perf(network): nothing waits for a routable address at boot

NetworkManager-wait-online holds network-online.target until a connection is
routable, and multi-user.target sits behind it through docker.service, the only
active unit that pulls the target in.

DECISIONS.md

@@ -1,5 +1,212 @@
 # Decisions
 
+## 2026-09-28 – Nothing waits for a routable address at boot
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: The ThinkPad took 54.7s to boot. Two of those posts are not the
+  configuration's to shorten: 14.7s of firmware, and 14.2s inside the initrd
+  where the machine waits for the LUKS passphrase to be typed — the prompt
+  stands at 4.97s after kernel start, `systemd-cryptsetup` runs at 19.20s.
+  What is left is 14.4s of userspace, and `NetworkManager-wait-online.service`
+  holds 10.6s of it: it keeps `network-online.target` until a connection is
+  routable, and `multi-user.target` sits behind that target through
+  `docker.service`. Of the two units that pull the target in, `docker.service`
+  is the only active one; `fwupd-refresh.service` is not running.
+- **Tradeoffs**: The first approach was to detach `docker.service` from the
+  target instead, which leaves the wait in place for anything else that may
+  want it. It needs `lib.mkForce` on both `after` and `wants`, so the upstream
+  unit's dependency list is copied into this flake and drifts silently on the
+  next nixpkgs bump. Disabling the wait is one line and nothing to keep in
+  sync. What it costs: docker starts without a guarantee that an address is
+  already routable.
+- **How**: `systemd.services.NetworkManager-wait-online.enable = false` in
+  `modules/network.nix`, with the measurement in the comment beside it.
+  Plymouth was not touched: `plymouth-quit-wait.service` shows 2.4s in
+  `systemd-analyze blame` but does not appear in the critical chain.
+
+## 2026-09-28 – Images open in the viewer, not in the browser
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: Images opened in Chromium although `viewnior` has been installed
+  since `3e40a70`. No `mimeapps.list` named `image/*` at all, so `xdg-open` took
+  the first candidate from `mimeinfo.cache` — `chromium-browser.desktop`, ahead
+  of `viewnior.desktop` by name.
+- **Tradeoffs**: Declared in `modules/desktop.nix` next to the viewer, not
+  beside the Firefox types in `modules/browsers.nix`; both modules add to the
+  same attribute set and the keys do not overlap.
+- **How**: `xdg.mime.defaultApplications` for gif, jpeg, png and webp on
+  `viewnior.desktop`, plus `addedAssociations` for webp, which
+  `viewnior.desktop` does not declare, and
+  `programs.gdk-pixbuf.modulePackages = [ pkgs.webp-pixbuf-loader ]`, without
+  which gdk-pixbuf cannot decode it.
+
+## 2026-09-28 – The splash in our own colours, and what Plymouth would not give
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: The first boot on the new theme showed four things: the keyboard
+  layout label at the password prompt was too large, it should sit further
+  down, the entry field was pixelated, and the palette was the upstream blue
+  rather than the Catppuccin lavender the rest of the system runs on.
+- **Tradeoffs**: Three of the four are files the theme ships, so they are
+  drawn here and committed — not generated in the package recipe. That keeps
+  the recipe untouched and puts every asset where it can be looked at. The
+  cost is that `keymap-render.png` now has to match Plymouth's offset table
+  by hand; the README says so, and the band from the original upload had
+  failed exactly that way.
+
+  The fourth is not a file. Plymouth places the layout indicator at
+  `y = dialog_bottom + …` (`two-step/plugin.c`) and has no alignment key for
+  it, so it cannot be moved without moving the entry field with it. Making
+  the images taller and putting their content at the bottom would work in
+  principle, but reaching the screen's lower edge from the middle needs over
+  a thousand pixels of empty image. Dropped.
+- **How**: `keymap-render.png` redrawn at 2304×24 — one layout, `de`, at the
+  offset the table gives it (2253, 51 wide) — against 26537×50 upstream;
+  `keyboard.png` scaled to match. `entry.png` redrawn at its original
+  305×75 with smooth edges. Both frame series, 81 `animation-*` and 51
+  `progress-*`, moved to lavender with `-modulate 130,125,105`, which lands
+  on `#b0c1ee` against the target `#b4befe`. Background and progress bar in
+  the descriptor follow `#1e1e2e`, `#313244`, `#b4befe`.
