waypak/flake.nix at main · samiser/waypak · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
{
  description = "flatpak-style app sandboxing for NixOS, enforced by your Wayland compositor";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs =
    { self, nixpkgs }:
    let
      systems = [
        "x86_64-linux"
        "aarch64-linux"
      ];
      forAllSystems = f: nixpkgs.lib.genAttrs systems (s: f nixpkgs.legacyPackages.${s});
      waySecure = pkgs: pkgs.way-secure or (pkgs.callPackage ./pkgs/way-secure.nix { });
    in
    {
      policies = import ./profiles;

      lib = {
        wrap = import ./lib/wrap.nix;
        fromFlatpakManifest = import ./lib/flatpak-manifest.nix { inherit (nixpkgs) lib; };
      }
      // import ./lib/compositor-rules.nix { inherit (nixpkgs) lib; };

      nixosModules.default = import ./modules { policies = self.policies; };

      overlays.default = final: _: { way-secure = waySecure final; };

      packages = forAllSystems (pkgs: rec {
        way-secure = waySecure pkgs;
        default = way-secure;
      });

      checks = forAllSystems (
        pkgs:
        let
          hello = self.lib.wrap {
            inherit pkgs;
            name = "hello";
            package = pkgs.hello;
            commands.greet.cmd = "hello -g hi";
          };
        in
        {
          wrap-hello = pkgs.runCommand "waypak-wrap-hello" { } ''
            grep -q 'exec ${hello.passthru.waypak.launcher}/bin/waypak-hello ' ${hello}/bin/hello
            grep -q 'exec ${hello.passthru.waypak.launcher}/bin/waypak-hello ' ${hello}/bin/hello-greet
            grep -q '^app_id=hello$' ${hello.passthru.waypak.launcher}/bin/waypak-hello
            [ ${hello.passthru.unwrapped} = ${pkgs.hello} ]
            touch $out
          '';
        }
      );
    };
}