714 lines
18 KiB
Nix
714 lines
18 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
usr,
|
|
username,
|
|
hostName,
|
|
...
|
|
}: let
|
|
#dotfiles = builtins.fetchGit {
|
|
# # allRefs = true;
|
|
# url = "https://git.dotya.ml/wanderer/dotfiles";
|
|
# ref = "master";
|
|
# allRefs = true;
|
|
# rev = "817b220cddeb12725a658111af3f0c7ad39597a9";
|
|
# # rev = "ac2cc918f89e56537cdb384ba3fe1c4c71e0c825";
|
|
#};
|
|
# rev = "e83a79d12b104b24a65b87d1327e6cab237ad175";
|
|
# rev = "7d485a27b6207d2495813461fcfb36948e3b3985";
|
|
# rev = "f9393bd2e76da15ac2df4d5b13e74f8cc0ad450c";
|
|
# rev = "9396a6a6d579f275d6baf4a1b0154b882368744b";
|
|
# rev = "3c9bd8d6e63df1bf42169cade8c5eb6ee7a235d2";
|
|
# rev = "6b0f6fdc49c79e2074c809e3a18fc859456382de";
|
|
# rev = "b3f4d2d9fb6519f85ec6bfb540fc42001c9ed0cb";
|
|
rev = "6a9da1441946100b541f963d014745ab4d2deeb9";
|
|
dotfiles = builtins.fetchTarball {
|
|
url = "https://git.dotya.ml/wanderer/dotfiles.git/archive/${rev}.tar.gz";
|
|
sha256 = "sha256:06vqgj8lalcqpfazbyniqjhfb79dzlirhrf40cxxn4v8bng6qmb0";
|
|
};
|
|
swayTgt = "sway-session.target";
|
|
start-waybar = pkgs.writeShellScriptBin "start-waybar" ''
|
|
export SWAYSOCK=/run/user/$(id -u)/sway-ipc.$(id -u).$(pgrep -f 'sway$').sock
|
|
${pkgs.waybar}/bin/waybar
|
|
'';
|
|
start-autotiling = pkgs.writeShellScriptBin "start-autotiling" ''
|
|
export SWAYSOCK=/run/user/$(id -u)/sway-ipc.$(id -u).$(pgrep -f 'sway$').sock
|
|
${pkgs.autotiling}/bin/autotiling
|
|
'';
|
|
# usr = username;
|
|
in {
|
|
imports = [
|
|
# ./modules/desktop/waybar.nix
|
|
# ./modules/desktop/hypr.nix
|
|
# ./modules/desktop/wayland.nix
|
|
# ./modules/desktop/sway.nix
|
|
./modules/catppuccin
|
|
];
|
|
|
|
catppuccin = {
|
|
defaultTheme = "mocha";
|
|
# bat.enable = true;
|
|
btop.enable = true;
|
|
dircolors.enable = true;
|
|
};
|
|
|
|
###sops = {
|
|
### defaultSopsFile = ./secrets.yaml;
|
|
### # age.keyFile = "/run/secrets-rendered/sopsFile";
|
|
### age.keyFile = "/run/secrets/rendered/sopsFile";
|
|
### secrets = {
|
|
### # gitUsername.path = "%r/secrets/gitUsername";
|
|
### gitConf.path = "${config.home.homeDirectory}/.config/git/config.${hostName}";
|
|
### };
|
|
###};
|
|
|
|
# home.enableNixpkgsReleaseCheck = false;
|
|
gtk = {
|
|
enable = true;
|
|
catppuccin = {
|
|
enable = true;
|
|
flavor = "mocha";
|
|
accent = "mauve";
|
|
size = "standard";
|
|
tweaks = [ "normal" ];
|
|
icon = {
|
|
enable = true;
|
|
flavor = "mocha";
|
|
accent = "mauve";
|
|
};
|
|
};
|
|
|
|
gtk3.extraConfig = {
|
|
gtk-application-prefer-dark-theme = true;
|
|
};
|
|
gtk4.extraConfig = {
|
|
gtk-application-prefer-dark-theme = true;
|
|
};
|
|
};
|
|
|
|
home = {
|
|
username = lib.mkForce "${usr}";
|
|
homeDirectory = lib.mkForce "/home/${usr}";
|
|
enableNixpkgsReleaseCheck = true;
|
|
|
|
activation = lib.mkAfter {
|
|
catppuccinBatCache = "${lib.getExe pkgs.bat} cache --build";
|
|
};
|
|
|
|
pointerCursor = {
|
|
gtk.enable = true;
|
|
