attempt to update the screen settings

Arming the built-in xHCI root hubs made them wake on hub-level events
(USB-C PD negotiation, SD card reader, internal peripherals), causing the
laptop to immediately self-wake from suspend. Drop the root-hub rule and arm
only the keyboard leaf by VID:PID; a leaf device's remote-wakeup propagates
through the hub without the hub's own wakeup flag being set.

modules/attrs/cad/default.nix

@@ -0,0 +1,16 @@
+{
+  self,
+  moduleWithSystem,
+  ...
+}: {
+  flake.nixosModules.cad = moduleWithSystem ({...}: let
+    modules = with self.nixosModules; [
+      freecad
+      openscad
+      prusa-slicer
+    ];
+  in {
+    imports = modules;
+  });
+}
+

modules/features/freecad/default.nix

@@ -0,0 +1,9 @@
+{...}: {
+  # Screenshot capture, region selection, annotation, and clipboard support for
+  # the Hyprland screenshot keybinds managed in the dotfiles repo.
+  flake.nixosModules.freecad = {pkgs, ...}: {
+    environment.systemPackages = with pkgs; [
+      freecad
+    ];
+  };
+}

modules/features/hyprland/default.nix

@@ -11,6 +11,7 @@
       ghostty
       waybar
       quickshell
+      screenshot
     ];
   in {
     imports = modules;
@@ -148,7 +149,6 @@
       udiskie
       brightnessctl
       # clipboard
-      wl-clipboard
       cliphist
       # theming
       gsettings-desktop-schemas

modules/features/moonlight/default.nix

@@ -0,0 +1,7 @@
+{...}: {
+  flake.nixosModules.moonlight = {pkgs, ...}: {
+    environment.systemPackages = with pkgs; [
+      moonlight-qt
+    ];
+  };
+}

modules/features/nextcloud/default.nix

@@ -0,0 +1,8 @@
+{...}: {
+  # Nextcloud desktop sync client. Account and sync settings remain per-user.
+  flake.nixosModules.nextcloud = {pkgs, ...}: {
+    environment.systemPackages = with pkgs; [
+      nextcloud-client
+    ];
+  };
+}

modules/features/openscad/default.nix

@@ -0,0 +1,10 @@
+{...}: {
+  # Screenshot capture, region selection, annotation, and clipboard support for
+  # the Hyprland screenshot keybinds managed in the dotfiles repo.
+  flake.nixosModules.openscad = {pkgs, ...}: {
+    environment.systemPackages = with pkgs; [
+      openscad
+      openscad-lsp
+    ];
+  };
+}

