058c95bb2c
sysvol: remove autostart option (assume true)
2024-03-21 17:16:11 +00:00
9b793ef4b8
programs: services: no need to fully-qualify paths anymore (s6 doesn't require)
2024-03-21 17:16:11 +00:00
1417497001
users/services: remove serviceConfig.Type option
2024-03-21 17:16:11 +00:00
db12e03f64
users/services: remove oneshot service type
2024-03-21 17:16:11 +00:00
81a6c53c26
users/services: remove RemainAfterExit option
2024-03-21 17:16:11 +00:00
9afd9725d1
users: services: remove no-longer-needed Restart and RestartSec options
2024-03-21 17:16:11 +00:00
384bc9e816
xdg-desktop-portal: fix to not over-escape $HOME in s6 service definition
2024-03-21 17:16:11 +00:00
6c6e10e470
s6: install manpages
2024-03-21 17:16:11 +00:00
dcdf58e1ab
sway: simplify wrapper
2024-03-21 17:16:11 +00:00
48b2280f2e
feedbackd: fix over-escaping of $HOME
2024-03-21 17:16:11 +00:00
291e704477
programs: replace systemd-specific 'environment' option with generic 'env'
...
note, these services no longer work with systemd, because systemd expects absolute paths
2024-03-21 17:16:11 +00:00
d199e9df99
programs: wob (and wob-audio): remove
...
i don't use it, and its service file was no longer compatible with s6 (it used 'environment')
2024-03-21 17:16:11 +00:00
2336767059
port service manager to s6
...
still a lot of cleanup to do (e.g. support dbus service types), but it boots to a usable desktop
2024-03-21 17:16:11 +00:00
63af94383b
sane-input-handler: only inhibit controls if screen is on
2024-03-21 17:16:11 +00:00
0335b89a12
fractal: stop persisting old directories
2024-03-21 17:16:01 +00:00
0a6b0cbec7
gtkcord4: rename to dissent
2024-03-21 17:16:01 +00:00
df2310d590
gnome-keyring: ensure the keyring directory is created before entering the sandbox
2024-03-21 17:16:01 +00:00
6595d177be
gimp: fix sandboxing
2024-03-13 11:36:57 +00:00
d194abb4bf
swaync: stylize the actual notifications
2024-03-13 11:29:05 +00:00
eaf45e2366
swaync: re-theme (pink/black)
2024-03-13 11:07:17 +00:00
66e04857b6
swaync: fix dimensions to be compatible with pinephone
2024-03-13 08:29:23 +00:00
fa0dcdc5be
swaync: splie style.css out to own file
2024-03-13 08:18:34 +00:00
23b87a283a
swaync: move to own directory
2024-03-13 08:17:14 +00:00
849ca59f68
swaync: fix styling of toggle buttons
2024-03-13 08:16:47 +00:00
5e1a6062af
swaync: ensure it starts *after* pipewire-pulse so that the mpris plugin can function
2024-03-13 07:53:45 +00:00
8dacb93861
fontconfig: remove no-longer-needed cache; disable Font Awesome (emoji seem well-covered by Noto Color Emoji)
2024-03-13 05:28:57 +00:00
eafabe87c4
xdg-desktop-portal: tell systemd the BusName of the service so that it won't consider it started until after said bus name is acquired
...
this partially fixes an error in sandboxed gtk apps where they would try to connect to org.freedesktop.portal to query settings, and then fall back to bad default fonts when the endpoint errored (because xdp-gtk wasn't ready)
2024-03-13 05:27:43 +00:00
ac22b36d78
dconf: invoke it ourselves instead of letting dbus do it for us
2024-03-13 04:49:48 +00:00
4439491bf0
dconf: fix over-restrictive sandboxing (because previously it was being run unsandboxed...)
