hosts/miku.nix

@@ -41,16 +41,12 @@
     sublime-music
     anki
     gnome-podcasts
-    gimp
     #psst
 
     evolution
     
     # Proprietary stuff (yikes)
-    discord-wrapped #discord-app-wrapped
+    discord-wrapped discord-app-wrapped spotify-wrapped
-    spotify-wrapped
-    vortex-wrapped
-    zoom-vm
   ];
   
   ptw = {
@@ -72,7 +68,6 @@
       };
       #xournalpp.enable = true;
       zsh.enable = true;
-      direnv.enable = true;
       office.enable = true;
       plasma.enable = true;
       gaming.enable = true;

lib/sandbox.nix

@@ -5,38 +5,38 @@
 }:
 
 {
-  name                       # Name of the sandboxed package, e.g. "package-wrapped"
+  name
-, launchScriptName           # Name of the script that will be placed in $out/bin
+, package
-, binary                     # The binary to execute inside the sandbox
+, binaryName
-, extraArgs ? []             # Extra arguments to add to the argv
+, version ? "1.0.0"
-, desktopFileAttributes ? {} # Arguments to apply to the desktop file
+, desktopFileArgs ? null
-, preDesktopFilePhase ? ""   # Code to run during the install phase before building the desktop file
+, copyIntoSandbox ? null
-, enableDesktopFile ? false  # Whether to build a desktop file
-, copyIntoSandbox ? {}       # Source -> destination relative to $out
 , unshareUser ? true
 , unshareIpc ? true
 , unsharePid ? true
 , unshareNet ? false
 , unshareUts ? true
 , unshareCgroup ? true
-, dieWithParent ? true       # Should bubblewrap exit when the parents exits
+, dieWithParent ? true
-, mountInHome ? []           # Files, directories to mount inside the sandbox
+, mountInHome ? []
-, chdirTo ? "\"$(pwd)\""     # What should be the CWD when entering the sandbox
+, chdirTo ? "\"$(pwd)\""
-, additionalBlacklist ? []   # Root directories that should not be mounted
+, additionalBlacklist ? []
-, additionalMounts ? []      # Files, directories outside the home directory to mount inside the sandbox
+, additionalMounts ? []
-, extraEnv ? {}              # Extra environment variables to set inside the sandbox
+, extraEnv ? {}
-, enableAlsa ? true          # Mount ALSA files from /etc/
-, enableSudo ? true          # Mount sudo files from /etc/
-, enableShells ? true        # Mount shell related files from /etc/
-, enableNix ? true           # Mount nix related files from /etc/
-, enableOsInfo ? true        # Mount /etc/{machine-id,os-release}
 }:
 
 let
-  mountHome = mountInHome == [];
-
   etcBindFlags = let
     files = [
+      # NixOS Compatibility
+      "static"
+      "nix" # mainly for nixUnstable users, but also for access to nix/netrc
+      # Shells
+      "bashrc"
+      "zshenv"
+      "zshrc"
+      "zinputrc"
+      "zprofile"
       # Users, Groups, NSS
       "passwd"
       "group"
@@ -46,22 +46,29 @@ let
       "nsswitch.conf"
       # User profiles
       "profiles"
+      # Sudo & Su
+      "login.defs"
+      "sudoers"
+      "sudoers.d"
       # Time
       "localtime"
       "zoneinfo"
+      # Other Core Stuff
+      "machine-id"
+      "os-release"
       # PAM
       "pam.d"
       # Fonts
       "fonts"
-    ]
+      # ALSA
-    ++ (lib.optionals enableNix [ "static" "nix" ])
+      "alsa"
-    ++ (lib.optionals enableShells [ "bashrc" "zshenv" "zshrc" "zinputrc" "zprofile" ])
+      "asound.conf"
-    ++ (lib.optionals enableSudo [ "login.defs" "sudoers" "sudoers.d" ])
+      # SSL
-    ++ (lib.optionals enableAlsa [ "alsa" "asound.conf" ])
+      "ssl/certs"
-    ++ (lib.optionals enableOsInfo [ "machine-id" "os-release" ])
+      "pki"
-      # Only add SSL stuff when we have networking enabled
+    ];
-    ++ (lib.optionals (!unshareNet) [ "ssl/certs" "pki" ]);
+  in builtins.concatStringsSep "\n  "
-  in builtins.concatStringsSep "\n  " (map (file: "--ro-bind-try /etc/${file} /etc/${file}") files);
+  (map (file: "--ro-bind-try /etc/${file} /etc/${file}") files);
 
