mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
8f0961d9c2
* fix(desktop): tie ai's link DNS takeover to mihomo's lifecycle sing-tun normally points systemd-resolved at the TUN DNS by running resolvectl (dns/domain/default-route). Under nixpkgs' hardened DynamicUser mihomo unit that hand-off fails silently: the unit's RestrictAddressFamilies blocks resolvectl's D-Bus socket and resolve1 requires privileged authorization, so resolved keeps querying the physical-link DNS, fake-ip is bypassed, and domain rules degrade to MATCH. Do the hand-off as '+' ExecStartPost/ExecStopPost hooks instead: '+' commands run outside the sandbox (systemd.exec: address-family restrictions do not apply to them) and ExecStopPost reverts even on crashes, so a dead mihomo leaves DNS usable. Signed-off-by: Ryan Yin <xiaoyin_c@qq.com> * docs(mihomo): record sing-tun's resolvectl hand-off as the leak cause Signed-off-by: Ryan Yin <xiaoyin_c@qq.com> * refactor(desktop): keep mihomo only on ai and shoukei ruby/kana never ran the core (service inactive live), and their resolved + TUN combo would reintroduce the resolver leak once enabled. Drop the enable and the explicit module import from computer-use; the eval test now pins mihomo=false for both guests. --------- Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
24 lines
344 B
Nix
24 lines
344 B
Nix
{
|
|
myvars,
|
|
lib,
|
|
}:
|
|
let
|
|
hosts = [
|
|
"ruby"
|
|
"kana"
|
|
];
|
|
in
|
|
lib.genAttrs hosts (name: {
|
|
computerUse = true;
|
|
atspi = true;
|
|
mihomo = false;
|
|
timeZone = "America/Los_Angeles";
|
|
xvfbRestart = "always";
|
|
i3Restart = "always";
|
|
vnc = true;
|
|
clipboardSync = true;
|
|
cuaDriver = name == "ruby";
|
|
brave = true;
|
|
chromium = true;
|
|
})
|