ferrosonic

firejail.nix

@@ -0,0 +1,108 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  agentProfile = pkgs.writeText "agent.profile" ''
+    whitelist /nix/store
+    whitelist /nix/var
+    read-only /nix/store
+    whitelist ''${HOME}/.cache/nix
+    whitelist ''${HOME}/.local/state/nix
+    whitelist /etc/nix
+    whitelist /etc/nixos
+    whitelist /nix/var/nix/daemon-socket
+    whitelist ''${HOME}/dev
+    whitelist ''${HOME}/work
+    whitelist ''${HOME}/.config
+
+    blacklist ''${HOME}
+    blacklist /etc/nixos/secrets
+    blacklist /etc/shadow
+    blacklist /etc/sudoers
+    blacklist /etc/sudoers.d
+    blacklist /root
+
+    caps.drop all
+    nonewprivs
+    noroot
+    seccomp
+
+    no3d
+    nodvd
+    notv
+    nou2f
+    novideo
+
+
+    ignore net none
+
+    machine-id
+    disable-mnt
+    private-dev
+    private-tmp
+    private-cache
+  '';
+in
+{
+  programs.firejail = {
+    enable = true;
+    wrappedBinaries = {
+      claude = {
+        executable = "${pkgs.claude-code}/bin/claude";
+        profile = agentProfile;
+        extraArgs = [
+          "--private=~/.local/state/claude-home"
+        ];
+      };
+      opencode = {
+        executable = "${pkgs.opencode}/bin/opencode";
+        profile = agentProfile;
+        extraArgs = [
+          "--private=/home/user/.local/state/opencode-home"
+        ];
+      };
+      chromium-sandbox = {
+        executable = "${pkgs.chromium}/bin/chromium";
+        profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile";
+        extraArgs = [
+          "--netns=wg0ns"
+          "--whitelist=~/downloads"
+          "--env=TGK_THEME=Adwaita:dark"
+          "--dns=10.2.0.1"
+          "--private=/home/user/.local/state/chromium-home"
+        ];
+      };
+      google-chrome-stable = {
+        # executable = "${chrome-argumented}/bin/google-chrome-stable";
+        executable = "${pkgs.google-chrome}/bin/google-chrome-stable";
+        profile = "${pkgs.firejail}/etc/firejail/google-chrome-stable.profile";
+        extraArgs = [
+          "--env=GTK_THEME=Adwaita:dark"
+          "--netns=wg-br0ns"
+          "--dns=10.2.0.1"
+          "--whitelist=/home/user/downloads"
+          "--whitelist=/home/user/pictures"
+        ];
+      };
+      tor-browser = {
+        executable = "${pkgs.tor-browser}/bin/tor-browser";
+        profile = "${pkgs.firejail}/etc/firejail/tor-browser-en-us.profile";
+        extraArgs = [
+          "--netns=wg0ns"
+          "--dns=1.1.1.1"
+        ];
+      };
+      freetube = {
+        executable = "${pkgs.freetube}/bin/freetube";
+        profile = "${pkgs.firejail}/etc/firejail/freetube.profile";
+        extraArgs = [
+          "--netns=wg0ns"
+          "--dns=1.1.1.1"
+        ];
+      };
+    };
+  };
+}