feat(desktop): driverless printing, OpenVPN plugin, VLC

networking.networkmanager.plugins defaulted to an empty list, so
NetworkManager offered no OpenVPN connection type at all.

Printing is driverless: asked over IPP the Samsung M267x 287x reports
image/urf and application/PCLm, so CUPS builds the queue from the
printer's own capabilities. No PPD, no unfree driver, and no printer
declared here. Avahi provides the discovery and resolves .local.

VLC instead of the mpv the Arch lists carry.

DECISIONS.md

@@ -1,5 +1,41 @@
 # Decisions
 
+## 2026-08-20 – Printing is driverless, VPN gets its plugin, VLC replaces mpv
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: Comparing the package set against the Arch lists turned up gaps that
+  were never decided, only missing: no media player, no VPN plugin, no printing.
+  `networking.networkmanager.plugins` was at its default `[ ]`, which means
+  NetworkManager cannot create an OpenVPN connection at all — the type is not
+  offered by nmcli, nmtui or nm-applet — while Arch installs
+  `networkmanager-openvpn`. Printing was absent on both sides.
+- **Tradeoffs**: (1) **Printing** — the Arch host drives the Samsung M267x 287x
+  the old way: a `socket://192.168.1.165` queue with the ULD PPD. Reproducing
+  that here would have meant an unfree driver package plus the printer's address
+  in version control, and Dominik ruled the printer out of the repository. Asked
+  over IPP, the device answers with `image/urf` and `application/PCLm` among its
+  document formats and IPP 2.0 — so driverless printing works and CUPS builds
+  the queue from what the printer reports about itself. `hardware.printers.
+  ensurePrinters` and `samsung-unified-linux-driver` (which does carry a
+  matching `M267x.ppd`) are therefore both unused. The price is a dependency on
+  mDNS discovery, and Avahi has to run for it; the gain is that any
+  AirPrint-capable printer works, not just this one. (2) **Media player** — mpv
+  is what Arch installs, with two AUR scripts; Dominik chose VLC instead, so
+  this is deliberately not an alignment. (3) **Where it lives** —
+  `modules/desktop.nix`, which every host imports (`flake.nix:95`), rather than
+  per host: none of it is machine specific.
+- **How**: `services.printing.enable`, `services.avahi` with `nssmdns4` (the
+  part that makes `.local` resolve) and `openFirewall`, which opens UDP 5353.
+  `networking.networkmanager.plugins = [ pkgs.networkmanager-openvpn ]` plus the
+  `openvpn` binary, and `vlc`, in `environment.systemPackages`. Verified by
+  evaluating both `desktop` and `thinkpad`: printing and Avahi on, 5353 in
+  `allowedUDPPorts`, the plugin and both packages present.
+- **Still missing against the Arch lists**: no browser at all — Arch installs
+  `waterfox-bin`, which nixpkgs does not have. Also absent: `viewnior`,
+  `blueberry`, `auto-cpufreq`, `snapper`/`snap-pac`, `plocate`, `nmap`, `sshfs`,
+  `smbclient` and walker with the elephant providers. `ufw` is deliberately not
+  missing: NixOS' own firewall is enabled on every host with no port open.
+
 ## 2026-08-20 – The desktop declares its real disks
 
 - **Who**: Dominik, ClaudeCode

modules/desktop.nix

@@ -202,6 +202,35 @@ in
     openmoji-color
   ];
 
+  # --- Printing ---
+  #
+  # Driverless only, and no printer is declared here. Asked over IPP, the
+  # Samsung M267x 287x answers with image/urf and application/PCLm among its
+  # document formats, so CUPS builds the queue from the capabilities the device
+  # reports about itself — no PPD, no driver package, nothing about anyone's
+  # network in this repository. Any AirPrint-capable printer works the same way,
+  # including ones this machine has never seen.
+  #
+  # Avahi is the discovery half: without it the printer is not found and its
+  # .local name does not resolve. openFirewall defaults to true and opens
+  # UDP 5353 for mDNS.
+  services.printing.enable = true;
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = true;
+  };
+
+  # --- VPN ---
+  #
+  # networking.networkmanager.plugins defaults to an empty list, and without the
+  # OpenVPN plugin NetworkManager cannot create such a connection at all —
+  # neither nmcli, nmtui nor nm-applet offer the type. Counterpart to
+  # networkmanager-openvpn in packages/official.txt. nm-applet, installed below,
+  # is what hands the keyring password to the connection.
+  networking.networkmanager.plugins = [ pkgs.networkmanager-openvpn ];
+
   environment.systemPackages = with pkgs; [
     # Own programs
     moonarchPkgs.sweet-cursors
@@ -239,9 +268,14 @@ in
     pavucontrol
     alsa-utils
 
-    # Network and bluetooth
+    # Network and bluetooth. openvpn is the binary the NetworkManager plugin
+    # below drives; it also stands on its own for a config file.
     networkmanagerapplet
     blueman
+    openvpn
+
+    # Media
+    vlc
 
     # File manager stack. thunar and tumbler come from their modules above;
     # ffmpegthumbnailer is what tumbler uses for video thumbnails.