Compare commits

...

3 Commits

2 changed files with 50 additions and 14 deletions

View File

@ -83,28 +83,52 @@ in
config = lib.mkMerge [ config = lib.mkMerge [
(lib.mkIf cfg.enable { (lib.mkIf cfg.enable {
users = {
users.greg = {
isNormalUser = true;
group = "greg";
uid = 2000;
description = "loud gym bro";
};
groups.greg.gid = 2000;
};
systemd.user.services.greg-ng = { systemd.user.services.greg-ng = {
description = "greg-ng, an mpv based media player"; description = "greg-ng, an mpv based media player";
wantedBy = [ "graphical-session.target" ]; wantedBy = [ "graphical-session.target" ];
partOf = [ "graphical-session.target" ]; partOf = [ "graphical-session.target" ];
environment = { environment.RUST_LOG = lib.mkIf cfg.enableDebug "greg_ng=trace,mpvipc=trace";
RUST_LOG = lib.mkIf cfg.enableDebug "greg_ng=trace,mpvipc=trace";
};
serviceConfig = { serviceConfig = {
Type = "simple"; Type = "simple";
ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}"; ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
Restart = "always"; Restart = "always";
RestartSec = 3; RestartSec = 3;
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
AmbientCapabilities = [ "" ];
CapabilityBoundingSet = [ "" ];
DeviceAllow = [ "" ];
LockPersonality = true;
# Might work, but wouldn't bet on it with embedded lua in mpv
MemoryDenyWriteExecute = false;
NoNewPrivileges = true;
# MPV and mesa tries to talk directly to the GPU.
PrivateDevices = false;
PrivateMounts = true;
PrivateTmp = true;
PrivateUsers = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
# MPV wants ~/.cache
ProtectHome = false;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "full";
RemoveIPC = true;
UMask = "0077";
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
];
}; };
}; };
}) })
@ -128,6 +152,16 @@ in
extraPortals = [ pkgs.xdg-desktop-portal-gtk ]; extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
}; };
users = {
users.greg = {
isNormalUser = true;
group = "greg";
uid = 2000;
description = "loud gym bro";
};
groups.greg.gid = 2000;
};
services.greetd = { services.greetd = {
enable = true; enable = true;
settings = rec { settings = rec {

View File

@ -66,7 +66,9 @@ async fn main() -> anyhow::Result<()> {
}) })
.await?; .await?;
show_grzegorz_image(mpv.clone()).await?; if let Err(e) = show_grzegorz_image(mpv.clone()).await {
log::warn!("Could not show Grzegorz image: {}", e);
}
let addr = SocketAddr::new(resolve(&args.host).await?, args.port); let addr = SocketAddr::new(resolve(&args.host).await?, args.port);
log::info!("Starting API on {}", addr); log::info!("Starting API on {}", addr);