifname "$iface" con-name Hotspot autoconnect no ssid "$ssid" > /dev/null
+nmcli connection modify Hotspot 802-11-wireless.mode ap
+if [ "$band" != "auto" ]; then
+    nmcli connection modify Hotspot 802-11-wireless.band "$band"
+fi
+nmcli connection modify Hotspot wifi-sec.key-mgmt "$key_mgmt"
+nmcli connection modify Hotspot wifi-sec.psk "$password"
+nmcli connection modify Hotspot ipv4.method shared
+
+nmcli connection up Hotspot

modules/scripts/hypr-theme-set.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Applies Hyprland's active/inactive window border colors immediately AND
+# persists them into ~/.config/hypr/display.conf's sibling, theme.conf
+# (sourced by hyprland.conf after the static general{} block, so it
+# overrides those hardcoded defaults) — without that file, a config
+# reload/restart would silently revert to whatever's hardcoded in
+# hyprland.conf, same class of bug as the display-settings one.
+set -euo pipefail
+
+accent="${1:?usage: hypr-theme-set <accent_hex_no_hash> <border_hex_no_hash>}"
+border="${2:?border required}"
+
+hyprctl keyword general:col.active_border "rgba(${accent}ff)" > /dev/null
+hyprctl keyword general:col.inactive_border "rgba(${border}ff)" > /dev/null
+
+conf="$HOME/.config/hypr/theme.conf"
+mkdir -p "$(dirname "$conf")"
+cat > "$conf" <<EOF
+general {
+    col.active_border = rgba(${accent}ff)
+    col.inactive_border = rgba(${border}ff)
+}
+EOF

modules/scripts/kitty-theme-set.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Regenerates ~/.config/kitty/theme.conf (included from kitty.conf) to
+# match the current Quickshell theme. No explicit reload needed — kitty
+# has a built-in config-file watcher (visible as `kitten __watch_conf__`
+# in its process list) that also watches included files, so this takes
+# effect live in already-open kitty windows.
+set -euo pipefail
+
+accent="${1:?usage: kitty-theme-set <accent> <bg> <bgAlt> <fg> <fgDim> <border>}"
+bg="${2:?bg required}"
+bg_alt="${3:?bgAlt required}"
+fg="${4:?fg required}"
+fg_dim="${5:?fgDim required}"
+border="${6:?border required}"
+
+conf="$HOME/.config/kitty/theme.conf"
+mkdir -p "$(dirname "$conf")"
+
+cat > "$conf" <<EOF
+background               $bg
+foreground                $fg
+selection_background      $border
+selection_foreground      $fg
+cursor                    $fg
+active_border_color       $accent
+inactive_border_color     $border
+active_tab_background     $bg_alt
+active_tab_foreground     $fg
+inactive_tab_background   $bg
+inactive_tab_foreground   $fg_dim
+EOF

modules/scripts/list-cursor-themes.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Lists installed Xcursor themes by scanning the real XCURSOR_PATH locations
+# for a "cursors" subdirectory — no hardcoded theme names.
+set -euo pipefail
+
+dirs=(
+    "$HOME/.icons"
+    "$HOME/.local/share/icons"
+    "/run/current-system/sw/share/icons"
+    # Packages installed via users.users.<name>.packages (as opposed to
+    # environment.systemPackages) land here, not under
+    # /run/current-system/sw — this is where bibata-cursors actually is.
+    "/etc/profiles/per-user/$USER/share/icons"
+)
+
+for d in "${dirs[@]}"; do
+    [ -d "$d" ] || continue
+    for theme in "$d"/*/; do
+        [ -d "${theme}cursors" ] || continue
+        basename "$theme"
+    done
+done | sort -u

