hakurei/nixos.nix, branch v0.4.1low-level userspace tooling for Rosa OShttp://src.rosa.moe/hakurei/atom/nixos.nix?h=v0.4.12026-04-11T14:28:18Znix: add sharefs supplementary group2026-04-11T14:28:18ZOphestracat@gensokyo.uk2026-04-11T14:27:56Zurn:sha1:28ebf973d6af4e28c706e90889957a8553125fac
This works around vfs inode file attribute race.
Signed-off-by: Ophestra <cat@gensokyo.uk>
hst: optionally reject insecure options2026-04-10T10:34:02ZOphestracat@gensokyo.uk2026-04-10T10:12:45Zurn:sha1:c33a6a5b7ee130370aeeebf6635977415115f7da
This prevents inadvertent use of insecure compatibility features.
Closes #30.
Signed-off-by: Ophestra <cat@gensokyo.uk>
cmd/hakurei: rename app to run2026-03-28T07:48:26ZOphestracat@gensokyo.uk2026-03-28T07:43:02Zurn:sha1:b1ea3b4acf85365fd76c890f8b8852b5f95be5c1
The run command was a legacy holdover from very early days and is only useful for testing and demonstration these days. This change also renames it to exec.
Signed-off-by: Ophestra <cat@gensokyo.uk>
hst: expose scheduling priority2026-03-11T17:15:14ZOphestracat@gensokyo.uk2026-03-11T16:20:08Zurn:sha1:620062cca92b6241c15f96f86a9c6f0f7882ecca
This is useful when limits are configured to allow it.
Signed-off-by: Ophestra <cat@gensokyo.uk>
hst: expose scheduling policy2026-03-11T15:52:18ZOphestracat@gensokyo.uk2026-03-11T12:06:44Zurn:sha1:04e6bc3c5c99d6a99f17cfa5f69f34fe8941aee2
This is primarily useful for poorly written music players for now.
Signed-off-by: Ophestra <cat@gensokyo.uk>
nix: configure sharefs via fileSystems2025-12-27T14:14:08ZOphestracat@gensokyo.uk2025-12-27T13:52:12Zurn:sha1:e42ea32dbe9283d14a7c0e8746059bc5ef97f6cd
Turns out this did not work because in the vm test harness, virtualisation.fileSystems completely and silently overrides fileSystems, causing its contents to not even be evaluated anymore. This is not documented as far as I can tell, and is not obvious by any stretch of the imagination. The current hack is cargo culted from nix-community/impermanence and hopefully lasts until this project fully replaces nix.
Signed-off-by: Ophestra <cat@gensokyo.uk>
cmd/sharefs: create directory as root2025-12-27T13:14:33ZOphestracat@gensokyo.uk2025-12-27T13:09:55Zurn:sha1:e7982b4ee9cc935d6b89f291087524cdee229d09
This optional behaviour is required on NixOS as it is otherwise impossible to set this up: systemd.mounts breaks startup order somehow even though my unit looks identical to generated ones, fileSystems does not support any kind of initialisation or ordering other than against other mount points.
Signed-off-by: Ophestra <cat@gensokyo.uk>
cmd/sharefs: containerise filesystem daemon2025-12-27T01:16:35ZOphestracat@gensokyo.uk2025-12-27T00:17:14Zurn:sha1:2f8ca8337633a199aae9b4cdd71c66ed1c9529a5
This replaces the forking daemonise libfuse function which prevents Go callbacks from calling into the runtime. This also enforces least privilege on the daemon process.
Signed-off-by: Ophestra <cat@gensokyo.uk>
nix: set noatime on sharefs2025-12-25T20:34:05ZOphestracat@gensokyo.uk2025-12-25T20:34:05Zurn:sha1:54712e04265f1e74194fe8df0cc8f596af2e80d5
Could improve performance, atime is not useful for this filesystem anyway.
Signed-off-by: Ophestra <cat@gensokyo.uk>
nix: do not restart sharefs2025-12-25T19:12:14ZOphestracat@gensokyo.uk2025-12-25T19:12:14Zurn:sha1:dce5839a797409bf6b58273fb343764a56f91bbf
This avoids disrupting running containers.
Signed-off-by: Ophestra <cat@gensokyo.uk>