system/desktop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sandboxing

Browse source
This commit is contained in:
root 2026-07-18 11:45:31 -03:00
parent 5f70e8be94
commit 0f1a81c2aa
No known key found for this signature in database
13 changed files with 230 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

17
configuration.nix
View file

@ -15,9 +15,6 @@
path = "/root/.ssh/desktop";
mode = "0600";
};
sops.secrets."deepseek_api_key" = {
owner = "agent";
};
nix.settings.experimental-features = [
"nix-command"
"flakes"
@ -96,14 +93,16 @@
enable = true;
ports = [ 22 ];
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
PasswordAuthentication = true;
KbdInteractiveAuthentication = true;
PermitRootLogin = "no";
AllowUsers = [
"user"
];
};
};
ratbagd.enable = true;
};
hardware = {
@ -171,10 +170,10 @@
};
systemd.tmpfiles.rules = [
"d /home/public 2775 root public - -"
"d /home/public/pictures 2775 root public - -"
"d /home/user/dev 0770 user users -"
"d /home/user/pictures 0750 user users -"
"a+ /home/public - - - - d:g:public:rwX,d:m::rwX"
"a+ /home/public/pictures - - - - d:g:public:rwX,d:m::rwX"
"a+ /home/user/dev - - - - d:g:users:rwX,d:m::rwX"
"a+ /home/user/pictures - - - - d:g:users:rwX,d:m::rwX"
];
}

7
firejail.nix
View file

@ -57,13 +57,6 @@ in
"--private=~/.local/state/claude-home"
];
};
opencode = {
executable = "${pkgs.opencode}/bin/opencode";
profile = agentProfile;
extraArgs = [
"--private=/home/user/.local/state/opencode-home"
];
};
chromium-sandbox = {
executable = "${pkgs.chromium}/bin/chromium";
profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile";

38
flake.lock generated
View file

@ -220,6 +220,27 @@
"type": "github"
}
},
"microvm": {
"inputs": {
"nixpkgs": [
"nixpkgs"
],
"spectrum": "spectrum"
},
"locked": {
"lastModified": 1784320259,
"narHash": "sha256-9yPGZVcPV0W9Iq1qL4rfkNigKIIUk4jRk3YbJNr3pLA=",
"owner": "microvm-nix",
"repo": "microvm.nix",
"rev": "24ae5c9f140e4c4b06d132ea3fc7795b550dfe9e",
"type": "github"
},
"original": {
"owner": "microvm-nix",
"repo": "microvm.nix",
"type": "github"
}
},
"naersk": {
"inputs": {
"fenix": "fenix_2",
@ -408,6 +429,7 @@
"ferrosonic": "ferrosonic",
"home-manager": "home-manager",
"impermanence": "impermanence",
"microvm": "microvm",
"niri-branch": "niri-branch",
"niri-scratchpad": "niri-scratchpad",
"nixpkgs": "nixpkgs_5",
@ -508,6 +530,22 @@
"type": "github"
}
},
"spectrum": {
"flake": false,
"locked": {
"lastModified": 1783694892,
"narHash": "sha256-xO8f7Qng+18FK2UlB9vcrkxCaQMCt5WjCH24aW/11eg=",
"ref": "refs/heads/main",
"rev": "24c4346e30fdea8d8e80f34aec3554a15a667d24",
"revCount": 1410,
"type": "git",
"url": "https://spectrum-os.org/git/spectrum"
},
"original": {
"type": "git",
"url": "https://spectrum-os.org/git/spectrum"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,

17
flake.nix
View file

@ -7,10 +7,10 @@
url = "github:Mic92/sops-nix";
inputs.nixpkgs.follows = "nixpkgs";
};
# microvm = {
# url = "github:microvm-nix/microvm.nix/da28962a2ba84718895b7325f600686c3b4ee099";
# inputs.nixpkgs.follows = "nixpkgs";
# };
microvm = {
url = "github:microvm-nix/microvm.nix";
inputs.nixpkgs.follows = "nixpkgs";
};
disko = {
url = "github:nix-community/disko/latest";
inputs.nixpkgs.follows = "nixpkgs";
@ -40,6 +40,7 @@
sops-nix,
impermanence,
home-manager,
microvm,
...
}:
let
@ -50,7 +51,7 @@
config.allowUnfree = true;
# overlays = [ inputs.neovim-nightly-overlay.overlays.default ];
};
# microvm = inputs.microvm.nixosModules.host;
microvm = inputs.microvm.nixosModules.host;
in
{
nixosConfigurations."${hostname}" = nixpkgs.lib.nixosSystem {
@ -60,7 +61,7 @@
nixpkgs
impermanence
home-manager
# microvm
microvm
sops-nix
;
hostname = hostname;
@ -76,8 +77,8 @@
./home
./firejail.nix
inputs.sops-nix.nixosModules.sops
# inputs.microvm.nixosModules.host
# (import ./vms)
inputs.microvm.nixosModules.host
(import ./microvm/sandbox.nix)
inputs.disko.nixosModules.disko
inputs.impermanence.nixosModules.impermanence
inputs.home-manager.nixosModules.home-manager

