Commit 700bf0d

HPCesia <me@hpcesia.com>
2026-10-09 08:45:15
chore: prune all comments
Assisted-by: crush:deepseek-v4.1-flash
main
1 parent 5290666
Changed files (10)
modules
desktop
aesthetic
cursor.nix
app
nixpak
_modules
common.nix
game
gamepad.nix
gnupg.nix
disk
preservation
default.nix
hosts
tribios
networking.nix
services
caddy
default.nix
headscale
_lib.nix
mihomo
tproxy.nix
mk-settings.nix
modules/desktop/aesthetic/cursor.nix
@@ -44,9 +44,8 @@
       defaultIndexThemePackage = pkgs.writeTextFile {
         name = "index.theme";
         destination = "/share/icons/default/index.theme";
-        # Set name in icons theme, for compatibility with AwesomeWM etc. See:
+        # `Name` is required for compatibility with AwesomeWM etc. See
         # https://github.com/nix-community/home-manager/issues/2081
-        # https://wiki.archlinux.org/title/Cursor_themes#XDG_specification
         text = ''
           [Icon Theme]
           Name=Default
modules/desktop/app/nixpak/_modules/common.nix
@@ -12,9 +12,7 @@ in {
     dbus = {
       policies =
         {
-          # `see`: The bus name can be enumerated by the application.
-          # `talk`: The application can send messages to, and receive replies and signals from, the bus name.
-          # `own`: The application can own the bus name
+          # dBus policy perms: `see` enumerates, `talk` sends/receives, `own` owns.
 
           # === General ===
           "${appId}" = "own";
modules/desktop/game/gamepad.nix
@@ -31,9 +31,8 @@
         extraModprobeConfig = ''
           options bluetooth disable_ertm=Y
           ${
-            # Linux 7.1-7.2 sticky-mixer detection falsely hides the DualSense "PCM Playback Volume"
-            # that haptics need at 100%.
-            # NOTE: 7.3 demotes the check and flips the flag to MIXER_GET_CUR_OK.
+            # Linux 7.1-7.2 falsely hides the DualSense "PCM Playback Volume"
+            # that haptics need; 7.3 demotes the check and clears the flag.
             let
               kernelVersion = lib.getVersion config.boot.kernelPackages.kernel;
             in
modules/desktop/gnupg.nix
@@ -119,9 +119,7 @@
         };
 
         files = {
-          # This configuration is based on the tutorial below, it allows for a robust setup
-          # https://blog.eleven-labs.com/en/openpgp-almost-perfect-key-pair-part-1
-          # ~/.gnupg/gpg.conf
+          # Based on https://blog.eleven-labs.com/en/openpgp-almost-perfect-key-pair-part-1
           ".gnupg/gpg.conf" = {
             generator = gpgConfGenerator;
             value = {
modules/disk/preservation/default.nix
@@ -16,7 +16,7 @@
   directoryEntry = mkEntryType "directory";
   fileEntry = mkEntryType "file";
 
-  # Carrier options in the shape of `preservation.preserveAt."/…".users.*`:
+  # Per-user carrier matching a `preservation.preserveAt."/…".users.*` entry:
   #
   #   persistence."<name>" = {
   #     directories = [ … ];
modules/hosts/tribios/networking.nix
@@ -53,10 +53,9 @@
         "net.ipv6.conf.br-lan.forwarding" = 1;
       };
 
-      # Tribios' network interfaces:
+      # Interfaces (from nixos-factor):
       # wan: enP3p49s0 (2.5Gbps)
       # lan: enP4p65s0 (2.5Gbps), end0 (1.0Gbps)
-      # Automatically configurated by nixos-factor.
       networking = {
         useNetworkd = true;
         bridges = {
modules/services/caddy/default.nix
@@ -52,11 +52,8 @@
         templateName
         ;
 
-      # Priority for reaching the source host:
-      #   1. Same host                -> loopback.
-      #   2. Source has a clear text  -> use it directly.
-      #   3. Source has a secret IP   -> import it from a vaultix template.
-      #   4. Otherwise                -> abort with a helpful message.
+      # Prefer loopback, then a clear-text address, then a vaultix-imported
+      # secret; abort when none is available.
       resolveAddress = srcHost: let
         src = srcHost.address;
modules/services/headscale/_lib.nix
@@ -71,9 +71,8 @@
         reverseProxy)
     );
 
