focus on disposable jails

5 files changed, 106 insertions, 130 deletions

diff --git a/.gitignore b/.gitignore
index 4eff273..d4d9f2d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
 distfiles/
 work/
 *.pkg
+appjail/files/dotfiles/
+appjail/files/pinentry-emacs
diff --git a/WORKFLOW.org b/WORKFLOW.org
index af575e4..ae2519a 100644
--- a/WORKFLOW.org
+++ b/WORKFLOW.org
@@ -108,6 +108,7 @@ doas poudriere ports -u -p base
 
 #+begin_src sh
 doas poudriere testport -j 151amd64 -p base -O custom -o devel/py-rassumfrassum
+doas poudriere bulk -j 151amd64 -p base -O custom -o misc/kimi-code
 #+end_src
 
 =testport= builds the port in the jail and then runs the full QA cycle: stage, =check-plist=, install, deinstall, reinstall. Dependencies from the official tree are fetched as binary packages; only overlay ports compile.
diff --git a/appjail/Makejail.env b/appjail/Makejail.env
new file mode 100644
index 0000000..830cd04
--- /dev/null
+++ b/appjail/Makejail.env
@@ -0,0 +1,53 @@
+OPTION overwrite
+OPTION type=thick
+OPTION start
+OPTION virtualnet=:<random> default
+OPTION nat
+
+CMD mkdir -p /home
+
+CMD pw groupadd -n cashmere -g 1001 || true
+CMD pw useradd -n cashmere -u 1001 -g cashmere -G wheel -s /bin/sh -m -d /home/cashmere || true
+
+# PKG --update
+PKG emacs git git-delta git-remote-gcrypt gnupg bash pinentry-curses password-store
+PKG py312-xonsh atuin zoxide carapace direnv fastfetch
+PKG coreutils eza fd-find bat ripgrep
+PKG doas nix sops vim npm
+PKG hs-pandoc isync msmtp mu
+PKG poppler-utils ImageMagick7
+
+COPY files/doas.conf /usr/local/etc/doas.conf
+CMD chown root:wheel /usr/local/etc/doas.conf
+CMD chmod 600 /usr/local/etc/doas.conf
+
+CMD grep -qx /usr/local/bin/xonsh /etc/shells || echo /usr/local/bin/xonsh >> /etc/shells
+
+CMD pw usermod -n cashmere -s /usr/local/bin/xonsh || true
+
+CMD mv /usr/local/share/emacs/site-lisp/default.el /usr/local/share/emacs/site-lisp/default.el.disabled || true
+
+CMD mkdir -p /home/cashmere/.config/atuin /home/cashmere/.ssh /home/cashmere/.gnupg
+COPY files/dotfiles/.gitconfig /home/cashmere/.gitconfig
+COPY files/dotfiles/.env /home/cashmere/.env
+COPY files/dotfiles/.profile /home/cashmere/.profile
+COPY files/dotfiles/.xonshrc /home/cashmere/.xonshrc
+COPY files/dotfiles/atuin.toml /home/cashmere/.config/atuin/config.toml
+COPY files/dotfiles/authorized_keys /home/cashmere/.ssh/authorized_keys
+COPY files/dotfiles/gpg-agent.conf /home/cashmere/.gnupg/gpg-agent.conf
+COPY files/dotfiles/sshcontrol /home/cashmere/.gnupg/sshcontrol
+COPY files/dotfiles/identity.tar.gz.gpg /home/cashmere/identity.tar.gz.gpg
+CMD chown -R cashmere:cashmere /home/cashmere
+CMD chmod 700 /home/cashmere/.ssh /home/cashmere/.gnupg
+CMD chmod 600 /home/cashmere/.ssh/authorized_keys /home/cashmere/.gnupg/sshcontrol /home/cashmere/.gnupg/gpg-agent.conf
+
+COPY files/pinentry-emacs /usr/local/bin/pinentry-emacs
+CMD chown root:wheel /usr/local/bin/pinentry-emacs
+CMD chmod 555 /usr/local/bin/pinentry-emacs
+
+# Hook in from the host (do NOT use `su - cashmere`: a login shell wipes
+# KITTY_WINDOW_ID/KITTY_PUBLIC_KEY, so kitty-graphics.el falls back to Sixel):
+#   doas jexec -U cashmere devenv env HOME=/home/cashmere USER=cashmere LOGNAME=cashmere xonsh -l
+# (host-side helper: `jail` function in the host .xonshrc / dotfiles.org)
+
+CMD echo makejail-env-done
diff --git a/appjail/files/doas.conf b/appjail/files/doas.conf
new file mode 100644
index 0000000..3e332f7
--- /dev/null
+++ b/appjail/files/doas.conf
@@ -0,0 +1 @@
+permit nopass keepenv cashmere as root
diff --git a/dotfiles.org b/dotfiles.org
index 8c2bf67..275ade2 100644
--- a/dotfiles.org
+++ b/dotfiles.org
@@ -126,6 +126,18 @@ if shutil.which("atuin"):
     if not running:
         subprocess.Popen(["atuin", "daemon", "start"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True)
 