modules/features/printing/default.nix

@@ -0,0 +1,104 @@
+{...}: {
+  # CUPS printing + eSCL scanning for the networked EPSON ET-8550.
+  #
+  # Two queues, deliberately:
+  #   EPSON_ET_8550        driverless / IPP Everywhere. The default. PDF is
+  #                        passed straight through and the printer's own RIP
+  #                        does the work. 51 page sizes, 26 borderless, and the
+  #                        only queue that can print CD/DVDs (MediaType Disc).
+  #   EPSON_ET_8550_Photo  Epson ESC/P-R. Host rasterises to ESC/P-R at 360dpi.
+  #                        34 sizes, 12 borderless, no disc support - but it is
+  #                        the only way to reach Epson's named media/quality
+  #                        presets ("Epson Ultra Glossy-Max Quality" etc) that
+  #                        IPP Everywhere cannot express. Kept for photo A/B.
+  #
+  # Note both PPDs are 360x360 HWResolution - escpr2 is not higher resolution.
+  #
+  # Both queues use the mDNS name, not 10.10.20.62, so a DHCP lease change
+  # doesn't break them. services.avahi.nssmdns4 is what resolves it.
+  # Port 9100 is closed on this printer, so socket:// is not an option.
+  #
+  # cups-browsed is off: it would auto-create a third duplicate queue for the
+  # same printer. avahi stays on for mDNS resolution and scanner discovery.
+  flake.nixosModules.printing = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: {
+    programs.system-config-printer.enable = true;
+
+    services.avahi = {
+      enable = true;
+      nssmdns4 = true;
+    };
+
+    services.printing = {
+      enable = true;
+      browsed.enable = false;
+      drivers = with pkgs; [
+        epson-escpr2
+      ];
+    };
+
+    hardware.printers = {
+      ensureDefaultPrinter = "EPSON_ET_8550";
+      ensurePrinters = [
+        {
+          name = "EPSON_ET_8550";
+          description = "EPSON ET-8550 (driverless)";
+          location = "Network";
+          deviceUri = "ipp://EPSONA70973.local:631/ipp/print";
+          model = "everywhere";
+        }
+        {
+          name = "EPSON_ET_8550_Photo";
+          description = "EPSON ET-8550 (ESC/P-R photo presets)";
+          location = "Network";
+          deviceUri = "ipp://EPSONA70973.local:631/ipp/print";
+          model = "epson-inkjet-printer-escpr2/Epson-ET-8550_Series-epson-escpr2-en.ppd";
+        }
+      ];
+    };
+
+    # hardware/printers.nix orders ensure-printers only after cups.service, but
+    # our deviceUri is an mDNS name and the driverless queue queries the printer
+    # while it is created. Run the generated script asynchronously so an offline
+    # printer cannot fail boot or nixos-rebuild, then retry until it is reachable.
+    systemd.services.ensure-printers = lib.mkIf (config.hardware.printers.ensurePrinters != [] && config.services.printing.enable) {
+      after = [
+        "avahi-daemon.service"
+        "network-online.target"
+        "nss-lookup.target"
+      ];
+      wants = [
+        "avahi-daemon.service"
+        "network-online.target"
+      ];
+      serviceConfig = {
+        Type = lib.mkForce "simple";
+        Restart = "on-failure";
+        RestartSec = "1min";
+      };
+    };
+
+    # eSCL/AirScan. The printer advertises _uscan._tcp with rs=eSCL and
+    # mopria-certified-scan=1.3, so sane-airscan drives it with no vendor
+    # backend. No scanner/lp group needed - there's no local udev device.
+    #
+    # sane-backends ships its own `escl` backend which also claims eSCL
+    # devices. Left enabled it double-lists the scanner and, worse, GETs the
+    # printer's web root and dumps the HTML response onto scanimage's stdout.
+    # Disabling it leaves sane-airscan as the only eSCL backend, which reports
+    # a far better device string (airscan:e0:EPSON ET-8550 Series).
+    hardware.sane = {
+      enable = true;
+      extraBackends = [pkgs.sane-airscan];
+      disabledDefaultBackends = ["escl"];
+    };
+
+    environment.systemPackages = with pkgs; [
+      simple-scan
+    ];
+  };
+}

modules/features/prusa-slicer/default.nix

@@ -0,0 +1,8 @@
+{...}: {
+  # PrusaSlicer package only; printer and filament profiles remain per-user.
+  flake.nixosModules.prusa-slicer = {pkgs, ...}: {
+    environment.systemPackages = with pkgs; [
+      prusa-slicer
+    ];
+  };
+}

modules/features/quickshell/default.nix

@@ -5,5 +5,6 @@
     environment.systemPackages = with pkgs; [
       quickshell
     ];
+    qt.enable = true;
   };
 }

modules/features/screenshot/default.nix

@@ -0,0 +1,12 @@
+{...}: {
+  # Screenshot capture, region selection, annotation, and clipboard support for
+  # the Hyprland screenshot keybinds managed in the dotfiles repo.
+  flake.nixosModules.screenshot = {pkgs, ...}: {
+    environment.systemPackages = with pkgs; [
+      grim
+      slurp
+      satty
+      wl-clipboard
+    ];
+  };
+}

modules/features/sunshine/default.nix

@@ -0,0 +1,13 @@
+{...}: {
+  # TODO: previously injected SLSsteam via LD_AUDIT from the sls-steam flake. Now stock.
+  flake.nixosModules.sunshine = {pkgs, ...}: {
+    services.sunshine = {
+      enable = true;
+      autoStart = true;
+      capSysAdmin = true;
+      openFirewall = true;
+      settings.output_name = "DP-3"
+    };
+    hardware.uinput.enable = true;
+  };
+}