2024-03-13 04:49:48 +00:00
546482dc80
dconf: disable GIO_EXTRA_MODULES patch
2024-03-13 02:41:39 +00:00
2f07fff084
dconf: migrate to sane.programs
2024-03-13 02:33:02 +00:00
7513811111
blast: minor cleanups
2024-03-12 12:06:57 +00:00
eabd113262
mpv: blast: shut it down properly even when sandboxed
...
it only cost everything. also, blast doesnt reliably clean up its pseudo devices
2024-03-12 11:51:15 +00:00
01fa9919fd
mpv: route casting through a lua script
...
this lets me use `subcprocess` instead of `run`, and so the command terminate alongside mpv
2024-03-12 05:01:45 +00:00
56a2c4e49f
mpv: split conf files out of main nix code
2024-03-12 03:32:07 +00:00
bf953fbdb5
mpv: move to own dir
2024-03-12 03:27:20 +00:00
4f2d0f2e56
mpv: tune uosc options
2024-03-12 03:05:56 +00:00
08ee0375cc
mpv: blast-to-default: remove unnecessary xdg-terminal-exec indirection
2024-03-11 12:07:08 +00:00
afd1a42ec7
mpv: refer to xdg-terminal-exec by name, not full path
2024-03-11 11:56:53 +00:00
21691fc2fd
mpv: add a menu option to cast just the audio, via Blast
2024-03-11 11:43:53 +00:00
c1edf96ce0
blast-ugjka: introduce a helper blast-to-default program
2024-03-11 11:43:29 +00:00
21714849cf
sway: get Celeste to run in fullscreen again
2024-03-11 08:04:21 +00:00
379f3ef9e0
zsh: deref alias: make the result writable
2024-03-11 08:01:27 +00:00
6822dad9c0
splatmoji: remove from config
2024-03-11 07:53:48 +00:00
9f8e42ef92
fcitx5: enable
2024-03-11 07:44:21 +00:00
bda374db13
sway: ship the nightly version
2024-03-11 05:53:14 +00:00
180a217744
cleanup: remove unnecessary config = { ... } scope
2024-03-11 04:31:11 +00:00
f13ece2212
sway: tune resize more shortcuts; enable natural scrolling
2024-03-11 04:30:28 +00:00
0905a658ad
rofi: cherry-pick my patches instead of pinning to a fork
...
wayland upstream released 1.7.5+wayland3, which is compatible with my patches
2024-03-10 23:43:34 +00:00
90b9d00f37
swaync: remove mpris icon patch (upstreamed)
2024-03-10 23:16:33 +00:00
573a50fedc
doc: pipewire: mention some debug env vars
2024-03-10 04:59:51 +00:00
f8797a77ff
blast: ship it!
...
TODO: integrate into mpv :)
2024-03-10 04:09:34 +00:00
e6111c9d5e
firefox: hide the bookmarks menuabar
2024-03-10 01:59:46 +00:00
4d6eb705eb
mpv: link to some useful extensions
2024-03-10 01:02:54 +00:00
fd70b6acbf
rofi: tune maximum height
2024-03-09 23:34:43 +00:00
8af962c3a6
mpv: auto-populate internal playlist with other files in the same directory, on launch
...
so now i can listen to whole albums by opening any file from within them.
and for shows the next episode will automatically launch.
2024-03-09 03:02:09 +00:00
9ea39799a5
zsh: fix c alias
2024-03-09 03:01:37 +00:00
f2e760710d
sysvol: tune its position
2024-03-08 23:06:37 +00:00
dc70ed8bd8
pipewire: wait for sockets to appear before considering it active
...