+def _jail_connect(args):                                                                                                          
+    if args:                                                                                                                      
+        name = args[0]                                                                                                            
+    else:                                                                                                                         
+        print("running jails:")                                                                                                  
+        jls                                                                                                                       
+        name = input("jail: ").strip()                                                                                            
+    if not name:                                                                                                                  
+        return                                                                                                                    
+    doas jexec -U cashmere @(name) env HOME=/home/cashmere USER=cashmere LOGNAME=cashmere xonsh -l                                
+
+aliases['jail'] = _jail_connect        
 
 execx($(atuin init xonsh))
 execx($(zoxide init xonsh), 'exec', __xonsh__.ctx, filename='zoxide')
@@ -169,142 +181,49 @@ pinentry-program /usr/local/bin/pinentry-emacs
 
 -----BEGIN PGP MESSAGE-----
 
-hQIMA0fZrn09GBJoARAAmta7oMHqtV+SvJj/7Q+EfG+QJkzNiVYC+hQhA+la8pLF
-T97DglIRO724duxSfy7MSRiYO6yy6wUCH5ZK4Ll7EHelf2S49VWSviPFadz9Dwm6
-206z7AzeyFyGvfVDjYhJZ78CIpZltnPUs48LDNmXK3Y2CogCeFQJI85apVdK7jhd
-Qb1rXbYAVaVCHtdDQU4sqNM0/zPDS+6gMNgrQDK2IVqyEVOMHMQkqtW9xAn71ebP
-RgcznEjm4IkWD03MWR5u7qN3izP+8g451tUVVOcII9z+/oI6kHCwaEvFwx2uVDI8
-iTydVV252X19fVX1F7UqDLEiY1HdpCsLagc0uE/TduF4FG8ubfrmLijHi5rs/4Qs
-aa4F6g8wPkVy5GY87Nm7MNSTgcC2EFIeborg1/Xu2CT0ZvQ+l4p+v52zfASwtAWR
-SMwdrKM46nI4Ogy/Vx0vfinB0z+ynNLWdpzMsiKGQSuwCcwxV8+yz2MI0JUgnCUA
-8FhH5gIEdIaj327QbhoPkqkszoMw7YXANHnF3wzf7iW5bk8LalBnlo92/Wx3xvi9
-O6G3GjcncP5UOmjTV1MVNUZLPNN/BNOinT/7i4PyFmHNDsrPlP0RfZI7B0x4sMuN
-r9/vOf2D1mopCNUoM+wtoj/Z329YN7mR0jP2EisTy8nE3OGKtUl/jEZ58mvOtZ6F
-AQwDHE1EcNNBM3MBB/9d055TRdlIn1maiUv3KhN7L21ZkkDDCJKQCDdrILe39fEQ
-mPlxBdCaPC7WHr1b0Msp1EMiUtJmzg//RB7gItPhdO6V+7EaEYQI3iBQc/kvLft4
-tmIE+8HV8DUNy4mv6qc8bb2y0TsAQXJx4vwgPo9v9cdJDFFwS/UCpRiJozvK3tyK
-0OiidRJ79r6vs55nV25wrxeCZHAINn1Vq4WtjJGrT+UwBRN9hvGMqoV0wjsgzMe9
-Fucqgu53HSoj6YpmKuGBOTmDqhqcHV0UySa5ZLlcHtlnYxlM8QOxF0ZwV5O9Qb18
-Sj/uXsGtaiidHRs3pSabSYwwuVwIchO83THJr17ThF4DvHPnD0odxDQSAQdADmdE
-K1/IeaEsVfB4eITc0vy+X/M7aflQT1lc+jGsPlowQoGPkrWwBdOeDxV2uK3cJ2/r
-sEMf/sjIQ9YtVJ4+KpESzMiouKpEVAzlJLgZpMkW0poBZpGEoDGNnLn5tLdXMe3C
-4g6MaiJzkLOMi11TvQ1ht5QLPGxM+LfTsyAHAY2aV8zOjnDi1v/jZMDOkIblPRMS
-FfuESFQeLl8trlIWwMOWo25TvTp1sokBfQEPHAxQrgv65hENgtHnxKGhpgfnFAsB
-hnYPbP6lDh0yTebZdGsd/3BxpHbNm7sKAINJRCcYdptPV6rWMfNGu3kR
-=GG9k
+hQIMA0fZrn09GBJoAQ/8CNgrMmtje3ID2JbpQ3s3hwm32kQYQaApv9oVlYxs3v0B
+e9p2lXV8VtihnnaSOwnZl3QRUZFPYuV6qTvhyY8XMtlpyRfBOjnAaR8JdnuGyQXf
+Xsy+gaMARQlU2kR76s9wmjrVxuJIdUFPP8yVz1rxB7RvNsaLU3D0M/ZopcovbBhJ
+DIQJkQ1H1QQM7OBnGmvBVrL21zaSwKuVkb6Or0CZLF8QoO25OYfRlM5w2r2y2rRj
+dX0E6NhDd+n0/06ly4oo01wO3MnQiqdTs1ov+JtZf5s7S5ahhPC5BJOAlVxtll9b
+RRR8n/pWueLNdbK/SAUnbPSUsKJiOFRAv5mQa+SGby28kMNIyDR9chIL+0+dFfvc
+OxKgL6c21yAiMzXKmunTnYG2aqLF9UpPa0pSXHR80kr0vfX7pmz99uMAUjHSduM0
+akZajlLuoOzQI60mh6urSbPxghtVfTLJi25hgxFj1XiZ6A24GvhmcMeRkxlG0yWE
+7biF+oZeWN1IFb4hWOx0fyiYZ6j3kbqPicts4Ytd3aTPP14LTbcq6pqg0UQ1BLXm
+9x1oiSeCySdDM68JGvA6KwYzyh70DTDRXD8lTfxooeDdTMmw6ghaoF81spFO3Vi6
+jVAgE1ecSgCUO6K7YwFFRhJujOBGrCbl+bEl+AOnlu4itSuwohEIGuWWNscRsn6F
+AQwDHE1EcNNBM3MBB/9pKBWGDZkkE9EDmmzWgDLlUYZLxZECr5PJC9vamoiYqJwb
+dRBqh4G4RM60Qtz9AeEZ9CpaMnUiXtpzXpMPz574PLXZYm2IDSpANUv+Fp+ge9LL
+SBB9+02sA9aIR+xTV63sLHxAxN8GSKZT4kPl1aKBRUHEsh8oi77SQBqqwUIvmwYI
+IOaMA5k9EpW5aEakWqEgo9gFj9k+TA8biUl7EW2qmex8jvZjCSUr8dHQfCDwWHPh
+k49zvAu9EUjOM8s+00elJ+p0rW2Ab8PmRVLQPxsGxOkK5NQp2V7heSLz1b494n1m
+OBL+dHDxn2lwPnuVbigohOEyGTc+qiQQM6oLovaFhF4DvHPnD0odxDQSAQdA+vH4
+fhdVx37ZqHdp2BsN1S/QeQgr7AWS5SBUAxf3pEow3OScsbIInSkLJ9bFZ8nQJOBI
+Bv3HO/doPyga8IFpGwsDKhG5InzMvG+md11F5K6j0psBklLzDd8KbYOIPYjbBvSS
+Plc0i5QPFpy/FnI0/2zSJYu08WbPitbHem57Tk6a3V1xkXVavziV8kc5eygdTfxt
+jBbQe5Lt9tDbPd8Fe7yNIhGJ8OFdKzzliqCCSzzga8AKzJ6AyixHsl3scpU9n8Jb
+Br3gms1smZVfUdn9NwAmOOZgcgGGvPQz+kruWcOKOoBKOFSQWrqx1bqEuw==
+=XEf0
 -----END PGP MESSAGE-----
 