   # Create this on the fly instead of linking from /nix
   # The container might have to modify it and re-run ldconfig if there are
@@ -81,21 +88,15 @@ let
     EOF
     ldconfig &> /dev/null
   '';
-  sandboxInitScriptName = "${name}-wrapped-init.sh";
+  init = run: writeShellScriptBin "${binaryName}-init" ''
-  sandboxInitScript = writeShellScriptBin sandboxInitScriptName ''
     source /etc/profile
     ${createLdConfCache}
-    exec ${binary} "$@"
+    exec ${run} "$@"
   '';
-
+  extraEnvString = lib.foldl (acc: val: acc + val + "\n") "" (lib.mapAttrsToList (name: value: "--setenv ${name} \"${value}\"") extraEnv);
-
+  mountHome = mountInHome == [];
-  sandboxScriptName = "${name}-wrapped.sh";
+  initStr = init "${package}/bin/${binaryName}";
-  sandboxScript = let
+  bwrapCmd = { initArgs ? "" }: ''
-    extraEnvString = lib.foldl (acc: val: acc + val + "\n") "" (lib.mapAttrsToList (name: value: "--setenv ${name} \"${value}\"") extraEnv);
-    stringify = x: "\"${x}\"";
-    safeAdditionalMounts = map stringify additionalMounts;
-    safeMountInHome = map stringify mountInHome;
-  in writeShellScriptBin sandboxScriptName ''
     blacklist=(/nix /dev /proc /etc ${lib.optionalString (!mountHome) "/home"} ${builtins.toString additionalBlacklist})
     ro_mounts=()
     symlinks=()
@@ -111,13 +112,13 @@ let
     done
 
     if [[ "${lib.optionalString (!mountHome) "1"}" = "1" ]]; then
-      for entry in ${builtins.toString safeMountInHome}; do
+      for entry in ${builtins.toString mountInHome}; do
         auto_mounts+=(--bind "/home/$USER/$entry" "/home/$USER/$entry")
       done
     fi
 
     if [[ ! -z "${builtins.toString additionalMounts}" ]]; then
-      for entry in ${builtins.toString safeAdditionalMounts}; do
+      for entry in ${builtins.toString additionalMounts}; do
         auto_mounts+=(--bind "$entry" "$entry")
       done
     fi
@@ -157,40 +158,27 @@ let
       "''${symlinks[@]}"
       "''${auto_mounts[@]}"
       ${extraEnvString}
-      ${sandboxInitScript}/bin/${sandboxInitScriptName}
+      ${initStr}/bin/${name}-init ${initArgs}
     )
-    exec "''${cmd[@]}" $@
+    exec "''${cmd[@]}"
   '';
+  bin = writeShellScriptBin name (bwrapCmd { initArgs = ''"$@"''; });
+  desktopItem = makeDesktopItem (desktopFileArgs // {
+    exec = "${bin}/bin/${name}";
+  });
+  copyIntoSandboxString = lib.concatStrings (map (x: "cp -Lr ${package}/${x} $out/${x}\n") copyIntoSandbox);
 in stdenv.mkDerivation {
-  pname = name;
+  pname = "${name}-sandboxed";
-  version = "1.0.0";
+  version = version;
 
   unpackPhase = ":";
   dontBuild = true;
   
-  installPhase = let
+  installPhase = ''
-    desktopFilePhase = let
-      desktopFile = makeDesktopItem (desktopFileAttributes // {
-        exec = "${sandboxScript}/bin/${sandboxScriptName}";
-      });
-    in ''
-      cp -r ${desktopFile}/share/applications $out/share
-    '';
-    copyIntoSandboxPhase = let
-      attrs = builtins.attrNames copyIntoSandbox;
-      cps = map (x: "cp -Lr ${x} $out/${copyIntoSandbox."${x}"}\n") attrs;
-    in lib.concatStrings cps;
-  in ''
     mkdir -p $out/bin
-    ln -s ${sandboxScript}/bin/${sandboxScriptName} $out/bin/${launchScriptName}
+    ln -s ${bin}/bin/${name} $out/bin/${name}
-
+  '' + lib.strings.optionalString (!(builtins.isNull desktopFileArgs)) ''
-    
+    mkdir -p $out/share/
-    # Generate the desktop file, if enabled
+    cp -r ${desktopItem}/share/applications $out/share
-    ${lib.optionalString enableDesktopFile "mkdir -p $out/share"}
+  '' + lib.strings.optionalString (!(builtins.isNull copyIntoSandbox)) copyIntoSandboxString;
-    ${lib.optionalString enableDesktopFile preDesktopFilePhase}
-    ${lib.optionalString enableDesktopFile desktopFilePhase}
-
-    # Copy extra files if they are specified
-    ${lib.optionalString (copyIntoSandbox != {}) copyIntoSandboxPhase}
-  '';
 }

modules/default.nix

@@ -24,7 +24,6 @@
     ./programs/office
     ./programs/gaming
     ./programs/bluray
-    ./programs/direnv
 
