system/desktop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sandboxing

Browse source
This commit is contained in:
root 2026-07-18 11:45:31 -03:00
parent 5f70e8be94
commit 0f1a81c2aa
No known key found for this signature in database
13 changed files with 230 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

17
configuration.nix
View file

@ -15,9 +15,6 @@
path = "/root/.ssh/desktop"; path = "/root/.ssh/desktop";
mode = "0600"; mode = "0600";
}; };
sops.secrets."deepseek_api_key" = {
owner = "agent";
};
nix.settings.experimental-features = [ nix.settings.experimental-features = [
"nix-command" "nix-command"
"flakes" "flakes"
@ -96,14 +93,16 @@
enable = true; enable = true;
ports = [ 22 ]; ports = [ 22 ];
settings = { settings = {
PasswordAuthentication = false; PasswordAuthentication = true;
KbdInteractiveAuthentication = false; KbdInteractiveAuthentication = true;
PermitRootLogin = "no"; PermitRootLogin = "no";
AllowUsers = [ AllowUsers = [
"user" "user"
]; ];
}; };
}; };
ratbagd.enable = true;
}; };
hardware = { hardware = {
@ -171,10 +170,10 @@
}; };
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d /home/public 2775 root public - -" "d /home/user/dev 0770 user users -"
"d /home/public/pictures 2775 root public - -" "d /home/user/pictures 0750 user users -"
"a+ /home/public - - - - d:g:public:rwX,d:m::rwX" "a+ /home/user/dev - - - - d:g:users:rwX,d:m::rwX"
"a+ /home/public/pictures - - - - d:g:public:rwX,d:m::rwX" "a+ /home/user/pictures - - - - d:g:users:rwX,d:m::rwX"
]; ];
} }

7
firejail.nix
View file

@ -57,13 +57,6 @@ in
"--private=~/.local/state/claude-home" "--private=~/.local/state/claude-home"
]; ];
}; };
opencode = {
executable = "${pkgs.opencode}/bin/opencode";
profile = agentProfile;
extraArgs = [
"--private=/home/user/.local/state/opencode-home"
];
};
chromium-sandbox = { chromium-sandbox = {
executable = "${pkgs.chromium}/bin/chromium"; executable = "${pkgs.chromium}/bin/chromium";
profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile"; profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile";

38
flake.lock generated
View file

@ -220,6 +220,27 @@
"type": "github" "type": "github"
} }
}, },
"microvm": {
"inputs": {
"nixpkgs": [
"nixpkgs"
],
"spectrum": "spectrum"
},
"locked": {
"lastModified": 1784320259,
"narHash": "sha256-9yPGZVcPV0W9Iq1qL4rfkNigKIIUk4jRk3YbJNr3pLA=",
"owner": "microvm-nix",
"repo": "microvm.nix",
"rev": "24ae5c9f140e4c4b06d132ea3fc7795b550dfe9e",
"type": "github"
},
"original": {
"owner": "microvm-nix",
"repo": "microvm.nix",
"type": "github"
}
},
"naersk": { "naersk": {
"inputs": { "inputs": {
"fenix": "fenix_2", "fenix": "fenix_2",
@ -408,6 +429,7 @@
"ferrosonic": "ferrosonic", "ferrosonic": "ferrosonic",
"home-manager": "home-manager", "home-manager": "home-manager",
"impermanence": "impermanence", "impermanence": "impermanence",
"microvm": "microvm",
"niri-branch": "niri-branch", "niri-branch": "niri-branch",
"niri-scratchpad": "niri-scratchpad", "niri-scratchpad": "niri-scratchpad",
"nixpkgs": "nixpkgs_5", "nixpkgs": "nixpkgs_5",
@ -508,6 +530,22 @@
"type": "github" "type": "github"
} }
}, },
"spectrum": {
"flake": false,
"locked": {
"lastModified": 1783694892,
"narHash": "sha256-xO8f7Qng+18FK2UlB9vcrkxCaQMCt5WjCH24aW/11eg=",
"ref": "refs/heads/main",
"rev": "24c4346e30fdea8d8e80f34aec3554a15a667d24",
"revCount": 1410,
"type": "git",
"url": "https://spectrum-os.org/git/spectrum"
},
"original": {
"type": "git",
"url": "https://spectrum-os.org/git/spectrum"
}
},
"systems": { "systems": {
"locked": { "locked": {
"lastModified": 1681028828, "lastModified": 1681028828,

