refactor: replace redundant mkForce with plain values and mkDefault

Each of these overrode a value nothing else set at a higher priority:

- qemu-guest: btrbk, hardwareTools and cloud-init have no competing
  definition on the guests.
- mdns: nixpkgs' sunshine module sets avahi.publish.* with mkDefault.
- computer-use: i18n now sets the time zone with mkDefault.
- darwin terminal: the shared ghostty/kitty font sizes are now mkDefault.
- shoukei: sunshine is mkDefault false in remote-desktop.nix, zram's
  memoryPercent is mkDefault 50; supportedFilesystems now merges instead
  of discarding the fsType entries other modules add.
- youko: nothing enables docker.
- nixpak: pasta.enable and sockets.pipewire are mkDefault in the shared
  modules, sockets.pulse already was.

Every NixOS host's toplevel drvPath is unchanged; on fern and frieren the
terminal font sizes and time zone evaluate to the same values.

Assisted-by: Claude Code (claude-opus-5-5)

hardening/nixpaks/firefox.nix

@@ -42,7 +42,7 @@ let
         # Firefox keeps the host network: local development servers and the
         # mihomo controller live on 127.0.0.1, and pasta's isolated loopback
         # would hide them. Chromium uses the same personal-browser policy.
-        pasta.enable = lib.mkForce false;
+        pasta.enable = false;
 
         bubblewrap = {
           # To trace all the home files Firefox accesses, you can use the following nushell command:

hardening/nixpaks/modules/chromium-browser.nix

@@ -56,7 +56,7 @@ let
         };
         flatpak = { inherit appId; };
         # Firefox/Chromium need host loopback for local services; Chrome and the rest use pasta.
-        pasta.enable = lib.mkForce (!hostLoopback);
+        pasta.enable = !hostLoopback;
         pasta.mode = "isolate";
         browserPermissions = {
           inherit

hardening/nixpaks/modules/desktop-base.nix

@@ -45,7 +45,7 @@
       wayland = true;
       x11 = lib.mkDefault false;
       pulse = lib.mkDefault true;
-      pipewire = false;
+      pipewire = lib.mkDefault false;
     };
     bind.rw = with sloth; [
       [

hardening/nixpaks/modules/file-viewer-policy.nix

@@ -32,7 +32,7 @@ in
       accessibility = true;
     };
     bubblewrap = {
-      sockets.pulse = lib.mkForce false;
+      sockets.pulse = false;
       bind.ro = lib.mkIf (!cfg.writableUserDirs) userDirs;
       bind.rw = lib.mkIf cfg.writableUserDirs userDirs;
     };

hardening/nixpaks/modules/musescore-policy.nix

@@ -2,7 +2,6 @@
 # ALSA via the host PipeWire plugin, MIDI uses the ALSA sequencer, and the UI
 # runs through XWayland.
 {
-  lib,
   sloth,
   ...
 }:
@@ -30,8 +29,8 @@
       x11 = true;
       # MuseScore speaks ALSA; the host ALSA configuration forwards its
       # default PCM to PipeWire, so expose the PipeWire socket for audio.
-      pulse = lib.mkForce false;
-      pipewire = lib.mkForce true;
+      pulse = false;
+      pipewire = true;
     };
     bind.rw = [
       (sloth.mkdir (sloth.concat' sloth.homeDir "/.config/MuseScore"))

hardening/nixpaks/modules/network.nix

@@ -1,9 +1,10 @@
 # https://github.com/nixpak/pkgs/blob/master/pkgs/modules/network.nix
+{ lib, ... }:
 {
   etc.sslCertificates.enable = true;
   bubblewrap.network = true;
   # pasta's default isolate mode gives the app its own loopback, so host
   # services on 127.0.0.1 are out of reach. Proxying still works because
   # mihomo runs in TUN mode, which sees pasta's outbound traffic.
-  pasta.enable = true;
+  pasta.enable = lib.mkDefault true;
 }

hardening/nixpaks/modules/slicer-policy.nix

@@ -20,7 +20,7 @@ in
     bubblewrap = {
       sockets = {
         x11 = true;
-        pulse = lib.mkForce cfg.enablePulse;
+        pulse = cfg.enablePulse;
       };
       env = {
         DISPLAY = sloth.envOr "DISPLAY" "";

home/base/gui/terminal/ghostty.nix

@@ -1,4 +1,5 @@
 {
+  lib,
   pkgs,
   ...
 }:
@@ -23,7 +24,7 @@
     installBatSyntax = false;
     settings = {
       font-family = "Maple Mono NF CN";
-      font-size = 13;
+      font-size = lib.mkDefault 13; # macOS overrides this in home/darwin/terminal.nix
 