+
+## 2026-09-28 – A stop timeout for stasis
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: Every reboot hung for a minute and a half. The journal names it:
+  `stasis.service: State 'stop-sigterm' timed out. Killing.`, 88 seconds after
+  the last system service went down, and niri received its own SIGTERM only
+  once stasis had been killed — the whole user manager was waiting on that one
+  unit. Stopped by hand with `systemctl --user stop stasis` it exits in zero
+  seconds, so the unit is not at fault; as part of the session teardown it
+  does not answer.
+- **Tradeoffs**: The cause sits in the program. stasis registers SIGTERM
+  through `signal_hook` and honours it in normal operation, so fixing it means
+  changing somebody else's Rust daemon and carrying a patch. A short stop
+  timeout treats the symptom instead — acceptable here because what stasis
+  holds is an idle timer, and nothing is lost when it goes down hard. The
+  alternative, leaving the default 90 seconds, costs that time on every
+  reboot.
+- **How**: `TimeoutStopSec = 5` in the unit in `modules/services.nix`, with
+  the measurement recorded beside it so the number is not mistaken for a
+  guess.
+
+## 2026-09-28 – A splash theme of our own, and a flake input after all
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: The Catppuccin splash showed the NixOS logo and the loading
+  animation and nothing else, the two of them touching. The cause is not the
+  theme's configuration: `nixos/modules/system/boot/plymouth.nix` links
+  `boot.plymouth.logo` into every theme directory named `catppuccin-<flavour>`
+  as `header-image.png`, and the `two-step` module that theme runs on has
+  alignment keys for `watermark`, `title`, `dialog` and the progress bar —
+  none for the header image, whose distance from the animation the module
+  decides on its own. The theme itself contributes only the throbber frames:
+  it sets `WatermarkVerticalAlignment` but ships no `watermark.png`, so those
+  lines take no effect.
+- **Tradeoffs**: (1) **A padded logo** — the same PNG with transparent space
+  below it. One line, but the spacing then lives inside an image file and
+  imagemagick joins the build. (2) **A derived theme under another name**,
+  with the logo going in as `watermark.png`. Uses the slot Plymouth intends
+  for a logo, but builds a package only to sidestep a loop over theme names.
+  (3) **Patching that loop in nixpkgs**, where the cause sits, which needs an
+  overridden module and a changed theme value on top. (4) **A theme of our
+  own**, which removes the question entirely: the loop matches only Catppuccin
+  and Spinner names, so every other theme is left alone. Chosen.
+
+  This reverses the reasoning of the 2026-09-25 entry below, which took
+  nixpkgs' `catppuccin-plymouth` precisely to avoid a new input. The theme
+  wanted here is not in nixpkgs, and carrying it as a source repo is the same
+  shape the flake already uses for Betterfox and the cursors.
+- **How**: `gitea.moonarch.de/nevaforget/moonarch-plymouth-theme`, derived
+  from tobilinuxer's *Linux Distro Logos - macOS Boot Style*
+  (opendesktop.org/p/2106821) under the X11 license, which permits the change;
+  the copyright notice travels with it in `LICENSE`. Renamed to `moonarch` in
+  the descriptor's filename, its `Name=` entry and its `ImageDir`, the images
+  untouched. It runs on `two-step` as well, but brings a progress bar and a
+  138-frame animation and no watermark, so nothing is drawn that it did not
+  bring itself. `pkgs/moonarch-plymouth.nix` rewrites the descriptor's FHS
+  `ImageDir` to the store path, the way nixpkgs' own theme packages do.
+
+## 2026-09-25 – amdgpu back in the ThinkPad's initrd, for Plymouth's sake
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: With the splash enabled, Plymouth came up on eDP-1 in the mode the
+  firmware had left behind, stretched over a panel with four times the pixels.
+  The boot log has both halves: `simpledrm` owns the framebuffer while the
+  initrd runs, and amdgpu only takes eDP-1 twenty-five seconds later, on the way
+  into the real root. Plymouth draws in the initrd, so it never saw the panel's
+  own resolution. The cause was `hardware.amdgpu.initrd.enable = false`, set on
+  this host to keep the LUKS passphrase prompt in the firmware's large text mode
+  rather than at 3840x2400, where the 8x16 console font is a fifth as tall.
+- **Tradeoffs**: The two wants are opposed — the console text is readable in the