17
flake.nix
View file

@ -7,10 +7,10 @@
url = "github:Mic92/sops-nix"; url = "github:Mic92/sops-nix";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
}; };
# microvm = { microvm = {
# url = "github:microvm-nix/microvm.nix/da28962a2ba84718895b7325f600686c3b4ee099"; url = "github:microvm-nix/microvm.nix";
# inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
# }; };
disko = { disko = {
url = "github:nix-community/disko/latest"; url = "github:nix-community/disko/latest";
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
@ -40,6 +40,7 @@
sops-nix, sops-nix,
impermanence, impermanence,
home-manager, home-manager,
microvm,
... ...
}: }:
let let
@ -50,7 +51,7 @@
config.allowUnfree = true; config.allowUnfree = true;
# overlays = [ inputs.neovim-nightly-overlay.overlays.default ]; # overlays = [ inputs.neovim-nightly-overlay.overlays.default ];
}; };
# microvm = inputs.microvm.nixosModules.host; microvm = inputs.microvm.nixosModules.host;
in in
{ {
nixosConfigurations."${hostname}" = nixpkgs.lib.nixosSystem { nixosConfigurations."${hostname}" = nixpkgs.lib.nixosSystem {
@ -60,7 +61,7 @@
nixpkgs nixpkgs
impermanence impermanence
home-manager home-manager
# microvm microvm
sops-nix sops-nix
; ;
hostname = hostname; hostname = hostname;
@ -76,8 +77,8 @@
./home ./home
./firejail.nix ./firejail.nix
inputs.sops-nix.nixosModules.sops inputs.sops-nix.nixosModules.sops
# inputs.microvm.nixosModules.host inputs.microvm.nixosModules.host
# (import ./vms) (import ./microvm/sandbox.nix)
inputs.disko.nixosModules.disko inputs.disko.nixosModules.disko
inputs.impermanence.nixosModules.impermanence inputs.impermanence.nixosModules.impermanence
inputs.home-manager.nixosModules.home-manager inputs.home-manager.nixosModules.home-manager

4
home/agents.nix
View file

@ -236,8 +236,8 @@ in
{ {
home-manager.users = lib.mkMerge [ home-manager.users = lib.mkMerge [
(home-manager-config { (home-manager-config {
uid = 1002; uid = 1001;
username = "agent"; username = "sandbox";
}) })
]; ];
} }

30
home/nvim/default.nix
View file

@ -61,13 +61,13 @@ in
}) })
''; '';
} }
# { {
# plugin = comment-nvim; plugin = comment-nvim;
# type = "lua"; type = "lua";
# config = '' config = ''
# require('Comment').setup() require('Comment').setup()
# ''; '';
# } }
{ {
plugin = conform-nvim; plugin = conform-nvim;
type = "lua"; type = "lua";
@ -87,7 +87,7 @@ in
less = { "prettierd" }, less = { "prettierd" },
blade = { "blade-formatter" }, blade = { "blade-formatter" },
go = { "gofmt" }, go = { "gofmt" },
wgsl = { "wgsl_fmt" }, wgsl = { "wgslfmt" },
odin = { "odinfmt" }, odin = { "odinfmt" },
}, },
}) })
@ -143,13 +143,13 @@ in
# plugin = neotest-zig; # plugin = neotest-zig;
# type = "lua"; # type = "lua";
# } # }
# { {
# plugin = nvim-autopairs; plugin = nvim-autopairs;
# type = "lua"; type = "lua";
# config = '' config = ''
# require('nvim-autopairs').setup() require('nvim-autopairs').setup()
# ''; '';
# } }
{ {
plugin = nvim-dap; plugin = nvim-dap;
type = "lua"; type = "lua";