       # hide title bar/header bar (Linux only; on macOS it would remove the traffic lights too)
       window-decoration = pkgs.stdenv.hostPlatform.isDarwin;

home/base/gui/terminal/kitty.nix

@@ -1,4 +1,5 @@
 {
+  lib,
   pkgs,
   ...
 }:
@@ -16,7 +17,7 @@
     enable = true;
     font = {
       name = "Maple Mono NF CN";
-      size = 13; # macOS overrides this in home/darwin/terminal.nix
+      size = lib.mkDefault 13; # macOS overrides this in home/darwin/terminal.nix
     };
 
     settings = {

home/darwin/terminal.nix

@@ -1,8 +1,8 @@
-{ lib, ... }:
+_:
 let
   fontSize = 15;
 in
 {
-  programs.ghostty.settings.font-size = lib.mkForce fontSize;
-  programs.kitty.font.size = lib.mkForce fontSize;
+  programs.ghostty.settings.font-size = fontSize;
+  programs.kitty.font.size = fontSize;
 }

hosts/12kingdoms-shoukei/apple-silicon.nix

@@ -1,5 +1,4 @@
 {
-  lib,
   mylib,
   pkgs,
   nixos-apple-silicon,
@@ -16,7 +15,7 @@
   # screen would bypass it entirely). Keep tuigreet from modules/nixos/desktop.nix.
 
   # 16G machine: more compressed swap than the 50% default
-  zramSwap.memoryPercent = lib.mkForce 75;
+  zramSwap.memoryPercent = 75;
 
   nix.settings = {
     extra-substituters = [

hosts/12kingdoms-shoukei/default.nix

@@ -24,7 +24,7 @@ in
   modules.remote-builders.enable = true;
 
   # disable sunshine for security
-  services.sunshine.enable = lib.mkForce false;
+  services.sunshine.enable = false;
 
   # Laptop joins untrusted networks and is never scraped (see youko's
   # `offlineHosts`); don't expose :9100, and don't keep the smartctl exporter

hosts/12kingdoms-shoukei/hardware-configuration.nix

@@ -48,8 +48,7 @@ in
   ];
 
   # supported file systems, so we can mount any removable disks with these filesystems.
-  # mkForce replaces the whole list, so entries added by any other module are lost here.
-  boot.supportedFilesystems = lib.mkForce [
+  boot.supportedFilesystems = [
     "ext4"
     "btrfs"
     "xfs"

hosts/12kingdoms-youko/homelab-services/oci-containers/default.nix

@@ -1,5 +1,4 @@
 {
-  lib,
   mylib,
   ...
 }:
@@ -7,7 +6,6 @@
   imports = mylib.scanPaths ./.;
 
   virtualisation = {
-    docker.enable = lib.mkForce false;
     podman = {
       enable = true;
       # Create a `docker` alias for podman, to use it as a drop-in replacement

modules/nixos/base/i18n.nix

@@ -1,6 +1,7 @@
+{ lib, ... }:
 {
-  # Set your time zone.
-  time.timeZone = "Asia/Shanghai";
+  # Set your time zone. A default: the computer-use VMs match their proxy region.
+  time.timeZone = lib.mkDefault "Asia/Shanghai";
 
   # English is the default. Chinese overrides only the categories where the
   # en_US default is factually wrong for China (metric, A4, CNY); everything

modules/nixos/base/networking/mdns.nix

@@ -33,10 +33,11 @@ in
         publish-addresses = true;
         publish-domain = true;
       };
-      # The nixpkgs sunshine module still sets these legacy options. Force them
-      # to null so settings.publish above is the only source of truth.
-      publish.enable = lib.mkForce null;
-      publish.userServices = lib.mkForce null;
+      # The nixpkgs sunshine module still sets these legacy options (with
+      # mkDefault). Reset them to null so settings.publish above is the only
+      # source of truth.
+      publish.enable = null;
+      publish.userServices = null;
     };
 
     # avahi and systemd-resolved both run an mDNS responder, which makes mDNS

modules/nixos/desktop/computer-use.nix

@@ -40,7 +40,7 @@ in
     hardware.graphics.enable = true;
 
     # Match the proxy's exit region.
-    time.timeZone = lib.mkForce timeZone;
+    time.timeZone = timeZone;
 
     # Browsers keep their profile/preferences in dconf.
     programs.dconf.enable = true;

modules/nixos/server/qemu-guest.nix

@@ -18,10 +18,10 @@
 
   config = {
     # disable backups in the VM
-    modules.btrbk.enable = lib.mkForce false;
+    modules.btrbk.enable = false;
 
     # VM guest: no physical hardware to inspect.
-    modules.hardwareTools.enable = lib.mkForce false;
+    modules.hardwareTools.enable = false;
 
     boot.growPartition = true;
     boot.kernelParams = [ "console=ttyS0" ];
@@ -30,7 +30,7 @@
     services.qemuGuest.enable = true; # qemu-guest-agent
     services.openssh.enable = true;
     # we configure the host via nixos itself, so we don't need the cloud-init
-    services.cloud-init.enable = lib.mkForce false;
+    services.cloud-init.enable = false;
     # Default so the NixOS test framework can override it: test-instrumentation
     # disables this getty to keep ttyS0 free for its backdoor console.
     systemd.services."serial-getty@ttyS0".enable = lib.mkDefault true;