4
home/agents.nix
View file

@ -236,8 +236,8 @@ in
{
home-manager.users = lib.mkMerge [
(home-manager-config {
uid = 1002;
username = "agent";
uid = 1001;
username = "sandbox";
})
];
}

30
home/nvim/default.nix
View file

@ -61,13 +61,13 @@ in
})
'';
}
# {
# plugin = comment-nvim;
# type = "lua";
# config = ''
# require('Comment').setup()
# '';
# }
{
plugin = comment-nvim;
type = "lua";
config = ''
require('Comment').setup()
'';
}
{
plugin = conform-nvim;
type = "lua";
@ -87,7 +87,7 @@ in
less = { "prettierd" },
blade = { "blade-formatter" },
go = { "gofmt" },
wgsl = { "wgsl_fmt" },
wgsl = { "wgslfmt" },
odin = { "odinfmt" },
},
})
@ -143,13 +143,13 @@ in
# plugin = neotest-zig;
# type = "lua";
# }
# {
# plugin = nvim-autopairs;
# type = "lua";
# config = ''
# require('nvim-autopairs').setup()
# '';
# }
{
plugin = nvim-autopairs;
type = "lua";
config = ''
require('nvim-autopairs').setup()
'';
}
{
plugin = nvim-dap;
type = "lua";

14
home/user.nix
View file

@ -62,13 +62,16 @@
systemd.user.services.waypipe-socket = {
Unit = {
Description = "start waypipe client";
After = [ "niri.service" ];
Requires = [ "niri.service" ];
};
Install = {
WantedBy = [ "graphical-session.target" ];
};
Service = {
ExecStart = "${pkgs.waypipe}/bin/waypipe --socket /tmp/waypipe.sock client";
ExecStartPost = "${pkgs.acl}/bin/setfacl -m u:agent:rw /tmp/waypipe.sock";
ExecStartPost = "${pkgs.acl}/bin/setfacl -m g:sandbox:rw /tmp/waypipe.sock";
ExecStopPost = "${pkgs.coreutils}/bin/rm /tmp/waypipe.sock";
RuntimeDirectory = "waypipe";
Type = "simple";
Restart = "on-failure";
@ -255,6 +258,7 @@
};
programs = {
opencode.enable = true;
dank-material-shell.enable = true;
ssh = {
enable = true;
@ -351,7 +355,7 @@
};
safe = {
directory = [
"/home/agent/*"
"/home/sandbox/*"
];
};
};
@ -360,9 +364,9 @@
home.packages = with pkgs; [
xrdb
(writeShellScriptBin "agent" ''
machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish
'')
# (writeShellScriptBin "agent" ''
# machinectl shell agent@ ${waypipe}/bin/waypipe --socket /run/waypipe.sock server fish
# '')
(writeShellApplication {
name = "tmux-sessionizer";
runtimeInputs = [

10
impermanence.nix
View file

@ -30,11 +30,11 @@
];
};
users.agent = {
files = [
".config/sops/age/keys.txt"
];
};
# users.agent = {
# files = [
# ".config/sops/age/keys.txt"
# ];
# };
};
environment.persistence."/.nobackup" = {

13
kernel/default.nix
View file

@ -74,6 +74,19 @@ in
security.pam.services.su.requireWheel = true;
security.pam.services.newgrp.requireWheel = true;
security.polkit = {
enable = true;
extraConfig = ''
polkit.addRule(function(action, subject) {
if ((action.id == "org.freedesktop.machine1.host-shell" ||
action.id == "org.freedesktop.machine1.login") &&
subject.user == "user") {
return polkit.Result.YES;
}
});
'';
};
boot = {
loader = {
systemd-boot.enable = true;

