rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden deployment, authentication, firewall and media storage failure paths

Browse source
This commit is contained in:
rope 2026-09-14 11:50:22 +01:00
parent 64ede7bd05
commit 7145a35927
35 changed files with 2529 additions and 499 deletions
Download patch file Download diff file Expand all files Collapse all files

56
settings/hyprland.nix
View file

@ -62,40 +62,6 @@ in
libcanberra-gtk3
];
# Lock *before* the machine actually suspends. hypridle's
# before_sleep_cmd cannot do this: it spawns the command and releases
# its sleep inhibitor in the same breath (journal: "Executing …" then
# "Releasing the sleep inhibitor!" on the same second), so the qs
# process gets frozen mid-lock and only finishes on resume — the lid
# opens showing the pre-suspend desktop for a beat before the lock
# paints. A unit ordered Before=sleep.target genuinely blocks the
# suspend until it exits. The sleep covers the gap between quickshell
# accepting the IPC and the lock surface committing a frame.
systemd.services.lock-before-sleep = {
description = "Lock the session before suspend";
before = [ "sleep.target" ];
wantedBy = [ "sleep.target" ];
serviceConfig = {
Type = "oneshot";
User = "fred";
# XDG_RUNTIME_DIR must be derived at runtime: the %U specifier is the
# UID of the *manager* running the unit (0 for system units), not the
# one in User=, so it pointed qs at /run/user/0.
ExecStart = pkgs.writeShellScript "lock-before-sleep" ''
export XDG_RUNTIME_DIR=/run/user/$(${pkgs.coreutils}/bin/id -u)
# HOME too: system units don't set it for User=, and qs resolves
# the config (and thus the instance to talk to) via ~/.config —
# without it: "Could not find "default" config directory".
export HOME=/home/fred
# --any-display: no WAYLAND_DISPLAY here, and qs skips instances
# on other displays without it.
${pkgs.quickshell}/bin/qs ipc --any-display call lock lock
${pkgs.coreutils}/bin/sleep 1
'';
TimeoutStartSec = "5s";
};
};
home-manager.users.fred = { config, lib, pkgs, inputs, ... }:
let
c = config.lib.stylix.colors;
@ -325,24 +291,14 @@ in
-- Ensure hyprland-session.target starts even if HM's
-- dbus-update-activation-environment chain fails upstream.
hl.exec_cmd("systemctl --user start hyprland-session.target")
-- greetd's pam leaves gnome-keyring-daemon in half-initialized
-- --login mode (autologin = no password, and nothing in a
-- non-GNOME session runs the second stage). --start completes
-- init so the lockscreen's pam unlock actually reaches it.
hl.exec_cmd("${pkgs.gnome-keyring}/bin/gnome-keyring-daemon --start --components=secrets")
-- Complete the keyring's PAM login initialization before Spotify
-- requests credentials. greetd has already authenticated Fred.
hl.exec_cmd("sh -c '${pkgs.gnome-keyring}/bin/gnome-keyring-daemon --start --components=secrets && exec spotify'")
-- mako removed; notifications handled by quickshell
hl.exec_cmd("wl-paste --type text --watch cliphist store")
hl.exec_cmd("wl-paste --type image --watch cliphist store")
hl.exec_cmd("hyprctl setcursor Bibata-Modern-Ice 24")
-- Spotify is NOT started here. It asks the Secret Service for its
-- credentials the moment it launches, and at this point the
-- lockscreen has not been dismissed yet, so the login keyring is
-- still locked and it lands on gcr's unlock prompt instead of
-- loading. Lock.qml starts it after pam accepts the password
-- (pam_gnome_keyring unlocks the keyring in its auth phase). The
-- window rule below still swallows it onto special:music, and the
-- respawn-on-close rule above is unaffected.
-- Scratchpad terminal: parked on special:scratch at
-- login so SUPER+Return is always an instant toggle and the shell
-- keeps its history/cwd between peeks.
@ -608,8 +564,8 @@ in
# (settings/quickshell.nix) via `hyprctl hyprsunset`.
services.hyprsunset.enable = true;
# Lock screen is quickshell's WlSessionLock (settings/quickshell.nix),
# triggered via `qs ipc call lock lock`.
# The independent Quickshell lock is configured in settings/auth.nix,
# triggered through the confirmed-lock helper.
services.hypridle = lib.mkIf isMacbook (
let
# Skip the action if any MPRIS player is playing — covers windowed
@ -620,7 +576,7 @@ in
enable = true;
settings = {
general = {
lock_cmd = "qs ipc call lock lock";
lock_cmd = "fred-lock";
# No before_sleep_cmd: hypridle does not wait for it before
# dropping its sleep inhibitor, so the lock lands after resume.
# systemd.services.lock-before-sleep handles suspend instead.