kat/hakurei
1
0
Fork 0
forked from rosa/hakurei
Code Pull Requests Activity
2,467 Commits 2 Branches 14 Tags
725f2e0ef3eaba1ad46b597604a684125ab93911
Commit Graph

36 Commits

Author SHA1 Message Date
cat 620062cca9 hst: expose scheduling priority 
This is useful when limits are configured to allow it.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-03-12 02:15:14 +09:00
cat 04e6bc3c5c hst: expose scheduling policy 
This is primarily useful for poorly written music players for now.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-03-12 00:52:18 +09:00
cat 423808ac76 nix: use package from module in default 
This makes overriding hakurei easier. Also avoids building hakurei twice since nix does that for some reason.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-01-11 03:50:08 +09:00
cat e42ea32dbe nix: configure sharefs via fileSystems 
Turns out this did not work because in the vm test harness, virtualisation.fileSystems completely and silently overrides fileSystems, causing its contents to not even be evaluated anymore. This is not documented as far as I can tell, and is not obvious by any stretch of the imagination. The current hack is cargo culted from nix-community/impermanence and hopefully lasts until this project fully replaces nix.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-27 23:14:08 +09:00
cat 7bfbd59810 cmd/sharefs: implement shared filesystem 
This is for passing files between applications, similar to android /sdcard.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-25 05:13:02 +09:00
cat 54610aaddc internal/outcome: expose pipewire via pipewire-pulse 
This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst.

Closes #29.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-15 12:57:06 +09:00
cat ebc67bb8ad nix: update flake lock 
NixOS 25.11 introduces a crash in cage and an intermittent crash in foot.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-12 08:39:55 +09:00
cat 87781c7658 treewide: include PipeWire op and enforce PulseAudio check 
This fully replaces PulseAudio with PipeWire and enforces the PulseAudio check and error message. The pipewire-pulse daemon is handled in the NixOS module.

Closes #26.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-08 08:53:04 +09:00
cat 422efcf258 hst: check for insecure PulseAudio enablement 
This is currently still a noop, but required for #26.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-08 03:13:02 +09:00
cat 699c19e972 hst/container: optional runtime and tmpdir sharing 
Sharing and persisting these directories do not always make sense. Make it optional here.

Closes #16.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-10-19 04:11:38 +09:00
cat 70e02090f7 nix: use slightly less ambiguous type 
I had trouble getting Nix to merge json arrays properly, I am not sure that this helps.

At this point I have given up trying to understand Nix type system, and I am just trying to keep the Nix stuff going with extensive tests until it can be replaced by lkl for testing and planterette for general usage.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-09-14 14:45:14 +09:00
cat a3988c1a77 hst: rename net and abstract fields 
This makes more sense and matches the container library.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-18 16:48:01 +09:00
netadr 5db0714072 container: optionally isolate host abstract UNIX domain sockets via landlock 2025-08-18 16:28:14 +09:00
cat 4ffeec3004 hst/enablement: editor friendly enablement adaptor 
Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-15 05:16:51 +09:00
cat 4433c993fa nix: check config via hakurei 
This is unfortunately the only feasible way of doing this in nix.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-15 03:27:54 +09:00
cat 99ac96511b hst/fs: interface filesystem config 
This allows mount points to be represented by different underlying structs.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-14 04:52:49 +09:00
cat e99d7affb0 container: use absolute for pathname 
This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-11 04:56:42 +09:00
cat f7bd28118c hst: configurable wait delay 
This is useful for programs that take a long time to clean up.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 03:06:49 +09:00
cat b43d104680 app: integrate interrupt forwarding 
This significantly increases usability of command line tools running through hakurei.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 02:23:06 +09:00
cat 87e008d56d treewide: rename to hakurei 
Fortify makes little sense for a container tool.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 04:57:41 +09:00
cat 2ffca6984a nix: use reverse-DNS style id as unique identifier 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-05-25 20:12:30 +09:00
cat f30a439bcd nix: improve common usability 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-05-16 04:40:12 +09:00
cat 2f4f21fb18 fst: rename device field 
Dev is very ambiguous. Rename it here alongside upcoming config changes.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-11 19:32:15 +09:00
cat 32c90ef4e7 nix: pass through exec arguments 
This is useful for when a wrapper script is unnecessary.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-27 03:04:46 +09:00
cat 5c4058d5ac app: run in native sandbox 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-25 01:52:49 +09:00
cat 3385538142 nix: clean up flake outputs 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-17 12:26:19 +09:00
cat c21a4cff14 nix: wrap fpkg 
This is usable on nixos now due to the static build.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-26 12:24:04 +09:00
cat 8bf162820b nix: separate fsu from package 
This appears to be the only way to build them with different configuration. This enables static linking in the main package.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-23 18:13:37 +09:00
cat 6ae02e72fa nix: test direct_wayland behaviour 
This should never be used outside tests unless you absolutely know what you're doing or are using GNOME.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 10:45:27 +09:00
cat 016da20443 nix: expose compat flag in nixos module 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 12:42:48 +09:00
cat 8a00a83c71 nix: expose syscall filter policy 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 17:24:42 +09:00
cat 134247b57d nix: configure target users via nixos 
This makes patching home-manager no longer necessary.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 17:04:19 +09:00
cat 4d3bd5338f nix: implement flake checks 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 20:54:28 +09:00
cat 95668ac998 nix: expose no_new_session in module 
Useful for shells and terminal programs like chat clients.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-28 00:19:06 +09:00
cat 653d69da0a nix: module descriptions 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:10:57 +09:00
cat f8256137ae nix: separate module options from implementation 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 17:08:22 +09:00