mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:36 +01:00
ryan4yin | 二花
b726c28c14
* feat(nixpak): sandbox Steam and Heroic in ~/Gaming idols-ai stops preserving ~/.local/share/Steam, ~/.steam, ~/.config/heroic and their game data, which must be moved into ~/Gaming before deploying. Assisted-by: DeepSeek Harness (deepseek-flash) * refactor(nixpak): replace steam-fix.nu with sandboxed protontricks Assisted-by: DeepSeek Harness (claude-opus-5-5) * fix(nixpak): hide host documents and GTK config from game sandboxes Assisted-by: DeepSeek Harness (claude-opus-5-5) * docs(ai): locate the Steam library under ~/Gaming Assisted-by: DeepSeek Harness (claude-opus-5-5) * fix(umu-game): confine writes to ~/Gaming and keep foreign entries Assisted-by: DeepSeek Harness (claude-opus-5-5) * fix(nixpak): keep Steam and Heroic in the application launcher The wrappers only carried bin/, so neither launcher had a desktop entry after replacing programs.steam. Assisted-by: DeepSeek Harness (deepseek-flash) * fix(nixpak): give the game sandboxes a fontconfig that sees CJK fonts Steam rendered Chinese as tofu: the FHS layers build their own /etc/fonts, whose config lists only DejaVu and the XDG font directory, so neither the host fonts nor the FHS /usr/share/fonts were ever scanned. Point FONTCONFIG_FILE at a small config that includes /usr/share/fonts, and ship WenQuanYi Zen Hei and Noto Sans CJK in all three FHS layers. Assisted-by: DeepSeek Harness (deepseek-flash) * fix(nixpak): grant the game launchers a StatusNotifier tray icon Steam and Heroic register a tray icon over D-Bus, and the game sandboxes granted no StatusNotifierWatcher access, so the desktop shell had nothing to show for them. Enable desktopIntegration.tray for all three launchers and teach the policy suites to expect it. Assisted-by: DeepSeek Harness (deepseek-flash) * fix(nixpak): drop the duplicate host CJK font and tidy the font overrides Steam reads the fonts inside its own FHS layer, so the system-wide wqy_zenhei added for it no longer serves any sandbox. Give gaming-policy its own comment for FONTCONFIG_FILE instead of leaving it under the compat-tool one, make the desktop-base value a default, and note the SNI tray grant in the README table. Assisted-by: DeepSeek Harness (deepseek-flash)
55 lines
1.9 KiB
Nu
55 lines
1.9 KiB
Nu
# Helpers shared by umu-install.nu and umu-uninstall.nu.
|
|
#
|
|
# Games only run in the umu sandbox (hardening/nixpaks/umu.nix), which mounts
|
|
# ~/Gaming over $HOME: a game installed at ~/Gaming/Games/<name> on the host is
|
|
# ~/Games/<name> inside. Everything under ~/Gaming is writable by the games, so
|
|
# these scripts, which run on the host, treat it as untrusted: they refuse
|
|
# symlinks before writing or deleting there, and never execute a file from it.
|
|
|
|
# The sandbox home, as seen from the host.
|
|
export def gaming-dir [] {
|
|
$nu.home-dir | path join "Gaming"
|
|
}
|
|
|
|
# Where games are installed, as seen from the host.
|
|
export def games-dir [] {
|
|
gaming-dir | path join "Games"
|
|
}
|
|
|
|
export def reject-symlink [path: string, label: string] {
|
|
let kind = (try { $path | path type } catch { "missing" })
|
|
if $kind == "symlink" {
|
|
print --stderr $"error: ($label) must not be a symlink: ($path)"
|
|
exit 2
|
|
}
|
|
}
|
|
|
|
# Both roots must be real directories before anything below them is touched.
|
|
export def reject-symlinked-roots [] {
|
|
reject-symlink (gaming-dir) "Gaming directory"
|
|
reject-symlink (games-dir) "Games directory"
|
|
}
|
|
|
|
export def check-name [name: string] {
|
|
if not ($name =~ '^[a-z0-9]+(-[a-z0-9]+)*$') {
|
|
print --stderr "error: name must be a lowercase slug (letters, digits, hyphens)"
|
|
exit 2
|
|
}
|
|
}
|
|
|
|
# The path as the sandbox sees it, or null if the sandbox cannot see it:
|
|
# ~/Gaming becomes $HOME, and the Nix store is read-only. Symlinks stay
|
|
# unresolved: under ~/Gaming the games choose their targets.
|
|
export def sandbox-path [path: string] {
|
|
let full = ($path | path expand --no-symlink)
|
|
let store = ($env.NIX_STORE_DIR? | default "/nix/store")
|
|
let gaming = (gaming-dir)
|
|
if $full == $gaming or ($full | str starts-with $"($gaming)/") {
|
|
$full | str replace $gaming $nu.home-dir
|
|
} else if ($full | str starts-with $"($store)/") {
|
|
$full
|
|
} else {
|
|
null
|
|
}
|
|
}
|