From bc57e4a91ef7a3a6c0001a2367b2376449fa209d Mon Sep 17 00:00:00 2001
From: cashmere <cashmere@autistici.org>
Date: Sat, 18 Jul 2026 05:59:25 +0200
Subject: focus on disposable jails

---
 appjail/Makejail.env    | 53 +++++++++++++++++++++++++++++++++++++++++++++++++
 appjail/files/doas.conf |  1 +
 2 files changed, 54 insertions(+)
 create mode 100644 appjail/Makejail.env
 create mode 100644 appjail/files/doas.conf

(limited to 'appjail')

diff --git a/appjail/Makejail.env b/appjail/Makejail.env
new file mode 100644
index 0000000..830cd04
--- /dev/null
+++ b/appjail/Makejail.env
@@ -0,0 +1,53 @@
+OPTION overwrite
+OPTION type=thick
+OPTION start
+OPTION virtualnet=:<random> default
+OPTION nat
+
+CMD mkdir -p /home
+
+CMD pw groupadd -n cashmere -g 1001 || true
+CMD pw useradd -n cashmere -u 1001 -g cashmere -G wheel -s /bin/sh -m -d /home/cashmere || true
+
+# PKG --update
+PKG emacs git git-delta git-remote-gcrypt gnupg bash pinentry-curses password-store
+PKG py312-xonsh atuin zoxide carapace direnv fastfetch
+PKG coreutils eza fd-find bat ripgrep
+PKG doas nix sops vim npm
+PKG hs-pandoc isync msmtp mu
+PKG poppler-utils ImageMagick7
+
+COPY files/doas.conf /usr/local/etc/doas.conf
+CMD chown root:wheel /usr/local/etc/doas.conf
+CMD chmod 600 /usr/local/etc/doas.conf
+
+CMD grep -qx /usr/local/bin/xonsh /etc/shells || echo /usr/local/bin/xonsh >> /etc/shells
+
+CMD pw usermod -n cashmere -s /usr/local/bin/xonsh || true
+
+CMD mv /usr/local/share/emacs/site-lisp/default.el /usr/local/share/emacs/site-lisp/default.el.disabled || true
+
+CMD mkdir -p /home/cashmere/.config/atuin /home/cashmere/.ssh /home/cashmere/.gnupg
+COPY files/dotfiles/.gitconfig /home/cashmere/.gitconfig
+COPY files/dotfiles/.env /home/cashmere/.env
+COPY files/dotfiles/.profile /home/cashmere/.profile
+COPY files/dotfiles/.xonshrc /home/cashmere/.xonshrc
+COPY files/dotfiles/atuin.toml /home/cashmere/.config/atuin/config.toml
+COPY files/dotfiles/authorized_keys /home/cashmere/.ssh/authorized_keys
+COPY files/dotfiles/gpg-agent.conf /home/cashmere/.gnupg/gpg-agent.conf
+COPY files/dotfiles/sshcontrol /home/cashmere/.gnupg/sshcontrol
+COPY files/dotfiles/identity.tar.gz.gpg /home/cashmere/identity.tar.gz.gpg
+CMD chown -R cashmere:cashmere /home/cashmere
+CMD chmod 700 /home/cashmere/.ssh /home/cashmere/.gnupg
+CMD chmod 600 /home/cashmere/.ssh/authorized_keys /home/cashmere/.gnupg/sshcontrol /home/cashmere/.gnupg/gpg-agent.conf
+
+COPY files/pinentry-emacs /usr/local/bin/pinentry-emacs
+CMD chown root:wheel /usr/local/bin/pinentry-emacs
+CMD chmod 555 /usr/local/bin/pinentry-emacs
+
+# Hook in from the host (do NOT use `su - cashmere`: a login shell wipes
+# KITTY_WINDOW_ID/KITTY_PUBLIC_KEY, so kitty-graphics.el falls back to Sixel):
+#   doas jexec -U cashmere devenv env HOME=/home/cashmere USER=cashmere LOGNAME=cashmere xonsh -l
+# (host-side helper: `jail` function in the host .xonshrc / dotfiles.org)
+
+CMD echo makejail-env-done
diff --git a/appjail/files/doas.conf b/appjail/files/doas.conf
new file mode 100644
index 0000000..3e332f7
--- /dev/null
+++ b/appjail/files/doas.conf
@@ -0,0 +1 @@
+permit nopass keepenv cashmere as root
-- 
cgit v1.3.1