14
home/user.nix
View file

@ -62,13 +62,16 @@
systemd.user.services.waypipe-socket = { systemd.user.services.waypipe-socket = {
Unit = { Unit = {
Description = "start waypipe client"; Description = "start waypipe client";
After = [ "niri.service" ];
Requires = [ "niri.service" ];
}; };
Install = { Install = {
WantedBy = [ "graphical-session.target" ]; WantedBy = [ "graphical-session.target" ];
}; };
Service = { Service = {
ExecStart = "${pkgs.waypipe}/bin/waypipe --socket /tmp/waypipe.sock client"; ExecStart = "${pkgs.waypipe}/bin/waypipe --socket /tmp/waypipe.sock client";
ExecStartPost = "${pkgs.acl}/bin/setfacl -m u:agent:rw /tmp/waypipe.sock"; ExecStartPost = "${pkgs.acl}/bin/setfacl -m g:sandbox:rw /tmp/waypipe.sock";
ExecStopPost = "${pkgs.coreutils}/bin/rm /tmp/waypipe.sock";
RuntimeDirectory = "waypipe"; RuntimeDirectory = "waypipe";
Type = "simple"; Type = "simple";
Restart = "on-failure"; Restart = "on-failure";
@ -255,6 +258,7 @@
}; };
programs = { programs = {
opencode.enable = true;
dank-material-shell.enable = true; dank-material-shell.enable = true;
ssh = { ssh = {
enable = true; enable = true;
@ -351,7 +355,7 @@
}; };
safe = { safe = {
directory = [ directory = [
"/home/agent/*" "/home/sandbox/*"
]; ];
}; };
}; };
@ -360,9 +364,9 @@
home.packages = with pkgs; [ home.packages = with pkgs; [
xrdb xrdb
(writeShellScriptBin "agent" '' # (writeShellScriptBin "agent" ''
machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish # machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish
'') # '')
(writeShellApplication { (writeShellApplication {
name = "tmux-sessionizer"; name = "tmux-sessionizer";
runtimeInputs = [ runtimeInputs = [

10
impermanence.nix
View file

@ -30,11 +30,11 @@
]; ];
}; };
users.agent = { # users.agent = {
files = [ # files = [
".config/sops/age/keys.txt" # ".config/sops/age/keys.txt"
]; # ];
}; # };
}; };
environment.persistence."/.nobackup" = { environment.persistence."/.nobackup" = {

13
kernel/default.nix
View file

@ -74,6 +74,19 @@ in
security.pam.services.su.requireWheel = true; security.pam.services.su.requireWheel = true;
security.pam.services.newgrp.requireWheel = true; security.pam.services.newgrp.requireWheel = true;
security.polkit = {
enable = true;
extraConfig = ''
polkit.addRule(function(action, subject) {
if ((action.id == "org.freedesktop.machine1.host-shell" ||
action.id == "org.freedesktop.machine1.login") &&
subject.user == "user") {
return polkit.Result.YES;
}
});
'';
};
boot = { boot = {
loader = { loader = {
systemd-boot.enable = true; systemd-boot.enable = true;