     # Services
     ./services/kanshi

modules/programs/direnv/default.nix

@@ -1,19 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.ptw.programs.direnv;
-in {
-  options.ptw.programs.direnv = {
-    enable = lib.mkEnableOption "Enable direnv";
-  };
-
-  config = lib.mkIf cfg.enable {
-    home-manager.users."${config.ptw.system.singleUser}".programs.direnv = {
-      enable = true;
-      enableZshIntegration = true;
-      nix-direnv = {
-        enable = true;
-      };
-    };
-  };
-}

modules/programs/emacs/default.nix

@@ -22,7 +22,7 @@ in {
     home-manager.users."${config.ptw.system.singleUser}" = {
       home.file = {
         #".emacs".text = builtins.replaceStrings [ "%%DARTLANG_ANALYSIS_SERVER_PATH%%" "" ] (builtins.readFile ./dotemacs);
-        ".emacs".source = ./dotemacs;
+        ".emace".source = ./dotemacs;
         ".emacs.d/mu4e.el".source = ./mu4e.el;
         ".emacs.d/themes/weyland-yutani-theme.el".source = "${weyland-yutani}/weyland-yutani-theme.el";
       };

modules/programs/gaming/default.nix

@@ -8,7 +8,7 @@ in {
   };
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
-      wineWowPackages.staging winetricks lutris-free-wrapped
+      winePackages.stagingFull winetricks lutris-free-wrapped
 
       (pkgs.callPackage ./wrapper.nix {
         inherit (pkgs) retroarch;

modules/programs/gnome/default.nix

@@ -10,11 +10,7 @@ in {
   config = lib.mkIf cfg.enable {
     environment = {
       systemPackages = with pkgs; [
-        # Themes
         arc-theme
-        libsForQt5.qtstyleplugin-kvantum
-
-        # Gnome Shell Extensions
         gnomeExtensions.appindicator
         gnomeExtensions.caffeine
         gnomeExtensions.gnome-40-ui-improvements
@@ -27,17 +23,14 @@ in {
         gnomeExtensions.gsconnect
         gnomeExtensions.blur-my-shell
         gnomeExtensions.forge
-
-        # Programs
         gnome.eog
         gnome.nautilus
         gnome.evince
+        unstable.gnome.gnome-shell
         gnome.gnome-terminal
         pinentry-gnome
-        mousai
-
-        # For config
         dconf # For home-manager
+        libsForQt5.qtstyleplugin-kvantum
       ];
       gnome.excludePackages = pkgs.gnome.optionalPackages;
     };

modules/programs/zsh/default.nix

@@ -47,14 +47,8 @@ in {
       bindkey "\e[3~" delete-char
     '';
       history.share = true;
-      initExtraFirst = let
-        enableDirenv = lib.optionalString
-          config.ptw.programs.direnv.enable
-          "eval \"$(${pkgs.direnv}/bin/direnv hook zsh)\"";
-      in ''
-      ${enableDirenv} 
-
       # TODO: Maybe move this somewhere else
+      initExtraFirst = ''
       wcurl() {
         [[ -z "$1" ]] && echo "Error: No URL specified" && exit 1
 

overlays/sandbox.nix

@@ -3,7 +3,27 @@ final: prev:
 let
   wrapInSandbox = prev.callPackage ../lib/sandbox.nix {};
 in {
-  /*
+  discord-wrapped = wrapInSandbox {
+    name = "discord";
+    package = prev.discord;
+    #package = discord-system-electron;
+    binaryName = "discord";
+    mountInHome = [ ".config/discord" ".config/BetterDiscord" ];
+    additionalBlacklist = [ "/mnt" ];
+    chdirTo = "/home/$USER";
+
+    version = "1.0.1";
+    copyIntoSandbox = [ "share/pixmaps" ];
+    desktopFileArgs = {
+      name = "discord-wrapped";
+      #exec = "discord";
+      icon = "discord";
+      desktopName = "Discord (wrapped)";
+      genericName = "Instant Messenger";
+      categories = [ "Network" "InstantMessaging" ];
+    };
+  };
+
   discord-app-wrapped = wrapInSandbox {
     name = "discord-app";
     package = prev.discord-app;
@@ -30,135 +50,48 @@ in {
     mountInHome = [ ".local/share/minecraft" ".minecraft" ];
     additionalBlacklist = [ "/mnt" ];
     chdirTo = "/home/$USER";
-  };*/
+  };
 
