Major config overhaul: use custom modules, setup for multi-host config, and less boilerplate

This commit is contained in:
Emmet K
2025-02-09 16:50:26 -06:00
parent 1fa8b17b07
commit 0453901d17
303 changed files with 3560 additions and 5566 deletions

View File

@@ -0,0 +1,30 @@
{ lib, config, pkgs, ... }:
let
cfg = config.systemSettings.security.firejail;
in {
options = {
systemSettings.security.firejail = {
enable = lib.mkEnableOption "Use firejail on some apps for extra security";
};
};
config = lib.mkIf cfg.enable {
environment.systemPackages = with pkgs; [ firejail ];
programs.firejail.enable = true;
programs.firejail.wrappedBinaries = {
#prismlauncher = {
# executable = "${pkgs.prismlauncher}/bin/prismlauncher";
# profile = ./firejail-profiles/prismlauncher.profile;
#};
#steam = {
# executable = "${pkgs.steam}/bin/steam";
# profile = "${pkgs.firejail}/etc/firejail/steam.profile";
#};
#steam-run = {
# executable = "${pkgs.steam}/bin/steam-run";
# profile = "${pkgs.firejail}/etc/firejail/steam.profile";
#};
};
};
}

View File

@@ -0,0 +1,51 @@
# Firejail profile for prismlauncher
# Description: An Open Source Minecraft launcher that can manage multiple instances
# This file is overwritten after every install/update
# Persistent global definitions
include globals.local
ignore noexec ${HOME}
noblacklist ${HOME}/.local/share/PrismLauncher
include allow-java.inc
include disable-common.inc
include disable-devel.inc
include disable-interpreters.inc
include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc
mkdir ${HOME}/.local/share/PrismLauncher
whitelist ${HOME}/.local/share/PrismLauncher
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
caps.drop all
netfilter
nodvd
nogroups
noinput
nonewprivs
noroot
notv
nou2f
novideo
protocol unix,inet,inet6,netlink
seccomp
tracelog
disable-mnt
private-bin java,java-config,minecraft-launcher,prismlauncher
private-cache
private-dev
# If multiplayer or realms break, add 'private-etc <your-own-java-folder-from-/etc>'
# or 'ignore private-etc' to your minecraft-launcher.local.
private-tmp
dbus-system none
restrict-namespaces