108 lines
2.6 KiB
Nix
108 lines
2.6 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
agentProfile = pkgs.writeText "agent.profile" ''
|
|
whitelist /nix/store
|
|
whitelist /nix/var
|
|
read-only /nix/store
|
|
whitelist ''${HOME}/.cache/nix
|
|
whitelist ''${HOME}/.local/state/nix
|
|
whitelist /etc/nix
|
|
whitelist /etc/nixos
|
|
whitelist /nix/var/nix/daemon-socket
|
|
whitelist ''${HOME}/dev
|
|
whitelist ''${HOME}/work
|
|
whitelist ''${HOME}/.config
|
|
|
|
blacklist ''${HOME}
|
|
blacklist /etc/nixos/secrets
|
|
blacklist /etc/shadow
|
|
blacklist /etc/sudoers
|
|
blacklist /etc/sudoers.d
|
|
blacklist /root
|
|
|
|
caps.drop all
|
|
nonewprivs
|
|
noroot
|
|
seccomp
|
|
|
|
no3d
|
|
nodvd
|
|
notv
|
|
nou2f
|
|
novideo
|
|
|
|
|
|
ignore net none
|
|
|
|
machine-id
|
|
disable-mnt
|
|
private-dev
|
|
private-tmp
|
|
private-cache
|
|
'';
|
|
in
|
|
{
|
|
programs.firejail = {
|
|
enable = true;
|
|
wrappedBinaries = {
|
|
claude = {
|
|
executable = "${pkgs.claude-code}/bin/claude";
|
|
profile = agentProfile;
|
|
extraArgs = [
|
|
"--private=~/.local/state/claude-home"
|
|
];
|
|
};
|
|
opencode = {
|
|
executable = "${pkgs.opencode}/bin/opencode";
|
|
profile = agentProfile;
|
|
extraArgs = [
|
|
"--private=/home/user/.local/state/opencode-home"
|
|
];
|
|
};
|
|
chromium-sandbox = {
|
|
executable = "${pkgs.chromium}/bin/chromium";
|
|
profile = "${pkgs.firejail}/etc/firejail/chromium-browser.profile";
|
|
extraArgs = [
|
|
"--netns=wg0ns"
|
|
"--whitelist=~/downloads"
|
|
"--env=TGK_THEME=Adwaita:dark"
|
|
"--dns=10.2.0.1"
|
|
"--private=/home/user/.local/state/chromium-home"
|
|
];
|
|
};
|
|
google-chrome-stable = {
|
|
# executable = "${chrome-argumented}/bin/google-chrome-stable";
|
|
executable = "${pkgs.google-chrome}/bin/google-chrome-stable";
|
|
profile = "${pkgs.firejail}/etc/firejail/google-chrome-stable.profile";
|
|
extraArgs = [
|
|
"--env=GTK_THEME=Adwaita:dark"
|
|
"--netns=wg-br0ns"
|
|
"--dns=10.2.0.1"
|
|
"--whitelist=/home/user/downloads"
|
|
"--whitelist=/home/user/pictures"
|
|
];
|
|
};
|
|
tor-browser = {
|
|
executable = "${pkgs.tor-browser}/bin/tor-browser";
|
|
profile = "${pkgs.firejail}/etc/firejail/tor-browser-en-us.profile";
|
|
extraArgs = [
|
|
"--netns=wg0ns"
|
|
"--dns=1.1.1.1"
|
|
];
|
|
};
|
|
freetube = {
|
|
executable = "${pkgs.freetube}/bin/freetube";
|
|
profile = "${pkgs.firejail}/etc/firejail/freetube.profile";
|
|
extraArgs = [
|
|
"--netns=wg0ns"
|
|
"--dns=1.1.1.1"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|