blob: e0f7ff5e0168dc8d910d4e312cd9132e6990d5bc (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
(use-modules (gnu)
(gnu system nss)
(guix utils)
(guix packages)
(guix gexp)
(nongnu packages linux)
(gnu packages)
(gnu packages window-management)
(gnu packages xorg)
(gnu packages vim)
(gnu system privilege)
((gnu packages admin) #:select (sudo opendoas))
(throne deps))
(use-service-modules desktop
sddm
ssh
xorg)
(operating-system
(kernel linux)
(firmware (list linux-firmware))
(host-name "guixygnu")
(timezone "Asia/Tehran")
(locale "en_US.utf8")
(keyboard-layout
(keyboard-layout "us" "altgr-intl"))
(bootloader
(bootloader-configuration
(bootloader grub-efi-bootloader)
(targets '("/boot/efi"))
(keyboard-layout keyboard-layout)))
(file-systems
(append
(list
(file-system
(device
(uuid "53edb5f0-2a5c-4159-9666-52e486b95a49" 'ext4))
(mount-point "/")
(type "ext4"))
(file-system
(device
(uuid "4141-8933" 'fat))
(mount-point "/boot/efi")
(type "vfat")))
%base-file-systems))
(swap-devices
(list
(swap-space
(target
(uuid "7ab8ddc5-940e-4180-a825-88becd9b6788")))))
(users
(cons
(user-account
(name "coast")
(password
(crypt
"coast"
"$6$qPWpreldLzlkO54O$l9DciT6EPOv47H3FPDo2f5zoDag9tFHoNWRWi0SKRSeZmMc3PoyW5Ery7INGPiYDvbHQb97jev/H37JV2F.tU1"))
(group "users")
(supplementary-groups
'("wheel" "netdev" "audio" "video")))
%base-user-accounts))
(packages
(append
(list
throne
niri
xwayland-satellite
vim
opendoas)
(filter
(lambda (p)
(not (eq? p sudo)))
%base-packages)))
(privileged-programs
(cons
(privileged-program
(program
(file-append opendoas "/bin/doas"))
(setuid? #t))
(cons
(privileged-program
(program
(file-append throne "/libexec/Throne"))
(setuid? #f)
(setgid? #f)
(capabilities
"cap_net_bind_service+ep"))
(cons
(privileged-program
(program
(file-append throne "/libexec/ThroneCore"))
(setuid? #f)
(setgid? #f)
(capabilities
"cap_net_admin,cap_net_raw,cap_net_bind_service,cap_sys_ptrace,cap_dac_read_search+ep"))
(filter
(lambda (pp)
(not
(string-contains
(with-output-to-string
(lambda ()
(write
(privileged-program-program pp))))
"sudo")))
%default-privileged-programs)))))
(services
(cons*
(service plasma-desktop-service-type)
(service
sddm-service-type
(sddm-configuration
(theme "breeze")))
(service openssh-service-type)
(modify-services %desktop-services
(delete gdm-service-type))))
(name-service-switch %mdns-host-lookup-nss))
|
