feat: hardening nixos desktops (#160)

* feat: hardening nixos desktops

* refactor: move hardening to the root folder

* feat: add nixpaks into nixpkgs via overlays

* feat: nixpak - add netease music

* docs: hardening

* fix: nvidia

* fix: disable apparmor & hardening profile to avoid neovim being killed

* fix: firefox cursor & fonts

hardening/nixpaks/default.nix

@@ -0,0 +1,30 @@
+{
+  pkgs,
+  nixpak,
+  ...
+}: let
+  callArgs = {
+    mkNixPak = nixpak.lib.nixpak {
+      inherit (pkgs) lib;
+      inherit pkgs;
+    };
+    safeBind = sloth: realdir: mapdir: [
+      (sloth.mkdir (sloth.concat' sloth.appDataDir realdir))
+      (sloth.concat' sloth.homeDir mapdir)
+    ];
+  };
+  wrapper = _pkgs: path: (_pkgs.callPackage path callArgs).config.script;
+in {
+  # Add nixpaked Apps into nixpkgs, and reference them in home-manager or other nixos modules
+  nixpkgs.overlays = [
+    (_: super: {
+      nixpaks = {
+        qq = wrapper super ./qq.nix;
+        qq-desktop-item = super.callPackage ./qq-desktop-item.nix {};
+
+        firefox = wrapper super ./firefox.nix;
+        firefox-desktop-item = super.callPackage ./firefox-desktop-item.nix {};
+      };
+    })
+  ];
+}