aboutsummaryrefslogtreecommitdiffhomepage
path: root/options.nix
AgeCommit message (Collapse)Author
2026-01-11nix: use package from module in defaultOphestra
This makes overriding hakurei easier. Also avoids building hakurei twice since nix does that for some reason. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-27nix: configure sharefs via fileSystemsOphestra
Turns out this did not work because in the vm test harness, virtualisation.fileSystems completely and silently overrides fileSystems, causing its contents to not even be evaluated anymore. This is not documented as far as I can tell, and is not obvious by any stretch of the imagination. The current hack is cargo culted from nix-community/impermanence and hopefully lasts until this project fully replaces nix. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-25cmd/sharefs: implement shared filesystemOphestra
This is for passing files between applications, similar to android /sdcard. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-15internal/outcome: expose pipewire via pipewire-pulseOphestra
This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst. Closes #29. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-12nix: update flake lockOphestra
NixOS 25.11 introduces a crash in cage and an intermittent crash in foot. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-08treewide: include PipeWire op and enforce PulseAudio checkOphestra
This fully replaces PulseAudio with PipeWire and enforces the PulseAudio check and error message. The pipewire-pulse daemon is handled in the NixOS module. Closes #26. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-12-08hst: check for insecure PulseAudio enablementOphestra
This is currently still a noop, but required for #26. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-10-19hst/container: optional runtime and tmpdir sharingOphestra
Sharing and persisting these directories do not always make sense. Make it optional here. Closes #16. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-09-14nix: use slightly less ambiguous typeOphestra
I had trouble getting Nix to merge json arrays properly, I am not sure that this helps. At this point I have given up trying to understand Nix type system, and I am just trying to keep the Nix stuff going with extensive tests until it can be replaced by lkl for testing and planterette for general usage. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-18hst: rename net and abstract fieldsOphestra
This makes more sense and matches the container library. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-18container: optionally isolate host abstract UNIX domain sockets via landlockClayton Gilmer
2025-08-15hst/enablement: editor friendly enablement adaptorOphestra
Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-15nix: check config via hakureiOphestra
This is unfortunately the only feasible way of doing this in nix. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-14hst/fs: interface filesystem configOphestra
This allows mount points to be represented by different underlying structs. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-11container: use absolute for pathnameOphestra
This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-07-29hst: configurable wait delayOphestra
This is useful for programs that take a long time to clean up. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-07-29app: integrate interrupt forwardingOphestra
This significantly increases usability of command line tools running through hakurei. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-25treewide: rename to hakureiOphestra
Fortify makes little sense for a container tool. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-05-25nix: use reverse-DNS style id as unique identifierOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-05-16nix: improve common usabilityOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-11fst: rename device fieldOphestra
Dev is very ambiguous. Rename it here alongside upcoming config changes. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-27nix: pass through exec argumentsOphestra
This is useful for when a wrapper script is unnecessary. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25app: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17nix: clean up flake outputsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26nix: wrap fpkgOphestra
This is usable on nixos now due to the static build. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23nix: separate fsu from packageOphestra
This appears to be the only way to build them with different configuration. This enables static linking in the main package. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-15nix: test direct_wayland behaviourOphestra
This should never be used outside tests unless you absolutely know what you're doing or are using GNOME. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-25nix: expose compat flag in nixos moduleOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-23nix: expose syscall filter policyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-23nix: configure target users via nixosOphestra
This makes patching home-manager no longer necessary. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-16nix: implement flake checksOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-28nix: expose no_new_session in moduleOphestra Umiker
Useful for shells and terminal programs like chat clients. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-19nix: module descriptionsOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-19nix: separate module options from implementationOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>