init

2026-01-14 21:24:19 +01:00 · 2026-01-14 21:24:19 +01:00 · 2be8de47fa
commit 2be8de47fa
87 changed files with 11501 additions and 0 deletions
--- a/modules/system/lutris-sandboxed.nix
+++ b/modules/system/lutris-sandboxed.nix
@ -0,0 +1,139 @@
+# Lutris Sandboxed with nix-bwrapper
+# Provides a sandboxed Lutris with restricted permissions
+{
+  config,
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
+
+let
+  # Apply the bwrapper overlay to get mkBwrapper
+  bwrapperPkgs = pkgs.extend inputs.nix-bwrapper.overlays.default;
+in
+{
+  # Provide the sandboxed Lutris package
+  nixpkgs.overlays = [
+    (final: prev: {
+      lutris-sandboxed = bwrapperPkgs.mkBwrapper {
+        app = {
+          package = prev.lutris.override {
+            extraPkgs = pkgs: [
+              pkgs.curl
+              pkgs.wget
+              pkgs.gnutar
+              pkgs.gzip
+              pkgs.zstd
+              pkgs.xz
+              pkgs.p7zip
+              pkgs.which
+              pkgs.file
+              pkgs.zenity
+              pkgs.vulkan-loader
+              pkgs.vulkan-tools
+              pkgs.unzip
+              pkgs.cabextract
+              pkgs.xorg.xrandr
+              pkgs.pciutils
+              pkgs.gamemode.lib
+              pkgs.xdg-utils
+            ];
+          };
+          isFhsenv = true; # Lutris uses buildFHSEnv
+          id = "net.lutris.Lutris";
+          env = {
+            WEBKIT_DISABLE_DMABUF_RENDERER = 1;
+            APPIMAGE_EXTRACT_AND_RUN = 1;
+            PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION = "python";
+            GTK_THEME = "catppuccin-mocha-blue-standard";
+            BROWSER = "xdg-open";
+            XDG_CURRENT_DESKTOP = "niri";
+            XDG_SESSION_TYPE = "wayland";
+            DBUS_SESSION_BUS_ADDRESS = "unix:path=$XDG_RUNTIME_DIR/bus";
+            # Ensure Vulkan loader finds the drivers
+            VK_ICD_FILENAMES = "/run/opengl-driver/share/vulkan/icd.d/radeon_icd.x86_64.json:/run/opengl-driver-32/share/vulkan/icd.d/radeon_icd.i686.json";
+          };
+        };
+
+        fhsenv = {
+          skipExtraInstallCmds = false;
+        };
+
+        # Disable Flatpak emulation
+        flatpak.enable = false;
+
+        # Filesystem: Limited to Games directory
+        mounts = {
+          read = [
+            "$HOME/.config/kdedefaults"
+            "$HOME/.local/share/color-schemes"
+            "$HOME/.local/share/Steam/compatibilitytools.d"
+            # GTK Theming
+            "$HOME/.config/gtk-3.0"
+            "$HOME/.config/gtk-4.0"
+            "$HOME/.icons"
+          ];
+
+          readWrite = [
+            "$HOME/Games"
+            "$HOME/.local/share/icons"
+            "$HOME/.config/lutris"
+            "$HOME/.local/share/lutris"
+            "$HOME/.cache/lutris"
+            "$HOME/.steam"
+            "$HOME/.local/share/steam"
+            "$HOME/.local/share/umu"
+            "$HOME/.local/share/applications"
+            "$HOME/.local/share/desktop-directories"
+          ];
+        };
+
+        # Bind mount systemd-resolved socket directory to fix DNS
+        # The sandbox mounts a tmpfs on /run, so we need to validly expose this
+        fhsenv.bwrap.additionalArgs = [
+          "--dir /run/systemd/resolve"
+          "--ro-bind-try /run/systemd/resolve /run/systemd/resolve"
+          # D-Bus session proxy
+          ''--bind "$XDG_RUNTIME_DIR/app/net.lutris.Lutris/bus" "$XDG_RUNTIME_DIR/bus"''
+          # D-Bus system proxy
+          ''--bind "$XDG_RUNTIME_DIR/app/net.lutris.Lutris/bus_system" /run/dbus/system_bus_socket''
+          # Wayland socket
+          ''--bind "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY"''
+          # PipeWire + Pulse
+          ''--bind "$XDG_RUNTIME_DIR/pipewire-0" "$XDG_RUNTIME_DIR/pipewire-0"''
+          ''--bind "$XDG_RUNTIME_DIR/pulse" "$XDG_RUNTIME_DIR/pulse"''
+          # Bind system themes to /usr/share
+          "--ro-bind /run/current-system/sw/share/themes /usr/share/themes"
+          "--ro-bind /run/current-system/sw/share/icons /usr/share/icons"
+        ];
+
+        # Disable built-in DBus module (invokes bwrap without --unshare-user)
+        dbus.enable = false;
+
+        # Manually set up DBus proxy with --unshare-user
+        script.preCmds.stage2 = (import ./sandbox-utils.nix { inherit pkgs lib; }).mkDbusProxyScript {
+          appId = "net.lutris.Lutris";
+          enableSystemBus = true;
+          proxyArgs = [
+            "--filter"
+            ''--talk="org.freedesktop.Flatpak"''
+            ''--talk="org.kde.StatusNotifierWatcher"''
+            ''--talk="org.kde.KWin"''
+            ''--talk="org.gnome.Mutter.DisplayConfig"''
+            ''--talk="org.freedesktop.ScreenSaver"''
+            ''--talk="org.freedesktop.portal.*"''
+            ''--talk="org.freedesktop.secrets"''
+            ''--talk="com.feralinteractive.GameMode"''
+            ''--call="org.freedesktop.portal.*=*@/org/freedesktop/portal/desktop"''
+            ''--own="net.lutris.Lutris"''
+          ];
+          systemProxyArgs = [
+            "--filter"
+            ''--talk="org.freedesktop.UDisks2"'' # Disk detection
+          ];
+        };
+      };
+    })
+  ];
+}