mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
818965a11f
* refactor(nixpak): unify desktop app sandboxes Move common GUI, portal, and network policy into reusable modules and migrate browsers plus Zoom/WeChat/QQ/Telegram to the same boundary. Assisted-by: DeepSeek Harness (deepseek-flash)
43 lines
1.2 KiB
Nix
43 lines
1.2 KiB
Nix
# Zoom keeps the upstream FHS runtime inside the outer nixpak boundary.
|
|
{ lib, sloth, ... }:
|
|
{
|
|
imports = [
|
|
./desktop-base.nix
|
|
./network.nix
|
|
];
|
|
pasta.mode = "isolate";
|
|
desktopIntegration.tray = true;
|
|
portalGroups = {
|
|
fileChooser = true;
|
|
openUri = true;
|
|
notifications = true;
|
|
screenCast = true;
|
|
camera = true;
|
|
inhibit = true;
|
|
inputMethod = true;
|
|
};
|
|
bubblewrap = {
|
|
# Screen sharing enumerates DRM connectors through sysfs. Missing this
|
|
# directory makes Zoom abort with std::filesystem_error.
|
|
bind.ro = [ "/sys/class/drm" ];
|
|
# ZoomLauncher selects xcb; the X11 connection retains X11's display trust.
|
|
sockets.x11 = true;
|
|
env = {
|
|
DISPLAY = sloth.envOr "DISPLAY" "";
|
|
XAUTHORITY = sloth.envOr "XAUTHORITY" (sloth.concat' sloth.homeDir "/.Xauthority");
|
|
};
|
|
bind.dev = [
|
|
# Zoom 7.2.1 still opens V4L2 device nodes directly for webcam capture.
|
|
"/dev/video0"
|
|
"/dev/video1"
|
|
];
|
|
bind.rw = [
|
|
(sloth.mkdir (sloth.concat' sloth.homeDir "/.zoom"))
|
|
(sloth.concat' sloth.xdgConfigHome "/zoomus.conf")
|
|
(sloth.concat' sloth.xdgConfigHome "/zoom.conf")
|
|
(sloth.mkdir (sloth.concat' sloth.xdgDocumentsDir "/Zoom"))
|
|
sloth.xdgDownloadDir
|
|
];
|
|
};
|
|
}
|