modules/scripts/rofi-theme-set.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Regenerates ~/.config/rofi/theme.rasi (imported by config.rasi) to match
+# the current Quickshell theme. Rofi has no config-file watcher — unlike
+# kitty, it's launched on demand rather than staying resident, so the next
+# time it's opened it just reads whatever is on disk. No reload step needed.
+set -euo pipefail
+
+accent="${1:?usage: rofi-theme-set <accent> <bg> <bgAlt> <fg> <fgDim> <border> <dark:1|0>}"
+bg="${2:?bg required}"
+bg_alt="${3:?bgAlt required}"
+fg="${4:?fg required}"
+fg_dim="${5:?fgDim required}"
+border="${6:?border required}"
+dark="${7:?dark required}"
+
+icon_theme="Gruvbox-Plus-Light"
+if [ "$dark" = "1" ]; then
+    icon_theme="Gruvbox-Plus-Dark"
+fi
+
+conf="$HOME/.config/rofi/theme.rasi"
+mkdir -p "$(dirname "$conf")"
+
+cat > "$conf" <<EOF
+* {
+    bg:            ${bg}ee;
+    bg-alt:        ${bg_alt}ee;
+    fg:            ${fg}ff;
+    accent:        ${accent}ff;
+    border-color:  ${border}ff;
+    placeholder:   ${fg_dim}ff;
+}
+configuration {
+    icon-theme: "$icon_theme";
+}
+EOF

modules/scripts/screenshot.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# Unified screenshot helper.
+#   screenshot <region|full|window> <clipboard|file|both>
+set -euo pipefail
+
+mode="${1:-region}"
+action="${2:-both}"
+
+geom=()
+case "$mode" in
+    region)
+        sel="$(slurp)" || exit 0
+        [ -z "$sel" ] && exit 0
+        geom=(-g "$sel")
+        ;;
+    window)
+        win="$(hyprctl activewindow -j)"
+        at_x=$(echo "$win" | jq -r '.at[0]')
+        at_y=$(echo "$win" | jq -r '.at[1]')
+        w=$(echo "$win" | jq -r '.size[0]')
+        h=$(echo "$win" | jq -r '.size[1]')
+        geom=(-g "${at_x},${at_y} ${w}x${h}")
+        ;;
+    full)
+        geom=()
+        ;;
+    *)
+        echo "unknown mode: $mode (expected region|full|window)" >&2
+        exit 1
+        ;;
+esac
+
+mkdir -p "$HOME/Screenshots"
+file="$HOME/Screenshots/$(date +%Y-%m-%d_%H-%M-%S).png"
+
+case "$action" in
+    clipboard)
+        grim "${geom[@]}" - | wl-copy
+        ;;
+    file)
+        grim "${geom[@]}" "$file"
+        ;;
+    both)
+        grim "${geom[@]}" "$file"
+        wl-copy < "$file"
+        ;;
+    *)
+        echo "unknown action: $action (expected clipboard|file|both)" >&2
+        exit 1
+        ;;
+esac

modules/scripts/show-desktop-toggle.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# "Show desktop" for Hyprland: stashes every window on the active workspace
+# into a hidden special workspace, and restores each one to the workspace
+# it came from on the next press — regardless of which workspace you're on
+# when you press it again (a single global state file, not one keyed by
+# "current workspace", which broke the moment you switched workspaces
+# in between).
+set -euo pipefail
+
+state_file="${XDG_RUNTIME_DIR:-/tmp}/hypr-show-desktop.json"
+
+if [ -s "$state_file" ]; then
+    jq -c '.[]' "$state_file" | while IFS= read -r entry; do
+        addr=$(echo "$entry" | jq -r '.address')
+        ws=$(echo "$entry" | jq -r '.workspace')
+        hyprctl dispatch movetoworkspacesilent "$ws,address:$addr" > /dev/null
+    done
+    rm -f "$state_file"
+else
+    ws_id=$(hyprctl activeworkspace -j | jq -r '.id')
+    hyprctl clients -j | jq -c --argjson ws "$ws_id" \
+        '[.[] | select(.workspace.id == $ws) | {address: .address, workspace: $ws}]' > "$state_file"
+    jq -r '.[].address' "$state_file" | while IFS= read -r addr; do
+        [ -n "$addr" ] && hyprctl dispatch movetoworkspacesilent "special:showdesktop,address:$addr" > /dev/null
+    done
+fi