# x11.enable = true;
|
|
package = pkgs.bibata-cursors;
|
|
name = "Bibata-Modern-Classic";
|
|
# package = pkgs.catppuccin-cursors.mochaDark;
|
|
##package = pkgs.catppuccin-cursors;
|
|
### name = "Catppuccin-Mocha-Mauve-Cursors";
|
|
##name = "mochaMauve";
|
|
size = 24;
|
|
};
|
|
|
|
|
|
packages = with pkgs; [
|
|
actionlint
|
|
asciinema
|
|
|
|
asciiquarium
|
|
bat
|
|
bc
|
|
sqlite
|
|
bun
|
|
caddy
|
|
cliphist
|
|
cowsay
|
|
curlie
|
|
dig
|
|
dogdns
|
|
doggo
|
|
dive # docker container explorer
|
|
entr # run arbitrary commands when files change
|
|
# eza
|
|
exif
|
|
exiftool
|
|
fd
|
|
feh
|
|
ffmpeg
|
|
figlet
|
|
file
|
|
git-lfs
|
|
# XXX: deprecated in 2505
|
|
# xsv
|
|
xan
|
|
gh
|
|
|
|
# firefox-wayland
|
|
# chromium
|
|
qutebrowser
|
|
captive-browser # filippo valsorda's wrapper around chromium
|
|
|
|
fx
|
|
gcc
|
|
gnumake
|
|
|
|
# go_1_23
|
|
#gofumpt
|
|
#golangci-lint
|
|
#golangci-lint-langserver
|
|
#gopls
|
|
#goreleaser
|
|
#gotools
|
|
# air
|
|
# delve
|
|
hadolint
|
|
|
|
graph-easy
|
|
|
|
vhs
|
|
skate
|
|
gum
|
|
glow
|
|
|
|
grype
|
|
syft
|
|
|
|
hugo
|
|
himalaya
|
|
ipcalc
|
|
jq
|
|
killall
|
|
libnotify
|
|
libtelnet
|
|
lolcat
|
|
# vivid
|
|
lsof
|
|
pipectl # manage named pipes
|
|
dante
|
|
|
|
mpv-unwrapped
|
|
vlc
|
|
playerctl
|
|
|
|
# fastfetch
|
|
# neofetch
|
|
netcat
|
|
networkmanagerapplet
|
|
|
|
nixfmt-classic
|
|
nix-output-monitor
|
|
statix
|
|
|
|
nmap
|
|
nodePackages.prettier
|
|
nodePackages.typescript
|
|
nodePackages.typescript-language-server
|
|
nodePackages.yaml-language-server
|
|
nodejs
|
|
pciutils
|
|
pgcli
|
|
|
|
pulsemixer
|
|
pamixer
|
|
pavucontrol
|
|
|
|
pylint
|
|
ruff
|
|
# ruff-lsp # XXX removed in 2505
|
|
python3
|
|
python312Packages.pipx
|
|
python312Packages.python-lsp-server
|
|
python312Packages.pylsp-rope
|
|
# python312Packages.ropper
|
|
python311Packages.ropper
|
|
pre-commit
|
|
trufflehog
|
|
ripgrep
|
|
rsync
|
|
slsa-verifier
|
|
shellcheck
|
|
shfmt
|
|
# signal-desktop
|
|
# slack # unfree
|
|
|
|
p7zip
|
|
zip
|
|
unzip
|
|
|
|
# XXX: deprecated in 24.11
|
|
### gnome.nautilus
|
|
### gnome.seahorse
|
|
### gnome.eog
|
|
### gnome.gnome-tweaks
|
|
### gnome.gnome-calculator
|
|
### gnome.gnome-calendar
|
|
nautilus
|
|
seahorse
|
|
eog
|
|
gnome-tweaks
|
|
gnome-calculator
|
|
gnome-calendar
|
|
# gnome.gnome-contacts
|
|
errands # todo w/ *dav support
|
|
blanket # ambient sounds
|
|
audio-sharing # share rtsp streams
|
|
clairvoyant
|
|
junction
|
|
# solanum
|
|
|
|
tailscale-systray
|
|
usbutils
|
|
v4l-utils
|
|
|
|
vim-vint
|
|
|
|
wev
|
|
whois
|
|
xdg-utils
|
|
yt-dlp
|
|
yq-go
|
|
zathura
|
|
|
|
hoppscotch
|
|
|
|
gammastep
|
|
wlsunset
|
|
|
|
gimp
|
|
inkscape
|
|
|
|
yaru-theme
|
|
# catppuccin-papirus-folders
|
|
# papirus-folders
|
|
];
|
|
|
|
sessionVariables = {
|
|
GTK_THEME = "Dracula";
|
|
# WLR_RENDERER = "vulkan";
|
|
XDG_SESSION_TYPE = "wayland";
|
|
GTK_USE_PORTAL = "1";
|
|