modules/features/via/default.nix

@@ -0,0 +1,15 @@
+{...}: {
+  # QMK/VIA keyboard tooling. QMK's uaccess rule lets the active local seat talk
+  # to HID devices; remote and non-seat sessions intentionally get no access.
+  flake.nixosModules.via = {pkgs, ...}: {
+    environment.systemPackages = with pkgs; [
+      via
+      qmk
+      vial
+    ];
+
+    # Do not add pkgs.via or pkgs.vial to services.udev.packages: both make
+    # every hidraw device world-writable. QMK's rules use seat-scoped ACLs.
+    hardware.keyboard.qmk.enable = true;
+  };
+}

modules/features/yazi/default.nix

@@ -0,0 +1,8 @@
+{...}: {
+  # Yazi a cli file explorer.
+  flake.nixosModules.yazi = {pkgs, ...}: {
+    environment.systemPackages = with pkgs; [
+      yazi
+    ];
+  };
+}

modules/hosts/shadow/default.nix

@@ -20,7 +20,11 @@
       gaming
       bottles
       netops
+      prusa-slicer
+      printing
+      via
+      nextcloud
+      sunshine
     ];
   };
 }
-

modules/hosts/shadow/disks.nix

@@ -53,6 +53,22 @@
         "x-systemd.device-timeout=10"
       ];
     };
+
+    # Pin the NFS server until nas.hfx.ahmza.com points at 10.10.100.4.
+    # Automounting keeps an unavailable NAS out of the boot path.
+    nfsShare = export: {
+      device = "10.10.100.4:${export}";
+      fsType = "nfs";
+      options = [
+        "nfsvers=4.2"
+        "noauto"
+        "nofail"
+        "_netdev"
+        "x-systemd.automount"
+        "x-systemd.idle-timeout=600"
+        "x-systemd.mount-timeout=10"
+      ];
+    };
   in {
     fileSystems = {
       # Boot essentials, by UUID. UUIDs rather than labels here on purpose:
@@ -72,6 +88,8 @@
       "/mnt/dump" = spinningDrive "DUMP";
       "/mnt/bak" = spinningDrive "BAK";
       "/mnt/games" = eagerDrive "GAMES";
+      "/mnt/nas" = nfsShare "/srv/nas";
+      "/mnt/media" = nfsShare "/srv/media";
     };
 
     # Swap exists for hibernation, not for memory pressure — 31GiB of RAM on a

modules/hosts/t480/default.nix

@@ -19,6 +19,13 @@
       obsidian
       discord
       gaming
+      winbox
+      cad
+      prusa-slicer
+      netops
+      via
+      t480UsbWakeup
+      moonlight
     ];
   };
 }

modules/hosts/t480/t480Configuration.nix

@@ -7,6 +7,13 @@
     networking = {
       hostName = "t480";
     };
+    services.logind.settings.Login = {
+      HandleLidSwitch = "suspend";
+      HandleLidSwitchDocked = "ignore";
+    };
+    services.fwupd = {
+      enable = true;
+    };
   };
 }
 

modules/hosts/t480/usb-wakeup.nix

@@ -0,0 +1,19 @@
+{...}: {
+  flake.nixosModules.t480UsbWakeup = {...}: {
+    services.udev.extraRules = ''
+      # Wake the T480 from S3 suspend via a keyboard plugged into a built-in USB
+      # port. The dock connects over the Thunderbolt-3 controller (3c:00.0), which
+      # powers down in S3 and cannot detect a cold replug — so dock-connected input
+      # cannot wake the machine after an unplug-triggered suspend. The built-in xHCI
+      # (00:14.0) stays wake-capable in S3, so a keyboard on a built-in port works.
+      #
+      # Arm ONLY the keyboard itself (match by VID:PID — the USB bus path is
+      # unstable across re-enumeration). Deliberately do NOT arm the built-in root
+      # hubs: arming a whole root hub makes it wake on hub-level events (USB-C PD
+      # negotiation, the SD card reader, internal peripherals), causing spurious
+      # self-wakes. A leaf device's remote-wakeup propagates through the hub without
+      # the hub's own wakeup flag being set.
+      ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="320f", ATTR{idProduct}=="5055", ATTR{power/wakeup}="enabled"
+    '';
+  };
+}

modules/system/core/user.nix

@@ -36,6 +36,7 @@
       extraGroups = [
         "networkmanager"
         "wheel"
+        "uinput"
       ];
     };
   };

modules/system/desktop/default.nix

@@ -9,6 +9,7 @@
       hyprland
       sddm
       network
+      yazi
     ];
   in {
     imports = modules;