modules/scripts/strip-metadata.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+if [ $# -eq 0 ]; then
+    echo "Usage: strip-metadata <file_or_directory>"
+    exit 1
+fi
+
+TARGET="$1"
+
+echo "[*] Stripping metadata from: $TARGET"
+
+# Remove all embedded metadata while keeping original filenames
+if command -v exiftool &> /dev/null; then
+    exiftool -all= -overwrite_original -r "$TARGET"
+    echo "[+] Exif metadata removed."
+else
+    echo "[!] Warning: exiftool is not installed."
+fi
+
+# Reset timestamps (atime and mtime) to Epoch (1970-01-01 00:00:00)
+echo "[*] Resetting timestamps..."
+find "$TARGET" -exec touch -t 197001010000.00 {} +
+
+echo "[+] Operation completed successfully."

modules/scripts/vault-toggle.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+CIPHER_DIR="/run/media/nexoniarz/Lukas/.vault_cipher"
+MOUNT_DIR="$HOME/Vault"
+
+mkdir -p "$CIPHER_DIR" "$MOUNT_DIR"
+
+if mountpoint -q "$MOUNT_DIR"; then
+    echo "[*] Synchronizing buffers and unmounting Vault..."
+    sync
+
+    if fusermount -u "$MOUNT_DIR"; then
+        echo "[+] Vault unmounted successfully."
+    else
+        echo "[!] Failed to unmount Vault. Check if any application is using $MOUNT_DIR"
+        exit 1
+    fi
+else
+    echo "[*] Mounting Vault..."
+    if [ ! -f "$CIPHER_DIR/gocryptfs.conf" ]; then
+        echo "[!] Container not initialized. Initializing new gocryptfs vault..."
+        gocryptfs -init "$CIPHER_DIR" || exit 1
+    fi
+    if gocryptfs -allow_other "$CIPHER_DIR" "$MOUNT_DIR"; then
+        echo "[+] Vault mounted successfully at $MOUNT_DIR"
+    else
+        echo "[!] Mount failed."
+        exit 1
+    fi
+fi

modules/scripts/wallpaper-delete.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Removes a wallpaper by moving it to the freedesktop.org trash
+# (~/.local/share/Trash), the same mechanism Thunar's own delete uses —
+# so it shows up in Thunar's Trash and can be restored from there,
+# instead of `rm` permanently destroying it with no way back.
+set -euo pipefail
+
+path="${1:?usage: wallpaper-delete <path>}"
+[ -e "$path" ] || exit 0
+
+trash_dir="$HOME/.local/share/Trash"
+mkdir -p "$trash_dir/files" "$trash_dir/info"
+
+name="$(basename "$path")"
+dest="$trash_dir/files/$name"
+info="$trash_dir/info/$name.trashinfo"
+n=1
+while [ -e "$dest" ] || [ -e "$info" ]; do
+    dest="$trash_dir/files/${name}.$n"
+    info="$trash_dir/info/${name}.$n.trashinfo"
+    n=$((n + 1))
+done
+
+cat > "$info" <<EOF
+[Trash Info]
+Path=$path
+DeletionDate=$(date +%Y-%m-%dT%H:%M:%S)
+EOF
+
+mv "$path" "$dest"