   steam-wrapped = wrapInSandbox {
-    name = "steam-wrapped";
+    name = "steam";
-    binary = "${prev.steam}/bin/steam";
+    package = prev.steam;
-    launchScriptName = "steam";
+    binaryName = "steam";
     mountInHome = [ ".steam" ".local/share/Steam" ];
     additionalBlacklist = [ "/mnt" ];
     additionalMounts = [ "/mnt/Storage/Games/SteamLibrary" ];
     chdirTo = "/home/$USER";
-
+    extraEnv = {
-    preDesktopFilePhase = ''
+      DRI_PRIME = "1";
-      cp -Lr ${prev.steam}/share/icons $out/share/icons
-    '';
-    desktopFileAttributes = {
-      name = "steam-wrapped";
-      icon = "steam";
-      desktopName = "Steam (wrapped)";
     };
-    enableDesktopFile = true;
+
+    copyIntoSandbox = [ "/share" ];
+  };
+
+  android-studio-wrapped = wrapInSandbox {
+    name = "android-studio";
+    package = prev.android-studio;
+    binaryName = "android-studio";
+    additionalBlacklist = [ "/mnt" ];
+    mountInHome = [ "Development/Personal/Android" ".android" ];
+    chdirTo = "/home/$USER";
   };
 
   spotify-wrapped = wrapInSandbox {
-    name = "spotify-wrapped";
+    name = "spotify";
-    launchScriptName = "spotify";
+    package = prev.spotify;
-    binary = "${prev.spotify}/bin/spotify";
+    binaryName = "spotify";
     additionalBlacklist = [ "/mnt" ];
     mountInHome = [ ".config/spotify" ];
     chdirTo = "/home/$USER";
-
-    preDesktopFilePhase = ''
-      cp -Lr ${prev.spotify}/share/icons $out/share/icons
-    '';
-    desktopFileAttributes = {
-      name = "spotify-wrapped";
-      icon = "spotify";
-      desktopName = "Spotify (wrapped)";
-    };
-    enableDesktopFile = true;
   };
 
   lutris-free-wrapped = wrapInSandbox {
-    name = "lutris-free-wrapped";
+    name = "lutris-free";
-    launchScriptName = "lutris";
+    package = prev.lutris-free;
-    binary = "${prev.lutris-free}/bin/lutris";
+    binaryName = "lutris";
     additionalBlacklist = [ "/mnt" ];
-    additionalMounts = [ "/mnt/Storage/Games/" ];
+    additionalMounts = [ "/mnt/Storage/Games/UPlay" ];
-    mountInHome = [ ".local/share/lutris" ".config/lutris" "Games" ];
+    mountInHome = [ ".local/share/lutris" ".config/lutris" ];
     chdirTo = "/home/$USER";
-
-    preDesktopFilePhase = ''
-      mkdir -p $out/share/
-      cp -Lr ${prev.lutris-free}/share/icons $out/share/icons/
-    '';
-    desktopFileAttributes = {
-      name = "lutris-wrapped";
-      icon = "lutris";
-      desktopName = "Lutris (wrapped)";
-    };
-    enableDesktopFile = true;
-  };
-
-  discord-wrapped = let
-    discordPkg = prev.discord;
-  in wrapInSandbox {
-    name = "discord-wrapped";
-    launchScriptName = "discord";
-    binary = "${discordPkg}/bin/discord";
-    mountInHome = [ ".config/discord" ".config/BetterDiscord" ];
-    additionalBlacklist = [ "/mnt" ];
-    chdirTo = "/home/$USER";
-
-    preDesktopFilePhase = ''
-      mkdir -p $out/share/icons
-      cp -L ${discordPkg}/share/pixmaps/discord.png $out/share/icons/discord.png
-    '';
-    desktopFileAttributes = {
-      name = "discord-wrapped";
-      #exec = "discord";
-      icon = "discord";
-      desktopName = "Discord (wrapped)";
-      genericName = "Instant Messenger";
-      #categories = [ "Network" "InstantMessaging" ];
-    };
-    enableDesktopFile = true;
-  };
-
-  vortex-wrapped = let
-    # The path to the wine prefix Vortex is installed in
-    prefixPath = "/mnt/Storage/Games/NewVortex";
-
-    vortexStartScript = prev.writeShellScriptBin "start-vortex.sh" ''
-      WINEARCH=win64 \
-      WINEPREFIX=${prefixPath} \
-      ${prev.wineWowPackages.staging}/bin/wine "C:\Program Files\Black Tree Gaming Ltd\Vortex\Vortex.exe"
-    '';
-    vortexIcon = builtins.fetchurl {
-      url = "https://www.nexusmods.com/bootstrap/images/vortex/vortex-logomark.svg";
-      sha256 = "0237wbbyvgapmmjsq5xab0izzaciqjx1si163r75wa2g7xvz4s22";
-    };
-  in wrapInSandbox {
-    name = "vortex-wrapped";
-    launchScriptName = "vortex";
-    binary = "${vortexStartScript}/bin/start-vortex.sh";
-
-    chdirTo = "/mnt/Storage/Games/";
-    additionalBlacklist = [ "/mnt" ];
-    additionalMounts = [
-      # Wine prefix
-      "/mnt/Storage/Games/NewVortex"
-      # Mod cache
-      "/mnt/Storage/Vortex Mods"
-      # Only access Skyrim: SE
-      "/mnt/Storage/Games/SteamLibrary/SteamLibrary/steamapps/common/Skyrim\ Special\ Edition/"
-    ];
-    mountInHome = [
-      # Mod downloads
-      "Downloads/Skyrim Mods"
-    ];
-
-    preDesktopFilePhase = ''
-      mkdir -p $out/share/icons
-      cp ${vortexIcon} $out/share/icons/vortex.svg
-    '';
-    desktopFileAttributes = {
-      name = "vortex-wrapped";
-      icon = "vortex";
-      desktopName = "Vortex Mod Manager (wrapped)";
-    };
-    enableDesktopFile = true;
   };
 }

packages/default.nix

@@ -66,6 +66,4 @@ in {
   discord-app = prev.callPackage applications/networking/instant-messengers/discord-app {
     chromium = prev.ungoogled-chromium;
   };
-
-  zoom-vm = prev.callPackage scripts/zoom-vm {};
 }

packages/scripts/zoom-vm/default.nix

@@ -1,46 +0,0 @@
-{
-  stdenv, lib
-, makeDesktopItem, writeShellScriptBin
-, virt-manager, libvirt, notify-desktop
-}:
-
-let
-  zoomVmScript = writeShellScriptBin "start-zoom-vm.sh" ''
-    ${notify-desktop}/bin/notify-desktop "Zoom VM" "Starting VM..."
-    output=$(/run/wrappers/bin/pkexec virsh start zoom 2>&1)
-    if [[ ! "$?" = "0" ]]; then
-       ${notify-desktop}/bin/notify-desktop -u critical "Zoom VM" "$output"
-       exit 1
-    fi
-
-    ${virt-manager}/bin/virt-manager --connect qemu:///system --show-domain-console zoom
-  '';
-  zoomIcon = builtins.fetchurl {
-    url = "https://dl.flathub.org/repo/appstream/x86_64/icons/128x128/us.zoom.Zoom.png";
-    sha256 = "0d94vhjna2196s4wnq0vkga345ad5lpb7b5qp6cymwf1hnpg9lyh";
-  };
-in stdenv.mkDerivation rec {
-  pname = "zoom-vm";
-  version = "1.0.0";
-
-  unpackPhase = ":";
-  dontBuild = true;
-
-  desktopItem = makeDesktopItem {
-    name = "zoom-vm";
-    desktopName = "Zoom (VM)";
-    exec = "start-zoom-vm";
-    icon = "us.zoom.Zoom";
-  };
-  
-  installPhase = ''
-    # Install the script
-    mkdir -p $out/bin
-    cp ${zoomVmScript}/bin/start-zoom-vm.sh $out/bin/start-zoom-vm
-
-    # Install the desktop file
-    mkdir -p $out/share/icons
-    cp ${zoomIcon} $out/share/icons/us.zoom.Zoom.png
-    cp -r ${desktopItem}/share/applications $out/share
-  '';
-}