docs(readme): show a realistic private-inventory layout and overrides

The consumer section had only a bare-bones flake snippet. Add an example
private layout (`system/` + `home/` split, `hosts/<host>/`), a fuller
`flake.nix` matching it, and an "Overriding the baseline" section covering
the three mechanisms (neutral default → real value, `local.*` options,
extra modules). Note that structurally only `flake.nix` is required.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -24,19 +24,63 @@ you can tweak.
 
 ## Import the modules into your own flake
 
-Add this repo as a flake input and import its modules from your own configuration:
+Add this repo as an input and assemble your machines in a private flake. Below is a
+**realistic example layout**. Structurally only `flake.nix` is required — every other path
+is just one way to organize your config; rename, merge, inline, or drop them freely. The one
+bit of *content* a bootable machine can't skip is its `hardware-configuration.nix`
+(`nixos-generate-config` output); the `hosts/<host>/` directory is only where this example
+keeps it.
+
+```
+your-inventory/
+├── flake.nix                        # inputs (pub + follows) + nixosConfigurations.<host>
+├── flake.lock
+├── system/                          # system-level modules
+│   ├── regional.nix                 # time zone / keymap / locale (see Overriding)
+│   ├── packages.nix                 # extra system packages
+│   └── tailscale.nix                # VPN / network topology
+├── home/                            # home-manager modules, one file per concern
+│   ├── identity.nix                 # git identity, name/email
+│   ├── ssh.nix                      # SSH hosts (topology — stays private)
+│   ├── syncthing.nix                # Syncthing peers
+│   └── …                            # personal apps: browser, editor, chat, …
+└── hosts/
+    └── myhost/
+        ├── default.nix              # hostname, user account, host-specific system bits
+        └── hardware-configuration.nix   # `nixos-generate-config` output
+```
+
+The `flake.nix` that wires it together:
 
 ```nix
 {
-  inputs.config.url = "github:<owner>/<repo>";
-  # …
-  outputs = { nixpkgs, config, home-manager, ... }: {
+  inputs = {
+    pub.url = "github:<owner>/<repo>";
+    # Reuse the public flake's pins so versions never drift between the two.
+    nixpkgs.follows = "pub/nixpkgs";
+    home-manager.follows = "pub/home-manager";
+  };
+
+  outputs = inputs@{ self, nixpkgs, pub, home-manager, ... }: {
     nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
       modules = [
-        config.nixosModules.default
-        ./hosts/myhost                 # your hardware + hostname
+        pub.nixosModules.default          # generic system baseline
+        ./system/regional.nix             # your regional values (see below)
+        ./hosts/myhost                    # hardware + hostname
         home-manager.nixosModules.home-manager
-        { home-manager.users.me.imports = [ config.homeModules.default ]; }
+        {
+          home-manager.useGlobalPkgs = true;
+          home-manager.useUserPackages = true;
+          # Inject your own inputs into your home modules; the public ones ignore them.
+          home-manager.extraSpecialArgs = { inherit inputs; };
+          home-manager.users.me.imports = [
+            pub.homeModules.default         # generic home baseline
+            ./home/identity.nix             # your git identity, name/email, …
+            ./home/ssh.nix                  # your SSH hosts (topology stays private)
+            # … more personal home modules
+          ];
+        }
       ];
     };
   };
@@ -46,6 +90,30 @@ Add this repo as a flake input and import its modules from your own configuratio
 Your machine list, hostnames, and any private specifics stay in *your* flake — you pull
 only the generic modules from here.
 
+## Overriding the baseline
+
+The public modules are a baseline you extend without forking. Three ways to shape them
+from your private flake, in rough order of how often you reach for them:
+
+1. **Neutral default → your real value.** Region-agnostic settings ship as `mkDefault`
+   placeholders (`console.keyMap = "us"`, `time.timeZone = "UTC"`, `en_US` locale). Set the
+   real ones in a private module — no `mkForce` needed:
+
+   ```nix
+   # system/regional.nix
+   { time.timeZone = "Europe/Berlin"; console.keyMap = "de"; }
+   ```
+
+2. **`local.*` options.** A module that exposes a knob puts it under the `local.*`
+   namespace with a default. Override in one line, e.g. a fuller TeX Live:
+
+   ```nix
+   local.texlive.package = pkgs.texlive.withPackages (ps: [ ps.scheme-full ]);
+   ```
+
+3. **Extra modules.** Anything with no public counterpart is just another module in the
+   import lists above — personal apps, SSH/Syncthing topology, secrets wiring.
+
 ## Architecture: three layers
 
 Kept apart on purpose. When adding config, decide which layer it belongs to: