diff --git a/configuration.nix b/configuration.nix index 7be81c3..1fd0b01 100644 --- a/configuration.nix +++ b/configuration.nix @@ -15,9 +15,6 @@ path = "/root/.ssh/desktop"; mode = "0600"; }; - sops.secrets."deepseek_api_key" = { - owner = "agent"; - }; nix.settings.experimental-features = [ "nix-command" "flakes" @@ -96,14 +93,16 @@ enable = true; ports = [ 22 ]; settings = { - PasswordAuthentication = false; - KbdInteractiveAuthentication = false; + PasswordAuthentication = true; + KbdInteractiveAuthentication = true; PermitRootLogin = "no"; AllowUsers = [ "user" ]; }; }; + + ratbagd.enable = true; }; hardware = { @@ -171,10 +170,10 @@ }; systemd.tmpfiles.rules = [ - "d /home/public 2775 root public - -" - "d /home/public/pictures 2775 root public - -" + "d /home/user/dev 0770 user users -" + "d /home/user/pictures 0750 user users -" - "a+ /home/public - - - - d:g:public:rwX,d:m::rwX" - "a+ /home/public/pictures - - - - d:g:public:rwX,d:m::rwX" + "a+ /home/user/dev - - - - d:g:users:rwX,d:m::rwX" + "a+ /home/user/pictures - - - - d:g:users:rwX,d:m::rwX" ]; } diff --git a/firejail.nix b/firejail.nix index 6654554..7a95668 100644 --- a/firejail.nix +++ b/firejail.nix @@ -57,13 +57,6 @@ in "--private=~/.local/state/claude-home" ]; }; - opencode = { - executable = "${pkgs.opencode}/bin/opencode"; - profile = agentProfile; - extraArgs = [ - "--private=/home/user/.local/state/opencode-home" - ]; - }; chromium-sandbox = { executable = "${pkgs.chromium}/bin/chromium"; profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile"; diff --git a/flake.lock b/flake.lock index 6729dc3..819f475 100644 --- a/flake.lock +++ b/flake.lock @@ -220,6 +220,27 @@ "type": "github" } }, + "microvm": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ], + "spectrum": "spectrum" + }, + "locked": { + "lastModified": 1784320259, + "narHash": "sha256-9yPGZVcPV0W9Iq1qL4rfkNigKIIUk4jRk3YbJNr3pLA=", + "owner": "microvm-nix", + "repo": "microvm.nix", + "rev": "24ae5c9f140e4c4b06d132ea3fc7795b550dfe9e", + "type": "github" + }, + "original": { + "owner": "microvm-nix", + "repo": "microvm.nix", + "type": "github" + } + }, "naersk": { "inputs": { "fenix": "fenix_2", @@ -408,6 +429,7 @@ "ferrosonic": "ferrosonic", "home-manager": "home-manager", "impermanence": "impermanence", + "microvm": "microvm", "niri-branch": "niri-branch", "niri-scratchpad": "niri-scratchpad", "nixpkgs": "nixpkgs_5", @@ -508,6 +530,22 @@ "type": "github" } }, + "spectrum": { + "flake": false, + "locked": { + "lastModified": 1783694892, + "narHash": "sha256-xO8f7Qng+18FK2UlB9vcrkxCaQMCt5WjCH24aW/11eg=", + "ref": "refs/heads/main", + "rev": "24c4346e30fdea8d8e80f34aec3554a15a667d24", + "revCount": 1410, + "type": "git", + "url": "https://spectrum-os.org/git/spectrum" + }, + "original": { + "type": "git", + "url": "https://spectrum-os.org/git/spectrum" + } + }, "systems": { "locked": { "lastModified": 1681028828, diff --git a/flake.nix b/flake.nix index ce56bcd..a842bf2 100644 --- a/flake.nix +++ b/flake.nix @@ -7,10 +7,10 @@ url = "github:Mic92/sops-nix"; inputs.nixpkgs.follows = "nixpkgs"; }; - # microvm = { - # url = "github:microvm-nix/microvm.nix/da28962a2ba84718895b7325f600686c3b4ee099"; - # inputs.nixpkgs.follows = "nixpkgs"; - # }; + microvm = { + url = "github:microvm-nix/microvm.nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; disko = { url = "github:nix-community/disko/latest"; inputs.nixpkgs.follows = "nixpkgs"; @@ -40,6 +40,7 @@ sops-nix, impermanence, home-manager, + microvm, ... }: let @@ -50,7 +51,7 @@ config.allowUnfree = true; # overlays = [ inputs.neovim-nightly-overlay.overlays.default ]; }; - # microvm = inputs.microvm.nixosModules.host; + microvm = inputs.microvm.nixosModules.host; in { nixosConfigurations."${hostname}" = nixpkgs.lib.nixosSystem { @@ -60,7 +61,7 @@ nixpkgs impermanence home-manager - # microvm + microvm sops-nix ; hostname = hostname; @@ -76,8 +77,8 @@ ./home ./firejail.nix inputs.sops-nix.nixosModules.sops - # inputs.microvm.nixosModules.host - # (import ./vms) + inputs.microvm.nixosModules.host + (import ./microvm/sandbox.nix) inputs.disko.nixosModules.disko inputs.impermanence.nixosModules.impermanence inputs.home-manager.nixosModules.home-manager diff --git a/home/agents.nix b/home/agents.nix index b069af8..27fb52f 100644 --- a/home/agents.nix +++ b/home/agents.nix @@ -236,8 +236,8 @@ in { home-manager.users = lib.mkMerge [ (home-manager-config { - uid = 1002; - username = "agent"; + uid = 1001; + username = "sandbox"; }) ]; } diff --git a/home/nvim/default.nix b/home/nvim/default.nix index 08e064e..ce34276 100644 --- a/home/nvim/default.nix +++ b/home/nvim/default.nix @@ -61,13 +61,13 @@ in }) ''; } - # { - # plugin = comment-nvim; - # type = "lua"; - # config = '' - # require('Comment').setup() - # ''; - # } + { + plugin = comment-nvim; + type = "lua"; + config = '' + require('Comment').setup() + ''; + } { plugin = conform-nvim; type = "lua"; @@ -87,7 +87,7 @@ in less = { "prettierd" }, blade = { "blade-formatter" }, go = { "gofmt" }, - wgsl = { "wgsl_fmt" }, + wgsl = { "wgslfmt" }, odin = { "odinfmt" }, }, }) @@ -143,13 +143,13 @@ in # plugin = neotest-zig; # type = "lua"; # } - # { - # plugin = nvim-autopairs; - # type = "lua"; - # config = '' - # require('nvim-autopairs').setup() - # ''; - # } + { + plugin = nvim-autopairs; + type = "lua"; + config = '' + require('nvim-autopairs').setup() + ''; + } { plugin = nvim-dap; type = "lua"; diff --git a/home/user.nix b/home/user.nix index bcc68fc..d5fdafc 100644 --- a/home/user.nix +++ b/home/user.nix @@ -62,13 +62,16 @@ systemd.user.services.waypipe-socket = { Unit = { Description = "start waypipe client"; + After = [ "niri.service" ]; + Requires = [ "niri.service" ]; }; Install = { WantedBy = [ "graphical-session.target" ]; }; Service = { ExecStart = "${pkgs.waypipe}/bin/waypipe --socket /tmp/waypipe.sock client"; - ExecStartPost = "${pkgs.acl}/bin/setfacl -m u:agent:rw /tmp/waypipe.sock"; + ExecStartPost = "${pkgs.acl}/bin/setfacl -m g:sandbox:rw /tmp/waypipe.sock"; + ExecStopPost = "${pkgs.coreutils}/bin/rm /tmp/waypipe.sock"; RuntimeDirectory = "waypipe"; Type = "simple"; Restart = "on-failure"; @@ -255,6 +258,7 @@ }; programs = { + opencode.enable = true; dank-material-shell.enable = true; ssh = { enable = true; @@ -351,7 +355,7 @@ }; safe = { directory = [ - "/home/agent/*" + "/home/sandbox/*" ]; }; }; @@ -360,9 +364,9 @@ home.packages = with pkgs; [ xrdb - (writeShellScriptBin "agent" '' - machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish - '') + # (writeShellScriptBin "agent" '' + # machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish + # '') (writeShellApplication { name = "tmux-sessionizer"; runtimeInputs = [ diff --git a/impermanence.nix b/impermanence.nix index b018315..7936f33 100644 --- a/impermanence.nix +++ b/impermanence.nix @@ -30,11 +30,11 @@ ]; }; - users.agent = { - files = [ - ".config/sops/age/keys.txt" - ]; - }; + # users.agent = { + # files = [ + # ".config/sops/age/keys.txt" + # ]; + # }; }; environment.persistence."/.nobackup" = { diff --git a/kernel/default.nix b/kernel/default.nix index e02655f..6edd722 100644 --- a/kernel/default.nix +++ b/kernel/default.nix @@ -74,6 +74,19 @@ in security.pam.services.su.requireWheel = true; security.pam.services.newgrp.requireWheel = true; + security.polkit = { + enable = true; + extraConfig = '' + polkit.addRule(function(action, subject) { + if ((action.id == "org.freedesktop.machine1.host-shell" || + action.id == "org.freedesktop.machine1.login") && + subject.user == "user") { + return polkit.Result.YES; + } + }); + ''; + }; + boot = { loader = { systemd-boot.enable = true; diff --git a/microvm/sandbox.nix b/microvm/sandbox.nix new file mode 100644 index 0000000..32b31be --- /dev/null +++ b/microvm/sandbox.nix @@ -0,0 +1,104 @@ +{ + config, + pkgs, + lib, + ... +}: +{ + microvm.host.useNotifySockets = true; + microvm.vms."sandbox" = { + config = { + users.users.root = { + password = ""; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh" + ]; + }; + users.users.sandbox = { + isNormalUser = true; + uid = 1001; + group = "users"; + extraGroups = [ + "video" + "render" + ]; + password = ""; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh" + ]; + }; + services.openssh.enable = true; + + boot.kernelModules = [ + "drm" + "virtio_gpu" + ]; + boot.blacklistedKernelModules = lib.mkForce [ ]; + + environment.sessionVariables = { + WAYLAND_DISPLAY = "wayland-1"; + DISPLAY = ":0"; + QT_QPA_PLATFORM = "wayland"; + GDK_BACKEND = "wayland"; + XDG_SESSION_TYPE = "wayland"; + }; + + hardware.graphics.enable = true; + system.stateVersion = lib.trivial.release; + + environment.systemPackages = with pkgs; [ + xdg-utils + ungoogled-chromium + ghostty + tmux + waypipe + pciutils + ]; + + microvm = { + vsock = { + cid = 3; + ssh.enable = true; + }; + writableStoreOverlay = "/nix/.rw-store"; + # graphics.enable = true; + mem = 4096; + interfaces = [ + { + type = "user"; + id = "vm-1"; + mac = "02:00:00:01:01:01"; + } + ]; + volumes = [ + { + mountPoint = "/var"; + image = "var.img"; + size = 256; + } + { + mountPoint = "/nix/.rw-store"; + image = "nix-store-overlay.img"; + size = 512; + } + ]; + shares = [ + { + proto = "virtiofs"; + tag = "projects"; + source = "/home/user/dev"; + mountPoint = "/home/user/dev"; + } + { + proto = "virtiofs"; + tag = "ro-store"; + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + readOnly = true; + } + ]; + hypervisor = "qemu"; + }; + }; + }; +} diff --git a/packages.nix b/packages.nix index 7d0d68d..09b439f 100644 --- a/packages.nix +++ b/packages.nix @@ -47,6 +47,7 @@ htmx-lsp2 imagemagick inkscape + # input-remapper pavucontrol pciutils poppler @@ -54,16 +55,7 @@ jq kitty lazygit - (pkgs.writeShellScriptBin "lf" '' - cd_file="/tmp/lf-lastdir" - - ${pkgs.lf}/bin/lf "$@" - - if [ -f "$cd_file" ]; then - cd "$(cat "$cd_file")" - rm "$cd_file" - fi - '') + lf libreoffice libvirt linux-firmware @@ -113,6 +105,7 @@ thunderbird tor-browser unzip + usbutils virt-manager virt-viewer vscode-langservers-extracted @@ -195,6 +188,7 @@ "glm-5.1" ]; }; + # services.input-remapper.enable = true; # services.open-webui = { # enable = true; # port = 11347; diff --git a/secrets/vpn.yaml b/secrets/vpn.yaml index e2601b7..49dcd36 100644 --- a/secrets/vpn.yaml +++ b/secrets/vpn.yaml @@ -6,15 +6,14 @@ wg-br0: private_key: ENC[AES256_GCM,data:y8djTiZ00DIhdN1YNUNmjqCPeSUrS+YWKfr4iLT8h54fSlgDn1OPAoyJllM=,iv:Wz/EiISOlaiSXSIa4h8L2wJPm34rxpQkErpuqAR/uC8=,tag:RS100jf8INb12q6+hGQDiw==,type:str] conf: ENC[AES256_GCM,data:3TJ34y3NI1wO2Oyh7D72t2WmlOq/pMS43Ck3gDFV9QPSC7E3GHtc86aZqRQm8qbRqnkJco1+nlJZmsC+BQdmW+U5RkRL7vUyDmrCyeDyJvEkNIJLzcFi4lppbYXG3A+fRO2l5guQA5qNSQmnyux51yY11/OCahoFEEenL1wH+R0ugMK/LIPwK0/Y2u7c+7SvNwwtK9xQUlb4azqUsdLX0xkUFbBje2BgN50BB2TxLZJexUNjOTW9TE57tw3yI4VjYEvIyBXOK4uuuST+TcNJY5B45tjd8PmO9vPYDw==,iv:BdNVbiMjzGtX0rzkLBb/YCDxqBv15L7bJcLTPzvt/yM=,tag:NmEMTPasBSsg1GSkYi/HxA==,type:str] wg-us0: - private_key: ENC[AES256_GCM,data:PWzeqoYLICXjYL5AV+dxUxYn6RL/tUMkfTMYhm+OdC85cPBPU135Ov15nUk=,iv:1CdiayG3F4xp3eid/ilboFUOL4Y92RUqipASOPT8Jl0=,tag:cJulFquSHjmKF+lUegp37Q==,type:str] - conf: ENC[AES256_GCM,data:x4bpjE/icVqe3lXHRNWf5W9w8EVAiNyqmFUR2LslSrEz0ekmJ4YDKDuU//+VoomsZzHhY6GhKtEVJ4Me/xY0G1+dSBBgpZlO8UyZVg8aydsVmA09fHYgwKovzHXc0XM9cbbovf2yyK8kO+X8e3ODy1dSu+a1SA3YsEp2G46kbRRxTdYazeHMJ+hJdmCONEvx0p0NcPlPAW8eZWEsAbVT/eQzB3TnF2THy/t4oWrn4r/MVvcsWgc1LJ3rVJ6L8RREU/PYBJoyDMgAs3DP79E8iOQS+bwdJj0+gcrP,iv:Ngqn/EA3QpOnBxz+slSyn+oOO33hLZlGhAg+RIlN+wI=,tag:BZFjGxI0nRsdPn99rvijdA==,type:str] + private_key: ENC[AES256_GCM,data:rouU6q7Qn8wu93YL+uAWKsItXK2d21rRbTLLURk15wmC8YUytt/Hx8XNCbk=,iv:6m4+yS1LIZMfwZrWkb/4I4ABFLca24G8Nz3UTMQw8Q8=,tag:eTR7MW7Y9m34S5CRKIWsLw==,type:str] + conf: ENC[AES256_GCM,data:QTc6Y4VOT0UQKY9il4p4dCGYiGRYYF6Pi80ytwMweMWr1aHNl3RyFfSkAtCW3GErO6Y2OUdiwukSBKpmP6DDmBMZfhH/bQzWTFX+bAbcMBD6Ql3rMYl3rZ7pfbAZpa5a/tnzsfK+0ee8GfAo9IKci5gq7ic6E5zD9IsNPNxUH4HWNWfpSfnQo4Z6V/S05/Yb+GH4gQuX/K/eLh1b/8oWePpcRSKaQSSDzEd2NtvAv8S2LUwJxg/QYSC0CxrOGWXGdaDE,iv:05MM/v8OjjwSijhLAqlLeohYMbyV932QvgWsPhaCXLI=,tag:qpgaYyb4jkEhJTI46RMvhA==,type:str] wg-uk0: private_key: ENC[AES256_GCM,data:r1BEMvO+Q/6VTuC7N/iqWf1Cyp4WZsUitVF14n5QXPzYK9PoWgPGylQQpmg=,iv:wR1gsHzzu0C629bs7yGW6evjdieONyzMnc9vvtTEh2Q=,tag:lMk4DuTDFtOW0heIJ0Ef2A==,type:str] conf: ENC[AES256_GCM,data:tCQaQEJ1Pa0jw96q/LRtqhAWes04GkGOUYAlZu3W3C9EGHj123dYZiWXcUgymSsi999M3RbO2mWNllSl17zkV1iGZAkA23aQLKDUU0/m/SSCLm2ohJOdLKkGeRK41TMGFRRydfYZJ9rg0iJdacfXrX2t4RGWgtprSlS2crOcrAQ+jhMjCNxKuAg0gaJyUh1lcTmOohe0aBiqxGJE+mc4mKMwCiUytNoprAc2TrnKUTQ7/eyIv9hn0PeRvLL59KFNrcVpCb7VRkufYpYlNtO1zyl2oczYzw+IXCHt,iv:S74FbQLM5sXhvoSaUD0wuMeAd7U4rL/dneaVS3ah8Bo=,tag:0U/k1Cyy4XbvmnlApg2BYg==,type:str] sops: age: - - recipient: age1y0tj3kt67pfnj38t9c8g2ghry3a0mhcq8rrqv5xr4jekwepxaelqzu3dkf - enc: | + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOHZSRkpBVVdUUk9OYUFH cVBra014WXJyRTJ0QWFKallLQlc0SXhNSlFBCmpwME92M2lCN2liVjZBRndlSVBk @@ -22,8 +21,8 @@ sops: OWhIdUxDcHB4Z3dTdDkyZWF6NEJCYzAKfPB9AZFQ08yqil+4AhIi6EMy8PXI4CAz lK4ON/M67T0UrlWN/m3pryOOr4Lj4oiZvdOR0BCO3kn4Pj0nq5jQOA== -----END AGE ENCRYPTED FILE----- - - recipient: age16v8w7q4wmn22hhakq2uzaus2508rhldm7lcwh0kukshzjzyhuqesqz44ze - enc: | + recipient: age1y0tj3kt67pfnj38t9c8g2ghry3a0mhcq8rrqv5xr4jekwepxaelqzu3dkf + - enc: | -----BEGIN AGE ENCRYPTED FILE----- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSC9Td1NTMzk2NlJDTDNM UVUzTSt1dGkrUVRGT1UzeXcwR1REN1U0dW5JCnNJRzdKZHVyR0dzaUw2TlVzQnQ2 @@ -31,7 +30,8 @@ sops: OEZ4WUp1QlVrTkVTN1BHMG0yaXFuSk0KLw3ZuvWTurJDTpyoq5YafLm8YFT4v4Vh s+ay8ju3kA1CKjMF3gBQF08EoCdP/jU6tZerNwwcs17el5zIvRmG7Q== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-02-08T19:15:21Z" - mac: ENC[AES256_GCM,data:IxRNC13NPMIhVon0vCH3df+JxQlIPzv79H6JQzj8hkQNLxbFtPzk9DlHW1PWX90UAQbaXnzUM9uyHZhg4TypVsuKiEhpGyE4LXn/O7wD3U66YMkbqGrpKtnWbCQNdj///N5nDf71QwdLTEAzH+Kn9zRmiZ60rEu3w1Wm5vitB78=,iv:jWQvvO8kJDULepEUbWRym57whNpd23Q2PkXCDNQeJLo=,tag:wPBtn7Onr3S9ksEmdCZFzg==,type:str] + recipient: age16v8w7q4wmn22hhakq2uzaus2508rhldm7lcwh0kukshzjzyhuqesqz44ze + lastmodified: "2026-07-12T15:08:29Z" + mac: ENC[AES256_GCM,data:RiyjNVLep6kPx8oNno+v/GSCXQ0mo4SJFo54+KUyP/up79mPYTxLiuRsEZXO5P3d5pzMqMubQntDaMj8h6C4IJjojPIFvl4AeOveXkOeFz50ufeNBkwKEsDJgNNQfw/3vgq5rTR5WegsLzEMagXuDGwEJPA3uQQf0Ea2pXFO/Nw=,iv:YpTw0+Q+tBK3j3uEYiHLUzwygUFPrUanH8apNwpJwDM=,tag:o5opSInF5D9Q0OgB/7uf7Q==,type:str] unencrypted_suffix: _unencrypted - version: 3.11.0 + version: 3.13.1 diff --git a/users.nix b/users.nix index b32143d..4dc3158 100644 --- a/users.nix +++ b/users.nix @@ -41,26 +41,25 @@ # ]; # linger = true; # }; - agent = { - uid = 1002; - homeMode = "770"; - home = "/home/agent"; - shell = pkgs.fish; - isNormalUser = true; - group = "agent"; - extraGroups = [ "public" ]; - linger = true; - }; - # sandbox = { - # uid = 1003; + # agent = { + # uid = 1002; # homeMode = "770"; - # home = "/home/sandbox"; + # home = "/home/agent"; # shell = pkgs.fish; # isNormalUser = true; - # group = "sandbox"; + # group = "agent"; # extraGroups = [ "public" ]; # linger = true; # }; + sandbox = { + uid = 1001; + homeMode = "770"; + home = "/home/sandbox"; + shell = pkgs.fish; + isNormalUser = true; + group = "users"; + linger = true; + }; user = { uid = 1000; homeMode = "700"; @@ -72,13 +71,11 @@ "libvirt" "systemd-journal" "kvm" - "public" - "agent" - "sandbox" "audio" "video" "render" "bluetooth" + "users" # "work" ]; hashedPasswordFile = config.sops.secrets."user/password".path; @@ -87,9 +84,6 @@ }; groups = { user.gid = 1000; - agent.gid = 1002; - public.gid = 777; - # sandbox.gid = 1003; }; }; }