this fixes race around consumers like sysvol starting too early
2024-03-08 22:44:59 +00:00
2b73ebb4c1
sysvol: don't start until after pipewire is ready
2024-03-08 12:55:33 +00:00
df98ef30e0
sysvol: integrate as a service (sane.programs)
2024-03-08 11:53:13 +00:00
f3568b3ffc
sway: port volume controls: pulse -> pipewire
2024-03-08 09:56:15 +00:00
9eaf4d71b2
sway: use simpler assign notation where applicable
2024-03-08 09:53:07 +00:00
3200188a32
sway: factor/generalize the TV workspace/output assignment
2024-03-08 09:50:35 +00:00
a4ab60b836
sway: auto-fullscreen everything on the TV
2024-03-08 09:42:07 +00:00
3282b40e9b
doc: sway: consider how to auto-fullscreen mpv on external display
2024-03-08 09:31:08 +00:00
39411164af
zsh: add deref function to turn a symlink into a real file
2024-03-08 08:50:28 +00:00
c0a94995a5
docs: note limitations of schlock
2024-03-08 08:16:11 +00:00
f4b5d3a70a
sway: position certain apps (mpv, Celeste) on external displays by default
2024-03-08 06:27:16 +00:00
07373b5e6b
sway: configure TV output
2024-03-08 06:23:33 +00:00
7281b94e23
deadd-notification-center: add to sane.programs
...
this is the bare, nearly-default config. i may come back to this,
or explore fixing swaync up into shape. deadd looks possibly a bit more
limited; needs much more effort to style.
2024-03-08 04:06:18 +00:00
0e83742096
sway: allow config reloading
2024-03-08 03:44:33 +00:00
7d8205352c
moby: use screen scale of 2.0 in portrait AND landscape
2024-03-08 02:21:47 +00:00
c4994162e1
mpv: fix go2tv sandbox interaction
2024-03-08 02:06:23 +00:00
24a211bd3d
sane-input-handler: remove keyboard launch fallback
...
it'll never work, because of sandboxing
2024-03-08 01:18:39 +00:00
27c12edec0
wvkbd: change default key border 2 -> 1 px
...
since moby is scaled 2x, it's actually 2 px *in practice*
2024-03-08 00:45:45 +00:00
b41320ffb3
megapixels: fix sandbox-related crash
2024-03-08 00:16:29 +00:00
ac41cfcd42
wvkbd: tune height (by guess)
2024-03-08 00:01:23 +00:00
62cbc65f12
epiphany: fix sandboxing
2024-03-07 23:24:33 +00:00
ccb856faf5
sane-input-handler: power -> vol to rotate display
2024-03-07 23:22:07 +00:00
bb300a4eb5
swayidle: dont enable screenoff action by default
2024-03-07 11:18:34 +00:00
fd4842ab5b
swayidle: auto screenoff
2024-03-07 10:59:44 +00:00
041ce0654e
schlock: sandbox + auto-launch via .desktop file
2024-03-07 10:32:40 +00:00
1d0458ab10
schlock: ship as sane.programs
2024-03-07 10:10:39 +00:00
a9419b7351
swayidle: sandbox
2024-03-06 21:33:11 +00:00
f0d0343b32
sway: lappy: fix output name
2024-03-06 21:18:43 +00:00
bd27f3a015
swayidle: enable; pair with swaylock
2024-03-06 20:55:01 +00:00
6a3e632335
sway: remove config for old external displays i no longer use
2024-03-06 19:03:13 +00:00
a4c4b0575c
sway: map touch inputs to their correct display
2024-03-06 19:02:23 +00:00
63d95edcbe
zsh: fix c alias
2024-03-06 09:47:33 +00:00
687e72897b
xdg-desktop-portal: don't always prompt the user for how to open every file
2024-03-06 06:25:36 +00:00
5f4e421ab9
sane-wipe: fix sandboxing
2024-03-06 05:11:24 +00:00
085232f18c
wvkbd: configure layers
2024-03-06 05:07:30 +00:00
18c7fc17fd
alacritty: configure font size per-host
2024-03-06 05:07:30 +00:00
a7567dfbe6
ship celeste64
2024-03-06 04:56:39 +00:00
bc0660b623
PDF viewer: evince -> zathura
2024-03-06 04:51:01 +00:00
d39bed46b5
rofi: allow access to Books
2024-03-06 01:39:48 +00:00
4b5d6b16e1
alacritty: ignore media keys
2024-03-05 23:25:31 +00:00
6765fe8d7d
wob: rename sxmo.wobsock -> wob.sock
2024-03-05 10:00:45 +00:00
955119e07b
wob-audio: fix, by finishing the port to pipewire
...
