- fingerprintingProtection with every protection on except forced light
mode: canvas/WebGL randomized, generic GPU name, UTC, fixed core count
- Accept-Language en-US, en (the common value)
- Firefox runs with its own fontconfig file that leaves out corefonts, so
sites can't measure them; other apps keep them
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Radeon Vega 8 iGPU now drives the desktop; the RTX 3060 Ti is used
through PRIME offload for games (everything launched by Steam) and for
LLMs (CUDA). Firefox video decoding moves to the iGPU's radeonsi VA-API,
so the nvidia-vaapi env vars are gone and Firefox's RDD sandbox is back on.
Requires the iGPU enabled as primary display in BIOS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
NVIDIA stays primary for displays; the 5700G iGPU (amdgpu + Mesa RADV)
is available for Vulkan compute such as LM Studio. Adds vulkan-tools
and amdgpu_top for checking it. Requires the iGPU enabled in BIOS.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
system.nix had grown to 200 lines covering boot, networking, locale,
audio, Bluetooth, fonts, nix settings, hardening, DNS and RGB. Split it
by concern into boot.nix, networking.nix, locale.nix, nix-settings.nix,
security.nix and audio.nix.
Also:
- drivers.nix -> hardware.nix, absorbing Bluetooth, the I2C udev rule,
OpenRGB and printing
- fonts -> desktop.nix
- nix-ld and pkgs.file -> apps.nix
- the Bottles tmpfiles link -> users.nix, next to services.flatpak
The reorganization is behavior-neutral: the dbus-1, system-units,
user-units and system-path trees are byte-identical to the previous
build once self-referential store paths are normalized, and
`nix store diff-closures` against the running system reports exactly
one change -- go 1.26.7.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Budgie's Wayland session had been broken; Plasma 6 replaces it with SDDM
still handling the Wayland greeter. Since the KDE apps in apps.nix were
already installed as GTK/MATE replacements, Budgie's exclude-package list
is no longer needed under native Plasma.
Also: OpenRGB service + udev rule, RTL-SDR/system tweaks, lmms, qemu,
qt5/qt6 qtwayland, nix flakes enabled.
RTL-SDR Blog V4. The V4 swapped the R820T2 tuner for an R828D behind a
built-in HF upconverter, so it needs the rtlsdrblog fork of librtlsdr --
the stock Osmocom one reports no supported devices. pkgs.rtl-sdr on this
channel already is that fork (rtl-sdr-blog 1.3.5), so hardware.rtl-sdr's
default package is correct as-is. That also blacklists the DVB-T drivers
that otherwise grab the dongle on plug-in, and ships udev rules handing it
to plugdev at 0660 -- hence plugdev in the user's groups, or every SDR app
needs root. Apps: SDR++ and rtl_433; the rtl_* CLI tools come with the
driver.
Both SDR apps are overridden to drop hardware we do not own. SDR++ and
rtl_433 default to supporting every radio ever made, which pulled in UHD
(1.4 GB of USRP firmware), BladeRF and LimeSuite. gqrx was the original
choice but reaches UHD through gr-osmosdr's gr-uhd feature; SDR++ uses no
GNU Radio at all. Per-package overrides rather than a global overlay, so
nothing else is affected.
Bootloader: systemd-boot -> Limine, themed to match the Gruvbox icon
theme. Limine installs to its own EFI directory and adds its own NVRAM
entry, so systemd-boot stays on the ESP as a firmware-menu fallback.
Display manager: lightdm -> SDDM with wayland.enable. Budgie in this
channel ships only a Wayland session (labwc) and was already running as
one; lightdm just handles that badly. SDDM's greeter runs on weston, not
kwin, so no KDE compositor comes along.
Qt defaults over Budgie's GTK/MATE apps. The Budgie module force-enables
gnome-terminal and installs nemo, eom, pluma, atril, engrampa, mate-calc
and mate-system-monitor; environment.budgie.excludePackages drops all of
them in favour of konsole, dolphin, gwenview, kate, okular, ark, kcalc and
plasma-systemmonitor. default-apps.nix rewritten to match: 113
associations, video to vlc, audio to elisa, text/code to kate, and
/etc/xdg/xdg-terminals.list pointing at konsole. Fixes a real bug there --
inode/directory was mapped to gwenview, so folders opened in the image
viewer.
Hyprland-era leftovers removed. system-telemetry and weather-fetch fed
Quickshell panels that no longer exist; brightness-ctl and hotspot-start
lost their keybinds. jq went with weather-fetch. Also dropped
gnome-screenshot, playerctl and imv. vault-toggle and strip-metadata stay
-- they never depended on Hyprland.
Comments trimmed throughout: deleted anything restating the code, kept the
ones recording a why you cannot recover by reading it (systemd.gpt_auto,
disable_ertm, ptrace_scope, the stable ethernet MAC, the mimeapps.list
parser gotcha). system.nix went 225 -> 166 lines.
README rewritten -- it still described Hyprland, Quickshell and Kitty.
Screenshot dropped.