104
microvm/sandbox.nix Normal file
View file

@ -0,0 +1,104 @@
{
config,
pkgs,
lib,
...
}:
{
microvm.host.useNotifySockets = true;
microvm.vms."sandbox" = {
config = {
users.users.root = {
password = "";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
];
};
users.users.sandbox = {
isNormalUser = true;
uid = 1001;
group = "users";
extraGroups = [
"video"
"render"
];
password = "";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILABd/iSJ4gn/ystDqNxLJTG0n0z5VIC9YXlmdUfOhHf desktop@icefox.sh"
];
};
services.openssh.enable = true;
boot.kernelModules = [
"drm"
"virtio_gpu"
];
boot.blacklistedKernelModules = lib.mkForce [ ];
environment.sessionVariables = {
WAYLAND_DISPLAY = "wayland-1";
DISPLAY = ":0";
QT_QPA_PLATFORM = "wayland";
GDK_BACKEND = "wayland";
XDG_SESSION_TYPE = "wayland";
};
hardware.graphics.enable = true;
system.stateVersion = lib.trivial.release;
environment.systemPackages = with pkgs; [
xdg-utils
ungoogled-chromium
ghostty
tmux
waypipe
pciutils
];
microvm = {
vsock = {
cid = 3;
ssh.enable = true;
};
writableStoreOverlay = "/nix/.rw-store";
# graphics.enable = true;
mem = 4096;
interfaces = [
{
type = "user";
id = "vm-1";
mac = "02:00:00:01:01:01";
}
];
volumes = [
{
mountPoint = "/var";
image = "var.img";
size = 256;
}
{
mountPoint = "/nix/.rw-store";
image = "nix-store-overlay.img";
size = 512;
}
];
shares = [
{
proto = "virtiofs";
tag = "projects";
source = "/home/user/dev";
mountPoint = "/home/user/dev";
}
{
proto = "virtiofs";
tag = "ro-store";
source = "/nix/store";
mountPoint = "/nix/.ro-store";
readOnly = true;
}
];
hypervisor = "qemu";
};
};
};
}

14
packages.nix
View file

@ -47,6 +47,7 @@
htmx-lsp2
imagemagick
inkscape
# input-remapper
pavucontrol
pciutils
poppler
@ -54,16 +55,7 @@
jq
kitty
lazygit
(pkgs.writeShellScriptBin "lf" ''
cd_file="/tmp/lf-lastdir"
${pkgs.lf}/bin/lf "$@"
if [ -f "$cd_file" ]; then
cd "$(cat "$cd_file")"
rm "$cd_file"
fi
'')
lf
libreoffice
libvirt
linux-firmware
@ -113,6 +105,7 @@
thunderbird
tor-browser
unzip
usbutils
virt-manager
virt-viewer
vscode-langservers-extracted
@ -195,6 +188,7 @@
"glm-5.1"
];
};
# services.input-remapper.enable = true;
# services.open-webui = {
# enable = true;
# port = 11347;