modules/scripts/wallpaper-set.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Sets the desktop wallpaper — static images go through hyprpaper's IPC,
+# video files loop via mpvpaper. Only one backend should ever be driving
+# the background at a time, so switching to one always tears the other
+# down first.
+#
+# usage: wallpaper-set <path> [fit_mode] [muted] [speed] [auto_pause]
+#   fit_mode:   cover|contain   (static images only, default cover)
+#   muted:      1|0             (animated only, default 1)
+#   speed:      playback speed  (animated only, default 1.0)
+#   auto_pause: 1|0             (animated only — mpvpaper -p, pauses
+#                                 playback while the wallpaper is hidden
+#                                 behind a fullscreen window, default 1)
+set -euo pipefail
+
+image="${1:?usage: wallpaper-set <path> [fit_mode] [muted] [speed] [auto_pause]}"
+fit_mode="${2:-cover}"
+muted="${3:-1}"
+speed="${4:-1.0}"
+auto_pause="${5:-1}"
+
+case "${image,,}" in
+    *.mp4|*.webm|*.mkv|*.mov|*.gif)
+        # -9: plain SIGTERM doesn't reliably kill mpvpaper (verified live —
+        # it survives pkill -f without -9), which would leave the old
+        # instance still holding the layer-shell surface underneath a new
+        # one. The short sleep gives it a moment to actually release that
+        # surface before a replacement tries to claim it.
+        pkill -9 -f mpvpaper > /dev/null 2>&1 || true
+        sleep 0.3
+
+        mpv_opts="loop-playlist=inf speed=$speed"
+        [ "$muted" = "1" ] && mpv_opts="no-audio $mpv_opts"
+
+        mpvpaper_flags=()
+        [ "$auto_pause" = "1" ] && mpvpaper_flags+=("-p")
+
+        # setsid + disown so mpvpaper (which runs forever, looping the
+        # video) survives after this script exits.
+        setsid mpvpaper "${mpvpaper_flags[@]}" -o "$mpv_opts" '*' "$image" \
+            > /dev/null 2>&1 < /dev/null &
+        disown
+        ;;
+    *)
+        # -9: plain SIGTERM doesn't reliably kill mpvpaper (verified live —
+        # it survives pkill -f without -9), which would leave the old
+        # instance still holding the layer-shell surface underneath a new
+        # one. The short sleep gives it a moment to actually release that
+        # surface before a replacement tries to claim it.
+        pkill -9 -f mpvpaper > /dev/null 2>&1 || true
+        sleep 0.3
+        # This hyprpaper version's IPC only exposes a single `wallpaper`
+        # request (confirmed via `hyprctl hyprpaper --help`) — it loads
+        # and swaps the image in one call. preload/unload/listloaded
+        # requests it used to need don't exist anymore and error out with
+        # "invalid hyprpaper request", which — combined with `set -e` —
+        # was aborting this script before it ever got here.
+        hyprctl hyprpaper wallpaper ",$image,$fit_mode" > /dev/null
+        ;;
+esac