NIXOS_XDG_OPEN_USE_PORTAL = "1";
|
|
};
|
|
|
|
stateVersion = lib.mkForce "24.05";
|
|
};
|
|
|
|
dconf = {
|
|
enable = true;
|
|
settings = {
|
|
"org/gnome/desktop/interface" = {
|
|
color-scheme = "prefer-dark";
|
|
};
|
|
};
|
|
};
|
|
|
|
editorconfig.settings = {
|
|
"*" = {
|
|
charset = "utf-8";
|
|
end_of_line = "lf";
|
|
trim_trailing_whitespace = true;
|
|
insert_final_newline = true;
|
|
max_line_width = 78;
|
|
indent_style = "space";
|
|
indent_size = 4;
|
|
};
|
|
};
|
|
|
|
#services = {
|
|
# # blueman-applet.enable = true;
|
|
# # network-manager-applet.enable = true;
|
|
|
|
# # avizo.enable = true;
|
|
|
|
# #batsignal = {
|
|
# # enable = true;
|
|
# # extraArgs = ["-w 25" "-c 15" "-d 10"];
|
|
# #};
|
|
|
|
# #mako.catppuccin.enable = true;
|
|
#};
|
|
|
|
programs = {
|
|
glamour.catppuccin.enable = true;
|
|
fuzzel = {
|
|
catppuccin.enable = true;
|
|
};
|
|
fzf = {
|
|
enable = true;
|
|
catppuccin.enable = true;
|
|
enableZshIntegration = true;
|
|
};
|
|
# gh = {enable = true;};
|
|
home-manager = {
|
|
enable = true; # let home-manager manage itself.
|
|
};
|
|
mpv.catppuccin.enable = true;
|
|
obs-studio = {
|
|
enable = true;
|
|
catppuccin.enable = true;
|
|
plugins = with pkgs.obs-studio-plugins; [wlrobs obs-pipewire-audio-capture obs-gstreamer];
|
|
};
|
|
vscode = {
|
|
enable = true;
|
|
package = pkgs.vscodium;
|
|
#extensions = with pkgs.vscode-extensions; [
|
|
# dracula-theme.theme-dracula
|
|
# vscodevim.vim
|
|
# yzhang.markdown-all-in-one
|
|
#];
|
|
};
|
|
#waybar = {
|
|
# systemd.enable = true;
|
|
# systemd.target = swayTgt;
|
|
# catppuccin.enable = true;
|
|
#};
|
|
tmux.catppuccin.enable = true;
|
|
zellij.catppuccin.enable = true;
|
|
zsh.syntaxHighlighting.catppuccin.enable = true;
|
|
};
|
|
qt.style.catppuccin.enable = true;
|
|
|
|
# better eval time
|
|
manual = {
|
|
html.enable = true;
|
|
manpages.enable = true;
|
|
json.enable = false;
|
|
};
|
|
|
|
fonts.fontconfig.enable = false;
|
|
|
|
# https://rycee.gitlab.io/home-manager/options.html#opt-programs.ssh.matchBlocks
|
|
|
|
home.file = {
|
|
".config/kitty/kitty.conf" = let
|
|
|
|
c = builtins.readFile "${dotfiles}/.config/kitty/kitty.conf";
|
|
cfg = builtins.replaceStrings ["# allow_remote_control no"] ["allow_remote_control yes"] c;
|
|
in {
|
|
text = cfg;
|
|
};
|
|
|
|
".vimrc" = {
|
|
source = "${dotfiles}/.vim/vimrc";
|
|
};
|
|
".vim/deoplete.vimrc.vim" = {
|
|
source = "${dotfiles}/.vim/deoplete.vimrc.vim";
|
|
};
|
|
".vim/gotags.vimrc.vim" = {
|
|
source = "${dotfiles}/.vim/gotags.vimrc.vim";
|
|
};
|
|
".vim/python.vimrc.vim" = {
|
|
source = "${dotfiles}/.vim/python.vimrc.vim";
|
|
};
|
|
|
|
".config/nvim/init.vim" = {
|
|
source = "${dotfiles}/.config/nvim/init.vim";
|
|
};
|
|
|
|
#".config/systemd/user.conf" = {
|
|
# text = ''
|
|
# [Manager]
|
|
# DefaultTimeoutStarSec=15s
|
|
# DefaultTimeoutStopSec=15s
|
|
# '';
|
|
#};
|
|
|
|
#".config/sway/config.d/dracula.sway" = {
|
|