+  firmware mode, Plymouth is only sharp in the native one. Plymouth draws the
+  passphrase prompt itself and scales with the panel, so as long as it runs the
+  text mode buys nothing; with `plymouth.enable=0` on the kernel line, or a
+  Plymouth that fails, the tiny prompt is back. That case is rare and reachable,
+  the splash is every boot.
+- **How**: The line is gone rather than set to `true`: nixos-hardware's amd
+  profile already sets `lib.mkDefault true`, and a build without it comes out at
+  the same store path. A comment in its place records what dropping it costs, so
+  the reasoning is not lost with the line.
+
+## 2026-09-25 – A boot splash, themed from nixpkgs rather than a new flake input
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: The boot was the one part of the system still showing stock text,
+  the LUKS passphrase prompt among it. With systemd in the initrd, Plymouth
+  draws that prompt itself, so the splash covers the whole way from firmware to
+  the greeter rather than stopping at the disk.
+- **Tradeoffs**: (1) **catppuccin/nix** offers `catppuccin.plymouth.enable`,
+  but this flake does not have that input, and taking it on for a boot splash
+  means carrying a second theming source next to the packages already used
+  here. (2) **nixpkgs' `catppuccin-plymouth`** is the same upstream theme as a
+  plain package, with a `variant` argument and no new input. Chosen. (3) The
+  cost either way is that boot messages are hidden, so a stalled boot shows a
+  still image first; `plymouth.enable=0` on the kernel line takes it back
+  without rebuilding, and the previous generation is in the boot menu.
+- **How**: `boot.plymouth` in `modules/theme.nix`, beside the other theme
+  packages, on flavour Mocha like them. `quiet` was already on the kernel
+  command line and the module adds `splash` on its own, so the kernel
+  parameters needed no change.
+
+## 2026-09-25 – Kvantum's theme where Qt5 looks for it, and one platform theme for both Qt versions
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: VLC came up in a style that is not Catppuccin. Two causes, measured
+  at the running process with `strace` and `QT_DEBUG_PLUGINS`.
+
+  The style plugin was never the problem: Kvantum's Qt5 build loads, and it
+  reads `/etc/xdg/Kvantum/kvantum.kvconfig`, so it knows the theme's name. It
+  then asks for the theme in four places — `~/.config/Kvantum`, `~/.themes`,
+  `~/.local/share/themes` and its own store path — and in none of them is it
+  installed. `/run/current-system/sw/share/Kvantum`, where it is, is never
+  looked at: the patch that teaches Kvantum `XDG_DATA_DIRS` no longer reaches
+  the Qt5 build after an upstream change (NixOS/nixpkgs#355277, still open,
+  from tsujan/Kvantum@6a4053a). Not finding its theme, Kvantum draws its
+  built-in default.
+
+  Behind that, a second one: `QT_QPA_PLATFORMTHEME` was `qt6ct`, and Qt5 reads
+  that variable too. A Qt5 client finds only the Qt6 plugin, cannot load it,
+  and ends up with no platform theme at all — no icon theme, no fonts, stock
+  dialogs. This was never specific to VLC; it held for every Qt5 client.
+- **Tradeoffs**: (1) **Overriding the Qt5 plugin package** so its own
+  `share/Kvantum` carries the theme would keep everything system-wide and leave
+  no state in the home directory, but it is a construction nobody else runs,
+  and it rebuilds the plugin locally. (2) **A wrapper around VLC** setting
+  `gtk3` as its platform theme would need no new package and no new config, but
+  it fixes one application where the gap is general. (3) The published
+  solutions for the Qt5 case — the nixpkgs issue's thread and catppuccin/nix —
+  all place the theme under `$XDG_CONFIG_HOME/Kvantum`, and pair it with the
+  qt5ct/qt6ct combination that nixpkgs itself ships as
+  `qt.platformTheme = "qt5ct"`. Chosen for being the trodden path.
+- **How**: A `systemd.user.tmpfiles` rule links
+  `~/.config/Kvantum/catppuccin-mocha-lavender` to the theme in the system
+  profile, `L+` like the cursor rule beside it so it follows the profile
+  instead of freezing at one store path. `QT_QPA_PLATFORMTHEME` is now `qt5ct`,
+  which each Qt version answers with the plugin built for it;
+  `libsForQt5.qt5ct` is installed alongside `qt6ct`, and
+  `/etc/xdg/qt5ct/qt5ct.conf` carries the same style, icon theme and dialog
+  setting as `qt6ct.conf`.
+
 ## 2026-09-25 – One portal config, and the file dialog on the GTK backend
 
