0dcac55a0c
hst/config: remove container etc field
...
This no longer needs special treatment since it can be specified as a generic filesystem entry.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-25 19:24:33 +09:00
a3988c1a77
hst: rename net and abstract fields
...
This makes more sense and matches the container library.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-18 16:48:01 +09:00
5db0714072
container: optionally isolate host abstract UNIX domain sockets via landlock
2025-08-18 16:28:14 +09:00
4ffeec3004
hst/enablement: editor friendly enablement adaptor
...
Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-15 05:16:51 +09:00
4433c993fa
nix: check config via hakurei
...
This is unfortunately the only feasible way of doing this in nix.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-15 03:27:54 +09:00
99ac96511b
hst/fs: interface filesystem config
...
This allows mount points to be represented by different underlying structs.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-14 04:52:49 +09:00
e99d7affb0
container: use absolute for pathname
...
This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-11 04:56:42 +09:00
ec33061c92
nix: remove nscd cover
...
This is a pd workaround that does nothing in the nixos module.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-01 22:04:58 +09:00
f7bd28118c
hst: configurable wait delay
...
This is useful for programs that take a long time to clean up.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-29 03:06:49 +09:00
b43d104680
app: integrate interrupt forwarding
...
This significantly increases usability of command line tools running through hakurei.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-29 02:23:06 +09:00
625632c593
nix: update flake lock
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-07-26 18:57:54 +09:00
87e008d56d
treewide: rename to hakurei
...
Fortify makes little sense for a container tool.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-06-25 04:57:41 +09:00
bf5772bd8a
nix: deduplicate home-manager merging
...
This becomes a problem when extraHomeConfig defines nixos module options.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-06-08 01:12:18 +09:00
2ffca6984a
nix: use reverse-DNS style id as unique identifier
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-05-25 20:12:30 +09:00
f30a439bcd
nix: improve common usability
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-05-16 04:40:12 +09:00
31b7ddd122
fst: improve config
...
The config struct more or less "grew" to what it is today. This change moves things around to make more sense and fixes nonsensical comments describing obsolete behaviour.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-04-13 03:30:19 +09:00
2f4f21fb18
fst: rename device field
...
Dev is very ambiguous. Rename it here alongside upcoming config changes.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-04-11 19:32:15 +09:00
72c59f9229
nix: check share/applications in share package
...
This allows share directories without share/applications/ to build correctly.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-03-29 19:28:20 +09:00
32c90ef4e7
nix: pass through exec arguments
...
This is useful for when a wrapper script is unnecessary.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-03-27 03:04:46 +09:00
371dd5b938
nix: create current-system symlink
...
This is copied at runtime because it appears to be impossible to obtain this path in nix.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-03-26 02:06:11 +09:00
67eb28466d
nix: create opengl-driver symlink
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-03-25 20:52:20 +09:00
5c4058d5ac
app: run in native sandbox
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-03-25 01:52:49 +09:00
3385538142
nix: clean up flake outputs
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-03-17 12:26:19 +09:00
2d4cabe786
nix: increase nixfmt max width
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-02-28 14:43:46 +09:00
8bf162820b
nix: separate fsu from package
...
This appears to be the only way to build them with different configuration. This enables static linking in the main package.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-02-23 18:13:37 +09:00
6ae02e72fa
nix: test direct_wayland behaviour
...
This should never be used outside tests unless you absolutely know what you're doing or are using GNOME.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-02-15 10:45:27 +09:00
989fb5395f
nix: remove unused configuration
...
User setup no longer depends on userdb.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-02-15 10:10:42 +09:00
8d04dd72f1
nix: mount nvidia devices
...
These non-standard paths are required in the sandbox for nvidia drivers to work.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-25 18:05:18 +09:00
016da20443
nix: expose compat flag in nixos module
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-25 12:42:48 +09:00
efacaa40fa
nix: set deny_devel correctly
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-24 00:50:35 +09:00
96d5d8a396
nix: apply shared home config to reserved aid
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-23 20:48:04 +09:00
8a00a83c71
nix: expose syscall filter policy
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-23 17:24:42 +09:00
134247b57d
nix: configure target users via nixos
...
This makes patching home-manager no longer necessary.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-01-23 17:04:19 +09:00
4d3bd5338f
nix: implement flake checks
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-16 20:54:28 +09:00
39e3ac3ccd
nix: require /etc/userdb nix-daemon
...
There seems to be some kind of credential caching in nix-daemon.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-07 21:07:57 +09:00
40cc8a68d1
nix: rename home directories
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-12-07 20:15:37 +09:00
95668ac998
nix: expose no_new_session in module
...
Useful for shells and terminal programs like chat clients.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-28 00:19:06 +09:00
653d69da0a
nix: module descriptions
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-19 18:10:57 +09:00
f8256137ae
nix: separate module options from implementation
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-19 17:08:22 +09:00
54b47b0315
nix: copy pixmaps directory to share package
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-18 14:46:08 +09:00
8f3f0c7bbf
nix: integrate dynamic users
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-18 02:49:48 +09:00
1a09b55bd4
nix: remove portal paths from default
...
Despite presenting itself as a generic desktop integration interface, xdg-desktop portal is highly flatpak-centric and only supports flatpak and snap in practice. It is a significant attack surface to begin with as it is a privileged process which accepts input from unprivileged processes, and the lack of support for anything other than fortify also introduces various information leaks when exposed to fortify as it treats fortified programs as unsandboxed, privileged programs in many cases.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-10 22:24:17 +09:00
9a13b311ac
app/config: rename map_real_uid from use_real_uid
...
This option only changes mapped uid in the user namespace.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-09 12:01:34 +09:00
431aa32291
nix: remove absolute Exec paths
...
Absolute paths set for Exec causes the program to be launched as the privileged user.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-08 02:05:47 +09:00
ad80be721b
nix: improve start script
...
Zsh store path in shebang. Replace writeShellScript with writeScript since runtimeShell is not overridable.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-06 14:09:41 +09:00
4d90e73366
nix: generate strict sandbox configuration
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-11-06 04:25:15 +09:00
b9d5fe49cb
nix: pass $SHELL for shell interpreter
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-12 23:01:06 +09:00
8f03ddc3fa
app: remove bubblewrap launch method
...
Launch methods serve the primary purpose of setting UID in the init namespace, which bubblewrap does not do. Furthermore, all applications will start within a bubblewrap sandbox once it has been implemented.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-10-10 00:11:04 +09:00
3d963b9f67
nix: include package buildInputs in devShells
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-17 23:15:33 +09:00
d49b97b1d4
nix: pass method string directly
...
Signed-off-by: Ophestra Umiker <cat@ophivana.moe >
2024-09-13 11:58:45 +09:00