modules/system.nix

@@ -0,0 +1,204 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Bootloader & Kernel
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot.configurationLimit = 5;
+  boot.kernelPackages = pkgs.linuxPackages;
+  boot.supportedFilesystems = [ "fuse" ];
+
+  # Networking
+  networking.hostName = "nixos";
+  networking.networkmanager.enable = true;
+
+  # Firewall Configuration
+  networking.firewall = {
+    enable = true;
+
+    # Allow local ping diagnostic queries
+    allowPing = true;
+
+    allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
+    allowedUDPPortRanges = [ { from = 1714; to = 1764; } ];
+    allowedTCPPorts = [ 80 443 ];
+    # allowedUDPPorts = [ ];
+  };
+
+  # Time zone and Internationalization
+  time.timeZone = "Europe/Warsaw";
+  i18n.defaultLocale = "pl_PL.UTF-8";
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "pl_PL.UTF-8";
+    LC_IDENTIFICATION = "pl_PL.UTF-8";
+    LC_MEASUREMENT = "pl_PL.UTF-8";
+    LC_MONETARY = "pl_PL.UTF-8";
+    LC_NAME = "pl_PL.UTF-8";
+    LC_NUMERIC = "pl_PL.UTF-8";
+    LC_PAPER = "pl_PL.UTF-8";
+    LC_TELEPHONE = "pl_PL.UTF-8";
+    LC_TIME = "pl_PL.UTF-8";
+  };
+
+  nix.settings.auto-optimise-store = true;
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 7d";
+  };
+
+  # Console keymap
+  console.keyMap = "pl2";
+
+  # Sound and Audio (Pipewire)
+  security.rtkit.enable = true;
+  services.pulseaudio.enable = false;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+
+  hardware.bluetooth = {
+    enable = true;
+    powerOnBoot = true;
+    settings = {
+      General = {
+        # Shows battery charge of connected devices on supported
+        # Bluetooth adapters. Defaults to 'false'.
+        Experimental = true;
+        # When enabled other devices can connect faster to us, however
+        # the tradeoff is increased power consumption. Defaults to
+        # 'false'.
+        FastConnectable = true;
+      };
+      Policy = {
+        # Enable all controllers when they are found. This includes
+        # adapters present on start as well as adapters that are plugged
+        # in later on. Defaults to 'true'.
+        AutoEnable = true;
+      };
+    };
+  };
+
+  services.blueman.enable = true;
+
+  #Firejail
+  programs.firejail = {
+    enable = true;
+  };
+
+  #FUSE shit
+  programs.fuse.userAllowOther = true;
+
+  # Enable GnuPG Agent with GUI pinentry support
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+    pinentryPackage = pkgs.pinentry-rofi; # Reuses the Rofi theme, no extra toolkit
+  };
+
+  security.sudo.extraConfig = ''
+    Defaults pwfeedback
+  '';
+
+  # Printing services
+  services.printing.enable = true;
+
+  nixpkgs.config.allowUnfree = true;
+
+  fonts.packages = with pkgs; [
+    corefonts
+    dejavu_fonts
+    noto-fonts
+    noto-fonts-cjk-sans
+    noto-fonts-color-emoji
+    nerd-fonts.fira-code
+    nerd-fonts.jetbrains-mono
+    nerd-fonts.hack
+    inter
+    liberation_ttf
+    roboto
+  ];
+
+  # --- Loader shim for running non-Nix-packaged binaries (e.g. the official
+  # Tor Browser bundle) that expect a standard FHS dynamic linker/libraries. ---
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = with pkgs; [
+    glib gtk3 gdk-pixbuf pango cairo atk
+    dbus dbus-glib fontconfig freetype
+    libx11 libxext libxrender libxtst
+    libxi libxcomposite libxdamage libxfixes
+    libxrandr libxcursor libxcb libxkbcommon
+    alsa-lib mesa zlib stdenv.cc.cc
+  ];
+  environment.systemPackages = [ pkgs.file ];
+
+  # --- Hardening: swap, kernel sysctls, DNS, MAC randomization ---
+
+  # Swap: replace disk swap with compressed in-RAM swap. Nothing sensitive
+  # (decrypted vault contents, browser memory, GPG session data) ever gets
+  # written to disk in plaintext via swap. Also faster than disk swap under
+  # memory pressure.
+  zramSwap.enable = true;
+  swapDevices = lib.mkForce [ ];
+  # systemd's gpt-auto-generator independently re-discovers and activates any
+  # GPT partition tagged as Linux swap, regardless of the swapDevices list
+  # above — this disables that auto-discovery so the old disk swap partition
+  # actually stays off. Doesn't affect /, /home, /nix, /boot: those are
+  # already explicitly declared in hardware-configuration.nix, not relying on
+  # gpt-auto. Takes effect on next reboot.
+  boot.kernelParams = [ "systemd.gpt_auto=0" ];
+
+  # Kernel/system hardening sysctls
+  boot.kernel.sysctl = {
+    # Hide kernel pointers from unprivileged users (blocks a common
+    # local info-leak used in exploit chains).
+    "kernel.kptr_restrict" = 2;
+    # Restrict dmesg access to root.
+    "kernel.dmesg_restrict" = 1;
+    # Reverse-path filtering: drop packets with spoofed source addresses.
+    "net.ipv4.conf.all.rp_filter" = 1;
+    "net.ipv4.conf.default.rp_filter" = 1;
+    # Don't accept/send ICMP redirects (blocks a classic local MITM trick).
+    "net.ipv4.conf.all.accept_redirects" = false;
+    "net.ipv4.conf.default.accept_redirects" = false;
+    "net.ipv6.conf.all.accept_redirects" = false;
+    "net.ipv6.conf.default.accept_redirects" = false;
+    "net.ipv4.conf.all.send_redirects" = false;
+    "net.ipv4.conf.default.send_redirects" = false;
+  };
+
+  # Crash dumps can contain decrypted memory contents, passwords, keys —
+  # never write them to disk.
+  systemd.coredump.enable = false;
+
+  # Blocks kexec-based kernel image tampering.
+  security.protectKernelImage = true;
+
+  # DNS-over-TLS system-wide (Tor Browser already routes its own DNS
+  # through Tor, so this only affects everything else). Cloudflare + Quad9
+  # both support DoT; "allow-downgrade" avoids hard failures on domains
+  # with broken DNSSEC deployment.
+  networking.nameservers = [ "1.1.1.1#cloudflare-dns.com" "9.9.9.9#dns.quad9.net" ];
+  services.resolved = {
+    enable = true;
+    settings.Resolve = {
+      DNSSEC = "allow-downgrade";
+      DNSOverTLS = "true";
+    };
+  };
+  networking.networkmanager.dns = "systemd-resolved";
+
+  # MAC address randomization.
+  # WiFi: fully random per connection (you're on ethernet now, but this
+  # protects you if you ever use WiFi).
+  # Ethernet: "stable" — a consistent pseudonymous MAC per connection
+  # profile rather than your real hardware MAC, so it won't break any
+  # static DHCP reservation/MAC filtering on your OpenWRT router, while
+  # still not exposing your real hardware identity.
+  networking.networkmanager.wifi.macAddress = "random";
+  networking.networkmanager.wifi.scanRandMacAddress = true;
+  networking.networkmanager.ethernet.macAddress = "stable";
+}

