Compare commits
3 Commits
4ff9f663eb
...
c15feac958
Author | SHA1 | Date |
---|---|---|
Oystein Kristoffer Tveit | c15feac958 | |
Oystein Kristoffer Tveit | 91ab1ad771 | |
Oystein Kristoffer Tveit | a476f877d2 |
60
module.nix
60
module.nix
|
@ -83,28 +83,52 @@ in
|
||||||
|
|
||||||
config = lib.mkMerge [
|
config = lib.mkMerge [
|
||||||
(lib.mkIf cfg.enable {
|
(lib.mkIf cfg.enable {
|
||||||
users = {
|
|
||||||
users.greg = {
|
|
||||||
isNormalUser = true;
|
|
||||||
group = "greg";
|
|
||||||
uid = 2000;
|
|
||||||
description = "loud gym bro";
|
|
||||||
};
|
|
||||||
groups.greg.gid = 2000;
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.user.services.greg-ng = {
|
systemd.user.services.greg-ng = {
|
||||||
description = "greg-ng, an mpv based media player";
|
description = "greg-ng, an mpv based media player";
|
||||||
wantedBy = [ "graphical-session.target" ];
|
wantedBy = [ "graphical-session.target" ];
|
||||||
partOf = [ "graphical-session.target" ];
|
partOf = [ "graphical-session.target" ];
|
||||||
environment = {
|
environment.RUST_LOG = lib.mkIf cfg.enableDebug "greg_ng=trace,mpvipc=trace";
|
||||||
RUST_LOG = lib.mkIf cfg.enableDebug "greg_ng=trace,mpvipc=trace";
|
|
||||||
};
|
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
Type = "simple";
|
Type = "simple";
|
||||||
ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
|
ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
|
||||||
Restart = "always";
|
Restart = "always";
|
||||||
RestartSec = 3;
|
RestartSec = 3;
|
||||||
|
|
||||||
|
RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
|
||||||
|
AmbientCapabilities = [ "" ];
|
||||||
|
CapabilityBoundingSet = [ "" ];
|
||||||
|
DeviceAllow = [ "" ];
|
||||||
|
LockPersonality = true;
|
||||||
|
# Might work, but wouldn't bet on it with embedded lua in mpv
|
||||||
|
MemoryDenyWriteExecute = false;
|
||||||
|
NoNewPrivileges = true;
|
||||||
|
# MPV and mesa tries to talk directly to the GPU.
|
||||||
|
PrivateDevices = false;
|
||||||
|
PrivateMounts = true;
|
||||||
|
PrivateTmp = true;
|
||||||
|
PrivateUsers = true;
|
||||||
|
ProcSubset = "pid";
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
# MPV wants ~/.cache
|
||||||
|
ProtectHome = false;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectProc = "invisible";
|
||||||
|
ProtectSystem = "full";
|
||||||
|
RemoveIPC = true;
|
||||||
|
UMask = "0077";
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
RestrictSUIDSGID = true;
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = [
|
||||||
|
"@system-service"
|
||||||
|
"~@privileged"
|
||||||
|
"~@resources"
|
||||||
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
})
|
})
|
||||||
|
@ -128,6 +152,16 @@ in
|
||||||
extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
users = {
|
||||||
|
users.greg = {
|
||||||
|
isNormalUser = true;
|
||||||
|
group = "greg";
|
||||||
|
uid = 2000;
|
||||||
|
description = "loud gym bro";
|
||||||
|
};
|
||||||
|
groups.greg.gid = 2000;
|
||||||
|
};
|
||||||
|
|
||||||
services.greetd = {
|
services.greetd = {
|
||||||
enable = true;
|
enable = true;
|
||||||
settings = rec {
|
settings = rec {
|
||||||
|
|
|
@ -66,7 +66,9 @@ async fn main() -> anyhow::Result<()> {
|
||||||
})
|
})
|
||||||
.await?;
|
.await?;
|
||||||
|
|
||||||
show_grzegorz_image(mpv.clone()).await?;
|
if let Err(e) = show_grzegorz_image(mpv.clone()).await {
|
||||||
|
log::warn!("Could not show Grzegorz image: {}", e);
|
||||||
|
}
|
||||||
|
|
||||||
let addr = SocketAddr::new(resolve(&args.host).await?, args.port);
|
let addr = SocketAddr::new(resolve(&args.host).await?, args.port);
|
||||||
log::info!("Starting API on {}", addr);
|
log::info!("Starting API on {}", addr);
|
||||||
|
|
Loading…
Reference in New Issue