mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
8f0961d9c2
* fix(desktop): tie ai's link DNS takeover to mihomo's lifecycle sing-tun normally points systemd-resolved at the TUN DNS by running resolvectl (dns/domain/default-route). Under nixpkgs' hardened DynamicUser mihomo unit that hand-off fails silently: the unit's RestrictAddressFamilies blocks resolvectl's D-Bus socket and resolve1 requires privileged authorization, so resolved keeps querying the physical-link DNS, fake-ip is bypassed, and domain rules degrade to MATCH. Do the hand-off as '+' ExecStartPost/ExecStopPost hooks instead: '+' commands run outside the sandbox (systemd.exec: address-family restrictions do not apply to them) and ExecStopPost reverts even on crashes, so a dead mihomo leaves DNS usable. Signed-off-by: Ryan Yin <xiaoyin_c@qq.com> * docs(mihomo): record sing-tun's resolvectl hand-off as the leak cause Signed-off-by: Ryan Yin <xiaoyin_c@qq.com> * refactor(desktop): keep mihomo only on ai and shoukei ruby/kana never ran the core (service inactive live), and their resolved + TUN combo would reintroduce the resolver leak once enabled. Drop the enable and the explicit module import from computer-use; the eval test now pins mihomo=false for both guests. --------- Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>