 - **Who**: Dominik, ClaudeCode

README.md

@@ -20,13 +20,14 @@ files therefore serves every system that pulls it in.
 flake.nix            Inputs and outputs
 pkgs/                Build recipes
   sweet-cursors.nix  cursor theme
+  moonarch-plymouth.nix  boot splash theme
   moonarch-scripts.nix  battery and camera helpers
   betterfox.nix      Firefox preference set
 modules/
   user.nix           moonarch.user option, set per host
   disk.nix           partitioning: GPT, optional LUKS2, btrfs subvolumes
   desktop.nix        compositor, /etc deployment, portals, the rest of the packages
-  theme.nix          GTK, Qt, Kvantum, cursors, fonts
+  theme.nix          GTK, Qt, Kvantum, Plymouth, cursors, fonts
   browsers.nix       Firefox with its preconfiguration, Chromium, handler
   shell.nix          zsh and the command line tools
   lock.nix           gtklock and its PAM stack

flake.lock

@@ -53,6 +53,22 @@
         "url": "https://gitea.moonarch.de/nevaforget/moonarch.git"
       }
     },
+    "moonarch-plymouth": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1790599371,
+        "narHash": "sha256-4eudA/FgaCTVO+dluJcTfEBsPFOiEThKu0V4UA8YPjw=",
+        "ref": "refs/heads/main",
+        "rev": "5307ddd8056e8403355bf9b3d68b6fbd2c57d718",
+        "revCount": 9,
+        "type": "git",
+        "url": "https://gitea.moonarch.de/nevaforget/moonarch-plymouth-theme.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://gitea.moonarch.de/nevaforget/moonarch-plymouth-theme.git"
+      }
+    },
     "nixos-hardware": {
       "inputs": {
         "nixpkgs": "nixpkgs"
@@ -105,6 +121,7 @@
         "betterfox": "betterfox",
         "disko": "disko",
         "moonarch": "moonarch",
+        "moonarch-plymouth": "moonarch-plymouth",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_2",
         "sweet-cursors": "sweet-cursors"

flake.nix

@@ -32,6 +32,10 @@
       url = "git+https://gitea.moonarch.de/nevaforget/Sweet-cursors.git";
       flake = false;
     };
+    moonarch-plymouth = {
+      url = "git+https://gitea.moonarch.de/nevaforget/moonarch-plymouth-theme.git";
+      flake = false;
+    };
   };
 
   outputs = { self, nixpkgs, ... }@inputs:
@@ -50,6 +54,11 @@
           version = "0-unstable";
         };
 