104
microvm/sandbox.nix Normal file
View file

@ -0,0 +1,104 @@
{
config,
pkgs,
lib,
...
}:
{
microvm.host.useNotifySockets = true;
microvm.vms."sandbox" = {
config = {
users.users.root = {
password = "";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
];
};
users.users.sandbox = {
isNormalUser = true;
uid = 1001;
group = "users";
extraGroups = [
"video"
"render"
];
password = "";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
];
};
services.openssh.enable = true;
boot.kernelModules = [
"drm"
"virtio_gpu"
];
boot.blacklistedKernelModules = lib.mkForce [ ];
environment.sessionVariables = {
WAYLAND_DISPLAY = "wayland-1";
DISPLAY = ":0";
QT_QPA_PLATFORM = "wayland";
GDK_BACKEND = "wayland";
XDG_SESSION_TYPE = "wayland";
};
hardware.graphics.enable = true;
system.stateVersion = lib.trivial.release;
environment.systemPackages = with pkgs; [
xdg-utils
ungoogled-chromium
ghostty
tmux
waypipe
pciutils
];
microvm = {
vsock = {
cid = 3;
ssh.enable = true;
};
writableStoreOverlay = "/nix/.rw-store";
# graphics.enable = true;
mem = 4096;
interfaces = [
{
type = "user";
id = "vm-1";
mac = "02:00:00:01:01:01";
}
];
volumes = [
{
mountPoint = "/var";
image = "var.img";
size = 256;
}
{
mountPoint = "/nix/.rw-store";
image = "nix-store-overlay.img";
size = 512;
}
];
shares = [
{
proto = "virtiofs";
tag = "projects";
source = "/home/user/dev";
mountPoint = "/home/user/dev";
}
{
proto = "virtiofs";
tag = "ro-store";
source = "/nix/store";
mountPoint = "/nix/.ro-store";
readOnly = true;
}
];
hypervisor = "qemu";
};
};
};
}

14
packages.nix
View file

@ -47,6 +47,7 @@
htmx-lsp2 htmx-lsp2
imagemagick imagemagick
inkscape inkscape
# input-remapper
pavucontrol pavucontrol
pciutils pciutils
poppler poppler
@ -54,16 +55,7 @@
jq jq
kitty kitty
lazygit lazygit
(pkgs.writeShellScriptBin "lf" '' lf
cd_file="/tmp/lf-lastdir"
${pkgs.lf}/bin/lf "$@"
if [ -f "$cd_file" ]; then
cd "$(cat "$cd_file")"
rm "$cd_file"
fi
'')
libreoffice libreoffice
libvirt libvirt
linux-firmware linux-firmware
@ -113,6 +105,7 @@
thunderbird thunderbird
tor-browser tor-browser
unzip unzip
usbutils
virt-manager virt-manager
virt-viewer virt-viewer
vscode-langservers-extracted vscode-langservers-extracted
@ -195,6 +188,7 @@
"glm-5.1" "glm-5.1"
]; ];
}; };
# services.input-remapper.enable = true;
# services.open-webui = { # services.open-webui = {
# enable = true; # enable = true;
# port = 11347; # port = 11347;