-* fastfetch
-
-#+begin_src json :tangle ~/.config/fastfetch/config.jsonc
-{
-  "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/master/doc/json_schema.json",
-  "display": {
-    "key": {
-      "width": 10
-    },
-    "separator": ""
-  },
-  "logo": {
-    "type": "auto",
-    "source": "~/.config/fastfetch/frieren.txt",
-    "color": {
-      "1": "#ccccff",
-      "2": "#c6d2ff",
-      "3": "#c1d7ff",
-      "4": "#bedcff",
-      "5": "#bde0fe"
-    },
-    "padding": {
-      "top": 1,
-      "left": 1
-    }
-  },
-  "modules": [
-    "break",
-    {
-      "type": "command",
-      "key": "󰀄 USER",
-      "keyColor": "#ccccff",
-      "text": "echo $USER@$(hostnamectl hostname)"
-    },
-    {
-      "type": "os",
-      "key": "󰣇 OS",
-      "keyColor": "#c9cfff",
-      "format": "{name} {version-id}"
-    },
-    {
-      "type": "command",
-      "key": "󰌽 KER",
-      "keyColor": "#c6d2ff",
-      "text": "echo $(uname -r | cut -d- -f1) $(uname -m)"
-    },
-    {
-      "type": "packages",
-      "key": "󰏗 PKG",
-      "keyColor": "#c4d4ff",
-      "format": "{all}"
-    },
-    {
-      "type": "terminal",
-      "key": "󰆍 TERM",
-      "keyColor": "#c1d7ff",
-      "format": "{pretty-name}"
-    },
-    {
-      "type": "shell",
-      "key": "󰞷 SH",
-      "keyColor": "#c0d9ff",
-      "format": "{pretty-name}"
-    },
-    {
-      "type": "uptime",
-      "keyColor": "#bedcff",
-      "key": "󰥔 UP"
-    },
-    {
-      "type": "memory",
-      "key": "󰍛 RAM",
-      "keyColor": "#bddeff",
-      "format": "{used} / {total} ({percentage})"
-    },
-    {
-      "type": "disk",
-      "folders": "/",
-      "key": "󰋊 SSD",
-      "keyColor": "#bde0fe",
-      "format": "{size-used} / {size-total} ({size-percentage})"
-    },
-    {
-      "type": "custom",
-      "format": "\u001b[90m \u001b[91m \u001b[92m \u001b[93m \u001b[94m \u001b[95m \u001b[96m \u001b[97m"
-    },
-    "break"
-  ]
-}
-#+end_src
-
-#+begin_src text :tangle ~/.config/fastfetch/frieren.txt
-$1⣿⣿⣿⣿⣿⣿⣿⣿⣿⣻⣿⣿⣿⡿⢿⡿⠿⠿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⡿⣿⣿
-$1⣿⣿⣿⣿⠿⠿⢿⣿⣿⠟⣋⣭⣶⣶⣞⣿⣶⣶⣶⣬⣉⠻⣿⣿⡿⣋⣉⠻⣿⣿⣿
-$2⣿⢻⣿⠃⣤⣤⣢⣍⣴⣿⢋⣵⣿⣿⣿⣿⣷⣶⣝⣿⣿⣧⣄⢉⣜⣥⣜⢷⢹⢇⢛
-$2⡏⡦⡁⡸⢛⡴⢣⣾⢟⣿⣿⣿⢟⣾⣧⣙⢿⣿⣿⣿⣿⣿⣿⣿⢩⢳⣞⢿⡏⢷⣾
-$3⣷⣵⡇⣗⡾⢁⣾⣟⣾⣿⡿⣻⣾⣿⣿⣿⡎⠛⡛⢿⣿⡟⣿⣿⡜⡜⢿⡌⠇⢾⣿
-$3⣿⣿⠁⣾⠏⣾⣿⣿⣽⣑⣺⣥⣿⣿⣿⣿⣷⣶⣦⣖⢝⢿⣿⣿⣿⡀⠹⣿⣼⢸⣿
-$4⣿⣿⢰⡏⢡⣿⣿⠐⣵⠿⠛⠛⣿⣿⣿⣿⣿⠍⠚⢙⠻⢦⣼⣿⣿⠁⣄⣿⣿⠘⣿
-$4⣿⣿⢸⢹⢈⣿⣿⠘⣡⡞⠉⡀⢻⣿⣿⣿⣿⢃⠠⢈⢳⣌⣩⣿⣿⠰⠿⢼⣿⠀⣿
-$5⣿⠿⣘⠯⠌⡟⣿⡟⣾⣇⢾⡵⣹⣟⣿⣿⣿⣮⣓⣫⣿⣟⢿⣿⢿⡾⡹⢆⣦⣤⢹
-$5⣅⣛⠶⠽⣧⣋⠳⡓⢿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣫⣸⠏⡋⠷⣛⣫⡍⣶⣿
-#+end_src
-
 * Tasks
 
