diff --git a/home/scripts/fullclip.sh b/home/scripts/fullclip.sh
new file mode 100644
index 0000000..cc550be
--- /dev/null
+++ b/home/scripts/fullclip.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+tmpfile=$(mktemp)
+trap 'rm -f "$tmpfile"' EXIT
+
+if (( $# == 0 )); then
+  printf 'usage: %s command [arg …]  — or — %s "full pipeline"\n' "$0" "$0" >&2
+  exit 1
+fi
+
+if (( $# == 1 )); then    
+  bash -c "$1" >"$tmpfile"
+else      
+  "$@" >"$tmpfile"
+fi
+
+data=$(cat "$tmpfile")
+op="$*"
+echo -e "\$ $op\n$data" | perl -p -e 'chomp if eof' | xclip -in -sel clip
+rm "$tmpfile"
diff --git a/system/networking/blockers.sh b/system/networking/blockers.sh
index 9ee2922..31c1cac 100644
--- a/system/networking/blockers.sh
+++ b/system/networking/blockers.sh
@@ -1,3 +1,4 @@
+# websites i'd like to (automatically) block on certain wifi connections
 set -euo pipefail
 
 blacklist=(
diff --git a/system/services/dnsmasq/default.nix b/system/services/dnsmasq/default.nix
index b5ed4a2..b0c6b82 100644
--- a/system/services/dnsmasq/default.nix
+++ b/system/services/dnsmasq/default.nix
@@ -12,7 +12,7 @@
     enable = true;
     resolveLocalQueries = true;
     settings = {
-      conf-dir = "/var/lib/dnsmasq/conf.d";
+      conf-dir = "/var/lib/dnsmasq/conf.d"; # see ../networking/blockers.sh and ...../home/scripts/dns
       listen-address = "127.0.0.1";
       resolv-file = "/dev/null"; # god fuck you fuck you fuck you tailscale + systemd-resolved + dnsmasq it took me *three hours* at 3am to get this one working
       server = ["1.1.1.1" "1.0.0.1"];
diff --git a/system/services/services.nix b/system/services/services.nix
index ca33227..d103904 100644
--- a/system/services/services.nix
+++ b/system/services/services.nix
@@ -7,7 +7,7 @@
     ./synaptics/default.nix
     ./tailscale/default.nix
     ./syncthing/default.nix
-    # ./resolved/default.nix
+    # ./resolved/default.nix (not enabled, in favor of dnsmasq)
     ./dnsmasq/default.nix
   ];
 }