18
secrets/vpn.yaml
View file

@ -6,15 +6,14 @@ wg-br0:
private_key: ENC[AES256_GCM,data:y8djTiZ00DIhdN1YNUNmjqCPeSUrS+YWKfr4iLT8h54fSlgDn1OPAoyJllM=,iv:Wz/EiISOlaiSXSIa4h8L2wJPm34rxpQkErpuqAR/uC8=,tag:RS100jf8INb12q6+hGQDiw==,type:str] private_key: ENC[AES256_GCM,data:y8djTiZ00DIhdN1YNUNmjqCPeSUrS+YWKfr4iLT8h54fSlgDn1OPAoyJllM=,iv:Wz/EiISOlaiSXSIa4h8L2wJPm34rxpQkErpuqAR/uC8=,tag:RS100jf8INb12q6+hGQDiw==,type:str]
conf: ENC[AES256_GCM,data:3TJ34y3NI1wO2Oyh7D72t2WmlOq/pMS43Ck3gDFV9QPSC7E3GHtc86aZqRQm8qbRqnkJco1+nlJZmsC+BQdmW+U5RkRL7vUyDmrCyeDyJvEkNIJLzcFi4lppbYXG3A+fRO2l5guQA5qNSQmnyux51yY11/OCahoFEEenL1wH+R0ugMK/LIPwK0/Y2u7c+7SvNwwtK9xQUlb4azqUsdLX0xkUFbBje2BgN50BB2TxLZJexUNjOTW9TE57tw3yI4VjYEvIyBXOK4uuuST+TcNJY5B45tjd8PmO9vPYDw==,iv:BdNVbiMjzGtX0rzkLBb/YCDxqBv15L7bJcLTPzvt/yM=,tag:NmEMTPasBSsg1GSkYi/HxA==,type:str] conf: ENC[AES256_GCM,data:3TJ34y3NI1wO2Oyh7D72t2WmlOq/pMS43Ck3gDFV9QPSC7E3GHtc86aZqRQm8qbRqnkJco1+nlJZmsC+BQdmW+U5RkRL7vUyDmrCyeDyJvEkNIJLzcFi4lppbYXG3A+fRO2l5guQA5qNSQmnyux51yY11/OCahoFEEenL1wH+R0ugMK/LIPwK0/Y2u7c+7SvNwwtK9xQUlb4azqUsdLX0xkUFbBje2BgN50BB2TxLZJexUNjOTW9TE57tw3yI4VjYEvIyBXOK4uuuST+TcNJY5B45tjd8PmO9vPYDw==,iv:BdNVbiMjzGtX0rzkLBb/YCDxqBv15L7bJcLTPzvt/yM=,tag:NmEMTPasBSsg1GSkYi/HxA==,type:str]
wg-us0: wg-us0:
private_key: ENC[AES256_GCM,data:PWzeqoYLICXjYL5AV+dxUxYn6RL/tUMkfTMYhm+OdC85cPBPU135Ov15nUk=,iv:1CdiayG3F4xp3eid/ilboFUOL4Y92RUqipASOPT8Jl0=,tag:cJulFquSHjmKF+lUegp37Q==,type:str] private_key: ENC[AES256_GCM,data:rouU6q7Qn8wu93YL+uAWKsItXK2d21rRbTLLURk15wmC8YUytt/Hx8XNCbk=,iv:6m4+yS1LIZMfwZrWkb/4I4ABFLca24G8Nz3UTMQw8Q8=,tag:eTR7MW7Y9m34S5CRKIWsLw==,type:str]
conf: ENC[AES256_GCM,data:x4bpjE/icVqe3lXHRNWf5W9w8EVAiNyqmFUR2LslSrEz0ekmJ4YDKDuU//+VoomsZzHhY6GhKtEVJ4Me/xY0G1+dSBBgpZlO8UyZVg8aydsVmA09fHYgwKovzHXc0XM9cbbovf2yyK8kO+X8e3ODy1dSu+a1SA3YsEp2G46kbRRxTdYazeHMJ+hJdmCONEvx0p0NcPlPAW8eZWEsAbVT/eQzB3TnF2THy/t4oWrn4r/MVvcsWgc1LJ3rVJ6L8RREU/PYBJoyDMgAs3DP79E8iOQS+bwdJj0+gcrP,iv:Ngqn/EA3QpOnBxz+slSyn+oOO33hLZlGhAg+RIlN+wI=,tag:BZFjGxI0nRsdPn99rvijdA==,type:str] conf: ENC[AES256_GCM,data:QTc6Y4VOT0UQKY9il4p4dCGYiGRYYF6Pi80ytwMweMWr1aHNl3RyFfSkAtCW3GErO6Y2OUdiwukSBKpmP6DDmBMZfhH/bQzWTFX+bAbcMBD6Ql3rMYl3rZ7pfbAZpa5a/tnzsfK+0ee8GfAo9IKci5gq7ic6E5zD9IsNPNxUH4HWNWfpSfnQo4Z6V/S05/Yb+GH4gQuX/K/eLh1b/8oWePpcRSKaQSSDzEd2NtvAv8S2LUwJxg/QYSC0CxrOGWXGdaDE,iv:05MM/v8OjjwSijhLAqlLeohYMbyV932QvgWsPhaCXLI=,tag:qpgaYyb4jkEhJTI46RMvhA==,type:str]
wg-uk0: wg-uk0:
private_key: ENC[AES256_GCM,data:r1BEMvO+Q/6VTuC7N/iqWf1Cyp4WZsUitVF14n5QXPzYK9PoWgPGylQQpmg=,iv:wR1gsHzzu0C629bs7yGW6evjdieONyzMnc9vvtTEh2Q=,tag:lMk4DuTDFtOW0heIJ0Ef2A==,type:str] private_key: ENC[AES256_GCM,data:r1BEMvO+Q/6VTuC7N/iqWf1Cyp4WZsUitVF14n5QXPzYK9PoWgPGylQQpmg=,iv:wR1gsHzzu0C629bs7yGW6evjdieONyzMnc9vvtTEh2Q=,tag:lMk4DuTDFtOW0heIJ0Ef2A==,type:str]