# source = "${dotfiles}/.config/sway/config.d/dracula.sway";
|
|
#};
|
|
#".config/waybar/config" = {
|
|
# source = "${dotfiles}/.config/waybar/config";
|
|
#};
|
|
#".config/waybar/style.css" = {
|
|
# source = "${dotfiles}/.config/waybar/style.css";
|
|
#};
|
|
#".config/waybar/modules/storage.sh" = {
|
|
# source = "${dotfiles}/.config/waybar/modules/storage.sh";
|
|
#};
|
|
#".config/kanshi/config" = let
|
|
# c = builtins.readFile "${dotfiles}/.config/kanshi/config";
|
|
# cfg = builtins.replaceStrings ["\"AU Optronics 0x213D Unknown\""] ["eDP-1"] c;
|
|
#in {
|
|
# # source = "${dotfiles}/.config/kanshi/config";
|
|
# text = ''
|
|
# profile lg-v {
|
|
# output "LG Electronics LG ULTRAFINE 401NTZNBX045" mode 2560x2160
|
|
# output eDP-1 disable
|
|
# }
|
|
|
|
# profile lg-vAlt {
|
|
# output "LG Electronics LG ULTRAFINE 401NTZNBX045" mode 2560x2160
|
|
# output "BOE 0x07DB Unknown" disable
|
|
# }
|
|
|
|
# profile lg-tv {
|
|
# # @ 60.000 Hz
|
|
# output "LG Electronics LG TV 0x01010101" mode 3840x2160
|
|
# output eDP-1 disable
|
|
# }
|
|
# profile d1 {
|
|
# output eDP-1 disable
|
|
# output "Dell Inc. DELL U2412M Y1H5T27N1EVL" mode 1920x1200 enable position 0,0 scale .94
|
|
# }
|
|
|
|
# profile d2 {
|
|
# output eDP-1 disable
|
|
# output "Dell Inc. DELL U2412M Y1H5T27N1EVL" mode 1920x1200 enable position 0,0 scale .94
|
|
# output "Dell Inc. DELL U2412M YPPY077L1JXS" disable
|
|
# }
|
|
# profile chwjt {
|
|
# output "BOE 0x07DB Unknown" disable
|
|
# output "XXX CHHWJT Unknown" mode 1920x1200 enable position 0,0
|
|
# }
|
|
# '' + cfg + ''
|
|
|
|
# profile fallback {
|
|
# output eDP-1 enable mode 1920x1080 position 0,0
|
|
# }
|
|
# profile fallback2 {
|
|
# output "BOE 0x07DB Unknown" enable mode 1920x1080 position 0,0
|
|
# }
|
|
# profile empty {
|
|
# }
|
|
# '';
|
|
#};
|
|
|
|
#".config/mako/config" = {
|
|
# text = (builtins.readFile "${dotfiles}/.config/mako/config") + ''
|
|
|
|
# [mode=away]
|
|
# default-timeout=0
|
|
# ignore-timeout=1
|
|
# '';
|
|
# # source = "${dotfiles}/.config/mako/config";
|
|
#};
|
|
#".config/swaylock/config" =
|
|
#let
|
|
# c = builtins.readFile "${dotfiles}/.config/swaylock/config";
|
|
# cfg = builtins.replaceStrings ["grace=5"] ["grace=1"] c;
|
|
#in {
|
|
# # source = "${dotfiles}/.config/swaylock/config";
|
|
# text = cfg;
|
|
#};
|
|
|
|
#".config/albert.conf" = {
|
|
# source = "${dotfiles}/.config/albert/albert.conf";
|
|
#};
|
|
|
|
".config/direnv/direnv.toml" = {
|
|
source = "${dotfiles}/.config/direnv/direnv.toml";
|
|
};
|
|
|
|
".config/git/config-common" = {
|
|
source = "${dotfiles}/.config/git/config";
|
|
};
|
|
".config/git/config" = {
|
|
text = ''
|
|
[include]
|
|
path = ~/.config/git/config-common
|
|
#[include]
|
|
# path = ~/.config/git/config.${hostName}
|
|
|
|
[alias]
|
|
fuckem = merge -s ours
|
|
'';
|
|
};
|
|
".config/git/allowed_signers" = {
|
|
source = "${dotfiles}/.config/git/allowed_signers";
|
|
};
|
|
|
|
".cargo/config.toml" = {
