starred/nix-config-ryan4yin
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-05-20 21:46:54 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

feat: optimize nixpaks

Browse Source
This commit is contained in:
Ryan Yin
2025-09-18 23:43:13 +08:00
parent 0c6e5dc32e
commit 8b2b43d28a
10 changed files with 444 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hardening/nixpaks/qq.nix
+83 -49
View File
@@ -5,62 +5,96 @@
# - QQ's flatpak manifest: https://github.com/flathub/com.qq.QQ/blob/master/com.qq.QQ.yaml
{
lib,
pkgs,
qq,
mkNixPak,
buildEnv,
makeDesktopItem,
...
}:
mkNixPak {
config =
{ sloth, ... }:
{
app = {
package = pkgs.qq;
binPath = "bin/qq";
};
flatpak.appId = "com.tencent.qq";
imports = [
./modules/gui-base.nix
./modules/network.nix
];
let
appId = "com.qq.QQ";
# list all dbus services:
# ls -al /run/current-system/sw/share/dbus-1/services/
# ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
dbus.policies = {
"org.gnome.Shell.Screencast" = "talk";
# System tray icon
"org.freedesktop.Notifications" = "talk";
"org.kde.StatusNotifierWatcher" = "talk";
# File Manager
"org.freedesktop.FileManager1" = "talk";
# Uses legacy StatusNotifier implementation
"org.kde.*" = "own";
};
bubblewrap = {
# To trace all the home files QQ accesses, you can use the following nushell command:
# just trace-access qq
# See the Justfile in the root of this repository for more information.
bind.rw = [
# given the read write permission to the following directories.
# NOTE: sloth.mkdir is used to create the directory if it does not exist!
(sloth.mkdir (
sloth.concat [
sloth.xdgConfigHome
"/QQ"
]
))
wrapped = mkNixPak {
config =
{ sloth, ... }:
{
app = {
package = qq;
binPath = "bin/qq";
};
flatpak.appId = appId;
sloth.xdgDocumentsDir
sloth.xdgDownloadDir
sloth.xdgMusicDir
sloth.xdgVideosDir
imports = [
./modules/gui-base.nix
./modules/network.nix
./modules/common.nix
];
sockets = {
x11 = false;
wayland = true;
pipewire = true;
# list all dbus services:
# ls -al /run/current-system/sw/share/dbus-1/services/
# ls -al /etc/profiles/per-user/ryan/share/dbus-1/services/
dbus.policies = {
"org.gnome.Shell.Screencast" = "talk";
# System tray icon
"org.freedesktop.Notifications" = "talk";
"org.kde.StatusNotifierWatcher" = "talk";
# File Manager
"org.freedesktop.FileManager1" = "talk";
# Uses legacy StatusNotifier implementation
"org.kde.*" = "own";
};
bubblewrap = {
# To trace all the home files QQ accesses, you can use the following nushell command:
# just trace-access qq
# See the Justfile in the root of this repository for more information.
bind.rw = [
# given the read write permission to the following directories.
# NOTE: sloth.mkdir is used to create the directory if it does not exist!
(sloth.mkdir (
sloth.concat [
sloth.xdgConfigHome
"/QQ"
]
))
sloth.xdgDocumentsDir
sloth.xdgDownloadDir
sloth.xdgMusicDir
sloth.xdgVideosDir
];
sockets = {
x11 = false;
wayland = true;
pipewire = true;
};
};
};
};
};
exePath = lib.getExe wrapped.config.script;
in
buildEnv {
inherit (wrapped.config.script) name meta passthru;
paths = [
wrapped.config.script
(makeDesktopItem {
name = appId;
desktopName = "QQ";
genericName = "QQ Boxed";
comment = "Tencent QQ, also known as QQ, is an instant messaging software service and web portal developed by the Chinese technology company Tencent.";
exec = "${exePath} %U";
startupNotify = true;
terminal = false;
icon = "${qq}/share/icons/hicolor/512x512/apps/qq.png";
startupWMClass = "QQ";
type = "Application";
categories = [
"InstantMessaging"
"Network"
];
extraConfig = {
X-Flatpak = appId;
};
})
];
}