+        moonarch-plymouth = pkgs.callPackage ./pkgs/moonarch-plymouth.nix {
+          src = inputs.moonarch-plymouth;
+          version = "0-unstable";
+        };
+
         moonarch-scripts = pkgs.callPackage ./pkgs/moonarch-scripts.nix {
           src = inputs.moonarch;
         };

hosts/thinkpad/default.nix

@@ -22,12 +22,16 @@
   boot.kernelPackages = pkgs.linuxPackages_zen;
   boot.kernelParams = [ "quiet" ];
 
-  # nixos-hardware puts amdgpu into the initrd, so the panel is already at its
-  # native 3840x2400 when LUKS asks for the passphrase and the 8x16 console font
-  # is a fifth of the height it has on the firmware framebuffer. Without the
-  # driver the prompt is drawn in the mode the firmware left behind and the
-  # driver loads a moment later, on the way into the real root.
-  hardware.amdgpu.initrd.enable = false;
+  # No hardware.amdgpu.initrd.enable here: nixos-hardware's amd profile already
+  # sets it, so the panel is at its native 3840x2400 by the time LUKS asks for
+  # the passphrase. Plymouth draws in the initrd and needs that — without the
+  # driver it gets the mode the firmware left behind, scaled over a panel with
+  # four times the pixels.
+  #
+  # Setting it to false, as this host did before, buys back the console text
+  # underneath: at 3840x2400 the 8x16 font is a fifth of the height it has on
+  # the firmware framebuffer, so a passphrase prompt that arrives as text —
+  # with Plymouth off, or failed — is barely readable.
 
   networking.hostName = "thinkpad";
   networking.networkmanager.enable = true;
@@ -99,6 +103,7 @@
     pnpm
     uv
     python3
+    glab
   ];
 
   # The nixos-hardware profile only sets hardware.cpu.amd.updateMicrocode as a

modules/browsers.nix

@@ -29,6 +29,7 @@ in
     preferencesStatus = "default";
     preferences = {
       "general.autoScroll" = true;
+      "browser.tabs.hoverPreview.showThumbnails" = false;
 
       # Only the offer to translate. Translating by hand from the context menu
       # keeps working.

modules/desktop.nix

@@ -193,6 +193,18 @@ in
     galculator
   ];
 
+  xdg.mime = {
+    defaultApplications = {
+      "image/gif" = "viewnior.desktop";
+      "image/jpeg" = "viewnior.desktop";
+      "image/png" = "viewnior.desktop";
+      "image/webp" = "viewnior.desktop";
+    };
+    addedAssociations."image/webp" = "viewnior.desktop";
+  };
+
+  programs.gdk-pixbuf.modulePackages = [ pkgs.webp-pixbuf-loader ];
+
   # Polkit agent for privilege prompts inside the session.
   security.polkit.enable = true;
   # The setuid pkexec wrapper is opt-in and off by default. Without it pkexec

modules/network.nix

@@ -11,6 +11,13 @@
   # is what hands the keyring password to the connection.
   networking.networkmanager.plugins = [ pkgs.networkmanager-openvpn ];
 