 ** Services
 
-*** TODO [#C] Unlock disk encryption over SSH
+*** CANCELLED [#C] Unlock disk encryption over SSH
+CLOSED: [2026-07-17 Fri 21:57]
+:LOGBOOK:
+- State "CANCELLED"  from "DONE"       [2026-07-17 Fri 21:57] \\
+  not needed
+- State "DONE"       from "TODO"       [2026-07-17 Fri 21:57]
+:END:
 
-*** TODO Navidrome
+*** CANCELLED Navidrome
+CLOSED: [2026-07-17 Fri 21:57]
+:LOGBOOK:
+- State "CANCELLED"  from "TODO"       [2026-07-17 Fri 21:57] \\
+  someday maybe
+:END:
 
 *** DONE yggdrasil
 CLOSED: [2026-07-12 Sun 17:08]
@@ -324,7 +243,7 @@ CLOSED: [2026-07-12 Sun 17:07]
 
 Source of truth for =/usr/local/etc/poudriere.conf=. Tangles through tramp's doas method and asks for the login password. See the "Setup" section of WORKFLOW.org for how this file is used.
 
-#+begin_src conf :tangle /doas::/usr/local/etc/poudriere.conf
+#+begin_src conf 
 # /usr/local/etc/poudriere.conf
 
 PACKAGE_FETCH_BRANCH=quarterly