|
|
text = ''
|
|
[build]
|
|
jobs = 4 # number of parallel jobs, defaults to # of CPUs
|
|
# rustc = ".cargo/bin/rustc" # the rust compiler tool
|
|
rustc-wrapper = "sccache" # enable sccache
|
|
|
|
[future-incompat-report]
|
|
frequency = 'always' # when to display a notification about a future incompat report
|
|
|
|
[http]
|
|
debug = false # HTTP debugging
|
|
ssl-version = "tlsv1.3" # TLS version to use
|
|
timeout = 30 # timeout for each HTTP request, in seconds
|
|
low-speed-limit = 10 # network timeout threshold (bytes/sec)
|
|
check-revoke = true # check for SSL certificate revocation
|
|
multiplexing = true # HTTP/2 multiplexing
|
|
|
|
[target.x86_64-unknown-linux-gnu]
|
|
rustflags = ["-C", "target-cpu=native"]
|
|
'';
|
|
};
|
|
|
|
".npmrc" = {
|
|
text = ''
|
|
prefix=''${HOME}/.npm-packages
|
|
audit=false
|
|
fund=false
|
|
'';
|
|
};
|
|
|
|
".config/tridactyl/tridactylrc" = {
|
|
source = "${dotfiles}/.config/tridactyl/tridactylrc";
|
|
};
|
|
|
|
".config/bat/config" = {
|
|
source = "${dotfiles}/.config/bat/config";
|
|
};
|
|
|
|
".ncpamixer.conf" = {
|
|
source = "${dotfiles}/.config/ncpamixer.conf";
|
|
};
|
|
|
|
".gdbinit" = {
|
|
text = ''
|
|
set auto-load safe-path /nix/store
|
|
set history save on
|
|
set history size 10000
|
|
set history remove-duplicates 100
|
|
set history filename ~/.gdb_history
|
|
'';
|
|
};
|
|
};
|
|
|
|
systemd.user.services = {
|
|
#avizo.Service = {
|
|
# RestartSec = "10s";
|
|
# Restart = "always";
|
|
#};
|
|
#network-manager-applet.Service = {
|
|
# RestartSec = "10s";
|
|
# Restart = "always";
|
|
#};
|
|
|
|
#waybar = {
|
|
# Unit = {
|
|
# Description = "Highly customizable Wayland bar for Sway and Wlroots based compositors.";
|
|
# Documentation = "https://github.com/Alexays/Waybar/wiki/";
|
|
# PartOf = swayTgt;
|
|
# After = swayTgt;
|
|
# };
|
|
|
|
# Service = {
|
|
# Environment = "PATH=/run/current-system/sw/sbin:/run/current-system/sw/bin:$PATH\nEnvironment=GDK_BACKEND=wayland";
|
|
# # ExecStart = "${start-waybar}/bin/start-waybar";
|
|
# ExecStart = "${pkgs.waybar}/bin/waybar"; # + " -l trace";
|
|
# ExecReload = "kill -SIGUSR2 $MAINPID";
|
|
# Restart = "on-failure";
|
|
# RestartSec = "5s";
|
|
# LockPersonality = true;
|
|
# PrivateTmp = "yes";
|
|
# # DevicePolicy = "closed";
|
|
# };
|
|
|
|
# Install = {WantedBy = [swayTgt];};
|
|
#};
|
|
|
|
#autotiling = {
|
|
# Unit = {
|
|
# Description = "Script for sway and i3 to automatically switch the horizontal / vertical window split orientation";
|
|
# Documentation = "https://github.com/nwg-piotr/autotiling";
|
|
# BindsTo = swayTgt;
|
|
# };
|
|
|
|
# Service = {
|
|
# Type = "simple";
|
|
# # ExecStart = "${start-autotiling}/bin/start-autotiling";
|
|
# ExecStart = "${pkgs.autotiling}/bin/autotiling";
|
|
# Restart = "always";
|
|
# RestartSec = "5s";
|
|
# LockPersonality = true;
|
|
# PrivateTmp = "yes";
|
|
# DevicePolicy = "closed";
|
|
# };
|
|
|
|
