refactor(scripts): split monolithic module into per-script submodules

Extract shared `mkScript` and `mkScriptModule` helpers into `lib.nix`
Split each script into `modules/scripts/<name>/` with its own
  `default.nix`, `script.sh`, and `assertions.nix`
Remove `conditions` parameter from `mkScriptModule`; move condition
  assertions into per-script `assertions.nix` files with inline checks
  and error messages
Simplify `mkScriptModule` to return `{ options, moduleConfig }` instead
  of a module function, taking `config` as a direct parameter
Add `description` field to `mkScript` that inserts the description as
  a `# <text>` comment between the shebang and env vars
Thread `description` through `mkScriptModule` to each `default.nix`
Move top comment lines from each `script.sh` into the `description`
  field and remove from sources to avoid duplication
Remove old flat `.sh` files from `modules/scripts/` root

3 files changed, 55 insertions, 0 deletions

diff --git a/modules/scripts/vpn-disconnect/assertions.nix b/modules/scripts/vpn-disconnect/assertions.nix
new file mode 100644
index 0000000..60c4e9b
--- /dev/null
+++ b/modules/scripts/vpn-disconnect/assertions.nix
@@ -0,0 +1,7 @@
+{ config, ... }:
+[
+  {
+    assertion = !config.scripts.vpn-disconnect.enable || config.scripts.vpn-connect.enable;
+    message = "scripts.vpn-disconnect is enabled but requires `scripts.vpn-connect.enable`.";
+  }
+]
diff --git a/modules/scripts/vpn-disconnect/default.nix b/modules/scripts/vpn-disconnect/default.nix
new file mode 100644
index 0000000..61f4738
--- /dev/null
+++ b/modules/scripts/vpn-disconnect/default.nix
@@ -0,0 +1,21 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
+  base = mkScriptModule {
+    name = "vpn-disconnect";
+    path = ./script.sh;
+    description = "VPN-disconnect - Kill VPN process and clean up";
+    inherit config;
+  };
+in
+{
+  options = base.options;
+  config = base.moduleConfig // {
+    assertions = base.moduleConfig.assertions ++ (import ./assertions.nix { inherit config lib; });
+  };
+}
diff --git a/modules/scripts/vpn-disconnect/script.sh b/modules/scripts/vpn-disconnect/script.sh
new file mode 100644
index 0000000..ead912c
--- /dev/null
+++ b/modules/scripts/vpn-disconnect/script.sh
@@ -0,0 +1,27 @@
+PID_FILE="$HOME/.cache/openvpn/vpn.pid"
+
+if [[ ! -f "$PID_FILE" ]]; then
+    echo "No VPN PID file found."
+    exit 1
+fi
+
+PID=$(cat "$PID_FILE")
+
+if ps -p "$PID" > /dev/null 2>&1; then
+    echo "Stopping VPN (PID: $PID)..."
+    sudo kill "$PID"
+
+    # Wait for clean shutdown
+    sleep 2
+
+    if ps -p "$PID" > /dev/null 2>&1; then
+        echo "Force killing VPN..."
+        sudo kill -9 "$PID"
+    fi
+
+    echo "VPN disconnected."
+else
+    echo "VPN process not running."
+fi
+
+rm -f "$PID_FILE"