conf: ENC[AES256_GCM,data:tCQaQEJ1Pa0jw96q/LRtqhAWes04GkGOUYAlZu3W3C9EGHj123dYZiWXcUgymSsi999M3RbO2mWNllSl17zkV1iGZAkA23aQLKDUU0/m/SSCLm2ohJOdLKkGeRK41TMGFRRydfYZJ9rg0iJdacfXrX2t4RGWgtprSlS2crOcrAQ+jhMjCNxKuAg0gaJyUh1lcTmOohe0aBiqxGJE+mc4mKMwCiUytNoprAc2TrnKUTQ7/eyIv9hn0PeRvLL59KFNrcVpCb7VRkufYpYlNtO1zyl2oczYzw+IXCHt,iv:S74FbQLM5sXhvoSaUD0wuMeAd7U4rL/dneaVS3ah8Bo=,tag:0U/k1Cyy4XbvmnlApg2BYg==,type:str] conf: ENC[AES256_GCM,data:tCQaQEJ1Pa0jw96q/LRtqhAWes04GkGOUYAlZu3W3C9EGHj123dYZiWXcUgymSsi999M3RbO2mWNllSl17zkV1iGZAkA23aQLKDUU0/m/SSCLm2ohJOdLKkGeRK41TMGFRRydfYZJ9rg0iJdacfXrX2t4RGWgtprSlS2crOcrAQ+jhMjCNxKuAg0gaJyUh1lcTmOohe0aBiqxGJE+mc4mKMwCiUytNoprAc2TrnKUTQ7/eyIv9hn0PeRvLL59KFNrcVpCb7VRkufYpYlNtO1zyl2oczYzw+IXCHt,iv:S74FbQLM5sXhvoSaUD0wuMeAd7U4rL/dneaVS3ah8Bo=,tag:0U/k1Cyy4XbvmnlApg2BYg==,type:str]
sops: sops:
age: age:
- recipient: age1y0tj3kt67pfnj38t9c8g2ghry3a0mhcq8rrqv5xr4jekwepxaelqzu3dkf - enc: |
enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOHZSRkpBVVdUUk9OYUFH YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOHZSRkpBVVdUUk9OYUFH
cVBra014WXJyRTJ0QWFKallLQlc0SXhNSlFBCmpwME92M2lCN2liVjZBRndlSVBk cVBra014WXJyRTJ0QWFKallLQlc0SXhNSlFBCmpwME92M2lCN2liVjZBRndlSVBk
@ -22,8 +21,8 @@ sops:
OWhIdUxDcHB4Z3dTdDkyZWF6NEJCYzAKfPB9AZFQ08yqil+4AhIi6EMy8PXI4CAz OWhIdUxDcHB4Z3dTdDkyZWF6NEJCYzAKfPB9AZFQ08yqil+4AhIi6EMy8PXI4CAz
lK4ON/M67T0UrlWN/m3pryOOr4Lj4oiZvdOR0BCO3kn4Pj0nq5jQOA== lK4ON/M67T0UrlWN/m3pryOOr4Lj4oiZvdOR0BCO3kn4Pj0nq5jQOA==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
- recipient: age16v8w7q4wmn22hhakq2uzaus2508rhldm7lcwh0kukshzjzyhuqesqz44ze recipient: age1y0tj3kt67pfnj38t9c8g2ghry3a0mhcq8rrqv5xr4jekwepxaelqzu3dkf
enc: | - enc: |
-----BEGIN AGE ENCRYPTED FILE----- -----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSC9Td1NTMzk2NlJDTDNM YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSC9Td1NTMzk2NlJDTDNM
UVUzTSt1dGkrUVRGT1UzeXcwR1REN1U0dW5JCnNJRzdKZHVyR0dzaUw2TlVzQnQ2 UVUzTSt1dGkrUVRGT1UzeXcwR1REN1U0dW5JCnNJRzdKZHVyR0dzaUw2TlVzQnQ2
@ -31,7 +30,8 @@ sops:
OEZ4WUp1QlVrTkVTN1BHMG0yaXFuSk0KLw3ZuvWTurJDTpyoq5YafLm8YFT4v4Vh OEZ4WUp1QlVrTkVTN1BHMG0yaXFuSk0KLw3ZuvWTurJDTpyoq5YafLm8YFT4v4Vh
s+ay8ju3kA1CKjMF3gBQF08EoCdP/jU6tZerNwwcs17el5zIvRmG7Q== s+ay8ju3kA1CKjMF3gBQF08EoCdP/jU6tZerNwwcs17el5zIvRmG7Q==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2026-02-08T19:15:21Z" recipient: age16v8w7q4wmn22hhakq2uzaus2508rhldm7lcwh0kukshzjzyhuqesqz44ze
mac: ENC[AES256_GCM,data:IxRNC13NPMIhVon0vCH3df+JxQlIPzv79H6JQzj8hkQNLxbFtPzk9DlHW1PWX90UAQbaXnzUM9uyHZhg4TypVsuKiEhpGyE4LXn/O7wD3U66YMkbqGrpKtnWbCQNdj///N5nDf71QwdLTEAzH+Kn9zRmiZ60rEu3w1Wm5vitB78=,iv:jWQvvO8kJDULepEUbWRym57whNpd23Q2PkXCDNQeJLo=,tag:wPBtn7Onr3S9ksEmdCZFzg==,type:str] lastmodified: "2026-07-12T15:08:29Z"
mac: ENC[AES256_GCM,data:RiyjNVLep6kPx8oNno+v/GSCXQ0mo4SJFo54+KUyP/up79mPYTxLiuRsEZXO5P3d5pzMqMubQntDaMj8h6C4IJjojPIFvl4AeOveXkOeFz50ufeNBkwKEsDJgNNQfw/3vgq5rTR5WegsLzEMagXuDGwEJPA3uQQf0Ea2pXFO/Nw=,iv:YpTw0+Q+tBK3j3uEYiHLUzwygUFPrUanH8apNwpJwDM=,tag:o5opSInF5D9Q0OgB/7uf7Q==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.11.0 version: 3.13.1

