Enable GNOME desktop by default on every NixOS host

Add GDM+GNOME, NetworkManager, PipeWire audio, and CUPS+Avahi
printing to modules/nixos/common.nix, applied unconditionally to
every NixOS host built from this flake, per add-gnome-desktop.
nix flake check remains unverified: Nix isn't installed on this
machine and no live NixOS host exists yet to boot-test against.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BBSd4VBfoKHjE1HR3P8kmn

3 files changed, 32 insertions, 9 deletions

diff --git a/README.md b/README.md
index 6ac539c..c69c28c 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ A single Nix flake for provisioning both NixOS hosts and non-NixOS systems (any
 
 - `flake.nix` — inputs (`nixpkgs`, `home-manager`) and outputs (`nixosConfigurations`, `homeConfigurations`, `formatter`, `devShells`)
 - `lib/` — `mkNixos` and `mkHome` helper functions that build `nixosConfigurations` / `homeConfigurations` entries
-- `modules/nixos/common.nix` — shared NixOS-only system settings applied to every NixOS host: flakes enabled, `tom` user (bash as the login shell), locale/timezone defaults, gc policy, sshd (key-only auth) with a firewall allowing port 22
+- `modules/nixos/common.nix` — shared NixOS-only system settings applied to every NixOS host: flakes enabled, `tom` user (bash as the login shell), locale/timezone defaults, gc policy, sshd (key-only auth) with a firewall allowing port 22, and a GNOME desktop (GDM login, NetworkManager, PipeWire audio, CUPS+Avahi printing) — see below
 - `modules/home/` — the shared, cross-platform home-manager profile (shell, editor, CLI tools, dev tools, dotfiles). The same modules are consumed whether activated via a NixOS host's home-manager module or standalone `home-manager switch`
 - `users/tom.nix` — identity/profile file consumed by both `mkNixos` and `mkHome`
 - `hosts/template/` — a copy-source-only NixOS host skeleton; **never** wired into `flake.nix` outputs directly (excluded from discovery by name — see below). Copy it via `scripts/bootstrap-host.sh` (or `nix run .#bootstrap-host`) when provisioning a real machine
@@ -33,6 +33,10 @@ This flake does not partition disks for you — do that first, with the standard
 8. Reboot and remove the install media.
 9. Afterwards, clone the flake to a stable path (e.g. `/etc/nix-config`) so future updates are just `sudo nixos-rebuild switch --flake /etc/nix-config#<real-hostname>`.
 
+## Desktop environment
+
+Every NixOS host built from this flake boots into a GNOME desktop by default (GDM as the login manager), applied unconditionally in `modules/nixos/common.nix` rather than as a per-host opt-in. Necessary companions are enabled alongside it: `networking.networkmanager` (GNOME's own network settings UI), `services.pipewire` + `security.rtkit` (audio, including PulseAudio-compatible clients), and `services.printing` (CUPS) + `services.avahi` (`nssmdns4`, `openFirewall`) for printing and network/AirPrint printer discovery — `openFirewall` is required so mDNS discovery traffic isn't blocked by the port-22-only firewall this repo already enables. This is a system-level toggle only; per-user GNOME customization (dconf, Shell extensions) is out of scope.
+
 ## Installing on a non-NixOS system (any Linux, or macOS once supported)
 
 Non-NixOS hosts are unaffected by `bootstrap-host` — there's nothing per-host to scaffold. `homeConfigurations` has one generic entry per platform (`tom@linux` for x86_64-linux, `tom@darwin` for aarch64-darwin), shared by every standalone machine of that platform.
diff --git a/modules/nixos/common.nix b/modules/nixos/common.nix
index df947c0..1b34e4e 100644
--- a/modules/nixos/common.nix
+++ b/modules/nixos/common.nix
@@ -38,4 +38,23 @@
     enable = true;
     allowedTCPPorts = [ 22 ];
   };
+
+  services.xserver.enable = true;
+  services.displayManager.gdm.enable = true;
+  services.desktopManager.gnome.enable = true;
+
+  networking.networkmanager.enable = true;
+
+  services.pipewire = {
+    enable = true;
+    pulse.enable = true;
+  };
+  security.rtkit.enable = true;
+
+  services.printing.enable = true;
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = true;
+  };
 }
diff --git a/openspec/changes/add-gnome-desktop/tasks.md b/openspec/changes/add-gnome-desktop/tasks.md
index e30615d..0e9cfb0 100644
--- a/openspec/changes/add-gnome-desktop/tasks.md
+++ b/openspec/changes/add-gnome-desktop/tasks.md
@@ -1,23 +1,23 @@
 ## 1. GNOME desktop and login manager
 