also rewrote it in Python because bash can't do floating point math
2024-03-05 09:32:37 +00:00
d43cc6c61c
alsa-ucm-conf: fold the Pinephone patches into sane.programs.alsa-ucm-conf & distribute to all hosts
2024-03-05 00:28:07 +00:00
c86afca795
cozy: patch via sane.programs, not overlay
2024-03-04 09:26:25 +00:00
b1dff9bfa8
steam: fix controllers to work in the sandbox
2024-03-03 20:03:20 +00:00
0630037f86
steam: sandbox
...
controllers are untested, probably need to be added; graphics and sound work fine
2024-03-03 10:10:14 +00:00
9513680538
sway: enable net access in the sandbox (for Xwayland)
2024-03-03 10:09:29 +00:00
0affeb098a
rofi: optimize sizing
2024-03-03 07:36:33 +00:00
979d07d693
wob: port pulseaudio -> pipewire
2024-03-03 07:22:03 +00:00
fd072883dc
sane-input-handler: port pulseaudio -> pipewire native
2024-03-03 07:13:23 +00:00
ed87792f9b
sed: sandbox
2024-03-03 07:06:00 +00:00
8821b3ca7d
procps: sandbox
2024-03-03 06:55:17 +00:00
5e5a1fbaae
rofi: allow to use more space on moby when keyboard is active
2024-03-03 04:46:12 +00:00
d2f470dc74
wvkbd: sandbox
2024-03-03 04:44:23 +00:00
7933ef41a2
unl0kr: simplify this code
2024-03-03 04:43:44 +00:00
6b45589e54
wireplumber: ensure ALSA_UCM_CONF2 env var is on PATH
...
this is critical for pipewire/wireplumber to work on moby
2024-03-03 04:43:11 +00:00
4b04cbc078
mpv: couple app volume to system volume
2024-03-03 03:22:28 +00:00
1498e364b2
doc: mimeo: mention jaro as alternative
2024-03-03 03:16:10 +00:00
0aaa3eaaeb
mpv: remove legacy vo=wlshim hack
2024-03-02 23:46:52 +00:00
c747855810
bonsai: sandbox
2024-03-02 22:34:38 +00:00
96ec0106ee
sane-input-handler: leverage sane-open-desktop instead of making direct gdbus calls
2024-03-02 21:20:47 +00:00
0c4d7761d3
sane-input-handler: sandbox
2024-03-02 21:20:47 +00:00
fe10640821
wob-pulse: sandbox
2024-03-02 20:57:44 +00:00
1fcf0bfcb1
swaync: fix signal-desktop check to be --user
2024-03-02 18:33:35 +00:00
a3ae650273
dialect: fix so it works inside a sandbox
2024-03-02 18:25:13 +00:00
3b603519ff
fuzzel: sandbox (well, i probably dont even have it on my system anymore :P)
2024-03-02 07:43:42 +00:00
f69ca166f4
sway: sandbox
2024-03-02 07:41:51 +00:00
3dd1d18dcd
less: sandbox
2024-03-02 07:11:45 +00:00
28cb705bd4
grim: sandbox
2024-03-02 07:11:45 +00:00
7fa1dbc5d5
slurp: sandbox
2024-03-02 07:11:45 +00:00
8b7575c205
swappy: sandbox
2024-03-02 07:11:45 +00:00
52e9902fa1
sane-screenshot: give it permissions to my screenshots dir (derp)
2024-03-02 06:14:05 +00:00
ab765a81af
sway: integrate sane-screenshot as the PrintScreen shortcut
2024-03-02 06:14:05 +00:00
a7bd831ad8
sane-screenshot: port to sane.programs
2024-03-02 06:14:05 +00:00
f4ec09f010
rofi: remember the last selected directory
2024-03-02 00:35:29 +00:00
a40cefc8a5
pipewire: speculatively add /dev/video*
2024-03-02 00:14:47 +00:00
f55bb3518f
wireplumber: add missing /dev/video2 which is on moby
2024-03-02 00:14:21 +00:00
3d16aa62ea
sway: let the pinephone default to it's normal scaling
...
it's actually pretty nice at 2.0 scaling with my current apps. i'll need to tweak swaync, conky, wvkbd, etc. later.