34
users.nix
View file

@ -41,26 +41,25 @@
# ]; # ];
# linger = true; # linger = true;
# }; # };
agent = { # agent = {
uid = 1002; # uid = 1002;
homeMode = "770";
home = "/home/agent";
shell = pkgs.fish;
isNormalUser = true;
group = "agent";
extraGroups = [ "public" ];
linger = true;
};
# sandbox = {
# uid = 1003;
# homeMode = "770"; # homeMode = "770";
# home = "/home/sandbox"; # home = "/home/agent";
# shell = pkgs.fish; # shell = pkgs.fish;
# isNormalUser = true; # isNormalUser = true;
# group = "sandbox"; # group = "agent";
# extraGroups = [ "public" ]; # extraGroups = [ "public" ];
# linger = true; # linger = true;
# }; # };
sandbox = {
uid = 1001;
homeMode = "770";
home = "/home/sandbox";
shell = pkgs.fish;
isNormalUser = true;
group = "users";
linger = true;
};
user = { user = {
uid = 1000; uid = 1000;
homeMode = "700"; homeMode = "700";
@ -72,13 +71,11 @@
"libvirt" "libvirt"
"systemd-journal" "systemd-journal"
"kvm" "kvm"
"public"
"agent"
"sandbox"
"audio" "audio"
"video" "video"
"render" "render"
"bluetooth" "bluetooth"
"users"
# "work" # "work"
]; ];
hashedPasswordFile = config.sops.secrets."user/password".path; hashedPasswordFile = config.sops.secrets."user/password".path;
@ -87,9 +84,6 @@
}; };
groups = { groups = {
user.gid = 1000; user.gid = 1000;
agent.gid = 1002;
public.gid = 777;
# sandbox.gid = 1003;
}; };
}; };
} }