+  # NetworkManager-wait-online holds network-online.target until a connection is
+  # routable, and multi-user.target waits behind it — measured at 10.6s in the
+  # journal, against 14.4s for the whole of userspace. Of the units that pull the
+  # target in, docker.service is the only active one; fwupd-refresh.service is
+  # not running.
+  systemd.services.NetworkManager-wait-online.enable = false;
+
   hardware.bluetooth.enable = true;
   services.blueman.enable = true;
 

modules/services.nix

@@ -272,6 +272,12 @@ in
       ExecReload = "${lib.getExe pkgs.stasis} reload";
       Restart = "on-failure";
       RestartSec = 2;
+      # Stopped by hand it exits at once; stopped as part of the session it
+      # does not answer SIGTERM, and the default 90 seconds left the whole
+      # user manager waiting on it — niri received its own SIGTERM only once
+      # stasis had been killed. Measured at 88s in the journal. What it holds
+      # is an idle timer, so nothing is lost when it goes down hard.
+      TimeoutStopSec = 5;
       IPAddressDeny = "any";
       ProtectProc = "invisible";
       ProcSubset = "pid";

modules/theme.nix

@@ -1,4 +1,4 @@
-# ABOUTME: GTK, Qt, Kvantum, cursors and fonts — the look, in one place.
+# ABOUTME: GTK, Qt, Kvantum, Plymouth, cursors and fonts — the look, in one place.
 # ABOUTME: Same theme derivations the greeter uses, so the two cannot drift apart.
 
 { pkgs, moonarchSrc, moonarchPkgs, moonarchThemes, ... }:
@@ -34,17 +34,36 @@ let
   #
   # Verified under strace: a Qt6 client opens the theme's .kvconfig straight
   # out of the package's store path. The patch only takes in the Qt6 build
-  # (NixOS/nixpkgs#355277) — a Qt5 client, here only VLC, falls back to the
-  # default style.
+  # (NixOS/nixpkgs#355277) — a Qt5 client searches four roots instead:
+  # ~/.config/Kvantum, ~/.themes, ~/.local/share/themes and its own store path.
+  # The tmpfiles rule further down puts the theme in the first of them, which is
+  # where the published solutions for this put it.
   kvantumTheme = pkgs.catppuccin-kvantum.override {
     accent = "lavender";
     variant = "mocha";
   };
+
+  # The theme name as both the package directory and the .kvconfig entry spell
+  # it, so the link target below cannot drift from what Kvantum looks up.
+  kvantumThemeName = "catppuccin-mocha-lavender";
+
 in
 {
   environment.etc = {
     "xdg/Kvantum/kvantum.kvconfig".source = "${xdg}/Kvantum/kvantum.kvconfig";
     "xdg/qt6ct/qt6ct.conf".source = "${xdg}/qt6ct/qt6ct.conf";
+
+    # No counterpart in moonarch's defaults: Arch ships qt5ct's own config, and
+    # this file only has to exist because Qt5 and Qt6 read one variable between
+    # them, see QT_QPA_PLATFORMTHEME below. Same settings as qt6ct.conf.
+    "xdg/qt5ct/qt5ct.conf".text = ''
+      # ABOUTME: System qt5ct config — Qt5 icon theme + Kvantum style, matching qt6ct.conf.
+      # ABOUTME: Deployed to /etc/xdg/qt5ct/qt5ct.conf; a user copy in ~/.config/qt5ct wins by XDG precedence.
+      [Appearance]
+      style=kvantum
+      icon_theme=Colloid-Grey-Catppuccin-Dark
+      standard_dialogs=default
+    '';
     "xdg/gtk-3.0/settings.ini".source = gtkSettings "3.0";
     "xdg/gtk-4.0/settings.ini".source = gtkSettings "4.0";
   };
@@ -90,6 +109,20 @@ in
     }];
   };
 
