refactor: shared desktop profile for enzo + kusanagi

profiles/desktop.nix becomes a username-agnostic shared base (niri, dconf, the
dark-theme portal fix, greetd, pipewire base, gpg agent, graphics, Firefox with
blank-home/no-bookmarks prefs, common desktop tools, font base). Both hosts now
import it.

Per-host desktop config splits into machines/<host>/desktop.nix:
- enzo: Adwaita cursor + monospace, HiDPI console font, yambar, hwebs groups.
- kusanagi (new file): GNOME/X11, printing/avahi/udisks2, pro-audio
  (rtkit/jack/32-bit), gpg ssh support, richer fonts, Bibata cursor, henz
  desktop groups, waybar/nm-applet.

Shared profile is username-agnostic (enzo=hwebs, kusanagi=henz): shared desktop
tools moved to environment.systemPackages, per-user groups stay in machine
files. Firefox now owned by the shared profile, so its redundant enable is
dropped from profiles/apps.nix. Dark theme + Firefox tweaks now apply to both
hosts. Both configurations build.

Assisted-by: Claude:claude-opus-4-8

2 files changed, 120 insertions, 0 deletions

diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix
index 10531c2..c39db8e 100644
--- a/machines/kusanagi/default.nix
+++ b/machines/kusanagi/default.nix
@@ -6,6 +6,7 @@
 {
   imports = [
     ../../profiles/desktop.nix
+    ./desktop.nix
     ../../profiles/dev.nix
     ../../profiles/apps.nix
     ./hardware-configuration.nix
diff --git a/machines/kusanagi/desktop.nix b/machines/kusanagi/desktop.nix
new file mode 100644
index 0000000..368022e
--- /dev/null
+++ b/machines/kusanagi/desktop.nix
@@ -0,0 +1,119 @@
+# kusanagi-only desktop extras. The shared niri/dark/audio/firefox base comes
+# from ../../profiles/desktop.nix (imported in ./default.nix); this file holds
+# the workstation's GNOME session, printing/scanning, pro-audio, richer fonts,
+# and cursor theme. (Hardware-specific audio/NAS/server config lives in
+# ./default.nix.)
+{ pkgs, ... }:
+
+{
+  # --- X11 + GNOME (alongside the niri session) ---
+  services.xserver.enable = true;
+  services.xserver.xkb = {
+    layout = "us";
+    variant = "";
+  };
+  services.displayManager.gdm.enable = false;
+  services.desktopManager.gnome.enable = true;
+
+  # --- Printing / discovery / disks ---
+  services.printing = {
+    enable = true;
+    drivers = with pkgs; [ gutenprint ];
+  };
+
+  # mDNS: printer discovery, and resolves kusanagi's *.local NAS names.
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = true;
+  };
+
+  # prevent auto-mounting optical disks
+  services.udisks2.enable = true;
+
+  # --- Pro audio (extends the shared pipewire base) ---
+  security.rtkit.enable = true;
+  services.pipewire = {
+    alsa.support32Bit = true;
+    jack.enable = true;
+    wireplumber.enable = true;
+  };
+
+  # --- GPG: forward the ssh-agent socket (workstation signs/auths via GPG) ---
+  programs.gnupg.agent.enableSSHSupport = true;
+
+  # --- Graphics: 32-bit for Steam/Wine ---
+  hardware.graphics.enable32Bit = true;
+
+  # --- Fonts: workstation extras + defaults (base packages from shared) ---
+  fonts = {
+    packages = with pkgs; [
+      noto-fonts-cjk-sans
+      noto-fonts-cjk-serif
+      inter
+      ibm-plex
+      public-sans
+    ];
+
+    fontconfig = {
+      defaultFonts = {
+        monospace = [
+          "Berkeley Mono"
+          "Liberation Mono"
+          "Symbols Nerd Font"
+        ];
+        sansSerif = [
+          "Liberation Sans"
+          "Noto Sans"
+        ];
+        serif = [ "Liberation Serif" ];
+        emoji = [ "Nerd Font Symbols Only" ];
+      };
+
+      # Force ui-sans-serif and system-ui to resolve correctly
+      localConf = ''
+        <?xml version="1.0"?>
+        <!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+        <fontconfig>
+          <alias>
+            <family>system-ui</family>
+            <prefer>
+              <family>Liberation Sans</family>
+            </prefer>
+          </alias>
+          <alias>
+            <family>ui-sans-serif</family>
+            <prefer>
+              <family>Liberation Sans</family>
+            </prefer>
+          </alias>
+        </fontconfig>
+      '';
+    };
+
+    fontDir.enable = true;
+  };
+
+  # --- Cursor / renderer ---
+  environment.sessionVariables = {
+    GSK_RENDERER = "gl";
+    XCURSOR_THEME = "Bibata-Modern-Classic";
+    XCURSOR_SIZE = "24";
+    HYPRCURSOR_THEME = "Bibata-Modern-Classic";
+    HYPRCURSOR_SIZE = "24";
+  };
+
+  # --- User: desktop groups (niri essentials + printing). Hardware groups
+  # (cdrom/optical/sg/scanner) stay in ./default.nix. ---
+  users.users.henz.extraGroups = [
+    "audio"
+    "lp"
+    "input"
+  ];
+
+  # --- Desktop tools specific to kusanagi (shared ones come from the profile) ---
+  environment.systemPackages = with pkgs; [
+    waybar
+    networkmanagerapplet
+  ];
+}