18
secrets/vpn.yaml
View file

@ -6,15 +6,14 @@ wg-br0:
private_key: ENC[AES256_GCM,data:y8djTiZ00DIhdN1YNUNmjqCPeSUrS+YWKfr4iLT8h54fSlgDn1OPAoyJllM=,iv:Wz/EiISOlaiSXSIa4h8L2wJPm34rxpQkErpuqAR/uC8=,tag:RS100jf8INb12q6+hGQDiw==,type:str]
conf: ENC[AES256_GCM,data:3TJ34y3NI1wO2Oyh7D72t2WmlOq/pMS43Ck3gDFV9QPSC7E3GHtc86aZqRQm8qbRqnkJco1+nlJZmsC+BQdmW+U5RkRL7vUyDmrCyeDyJvEkNIJLzcFi4lppbYXG3A+fRO2l5guQA5qNSQmnyux51yY11/OCahoFEEenL1wH+R0ugMK/LIPwK0/Y2u7c+7SvNwwtK9xQUlb4azqUsdLX0xkUFbBje2BgN50BB2TxLZJexUNjOTW9TE57tw3yI4VjYEvIyBXOK4uuuST+TcNJY5B45tjd8PmO9vPYDw==,iv:BdNVbiMjzGtX0rzkLBb/YCDxqBv15L7bJcLTPzvt/yM=,tag:NmEMTPasBSsg1GSkYi/HxA==,type:str]
wg-us0:
private_key: ENC[AES256_GCM,data:PWzeqoYLICXjYL5AV+dxUxYn6RL/tUMkfTMYhm+OdC85cPBPU135Ov15nUk=,iv:1CdiayG3F4xp3eid/ilboFUOL4Y92RUqipASOPT8Jl0=,tag:cJulFquSHjmKF+lUegp37Q==,type:str]
conf: ENC[AES256_GCM,data:x4bpjE/icVqe3lXHRNWf5W9w8EVAiNyqmFUR2LslSrEz0ekmJ4YDKDuU//+VoomsZzHhY6GhKtEVJ4Me/xY0G1+dSBBgpZlO8UyZVg8aydsVmA09fHYgwKovzHXc0XM9cbbovf2yyK8kO+X8e3ODy1dSu+a1SA3YsEp2G46kbRRxTdYazeHMJ+hJdmCONEvx0p0NcPlPAW8eZWEsAbVT/eQzB3TnF2THy/t4oWrn4r/MVvcsWgc1LJ3rVJ6L8RREU/PYBJoyDMgAs3DP79E8iOQS+bwdJj0+gcrP,iv:Ngqn/EA3QpOnBxz+slSyn+oOO33hLZlGhAg+RIlN+wI=,tag:BZFjGxI0nRsdPn99rvijdA==,type:str]
private_key: ENC[AES256_GCM,data:rouU6q7Qn8wu93YL+uAWKsItXK2d21rRbTLLURk15wmC8YUytt/Hx8XNCbk=,iv:6m4+yS1LIZMfwZrWkb/4I4ABFLca24G8Nz3UTMQw8Q8=,tag:eTR7MW7Y9m34S5CRKIWsLw==,type:str]
conf: ENC[AES256_GCM,data:QTc6Y4VOT0UQKY9il4p4dCGYiGRYYF6Pi80ytwMweMWr1aHNl3RyFfSkAtCW3GErO6Y2OUdiwukSBKpmP6DDmBMZfhH/bQzWTFX+bAbcMBD6Ql3rMYl3rZ7pfbAZpa5a/tnzsfK+0ee8GfAo9IKci5gq7ic6E5zD9IsNPNxUH4HWNWfpSfnQo4Z6V/S05/Yb+GH4gQuX/K/eLh1b/8oWePpcRSKaQSSDzEd2NtvAv8S2LUwJxg/QYSC0CxrOGWXGdaDE,iv:05MM/v8OjjwSijhLAqlLeohYMbyV932QvgWsPhaCXLI=,tag:qpgaYyb4jkEhJTI46RMvhA==,type:str]
wg-uk0:
private_key: ENC[AES256_GCM,data:r1BEMvO+Q/6VTuC7N/iqWf1Cyp4WZsUitVF14n5QXPzYK9PoWgPGylQQpmg=,iv:wR1gsHzzu0C629bs7yGW6evjdieONyzMnc9vvtTEh2Q=,tag:lMk4DuTDFtOW0heIJ0Ef2A==,type:str]
conf: ENC[AES256_GCM,data:tCQaQEJ1Pa0jw96q/LRtqhAWes04GkGOUYAlZu3W3C9EGHj123dYZiWXcUgymSsi999M3RbO2mWNllSl17zkV1iGZAkA23aQLKDUU0/m/SSCLm2ohJOdLKkGeRK41TMGFRRydfYZJ9rg0iJdacfXrX2t4RGWgtprSlS2crOcrAQ+jhMjCNxKuAg0gaJyUh1lcTmOohe0aBiqxGJE+mc4mKMwCiUytNoprAc2TrnKUTQ7/eyIv9hn0PeRvLL59KFNrcVpCb7VRkufYpYlNtO1zyl2oczYzw+IXCHt,iv:S74FbQLM5sXhvoSaUD0wuMeAd7U4rL/dneaVS3ah8Bo=,tag:0U/k1Cyy4XbvmnlApg2BYg==,type:str]
sops:
age:
- recipient: age1y0tj3kt67pfnj38t9c8g2ghry3a0mhcq8rrqv5xr4jekwepxaelqzu3dkf
enc: |
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOHZSRkpBVVdUUk9OYUFH
cVBra014WXJyRTJ0QWFKallLQlc0SXhNSlFBCmpwME92M2lCN2liVjZBRndlSVBk
@ -22,8 +21,8 @@ sops:
OWhIdUxDcHB4Z3dTdDkyZWF6NEJCYzAKfPB9AZFQ08yqil+4AhIi6EMy8PXI4CAz
lK4ON/M67T0UrlWN/m3pryOOr4Lj4oiZvdOR0BCO3kn4Pj0nq5jQOA==
-----END AGE ENCRYPTED FILE-----
- recipient: age16v8w7q4wmn22hhakq2uzaus2508rhldm7lcwh0kukshzjzyhuqesqz44ze
enc: |
recipient: age1y0tj3kt67pfnj38t9c8g2ghry3a0mhcq8rrqv5xr4jekwepxaelqzu3dkf
- enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSC9Td1NTMzk2NlJDTDNM
UVUzTSt1dGkrUVRGT1UzeXcwR1REN1U0dW5JCnNJRzdKZHVyR0dzaUw2TlVzQnQ2
@ -31,7 +30,8 @@ sops:
OEZ4WUp1QlVrTkVTN1BHMG0yaXFuSk0KLw3ZuvWTurJDTpyoq5YafLm8YFT4v4Vh
s+ay8ju3kA1CKjMF3gBQF08EoCdP/jU6tZerNwwcs17el5zIvRmG7Q==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-02-08T19:15:21Z"
mac: ENC[AES256_GCM,data:IxRNC13NPMIhVon0vCH3df+JxQlIPzv79H6JQzj8hkQNLxbFtPzk9DlHW1PWX90UAQbaXnzUM9uyHZhg4TypVsuKiEhpGyE4LXn/O7wD3U66YMkbqGrpKtnWbCQNdj///N5nDf71QwdLTEAzH+Kn9zRmiZ60rEu3w1Wm5vitB78=,iv:jWQvvO8kJDULepEUbWRym57whNpd23Q2PkXCDNQeJLo=,tag:wPBtn7Onr3S9ksEmdCZFzg==,type:str]
recipient: age16v8w7q4wmn22hhakq2uzaus2508rhldm7lcwh0kukshzjzyhuqesqz44ze
lastmodified: "2026-07-12T15:08:29Z"
mac: ENC[AES256_GCM,data:RiyjNVLep6kPx8oNno+v/GSCXQ0mo4SJFo54+KUyP/up79mPYTxLiuRsEZXO5P3d5pzMqMubQntDaMj8h6C4IJjojPIFvl4AeOveXkOeFz50ufeNBkwKEsDJgNNQfw/3vgq5rTR5WegsLzEMagXuDGwEJPA3uQQf0Ea2pXFO/Nw=,iv:YpTw0+Q+tBK3j3uEYiHLUzwygUFPrUanH8apNwpJwDM=,tag:o5opSInF5D9Q0OgB/7uf7Q==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0
version: 3.13.1

