diff options
| -rw-r--r-- | .gitignore | 2 | ||||
| -rw-r--r-- | WORKFLOW.org | 1 | ||||
| -rw-r--r-- | appjail/Makejail.env | 53 | ||||
| -rw-r--r-- | appjail/files/doas.conf | 1 | ||||
| -rw-r--r-- | dotfiles.org | 179 |
5 files changed, 106 insertions, 130 deletions
@@ -1,3 +1,5 @@ distfiles/ work/ *.pkg +appjail/files/dotfiles/ +appjail/files/pinentry-emacs diff --git a/WORKFLOW.org b/WORKFLOW.org index af575e4..ae2519a 100644 --- a/WORKFLOW.org +++ b/WORKFLOW.org @@ -108,6 +108,7 @@ doas poudriere ports -u -p base #+begin_src sh doas poudriere testport -j 151amd64 -p base -O custom -o devel/py-rassumfrassum +doas poudriere bulk -j 151amd64 -p base -O custom -o misc/kimi-code #+end_src =testport= builds the port in the jail and then runs the full QA cycle: stage, =check-plist=, install, deinstall, reinstall. Dependencies from the official tree are fetched as binary packages; only overlay ports compile. diff --git a/appjail/Makejail.env b/appjail/Makejail.env new file mode 100644 index 0000000..830cd04 --- /dev/null +++ b/appjail/Makejail.env @@ -0,0 +1,53 @@ +OPTION overwrite +OPTION type=thick +OPTION start +OPTION virtualnet=:<random> default +OPTION nat + +CMD mkdir -p /home + +CMD pw groupadd -n cashmere -g 1001 || true +CMD pw useradd -n cashmere -u 1001 -g cashmere -G wheel -s /bin/sh -m -d /home/cashmere || true + +# PKG --update +PKG emacs git git-delta git-remote-gcrypt gnupg bash pinentry-curses password-store +PKG py312-xonsh atuin zoxide carapace direnv fastfetch +PKG coreutils eza fd-find bat ripgrep +PKG doas nix sops vim npm +PKG hs-pandoc isync msmtp mu +PKG poppler-utils ImageMagick7 + +COPY files/doas.conf /usr/local/etc/doas.conf +CMD chown root:wheel /usr/local/etc/doas.conf +CMD chmod 600 /usr/local/etc/doas.conf + +CMD grep -qx /usr/local/bin/xonsh /etc/shells || echo /usr/local/bin/xonsh >> /etc/shells + +CMD pw usermod -n cashmere -s /usr/local/bin/xonsh || true + +CMD mv /usr/local/share/emacs/site-lisp/default.el /usr/local/share/emacs/site-lisp/default.el.disabled || true + +CMD mkdir -p /home/cashmere/.config/atuin /home/cashmere/.ssh /home/cashmere/.gnupg +COPY files/dotfiles/.gitconfig /home/cashmere/.gitconfig +COPY files/dotfiles/.env /home/cashmere/.env +COPY files/dotfiles/.profile /home/cashmere/.profile +COPY files/dotfiles/.xonshrc /home/cashmere/.xonshrc +COPY files/dotfiles/atuin.toml /home/cashmere/.config/atuin/config.toml +COPY files/dotfiles/authorized_keys /home/cashmere/.ssh/authorized_keys +COPY files/dotfiles/gpg-agent.conf /home/cashmere/.gnupg/gpg-agent.conf +COPY files/dotfiles/sshcontrol /home/cashmere/.gnupg/sshcontrol +COPY files/dotfiles/identity.tar.gz.gpg /home/cashmere/identity.tar.gz.gpg +CMD chown -R cashmere:cashmere /home/cashmere +CMD chmod 700 /home/cashmere/.ssh /home/cashmere/.gnupg +CMD chmod 600 /home/cashmere/.ssh/authorized_keys /home/cashmere/.gnupg/sshcontrol /home/cashmere/.gnupg/gpg-agent.conf + +COPY files/pinentry-emacs /usr/local/bin/pinentry-emacs +CMD chown root:wheel /usr/local/bin/pinentry-emacs +CMD chmod 555 /usr/local/bin/pinentry-emacs + +# Hook in from the host (do NOT use `su - cashmere`: a login shell wipes +# KITTY_WINDOW_ID/KITTY_PUBLIC_KEY, so kitty-graphics.el falls back to Sixel): +# doas jexec -U cashmere devenv env HOME=/home/cashmere USER=cashmere LOGNAME=cashmere xonsh -l +# (host-side helper: `jail` function in the host .xonshrc / dotfiles.org) + +CMD echo makejail-env-done diff --git a/appjail/files/doas.conf b/appjail/files/doas.conf new file mode 100644 index 0000000..3e332f7 --- /dev/null +++ b/appjail/files/doas.conf @@ -0,0 +1 @@ +permit nopass keepenv cashmere as root diff --git a/dotfiles.org b/dotfiles.org index 8c2bf67..275ade2 100644 --- a/dotfiles.org +++ b/dotfiles.org @@ -126,6 +126,18 @@ if shutil.which("atuin"): if not running: subprocess.Popen(["atuin", "daemon", "start"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True) +def _jail_connect(args): + if args: + name = args[0] + else: + print("running jails:") + jls + name = input("jail: ").strip() + if not name: + return + doas jexec -U cashmere @(name) env HOME=/home/cashmere USER=cashmere LOGNAME=cashmere xonsh -l + +aliases['jail'] = _jail_connect execx($(atuin init xonsh)) execx($(zoxide init xonsh), 'exec', __xonsh__.ctx, filename='zoxide') @@ -169,142 +181,49 @@ pinentry-program /usr/local/bin/pinentry-emacs -----BEGIN PGP MESSAGE----- -hQIMA0fZrn09GBJoARAAmta7oMHqtV+SvJj/7Q+EfG+QJkzNiVYC+hQhA+la8pLF -T97DglIRO724duxSfy7MSRiYO6yy6wUCH5ZK4Ll7EHelf2S49VWSviPFadz9Dwm6 -206z7AzeyFyGvfVDjYhJZ78CIpZltnPUs48LDNmXK3Y2CogCeFQJI85apVdK7jhd -Qb1rXbYAVaVCHtdDQU4sqNM0/zPDS+6gMNgrQDK2IVqyEVOMHMQkqtW9xAn71ebP -RgcznEjm4IkWD03MWR5u7qN3izP+8g451tUVVOcII9z+/oI6kHCwaEvFwx2uVDI8 -iTydVV252X19fVX1F7UqDLEiY1HdpCsLagc0uE/TduF4FG8ubfrmLijHi5rs/4Qs -aa4F6g8wPkVy5GY87Nm7MNSTgcC2EFIeborg1/Xu2CT0ZvQ+l4p+v52zfASwtAWR -SMwdrKM46nI4Ogy/Vx0vfinB0z+ynNLWdpzMsiKGQSuwCcwxV8+yz2MI0JUgnCUA -8FhH5gIEdIaj327QbhoPkqkszoMw7YXANHnF3wzf7iW5bk8LalBnlo92/Wx3xvi9 -O6G3GjcncP5UOmjTV1MVNUZLPNN/BNOinT/7i4PyFmHNDsrPlP0RfZI7B0x4sMuN -r9/vOf2D1mopCNUoM+wtoj/Z329YN7mR0jP2EisTy8nE3OGKtUl/jEZ58mvOtZ6F -AQwDHE1EcNNBM3MBB/9d055TRdlIn1maiUv3KhN7L21ZkkDDCJKQCDdrILe39fEQ -mPlxBdCaPC7WHr1b0Msp1EMiUtJmzg//RB7gItPhdO6V+7EaEYQI3iBQc/kvLft4 -tmIE+8HV8DUNy4mv6qc8bb2y0TsAQXJx4vwgPo9v9cdJDFFwS/UCpRiJozvK3tyK -0OiidRJ79r6vs55nV25wrxeCZHAINn1Vq4WtjJGrT+UwBRN9hvGMqoV0wjsgzMe9 -Fucqgu53HSoj6YpmKuGBOTmDqhqcHV0UySa5ZLlcHtlnYxlM8QOxF0ZwV5O9Qb18 -Sj/uXsGtaiidHRs3pSabSYwwuVwIchO83THJr17ThF4DvHPnD0odxDQSAQdADmdE -K1/IeaEsVfB4eITc0vy+X/M7aflQT1lc+jGsPlowQoGPkrWwBdOeDxV2uK3cJ2/r -sEMf/sjIQ9YtVJ4+KpESzMiouKpEVAzlJLgZpMkW0poBZpGEoDGNnLn5tLdXMe3C -4g6MaiJzkLOMi11TvQ1ht5QLPGxM+LfTsyAHAY2aV8zOjnDi1v/jZMDOkIblPRMS -FfuESFQeLl8trlIWwMOWo25TvTp1sokBfQEPHAxQrgv65hENgtHnxKGhpgfnFAsB -hnYPbP6lDh0yTebZdGsd/3BxpHbNm7sKAINJRCcYdptPV6rWMfNGu3kR -=GG9k +hQIMA0fZrn09GBJoAQ/8CNgrMmtje3ID2JbpQ3s3hwm32kQYQaApv9oVlYxs3v0B +e9p2lXV8VtihnnaSOwnZl3QRUZFPYuV6qTvhyY8XMtlpyRfBOjnAaR8JdnuGyQXf +Xsy+gaMARQlU2kR76s9wmjrVxuJIdUFPP8yVz1rxB7RvNsaLU3D0M/ZopcovbBhJ +DIQJkQ1H1QQM7OBnGmvBVrL21zaSwKuVkb6Or0CZLF8QoO25OYfRlM5w2r2y2rRj +dX0E6NhDd+n0/06ly4oo01wO3MnQiqdTs1ov+JtZf5s7S5ahhPC5BJOAlVxtll9b +RRR8n/pWueLNdbK/SAUnbPSUsKJiOFRAv5mQa+SGby28kMNIyDR9chIL+0+dFfvc +OxKgL6c21yAiMzXKmunTnYG2aqLF9UpPa0pSXHR80kr0vfX7pmz99uMAUjHSduM0 +akZajlLuoOzQI60mh6urSbPxghtVfTLJi25hgxFj1XiZ6A24GvhmcMeRkxlG0yWE +7biF+oZeWN1IFb4hWOx0fyiYZ6j3kbqPicts4Ytd3aTPP14LTbcq6pqg0UQ1BLXm +9x1oiSeCySdDM68JGvA6KwYzyh70DTDRXD8lTfxooeDdTMmw6ghaoF81spFO3Vi6 +jVAgE1ecSgCUO6K7YwFFRhJujOBGrCbl+bEl+AOnlu4itSuwohEIGuWWNscRsn6F +AQwDHE1EcNNBM3MBB/9pKBWGDZkkE9EDmmzWgDLlUYZLxZECr5PJC9vamoiYqJwb +dRBqh4G4RM60Qtz9AeEZ9CpaMnUiXtpzXpMPz574PLXZYm2IDSpANUv+Fp+ge9LL +SBB9+02sA9aIR+xTV63sLHxAxN8GSKZT4kPl1aKBRUHEsh8oi77SQBqqwUIvmwYI +IOaMA5k9EpW5aEakWqEgo9gFj9k+TA8biUl7EW2qmex8jvZjCSUr8dHQfCDwWHPh +k49zvAu9EUjOM8s+00elJ+p0rW2Ab8PmRVLQPxsGxOkK5NQp2V7heSLz1b494n1m +OBL+dHDxn2lwPnuVbigohOEyGTc+qiQQM6oLovaFhF4DvHPnD0odxDQSAQdA+vH4 +fhdVx37ZqHdp2BsN1S/QeQgr7AWS5SBUAxf3pEow3OScsbIInSkLJ9bFZ8nQJOBI +Bv3HO/doPyga8IFpGwsDKhG5InzMvG+md11F5K6j0psBklLzDd8KbYOIPYjbBvSS +Plc0i5QPFpy/FnI0/2zSJYu08WbPitbHem57Tk6a3V1xkXVavziV8kc5eygdTfxt +jBbQe5Lt9tDbPd8Fe7yNIhGJ8OFdKzzliqCCSzzga8AKzJ6AyixHsl3scpU9n8Jb +Br3gms1smZVfUdn9NwAmOOZgcgGGvPQz+kruWcOKOoBKOFSQWrqx1bqEuw== +=XEf0 -----END PGP MESSAGE----- -* fastfetch - -#+begin_src json :tangle ~/.config/fastfetch/config.jsonc -{ - "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/master/doc/json_schema.json", - "display": { - "key": { - "width": 10 - }, - "separator": "" - }, - "logo": { - "type": "auto", - "source": "~/.config/fastfetch/frieren.txt", - "color": { - "1": "#ccccff", - "2": "#c6d2ff", - "3": "#c1d7ff", - "4": "#bedcff", - "5": "#bde0fe" - }, - "padding": { - "top": 