feat(nixpak): sandbox six desktop apps (#497)

* feat(nixpak): sandbox six desktop apps

* chore(nixpak): trim OBS plugin set

* fix(nixpak): enable OBS on aarch64

* fix(nixpak): let imv read the full home directory

* fix(home): drop redundant freerdp package

* fix(nixpak): grant OBS access to V4L2 camera devices

* fix(nixpak): expose V4L2 sysfs to OBS

* fix(nixpak): expose NVIDIA encode library to OBS

* docs(nixpak): record OBS interactive validation

* docs(nixpak): record OBS RTMP validation

* fix(nixpak): run MuseScore via XWayland and PulseAudio

* docs(nixpak): explain app sandboxing rationale

* fix(nixpak): route MuseScore ALSA through PipeWire

home/linux/gui/base/creative.nix

@@ -1,49 +1,12 @@
+{ pkgs, ... }:
 {
-  pkgs,
-  pkgs-stable,
-  pkgs-blender,
-  ...
-}:
-{
-  home.packages = with pkgs-stable; [
+  home.packages = with pkgs; [
     # creative
-    pkgs.nixpaks.krita # digital painting
-    musescore # music notation
-    pkgs.nixpaks.orca-slicer # 3d printer slicer app
-    pkgs.nixpaks.bambu-studio # bambu 3d printer slicer app
-    pkgs-blender.blender # 3d modeling
+    nixpaks.krita # digital painting
+    nixpaks.musescore # music notation
+    nixpaks.orca-slicer # 3d printer slicer app
+    nixpaks.bambu-studio # bambu 3d printer slicer app
+    nixpaks.blender # 3d modeling
+    nixpaks.obs-studio # screen recording and streaming; plugins are bundled by the wrapper
   ];
-
-  programs = {
-    # live streaming
-    obs-studio = {
-      enable = pkgs.stdenv.hostPlatform.isx86_64;
-      plugins = with pkgs.obs-studio-plugins; [
-        # screen capture
-        wlrobs
-        # obs-ndi
-        # obs-nvfbc
-        # obs-teleport
-        # obs-hyperion
-        # droidcam-obs
-        # obs-vkcapture
-        obs-gstreamer
-        input-overlay
-        obs-multi-rtmp
-        obs-source-clone
-        # obs-shaderfilter
-        # obs-source-record
-        # obs-livesplit-one
-        # looking-glass-obs
-        # obs-vintage-filter
-        # obs-command-source
-        # obs-move-transition
-        # obs-backgroundremoval
-        # advanced-scene-switcher
-        obs-pipewire-audio-capture
-        obs-vaapi
-        # obs-3d-effect
-      ];
-    };
-  };
 }

home/linux/gui/base/media.nix

@@ -12,7 +12,7 @@
       pavucontrol
       playerctl
       pulsemixer
-      imv # simple image viewer
+      pkgs.nixpaks.imv # simple image viewer
 
       # music
       go-musicfox # TUI NetEase Cloud Music client; plays through mpv (configured below)
@@ -30,8 +30,8 @@
 
   programs.mpv = {
     enable = true;
+    package = pkgs.nixpaks.mpv;
     defaultProfiles = [ "gpu-hq" ];
-    scripts = [ pkgs.mpvScripts.mpris ];
   };
 
   services = {

home/linux/gui/base/misc.nix

@@ -9,9 +9,8 @@
     # do not support .pdf
     nixpaks.foliate
 
-    # remote desktop(rdp connect)
-    remmina
-    freerdp # required by remmina
+    # remote desktop (RDP/VNC/SPICE); FreeRDP is a Remmina runtime dependency
+    nixpaks.remmina
 
     # my custom hardened packages
     nixpaks.qq