documentation improvements

TODO.md

@@ -1,4 +1,7 @@
 ## BUGS
+- `rmDbusServices` may break sandboxing
+  - e.g. if the package ships a systemd unit which references $out, then make-sandboxed won't properly update that unit.
+  - `rmDbusServicesInPlace` is not affected
 - moby: touchscreen input is still enabled when screen is off
 - when moby wlan is explicitly set down (via ip link set wlan0 down), /var/lib/trust-dns/dhcp-configs doesn't get reset
   - `ip monitor` can detect those manual link state changes (NM-dispatcher it seems cannot)
@@ -153,6 +156,7 @@
   - use `systemctl list-jobs` to show what's being waited on
   - i think it's `systemd-networkd-wait-online.service` that's blocking this?
     - i wonder what interface it's waiting for. i should use `--ignore=...` to ignore interfaces i don't care about.
+  - also `wireguard-wg-home.target` when net is offline
 - add `pkgs.impure-cached.<foo>` package set to build things with ccache enabled
   - every package here can be auto-generated, and marked with some env var so that it doesn't pollute the pure package set
   - would be super handy for package prototyping!

hosts/common/polyunfill.nix

@@ -19,7 +19,7 @@ in
     apply = lib.filterAttrs (name: _: !(builtins.elem name [
       # from <repo:nixos/nixpkgs:nixos/modules/security/polkit.nix>
       "pkexec"
-      "polkit-agent-helper-1"
+      "polkit-agent-helper-1"  #< used by systemd; without this you'll have to `sudo systemctl daemon-reload` instead of unauth'd `systemctl daemon-reload`
       # from <repo:nixos/nixpkgs:nixos/modules/services/system/dbus.nix>
       "dbus-daemon-launch-helper"
       # from <repo:nixos/nixpkgs:nixos/modules/security/wrappers/default.nix>