92 lines
2.1 KiB
Nix
92 lines
2.1 KiB
Nix
{ config, pkgs, lib, inputs ? null, ... }:
|
|
|
|
let
|
|
walkerPkg =
|
|
if inputs != null && inputs ? walker
|
|
then inputs.walker.packages.${pkgs.system}.default
|
|
else pkgs.walker;
|
|
|
|
elephantPkg =
|
|
if inputs != null && inputs ? elephant
|
|
then inputs.elephant.packages.${pkgs.system}.default
|
|
else pkgs.elephant;
|
|
|
|
sessionTarget = "graphical-session.target";
|
|
in
|
|
{
|
|
xdg.enable = true;
|
|
|
|
home.packages = [
|
|
walkerPkg
|
|
elephantPkg
|
|
];
|
|
|
|
systemd.user.services.elephant = {
|
|
Unit = {
|
|
Description = "Elephant backend for Walker";
|
|
PartOf = [ sessionTarget ];
|
|
After = [ sessionTarget ];
|
|
};
|
|
|
|
Service = {
|
|
Type = "simple";
|
|
ExecStart = "${elephantPkg}/bin/elephant";
|
|
|
|
Restart = "on-failure";
|
|
RestartSec = 1;
|
|
|
|
# Ensure Elephant can create its socket under:
|
|
# /run/user/$UID/elephant/...
|
|
RuntimeDirectory = "elephant";
|
|
RuntimeDirectoryMode = "0700";
|
|
|
|
# Light hardening (DO NOT use ProtectSystem=strict here)
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectControlGroups = true;
|
|
LockPersonality = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
};
|
|
|
|
Install = {
|
|
WantedBy = [ sessionTarget ];
|
|
};
|
|
};
|
|
|
|
systemd.user.services.walker = {
|
|
Unit = {
|
|
Description = "Walker GApplication service";
|
|
PartOf = [ sessionTarget ];
|
|
After = [ sessionTarget "elephant.service" ];
|
|
Wants = [ "elephant.service" ];
|
|
};
|
|
|
|
Service = {
|
|
Type = "simple";
|
|
ExecStart = "${walkerPkg}/bin/walker --gapplication-service";
|
|
|
|
Restart = "on-failure";
|
|
RestartSec = 1;
|
|
|
|
# Light hardening
|
|
NoNewPrivileges = true;
|
|
PrivateTmp = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelModules = true;
|
|
ProtectControlGroups = true;
|
|
LockPersonality = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
};
|
|
|
|
Install = {
|
|
WantedBy = [ sessionTarget ];
|
|
};
|
|
};
|
|
}
|