2024-03-01 23:53:31 +00:00
2548cfeadc
xdg-desktop-portal-wlr: fix crashing due to over-restrictive sandbox
2024-03-01 21:17:31 +00:00
90acbf716d
Videos/gPodder: allow access from mpv and rofi
2024-03-01 21:02:04 +00:00
bba149c670
zsh: new c helper to change into a dir and list it
2024-03-01 20:09:20 +00:00
c056984003
zsh: alias exiy -> exit
2024-03-01 19:56:09 +00:00
2324d75165
switch psmisc -> killall
...
otherwise a really shitty `pstree` makes its way onto my PATH
2024-03-01 18:50:20 +00:00
9296b7731b
rofi: add a .desktop file to rofi-snippets
2024-03-01 18:07:52 +00:00
95c95d6f53
splatmoji: actually install the .desktop files
2024-03-01 18:03:45 +00:00
fca23e661a
xdg-desktop-portal: disable debug logging
2024-03-01 17:50:49 +00:00
9a7ebbd9d3
rofi: configure window height/location
2024-03-01 17:18:40 +00:00
56b00d998e
rofi: theme
...
i still need to figure out how to make it wider for moby
2024-03-01 16:40:09 +00:00
01ef182073
waybar: theme the indicator style
...
i don't know if it's perfect, but it is better
2024-03-01 15:32:52 +00:00
b6daeddfa2
waybar: show different modules for moby v.s. others
2024-03-01 15:25:42 +00:00
c6e956f3d2
waybar: fix button.urgent color to match sway's client.urgent
2024-03-01 15:03:14 +00:00
82368eb45a
sway: desko: fix monitor layout
...
i guess my monitor's name changed... 👀
2024-03-01 07:19:00 +00:00
65fb9e1d57
rofi: allow access to more servo media paths
2024-03-01 07:14:41 +00:00
b02ae7ef74
moby: polyfill an OK sway layout
2024-03-01 05:20:28 +00:00
37ddb2ae17
waybar: fix font size to be more usable on moby
2024-03-01 04:46:06 +00:00
81e02e2885
sway: moby: fix layout/scale preferences
2024-03-01 04:38:26 +00:00
4a3f59468c
sway: launch gui apps via sane-open-desktop instead of inline
...
this will allow for sandboxing, in the future
2024-03-01 04:19:19 +00:00
daab5939e7
rofi: split sane-open-desktop out as a helper
2024-03-01 04:19:19 +00:00
e7430c41f9
refactor: sway-config: for readability
2024-03-01 03:29:52 +00:00
5849e75577
sway-config: remove dead window specializations
2024-03-01 03:21:47 +00:00
296123651c
sway: fold sway-config.nix into default.nix
2024-03-01 03:18:37 +00:00
7f0d5e7810
sane-input-handler: explain why i setsid
2024-03-01 03:11:06 +00:00
7af928a6d2
sway: direct inputs to bonsai WITHOUT swallowing them
2024-03-01 03:10:44 +00:00
b73569d675
wvkbd: fix service typo
2024-02-29 22:04:42 +00:00
50ee15ef2b
send sway-related cross patches upstream
2024-02-29 21:35:02 +00:00
9764d5f095
sway/waybar: decrease cross-specific patches
...
cava cross compiles now (yay); sndio is actually required by waybar if cava is enabled, so remove the disable
2024-02-29 18:56:54 +00:00
43386f3ba5
nixpkgs: update; couple cross-compiling patches have merged upstream
...
