Nix packaging: package, hardened module, VM test, completions (#40) #99

Merged

lost-rob0t merged 1 commit from agent/issue-40-nix-packaging into main

2026-08-30 11:26:05 +00:00

lost-rob0t commented

2026-08-30 11:22:11 +00:00

(Migrated from github.com)

Implements #40.

nix flake check passes (package + NixOS VM test under KVM)
package with bash/zsh/fish completions, overlay, dev shell extension
hardened systemd user unit: ProtectHome=read-only, IPAddressDeny=any (loopback opt-in), empty capabilities, syscall filter, UMask 0077
starts in off by default; uninstall preserves data; destroy is an explicit manual oneshot
docs/nix.md documents optional dependencies (OCR, Ollama, ActivityWatch, GPG, portals) and qtile widget integration

Issue stays OPEN pending the daemon process mode (long-running IPC server), the documented blocker for the full VM start/control/capture/stop/query scenario.

Implements #40. - `nix flake check` passes (package + NixOS VM test under KVM) - package with bash/zsh/fish completions, overlay, dev shell extension - hardened systemd user unit: ProtectHome=read-only, IPAddressDeny=any (loopback opt-in), empty capabilities, syscall filter, UMask 0077 - starts in `off` by default; uninstall preserves data; destroy is an explicit manual oneshot - docs/nix.md documents optional dependencies (OCR, Ollama, ActivityWatch, GPG, portals) and qtile widget integration Issue stays OPEN pending the daemon process mode (long-running IPC server), the documented blocker for the full VM start/control/capture/stop/query scenario.