modules/theme.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, lib, ... }:
+
+{
+  # Dark GTK theme (built into GTK3/4's Adwaita since 3.20) for Thunar and
+  # other GTK apps, as a starting point. The actual palette (accent color,
+  # dark/light) is no longer static here — it's generated at runtime by
+  # gtk-theme-set (modules/scripts/gtk-theme-set.sh), called from the
+  # Quickshell Theme picker (dotfiles/quickshell/Theme.qml) every time the
+  # theme changes, so switching accent/mode there actually reaches GTK
+  # apps instead of requiring a rebuild.
+  environment.systemPackages = with pkgs; [
+    gnome-themes-extra
+    adwaita-icon-theme
+    gruvbox-plus-icons
+    dconf
+  ];
+
+  # No environment.sessionVariables.GTK_THEME here on purpose: GTK_THEME
+  # takes priority over settings.ini's gtk-theme-name for GTK3 apps, and
+  # as a session env var it's fixed at login — it can't be changed live.
+  # A leftover "Adwaita:dark" override here was silently overriding
+  # whatever gtk-theme-set wrote to settings.ini, permanently forcing
+  # dark mode and blocking the Theme picker from ever reaching Thunar.
+
+  systemd.tmpfiles.rules = [
+    "d /home/nexoniarz/.config/gtk-3.0 0755 nexoniarz users -"
+    "d /home/nexoniarz/.config/gtk-4.0 0755 nexoniarz users -"
+    # `f`, not `L+`: created empty only if missing, never overwritten on
+    # rebuild — gtk-theme-set owns the actual content from here on.
+    "f /home/nexoniarz/.config/gtk-3.0/gtk.css 0644 nexoniarz users - -"
+    "f /home/nexoniarz/.config/gtk-4.0/gtk.css 0644 nexoniarz users - -"
+    "f /home/nexoniarz/.config/gtk-3.0/settings.ini 0644 nexoniarz users - -"
+    "f /home/nexoniarz/.config/gtk-4.0/settings.ini 0644 nexoniarz users - -"
+  ];
+}

modules/users.nix

@@ -0,0 +1,27 @@
+{ config, pkgs, ... }:
+
+{
+  # Primary user account configuration (Access and settings only)
+  users.users."nexoniarz" = {
+    isNormalUser = true;
+    description = "Nexoniarz";
+    extraGroups = [ "networkmanager" "wheel" "fuse" "i2c" "video" ];
+    shell = pkgs.zsh;
+  };
+
+  # Default shell (ZSH)
+  programs.zsh.enable = true;
+
+  # Web browser configuration
+  programs.firefox.enable = true;
+
+  # Enable Steam with optimized system configurations
+  programs.steam = {
+    enable = true;
+    remotePlay.openFirewall = true;
+    dedicatedServer.openFirewall = true;
+  };
+
+  # Enable Flatpak support
+  services.flatpak.enable = true;
+}