```
• Updated input 'nixpkgs-next-unpatched':
'github:nixos/nixpkgs/0852bff4370133e3a62b0cc7d14d193b928a7c59' (2024-02-29)
→ 'github:nixos/nixpkgs/e894afb6c101fea0771b47d7827bef022e89ee1e' (2024-02-29)
• Updated input 'nixpkgs-unpatched':
'github:nixos/nixpkgs/9f21aa90cb8c078969543956d88c19696b646743' (2024-02-29)
→ 'github:nixos/nixpkgs/d29fabd630000579f744d04639d625828ba412bf' (2024-02-29)
```
2024-02-29 18:22:35 +00:00
083f743c1f
remove nixpkgs less defaults and manage PAGER myself
...
this lets me avoid the lesspipe cross failures, notably
2024-02-29 15:18:51 +00:00
6253d1799a
port sxmo_hook_inputhandler.sh -> sane-input-handler
...
this one can run outside the SXMO environment.
major thing missing at the moment is that rofi doesn't get volume
control inputs because bonsai out-competes it for exclusive control.
2024-02-29 01:26:38 +00:00
d8a8038cae
xdg-terminal-exec: define a .desktop file
2024-02-29 00:17:26 +00:00
7fd56b63cb
rofi: better patch for the DT_UNKNOWN edgecase
2024-02-28 21:41:59 +00:00
7a65bd36c7
rofi: patch the filebrowser to reliably list entries on remote filesystems
...
see: <https://github.com/davatorium/rofi/issues/1954 >
2024-02-28 21:18:19 +00:00
40e30cf2f8
programs: make sandbox.wrapperType default to "wrappedDerivation" and remove everywhere i manually set that
2024-02-28 17:39:00 +00:00
812c0c8029
packages: reduce the number of packages which are using inplace sandbox wrapping
2024-02-28 17:35:40 +00:00
70229e0839
rofi: persist the filebrowsercache
2024-02-28 15:41:52 +00:00
cd303a76bc
rofi: disable "run" from combi
...
they wouldn't work, since i only 'xdg-open' the entries
2024-02-28 15:32:12 +00:00
e43aa3bb8b
splatmoji: fix sandboxing so rofi can read its config/cache
2024-02-28 15:19:53 +00:00
6c2d80715c
rofi-snippets: fix sandboxing so rofi can read its config/cache
2024-02-28 15:15:02 +00:00
d912190db5
sway: split snippets into own program (rofi-snippets)
2024-02-28 14:44:05 +00:00
c380f61bea
fix "rescue" host to eval again
2024-02-28 14:19:45 +00:00
b302113fc0
modules/programs: require manual definition; don't auto-populate attrset
...
this greatly decreases nix eval time
2024-02-28 13:35:09 +00:00
3816393e06
rofi: try integrating rofi-emoji (failed)
2024-02-28 01:28:05 +00:00
4c6c470c86
sway: snippets: port from fuzzel -> rofi
2024-02-28 01:26:22 +00:00
409a4db232
splatmoji: use rofi instead of fuzzel
...
will be best if i can port everything to one dmenu helper
2024-02-28 01:18:51 +00:00
8f424dcd5a
programs: sandboxing: link /etc into sandboxed programs
...
this is crucial for e.g. swaync, to find its resource files.
maybe a good idea to link *every* package directory which i also link
into /run/current-system.
2024-02-27 22:25:17 +00:00
67536e3c1f
programs: assorted: correct sandbox paths now that Pictures/Videos/Books are categorized
...
i don't like this Pictures/ approach though. i may reconsolidate some of those
2024-02-27 21:37:20 +00:00
715de37954
rofi: fix files to be opened with xdg-open
2024-02-27 21:20:12 +00:00
e37a7d85b3
~/Videos: don't persist ALL videos: just ~/Videos/local
...
otherwise, ~/Videos/servo is a symlink which the programs module doesn't know how to traverse (and hence, sandbox).
2024-02-27 20:45:56 +00:00
36f6c72183
rofi: sandbox, and launch apps via xdg-open or gdbus
2024-02-27 18:35:15 +00:00
20a1aeb5b3
programs: add gdbus as a standalone program, separate from the rest of glib
2024-02-27 18:28:24 +00:00
4379addf9e
plumb my configured sway through to everywhere that wants pkgs.sway.
...
kinda ugly. this lets me avoid having multiple versions of sway on my
system.