1, - "left": 1 - } - }, - "modules": [ - "break", - { - "type": "command", - "key": " USER", - "keyColor": "#ccccff", - "text": "echo $USER@$(hostnamectl hostname)" - }, - { - "type": "os", - "key": " OS", - "keyColor": "#c9cfff", - "format": "{name} {version-id}" - }, - { - "type": "command", - "key": " KER", - "keyColor": "#c6d2ff", - "text": "echo $(uname -r | cut -d- -f1) $(uname -m)" - }, - { - "type": "packages", - "key": " PKG", - "keyColor": "#c4d4ff", - "format": "{all}" - }, - { - "type": "terminal", - "key": " TERM", - "keyColor": "#c1d7ff", - "format": "{pretty-name}" - }, - { - "type": "shell", - "key": " SH", - "keyColor": "#c0d9ff", - "format": "{pretty-name}" - }, - { - "type": "uptime", - "keyColor": "#bedcff", - "key": " UP" - }, - { - "type": "memory", - "key": " RAM", - "keyColor": "#bddeff", - "format": "{used} / {total} ({percentage})" - }, - { - "type": "disk", - "folders": "/", - "key": " SSD", - "keyColor": "#bde0fe", - "format": "{size-used} / {size-total} ({size-percentage})" - }, - { - "type": "custom", - "format": "\u001b[90m \u001b[91m \u001b[92m \u001b[93m \u001b[94m \u001b[95m \u001b[96m \u001b[97m" - }, - "break" - ] -} -#+end_src - -#+begin_src text :tangle ~/.config/fastfetch/frieren.txt -$1⣿⣿⣿⣿⣿⣿⣿⣿⣿⣻⣿⣿⣿⡿⢿⡿⠿⠿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⡿⣿⣿ -$1⣿⣿⣿⣿⠿⠿⢿⣿⣿⠟⣋⣭⣶⣶⣞⣿⣶⣶⣶⣬⣉⠻⣿⣿⡿⣋⣉⠻⣿⣿⣿ -$2⣿⢻⣿⠃⣤⣤⣢⣍⣴⣿⢋⣵⣿⣿⣿⣿⣷⣶⣝⣿⣿⣧⣄⢉⣜⣥⣜⢷⢹⢇⢛ -$2⡏⡦⡁⡸⢛⡴⢣⣾⢟⣿⣿⣿⢟⣾⣧⣙⢿⣿⣿⣿⣿⣿⣿⣿⢩⢳⣞⢿⡏⢷⣾ -$3⣷⣵⡇⣗⡾⢁⣾⣟⣾⣿⡿⣻⣾⣿⣿⣿⡎⠛⡛⢿⣿⡟⣿⣿⡜⡜⢿⡌⠇⢾⣿ -$3⣿⣿⠁⣾⠏⣾⣿⣿⣽⣑⣺⣥⣿⣿⣿⣿⣷⣶⣦⣖⢝⢿⣿⣿⣿⡀⠹⣿⣼⢸⣿ -$4⣿⣿⢰⡏⢡⣿⣿⠐⣵⠿⠛⠛⣿⣿⣿⣿⣿⠍⠚⢙⠻⢦⣼⣿⣿⠁⣄⣿⣿⠘⣿ -$4⣿⣿⢸⢹⢈⣿⣿⠘⣡⡞⠉⡀⢻⣿⣿⣿⣿⢃⠠⢈⢳⣌⣩⣿⣿⠰⠿⢼⣿⠀⣿ -$5⣿⠿⣘⠯⠌⡟⣿⡟⣾⣇⢾⡵⣹⣟⣿⣿⣿⣮⣓⣫⣿⣟⢿⣿⢿⡾⡹⢆⣦⣤⢹ -$5⣅⣛⠶⠽⣧⣋⠳⡓⢿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣫⣸⠏⡋⠷⣛⣫⡍⣶⣿ -#+end_src - * Tasks ** Services -*** TODO [#C] Unlock disk encryption over SSH +*** CANCELLED [#C] Unlock disk encryption over SSH +CLOSED: [2026-07-17 Fri 21:57] +:LOGBOOK: +- State "CANCELLED" from "DONE" [2026-07-17 Fri 21:57] \\ + not needed +- State "DONE" from "TODO" [2026-07-17 Fri 21:57] +:END: -*** TODO Navidrome +*** CANCELLED Navidrome +CLOSED: [2026-07-17 Fri 21:57] +:LOGBOOK: +- State "CANCELLED" from "TODO" [2026-07-17 Fri 21:57] \\ + someday maybe +:END: *** DONE yggdrasil CLOSED: [2026-07-12 Sun 17:08] @@ -324,7 +243,7 @@ CLOSED: [2026-07-12 Sun 17:07] Source of truth for =/usr/local/etc/poudriere.conf=. Tangles through tramp's doas method and asks for the login password. See the "Setup" section of WORKFLOW.org for how this file is used. -#+begin_src conf :tangle /doas::/usr/local/etc/poudriere.conf +#+begin_src conf # /usr/local/etc/poudriere.conf PACKAGE_FETCH_BRANCH=quarterly |