-  # Hosts whose reverse-proxy domains resolve to tailscale IPs (direct-dns
-  # mode "tailscale") are reached through the tailnet like tailnet-domain
-  # sites, so they need the same web-port grants.
+  # Direct-dns "tailscale" hosts are reached through the tailnet like
+  # tailnet-domain sites, so they need the same web-port grants.
   mkDirectDnsGrants = reverseProxy: let
     tailscaleHosts = lib.filter (h: h.v4 != null || h.v6 != null) (
       map (e: {inherit (e) v4 v6;})
modules/services/mihomo/tproxy.nix
@@ -7,10 +7,8 @@
     }: let
       cfg = host.settings.services.mihomo;
       tproxyMark = "666";
-      # Must differ from tproxyMark with an unqualified policy rule:
-      # fib_validate_source() reverse lookups (iif lo, mark kept via
-      # src_valid_mark) would otherwise re-route LAN packets into
-      # table 100 and drop them as martians.
+      # Unqualified policy rule: fib_validate_source() keeps the mark on reverse
+      # lookups (iif lo), which would re-route LAN packets into table 100.
       selfMark = "667";
       tproxyRules = pkgs.writeText "mihomo-tproxy.nft" ''
         table inet mihomo {
@@ -111,14 +109,13 @@
         "net.ipv4.conf.default.rp_filter" = 0;
       };
 
-      # The rpfilter chain's `fib saddr . mark` with the tproxy mark hits
-      # table 100 (dev lo) where oif never equals iif; exempt marked
-      # packets or every tproxied packet gets dropped.
+      # rpfilter's `fib saddr . mark` hits table 100 on marked packets (oif
+      # never equals iif there), so they must be exempted.
       networking.firewall.extraReversePathFilterRules = "meta mark { ${tproxyMark}, ${selfMark} } accept";
 
       services.mihomo = {
         # tunMode grants CAP_NET_ADMIN (no PrivateUsers) for IP_TRANSPARENT;
-        # the TUN device stays off — nftables intercepts traffic.
+        # the TUN device stays off because nftables intercepts traffic.
         tunMode = true;
         config = {
           tun.enable = lib.mkForce false;
@@ -129,10 +126,8 @@
       systemd.services.mihomo = {
         serviceConfig = let
           ip = lib.getExe' pkgs.iproute2 "ip";
-          # fib_validate_source() keeps the fwmark (src_valid_mark), so
-          # reverse lookups (iif lo) would hit table 100 (RTN_LOCAL) and
-          # drop as martians; qualifying the rule by LAN ingress keeps
-          # forward lookups matching while reverse ones miss it.
+          # Qualify by LAN ingress: fib_validate_source() keeps the fwmark, so a
+          # bare rule would also match reverse lookups (iif lo) into table 100.
           ipRulesAdd =
             lib.concatMapStrings (ifname: ''
               ${ip} rule add fwmark ${tproxyMark} iif ${ifname} lookup 100 pref 5000 2>/dev/null || true
modules/mk-settings.nix
@@ -1,16 +1,5 @@
-# Per-aspect settings surface for hosts and users.
-#
-#   den.aspects.<name>.settings.host = { <opt> = lib.mkOption ...; };
-#   den.aspects.<name>.settings.user = { <opt> = lib.mkOption ...; };
-#
-# Collected into the schemas as typed options:
-#
-#   den.schema.host.options.settings.<aspect-path>.<option>
-#   den.schema.user.options.system.settings.<aspect-path>.<option>
-#
-# Hosts/users provide values at the same path on their entities, and
-# aspects read them from their context. User values merge the shared
-# `den.users.<username>` registry first, as lowest-priority definitions.
+# Settings surface shared by hosts and users. Aspects declare
+# `settings.{host,user}`; entities supply values and aspects read them back.
 {
   config,
   lib,