2024-02-27 16:11:10 +00:00
5c7eceeb55
grimshot: move to own file
2024-02-27 14:54:53 +00:00
50aa16df81
cross compilation: remove unused patches; note upstreaming status
2024-02-27 14:53:26 +00:00
40e22533fb
swaynotificationcenter: update config/patches to be compatible with 0.10.0
2024-02-27 11:19:29 +00:00
92033c8414
rofi: place druncache into rofi cache dir
2024-02-27 01:21:27 +00:00
16f0424631
rofi: patch so that i can use -run-command "my-launcher {app_id}.desktop"
...
this plus xdg-desktop-portal's DynamicLauncher should provide a way to sandbox everything
2024-02-27 01:03:21 +00:00
6fd1ce1f61
rofi: port cache from plaintext to cryptClearOnBoot
...
because i don't think it has any invalidation logic
2024-02-26 23:04:50 +00:00
a7c325c8e1
xdg-desktop-portal: link applications so that DynamicLauncher portal can work
2024-02-26 22:31:48 +00:00
245e6c93cd
docs: xdg-desktop-portal: document notable dbus endpoints
2024-02-26 22:29:03 +00:00
ec073592ed
sway: use rofi app launcher instead of fuzzel
2024-02-26 21:22:03 +00:00
617525a317
programs: add rofi (dmenu-style launcher/file browser)
2024-02-26 21:21:30 +00:00
f2e1bb6b86
programs: python3-repl: sandbox
2024-02-25 18:52:55 +00:00
c402a265cd
programs: stepmania: sandbox
2024-02-25 18:26:32 +00:00
d5643a6a5d
assorted static-nix-shell packages: use srcRoot
2024-02-25 17:37:38 +00:00
c9c1181242
programs: wireplumber: sandbox
2024-02-25 17:11:48 +00:00
f9888fe8d6
programs: sane-private-init: sandbox
2024-02-25 16:46:10 +00:00
036145e6ba
programs: sane-private-change-passwd: sandbox
...
note that this is entirely untested
2024-02-25 16:35:13 +00:00
7c486492c8
programs: pipewire: port sandbox to bwrap and restrict further
2024-02-25 15:19:57 +00:00
890b41f563
programs: pipewire: sandbox
...
still need to sandbox wireplumber
2024-02-25 14:34:11 +00:00
ca36fe1b96
programs: gnome.seahorse: sandbox
2024-02-25 12:03:42 +00:00
d2df668c9e
modules/programs: sane-sandboxed: replace --sane-sandbox-keep-pidspace with --sane-sandbox-keep-namespace <pid|cgroup|ipc|uts>
2024-02-25 12:00:00 +00:00
b7921ac41b
refactor: programs: sort
2024-02-25 11:53:49 +00:00
c304367e21
programs: gnome-maps: sandbox
2024-02-25 11:51:50 +00:00
2ad33a49df
refactor: pipewire: remove dead code
2024-02-25 10:38:42 +00:00
0b4efd2ab2
pipewire: migrate services to sane.programs to completely disable socket activation
...
see: https://github.com/NixOS/nixpkgs/issues/291318
2024-02-25 10:36:21 +00:00
0745e9fc06
refactor: programs: split gnome-maps into own file
2024-02-25 09:06:32 +00:00
e0267b5669
programs: pipewire: disable socket activation
2024-02-25 08:55:59 +00:00
b3c7aac8c5
programs: wike: sandbox: enable DRI to fix graphical glitches
2024-02-25 08:38:10 +00:00
c788596c45
programs: sane-private-do: grant net access
...
crucial for e.g. sane-private-do git push
2024-02-25 08:25:13 +00:00
6865331b48
programs: sandbox sane-scripts.private-do
2024-02-25 05:41:27 +00:00
f714bd8281
programs: jq: sandbox
2024-02-25 01:59:01 +00:00
73b2594d9b
programs: sandboxing: distinguish between "existingFileOrParent" and "existingOrParent"
2024-02-25 01:59:01 +00:00
eecb98e2ee
programs: bonsai: fix eval error
2024-02-23 16:00:32 +00:00
aa0991bd6c
persistence: cleanup so it all works well with symlink-based stores
2024-02-23 13:09:44 +00:00
62b39bf01e
firefox: integrate the "persist" config into "sane.programs"
2024-02-23 11:23:41 +00:00
0d8307e877
programs: gnome-keyring: sandbox
...