+  # The boot splash. `quiet` is already on the kernel command line and the module
+  # puts `splash` there itself, so nothing else has to change for it to show.
+  # With systemd in the initrd, which this configuration uses, systemd asks for
+  # the LUKS passphrase and Plymouth draws that prompt; the script initrd instead
+  # shows it as text before the splash comes up.
+  # The theme carries a name of its own, outside the catppuccin-<flavour> set
+  # that the NixOS plymouth module links its logo into, so the splash shows
+  # what the theme brings and nothing besides.
+  boot.plymouth = {
+    enable = true;
+    theme = "moonarch";
+    themePackages = [ moonarchPkgs.moonarch-plymouth ];
+  };
+
   # Qt applications are wrapped, so each one looks for plugins in its own
   # closure and never finds a style installed alongside it — which is why VLC
   # kept coming up in the stock Qt style. Enabling this puts the profile's Qt5
@@ -108,7 +141,12 @@ in
   # everything started from its launcher — never sees them, and Qt applications
   # come up unstyled. Set here they travel through /etc/profile into
   # niri-session's import-environment, and from there into the user manager.
-  environment.sessionVariables.QT_QPA_PLATFORMTHEME = "qt6ct";
+  # qt5ct, not qt6ct: Qt5 and Qt6 both read this one variable, and a Qt5 client
+  # asked for "qt6ct" finds only a Qt6 plugin it cannot load, so it comes up
+  # with no platform theme at all — no icon theme, no fonts, stock dialogs.
+  # Under "qt5ct" each version loads the plugin built for it; that pairing is
+  # what nixpkgs ships as qt.platformTheme "qt5ct", which installs both.
+  environment.sessionVariables.QT_QPA_PLATFORMTHEME = "qt5ct";
   environment.sessionVariables.QT_STYLE_OVERRIDE = "kvantum";
 
   # Same gap, cursors: niri's cursor block reaches xwayland-satellite, so X11
@@ -132,6 +170,12 @@ in
     # link on every activation, unlike the 'C' rules elsewhere, which keeps it
     # following the theme instead of freezing at today's one.
     "L+ %h/.icons/default - - - - /run/current-system/sw/share/icons/Sweet-cursors"
+
+    # Kvantum's Qt5 build never looks at XDG_DATA_DIRS, so the theme installed
+    # system-wide is invisible to it; ~/.config/Kvantum is the first place it
+    # does look. 'L+' for the same reason as the rule above: the link follows
+    # the system profile instead of freezing at one store path.
+    "L+ %h/.config/Kvantum/${kvantumThemeName} - - - - /run/current-system/sw/share/Kvantum/${kvantumThemeName}"
   ];
 
   environment.systemPackages = with pkgs; [
@@ -143,6 +187,7 @@ in
     libsForQt5.qtstyleplugin-kvantum
     qt6Packages.qtstyleplugin-kvantum
     kvantumTheme
+    libsForQt5.qt5ct
     qt6Packages.qt6ct
     qt6.qt5compat
 

pkgs/moonarch-plymouth.nix

@@ -0,0 +1,37 @@
+# ABOUTME: Nix build recipe for the Moonarch Plymouth boot splash.
+# ABOUTME: Rewrites the descriptor's FHS ImageDir to wherever the theme lands.
+
+{ lib, stdenvNoCC, src, version }:
+
+stdenvNoCC.mkDerivation {
+  pname = "moonarch-plymouth";
+  inherit version src;
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  # The theme's own name, which boot.plymouth.theme has to match. It stays
+  # outside the catppuccin-<flavour> set that the NixOS plymouth module links
+  # its logo into, so nothing is added to the splash that the theme did not
+  # bring itself.
+  installPhase = ''
+    runHook preInstall
+
+    dir="$out/share/plymouth/themes/moonarch"
+    install -dm755 "$dir"
+    cp -r images "$dir/images"
+
+    # ImageDir in the repo names an FHS path; plymouthd reads it verbatim.
+    substitute moonarch.plymouth "$dir/moonarch.plymouth" \
+      --replace-fail /usr/share/plymouth/themes/moonarch "$dir"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Moonarch Plymouth boot splash";
+    homepage = "https://gitea.moonarch.de/nevaforget/moonarch-plymouth-theme";
+    license = lib.licenses.x11;
+    platforms = lib.platforms.linux;
+  };
+}