diff options
| author | Henry J. Webster <hwebs@hwebs.info> | 2026-08-03 22:00:49 -0500 |
|---|---|---|
| committer | Henry J. Webster <hwebs@hwebs.info> | 2026-08-03 22:12:32 -0500 |
| commit | 3df910d75fa98a7d0291e6b8c6889905c6088f64 (patch) | |
| tree | 8b3234001e4d128e4390fe9966a74df5dd7c0129 /machines/kusanagi | |
| parent | 71e36370770acc7498748a890cd0365b3d351027 (diff) | |
profiles: extract shared sandbox profile for enzo + kusanagi
Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir,
scoped sudo de-escalation, and the local-clones workflow docs) out of
machines/enzo into a shared profiles/sandbox.nix that both machines import.
The only per-machine value is the human owner allowed to drop into the
sandbox, exposed as a `sandbox.owner` string option so the profile stays
username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox
it didn't have before; enzo's inline block collapses to one setting.
Assisted-by: claude-code:claude-opus-4-8
Diffstat (limited to 'machines/kusanagi')
| -rw-r--r-- | machines/kusanagi/default.nix | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix index a22843d..bb719d1 100644 --- a/machines/kusanagi/default.nix +++ b/machines/kusanagi/default.nix @@ -9,9 +9,14 @@ ./desktop.nix ../../profiles/dev.nix ../../profiles/apps.nix + ../../profiles/sandbox.nix ./hardware-configuration.nix ]; + # Run coding agents under the isolated `yokai` sandbox user; henz owns the + # canonical repos in ~. See profiles/sandbox.nix for the full workflow. + sandbox.owner = "henz"; + networking.hostName = "kusanagi"; # This value determines the NixOS release from which the default |