Files
nix-config/hardening/nixpaks/umu.nix
T
ryan4yin | 二花 08d2ff7578 feat(nixpak): sandbox umu-launcher with ~/Gaming as its home (#519)
* feat(nixpak): sandbox umu-launcher with ~/Games as its home

umu-run, winetricks and bbe leave the host PATH, so umu launchers
generated before this stop working until rewritten with
`umu-install.nu <name> - <launcher> <gameid>`.

Assisted-by: Claude Agent SDK (claude-opus-5-5)

* refactor(nixpak): mount ~/Gaming as the game sandbox home

idols-ai now preserves ~/Gaming instead of ~/Games, so existing games
vanish from the host after deploy until the preserved ~/Games is moved
to ~/Gaming/Games.

Assisted-by: Claude Agent SDK (claude-opus-5-5)

* docs(nixpak): record umu runtime validation

Assisted-by: Claude Agent SDK (claude-opus-5-5)
Assisted-by: DeepSeek Harness (deepseek-flash)
2026-11-05 22:39:48 -06:00

58 lines
1.7 KiB
Nix

# umu-launcher sandbox for Windows games outside Steam. The launchers that the
# nix-config-umu-game skill writes to ~/Gaming/Games/<name> are game-writable,
# so the host never executes them: `umu-sandbox ~/Games/<name>/run` (a sandbox
# path) runs the whole script, conf and prelaunch included, inside the sandbox.
{
steam,
umu-launcher-unwrapped,
mangohud,
winetricks,
bbe,
gamescope,
dwproton-bin,
writeShellScript,
mkNixPak,
...
}:
let
appId = "org.openwinecomponents.umu";
# pkgs/by-name/um/umu-launcher, with a generic entry point and the tools the
# generated launchers call.
package = steam.buildRuntimeEnv {
pname = "umu-sandbox";
inherit (umu-launcher-unwrapped) version;
extraPkgs = _: [
umu-launcher-unwrapped
mangohud
winetricks
bbe
gamescope
];
executableName = "umu-sandbox";
runScript = writeShellScript "umu-sandbox" ''exec "$@"'';
# As upstream: Legendary spawns umu and exits without waiting for it.
dieWithParent = false;
meta = umu-launcher-unwrapped.meta // {
mainProgram = "umu-sandbox";
};
};
wrapped = mkNixPak {
config = {
imports = [ ./modules/gaming-policy.nix ];
app = {
inherit package;
binPath = "bin/umu-sandbox";
};
flatpak = { inherit appId; };
bubblewrap.env = {
# The session's UMU_PROTONPATH does not survive clearEnv; this path
# also tracks every dwproton-bin update.
UMU_PROTONPATH = "${dwproton-bin.steamcompattool}";
# Lets the generated launchers refuse to start outside the sandbox.
UMU_SANDBOX = "1";
};
};
};
in
wrapped.config.script