and now secrets are readable again. they were broken for the last ~10 commits :)
2024-02-23 09:49:35 +00:00
9b1a2ae9bb
programs: mpv: remove useless "extraRuntimePaths = []" override
2024-02-23 09:32:19 +00:00
b8b805765b
programs: gnome-keyring-daemon: remove the SUID wrapper
...
it's not actually mandated. just, when enabled, gkd will `mlock` its
secrets into memory. but i don't use swap anyway. plus, i'll enable that
momentarily anyway (though systemd will probably not understand the
capablity)
2024-02-23 09:28:41 +00:00
84eae20765
gnome-keyring: don't integrate with PAM
...
PAM integration is only required if the keyring is encrypted on-disk
2024-02-23 09:15:30 +00:00
4a10c5f729
gnome-keyring: start as systemd service explicitly, not as implicit dbus service
2024-02-23 09:09:54 +00:00
c2696c1cd9
gnome-keyring: use sane.fs abstractions to write out the keyrings
2024-02-23 08:57:41 +00:00
ea6f45555c
gnome-keyring: simplify the scripts (untested)
2024-02-23 08:14:09 +00:00
687db545b4
gnome-keyring: move persistence and init script to sane.programs
2024-02-23 07:22:07 +00:00
24d1d13d0a
programs: simplify sandboxing of file browsers/etc now that private data lives on a different mount
2024-02-23 07:06:29 +00:00
057b9e3fed
replace links/references to ~/private/FOO with just ~/FOO
2024-02-23 07:06:29 +00:00
4a316d4b91
bonsai: lift out of sxmo
2024-02-23 07:06:29 +00:00
af03b3f6e8
xwayland: sandbox
2024-02-23 01:05:24 +00:00
5819f07181
programs: xwayland: sandbox
2024-02-22 22:12:03 +00:00
122f3fa5cc
sway: remove xwayland-specific placement of Signal
...
it breaks non-xwayland sway config parsing, and Signal is native Wayland now anyway even with Xwayland running'
2024-02-22 22:01:48 +00:00
473999c001
sway: re-enable networkmanager
2024-02-21 23:46:25 +00:00
d1de9efde1
sway: port xwayland use to sane.programs API
2024-02-21 23:32:10 +00:00
50c3f04714
pipewire: remove dead alsa comments
2024-02-21 23:26:40 +00:00
49bad8f186
sway: split pipewire persisted file into pipewire.nix
2024-02-21 23:26:25 +00:00
fd9f500e97
sway: split pipewire config into separate sane.programs.pipewire
2024-02-21 23:23:52 +00:00
386651044e
sway: port to sane.programs API
2024-02-21 23:18:57 +00:00
d77a12ce7b
unl0kr: remove the "afterLogin" option and choose automatically which desktop to launch
2024-02-21 20:47:48 +00:00
153d2a1047
GSK_RENDERER: don't set globally, but just for the apps which _actually_ require it
...
this way i can avoid conflicts around apps which don't expect this to be set (e.g. delfin)
2024-02-21 16:56:56 +00:00
b8f090be93
programs: delfin: add required mpris permissions
2024-02-21 13:27:19 +00:00
5a0760a571
programs: sandbox oathtools
2024-02-21 00:03:48 +00:00
757ab79724
programs: dconf: sandbox
2024-02-20 23:43:25 +00:00
81148b7b42
programs: explicitly depend on dconf instead of manually persisting dconf's dirs
2024-02-20 23:39:27 +00:00
429d0c53e7
programs: ripgrep: sandbox with bwrap instead of landlock
...
this provides network isolation
2024-02-20 23:32:54 +00:00
