Files
nix-config/hardening/nixpaks/remmina.nix
T
ryan4yin | 二花 c277c81cd6 feat(nixpak): sandbox six desktop apps (#497)
* feat(nixpak): sandbox six desktop apps

* chore(nixpak): trim OBS plugin set

* fix(nixpak): enable OBS on aarch64

* fix(nixpak): let imv read the full home directory

* fix(home): drop redundant freerdp package

* fix(nixpak): grant OBS access to V4L2 camera devices

* fix(nixpak): expose V4L2 sysfs to OBS

* fix(nixpak): expose NVIDIA encode library to OBS

* docs(nixpak): record OBS interactive validation

* docs(nixpak): record OBS RTMP validation

* fix(nixpak): run MuseScore via XWayland and PulseAudio

* docs(nixpak): explain app sandboxing rationale

* fix(nixpak): route MuseScore ALSA through PipeWire
2026-11-01 01:24:47 -05:00

64 lines
1.4 KiB
Nix

{
lib,
remmina,
mkNixPak,
buildEnv,
makeDesktopItem,
runCommandLocal,
...
}:
let
appId = "org.remmina.Remmina";
wrapped = mkNixPak {
config = {
imports = [ ./modules/remote-desktop-policy.nix ];
app = {
package = remmina;
binPath = "bin/remmina";
};
flatpak = { inherit appId; };
# Preserve the SSH Tunnel tab used for localhost VNC access.
remoteDesktop.sshAgent = true;
};
};
exe = lib.getExe wrapped.config.script;
assets = runCommandLocal "remmina-desktop-assets" { } ''
mkdir -p $out/share
ln -s ${remmina}/share/icons $out/share/icons
'';
in
buildEnv {
inherit (wrapped.config.script) name passthru;
meta = wrapped.config.script.meta // {
mainProgram = "remmina";
};
paths = [
wrapped.config.script
assets
(makeDesktopItem {
name = appId;
desktopName = "Remmina";
genericName = "Remote Desktop Client";
comment = "Connect to RDP, VNC, SPICE and SSH sessions";
exec = "${exe} %U";
icon = appId;
terminal = false;
startupNotify = true;
startupWMClass = appId;
categories = [
"GTK"
"Network"
];
mimeTypes = [
"application/x-remmina"
"x-scheme-handler/rdp"
"x-scheme-handler/spice"
"x-scheme-handler/vnc"
"x-scheme-handler/ssh"
"x-scheme-handler/remmina"
];
extraConfig.X-Flatpak = appId;
})
];
}