# Install = {WantedBy = [swayTgt];};
|
|
#};
|
|
|
|
#kanshi = {
|
|
# Unit = {
|
|
# Description = "Dynamic output configuration for Wayland compositors";
|
|
# # Documentation = "man:kanshi(1)";
|
|
# Documentation = "https://sr.ht/~emersion/kanshi";
|
|
# # BindsTo = config.services.kanshi.systemdTarget;
|
|
# BindsTo = [swayTgt];
|
|
# };
|
|
# # Install = {WantedBy = [config.services.kanshi.systemdTarget];};
|
|
# Install = {WantedBy = [swayTgt];};
|
|
|
|
# Service = {
|
|
# Type = "simple";
|
|
# # ExecStart = "/usr/sbin/kanshi";
|
|
# ExecStart = "${config.services.kanshi.package}/bin/kanshi";
|
|
# Restart = "always";
|
|
# RestartSec = "5s";
|
|
# # LockPersonality = true;
|
|
# PrivateTmp = "yes";
|
|
# # DevicePolicy = "closed";
|
|
# };
|
|
#};
|
|
|
|
#gopls = {
|
|
# Unit = {
|
|
# Description = "Go language server";
|
|
# };
|
|
|
|
# Service = let
|
|
# sock = "/tmp/.gopls-daemon.sock";
|
|
# c = pkgs.coreutils;
|
|
# # script = "${c}/bin/rm -v -f ${sock} || ${c}/bin/true";
|
|
# script = pkgs.writeShellScriptBin "cleanup" ''
|
|
# ${c}/bin/rm -v -f ${sock} || ${c}/bin/true
|
|
# '';
|
|
# # script = "rm -v -f ${sock} || true";
|
|
# start = pkgs.writeShellScriptBin "gopls" ''
|
|
# #${pkgs.gopls}/bin/gopls -listen="unix;${sock}"
|
|
# ''${HOME}/go/bin/gopls -listen="unix;${sock}"
|
|
# '';
|
|
# in {
|
|
# Type = "simple";
|
|
# # Environment = "PATH=/run/current-system/sw/bin";
|
|
# # ExecStartPre = "${pkgs.bash}/bin/bash -c \"${script}\"";
|
|
# ExecStartPre = "${script}/bin/cleanup";
|
|
# # ExecStart = "%h/go/bin/gopls -listen=\"unix;${sock}\"";
|
|
# ExecStart = "${start}/bin/gopls";
|
|
# # ExecStartPost = "${pkgs.bash}/bin/bash -c \"${script}\"";
|
|
# ExecStartPost = "${script}/bin/cleanup";
|
|
# Restart = "on-failure";
|
|
# RestartSec = "1m";
|
|
# TimeoutStopFailureMode = "abort";
|
|
# SystemCallFilter = "~@reboot @obsolete";
|
|
# ProtectProc = "invisible";
|
|
# ProcSubset = "pid";
|
|
# # ProtectHome = "tmpfs";
|
|
# ProtectHome = "read-only";
|
|
# # https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html#Specifiers
|
|
# BindPaths = [
|
|
# "%h/.cache/go-build"
|
|
# "%h/go"
|
|
# "/tmp"
|
|
# "/etc/profiles/per-user/%u/bin"
|
|
# ];
|
|
# Environment = "PATH=/etc/profiles/per-user/%u/bin:$PATH";
|
|
# PrivateTmp = "no";
|
|
# # RestrictNamespaces = false;
|
|
# RestrictNamespaces = "yes";
|
|
# # RestrictNamespaces = "no";
|
|
# NoNewPrivileges = "yes";
|
|
# # XXX: this is questionable.
|
|
# # ProtectSystem = "strict";
|
|
# DevicePolicy = "closed";
|
|
# LockPersonality = true;
|
|
# MemoryDenyWriteExecute = true;
|
|
# #RestrictAddressFamilies="AF_UNIX AF_INET AF_INET6";
|
|
# RestrictAddressFamilies = "AF_UNIX";
|
|
# RestrictRealtime = true;
|
|
# RestrictSUIDSGID = true;
|
|
# SystemCallArchitectures = "native";
|
|
# };
|
|
|
|
# Install = {WantedBy = ["default.target"];};
|
|
#};
|
|
};
|
|
|
|
xdg = (import "${dotfiles}/nix/xdg.nix") {inherit pkgs config hostName;};
|
|
}
|