34
users.nix
View file

@ -41,26 +41,25 @@
# ];
# linger = true;
# };
agent = {
uid = 1002;
homeMode = "770";
home = "/home/agent";
shell = pkgs.fish;
isNormalUser = true;
group = "agent";
extraGroups = [ "public" ];
linger = true;
};
# sandbox = {
# uid = 1003;
# agent = {
# uid = 1002;
# homeMode = "770";
# home = "/home/sandbox";
# home = "/home/agent";
# shell = pkgs.fish;
# isNormalUser = true;
# group = "sandbox";
# group = "agent";
# extraGroups = [ "public" ];
# linger = true;
# };
sandbox = {
uid = 1001;
homeMode = "770";
home = "/home/sandbox";
shell = pkgs.fish;
isNormalUser = true;
group = "users";
linger = true;
};
user = {
uid = 1000;
homeMode = "700";
@ -72,13 +71,11 @@
"libvirt"
"systemd-journal"
"kvm"
"public"
"agent"
"sandbox"
"audio"
"video"
"render"
"bluetooth"
"users"
# "work"
];
hashedPasswordFile = config.sops.secrets."user/password".path;
@ -87,9 +84,6 @@
};
groups = {
user.gid = 1000;
agent.gid = 1002;
public.gid = 777;
# sandbox.gid = 1003;
};
};
}