-- [ ] 1.1 In `modules/nixos/common.nix`, add `services.xserver.enable = true;` — verify by reading the file
-- [ ] 1.2 Add `services.displayManager.gdm.enable = true;` and `services.desktopManager.gnome.enable = true;` — verify by reading the added block, and flag the option-path uncertainty from design.md (post-migration `services.displayManager.*`/`services.desktopManager.*` vs. older `services.xserver.displayManager.*`/`services.xserver.desktopManager.*`) as a known risk to re-check once `nix flake check` can run
+- [x] 1.1 In `modules/nixos/common.nix`, add `services.xserver.enable = true;` — verify by reading the file
+- [x] 1.2 Add `services.displayManager.gdm.enable = true;` and `services.desktopManager.gnome.enable = true;` — verify by reading the added block, and flag the option-path uncertainty from design.md (post-migration `services.displayManager.*`/`services.desktopManager.*` vs. older `services.xserver.displayManager.*`/`services.xserver.desktopManager.*`) as a known risk to re-check once `nix flake check` can run
 
 ## 2. Networking and audio companions
 
-- [ ] 2.1 Add `networking.networkmanager.enable = true;` — verify by reading the added line
-- [ ] 2.2 Add `services.pipewire = { enable = true; pulse.enable = true; };` and `security.rtkit.enable = true;` — verify by reading the added block
+- [x] 2.1 Add `networking.networkmanager.enable = true;` — verify by reading the added line
+- [x] 2.2 Add `services.pipewire = { enable = true; pulse.enable = true; };` and `security.rtkit.enable = true;` — verify by reading the added block
 
 ## 3. Printing
 
-- [ ] 3.1 Add `services.printing.enable = true;` — verify by reading the added line
-- [ ] 3.2 Add `services.avahi = { enable = true; nssmdns4 = true; openFirewall = true; };` — verify by reading the added block, and confirm `openFirewall = true` is present so mDNS/printer discovery isn't blocked by the firewall enabled in `add-developer-environment`
+- [x] 3.1 Add `services.printing.enable = true;` — verify by reading the added line
+- [x] 3.2 Add `services.avahi = { enable = true; nssmdns4 = true; openFirewall = true; };` — verify by reading the added block, and confirm `openFirewall = true` is present so mDNS/printer discovery isn't blocked by the firewall enabled in `add-developer-environment`
 
 ## 4. Documentation
 
-- [ ] 4.1 Update `README.md` to document that NixOS hosts from this flake now boot into GNOME (GDM login) by default, with NetworkManager, PipeWire, and CUPS+Avahi printing enabled as necessary companions — verify by reading the updated section for consistency with the actual module changes
+- [x] 4.1 Update `README.md` to document that NixOS hosts from this flake now boot into GNOME (GDM login) by default, with NetworkManager, PipeWire, and CUPS+Avahi printing enabled as necessary companions — verify by reading the updated section for consistency with the actual module changes
 
 ## 5. Validation
 
 - [ ] 5.1 Run `nix flake check` and confirm `modules/nixos/common.nix` still evaluates without error with the new services added, resolving the option-path question from task 1.2 (blocked — Nix is not installed on this machine, and there's still no live NixOS host to boot; run this once Nix/a real host are available — this is the real acceptance gate, not the individual checkboxes above)
-- [ ] 5.2 Manually trace through each spec scenario in `specs/gnome-desktop/spec.md` against the implemented module, confirming each is satisfied by inspection given #5.1 cannot run locally
+- [x] 5.2 Manually trace through each spec scenario in `specs/gnome-desktop/spec.md` against the implemented module, confirming each is satisfied by inspection given #5.1 cannot run locally