diff options
Diffstat (limited to 'machines/enzo/default.nix')
| -rw-r--r-- | machines/enzo/default.nix | 107 |
1 files changed, 6 insertions, 101 deletions
diff --git a/machines/enzo/default.nix b/machines/enzo/default.nix index d14dacd..3246ca3 100644 --- a/machines/enzo/default.nix +++ b/machines/enzo/default.nix @@ -7,6 +7,7 @@ # apps.nix here, or one-off packages below, as needed. ../../profiles/desktop.nix ../../profiles/dev.nix + ../../profiles/sandbox.nix ./desktop.nix inputs.disko.nixosModules.disko @@ -25,10 +26,10 @@ users.users.hwebs = { isNormalUser = true; description = "Henry J. Webster"; + # (ikai — the sandbox group — is added by profiles/sandbox.nix.) extraGroups = [ "networkmanager" "wheel" - "ikai" ]; packages = with pkgs; [ git @@ -47,106 +48,10 @@ }; # --- Sandbox account (yokai) --- - # Model: LOCAL CLONES, not a shared working tree. yokai owns its own clone of - # each repo under /srv/git; hwebs keeps the canonical repo in ~. Work moves - # between the two over git remotes — never by sharing one tree. - # - # Why not one shared tree: git executes hooks and config out of .git, so a - # tree yokai can write must never be one hwebs runs `git` *inside* — a planted - # hook/config would run as hwebs and escape the sandbox. Git's "dubious - # ownership" warning is exactly that guard; don't defeat it with safe.directory - # on a yokai-writable repo. - # - # CARDINAL RULE: hwebs never runs git with CWD inside /srv/git/<repo>. Review - # the agent's work by FETCHING its commits into your own repo and reading them - # there. - # - # /srv/git is created below as 2770 root:ikai — group-writable + setgid, so - # hwebs and yokai (both in ikai) can each drop clones without sudo and new - # files inherit the ikai group. It sits outside ~ so /home/hwebs stays 700 - # and yokai never needs to traverse into home. (Tradeoff: yokai has write on - # the /srv/git dir itself, i.e. its own play area — fine for a sandbox.) - # - # Seed the agent's clone (hand a fresh clone to yokai): - # git clone ~/git/<repo> /srv/git/<repo> - # sudo chown -R yokai:ikai /srv/git/<repo> # yokai now owns its tree - # TODO: wrap seed (clone + chown) in a one-shot helper (shell fn / just). - # - # Pull the agent's work back into YOUR repo (stay in your trusted tree): - # git -C ~/git/<repo> remote add sandbox /srv/git/<repo> - # git -C ~/git/<repo> fetch sandbox - # git -C ~/git/<repo> log --oneline sandbox/main # review, then merge - # - # Land + SIGN on main (signatures attest that hwebs reviewed+vouches, so hwebs - # signs — never put a signing key in yokai's home, and never give yokai yours). - # Squash the agent's WIP into one commit you author + sign; satisfies "require - # signed commits" branch protection trivially and keeps history clean: - # git -C ~/git/<repo> checkout main - # git -C ~/git/<repo> merge --squash sandbox/main # stage, don't commit - # git -C ~/git/<repo> commit -S -m "...\n\nAssisted-by: claude-code:<model>" - # git -C ~/git/<repo> push origin main - # Alt — keep granular commits instead of squashing: rebase re-commits each - # one signed by hwebs (also all-signed, but review commit-by-commit): - # git -C ~/git/<repo> checkout -b land sandbox/main # local branch at tip - # git -C ~/git/<repo> rebase -S main # replay onto main, sign each - # git -C ~/git/<repo> checkout main - # git -C ~/git/<repo> merge --ff-only land && git -C ~/git/<repo> branch -d land - # git -C ~/git/<repo> push origin main - # Alt — INTERACTIVE, for exploring/curating the agent's history by hand: opens - # a todo list (pick/squash/fixup/reword/drop/reorder per commit), then the - # message editor. Good when you want to hand-pick what lands. Run it in a real - # terminal — interactive git can't be driven through the agent harness: - # git -C ~/git/<repo> checkout -b land sandbox/main - # git -C ~/git/<repo> rebase -i -S main # -S signs each resulting commit - # # ...then merge --ff-only land into main + push, as above. - # (Signing config lives in hwebs's dotfiles, not here: commit.gpgsign + - # user.signingkey.) - # - # Airtight variant — exchange via bundles (inert data, no hooks/config run): - # (yokai) git -C /srv/git/<repo> bundle create /srv/git/x.bundle main - # (hwebs) git -C ~/git/<repo> fetch /srv/git/x.bundle main:sandbox/main - # - # Run the agent as yokai: sudo -u yokai claude - # - # Let hwebs drop to yokai without a password. This grants NO new privilege — - # it's a de-escalation to a weaker account — so NOPASSWD here is low-risk, - # unlike a run-as-root rule. Scoped to runAs=yokai only; root stays gated. - security.sudo.extraRules = [ - { - users = [ "hwebs" ]; - runAs = "yokai"; - commands = [ - { - command = "ALL"; - options = [ - "NOPASSWD" - "SETENV" - ]; - } - ]; - } - ]; - - users.groups.ikai = { }; - users.users.yokai = { - isNormalUser = true; - description = "Sandbox account for coding agents"; - group = "ikai"; - packages = with pkgs; [ - git - claude-code - pi-coding-agent - ]; - }; - - # Drop dir for the agent's local clones. Created at activation as 2770 - # root:ikai — setgid (new entries inherit ikai) + group-writable so hwebs and - # yokai can each place clones here without sudo; world sees nothing. Sits - # outside ~ so /home/hwebs stays a sealed 700. Trailing "-" = no age-cleaning. - # Each clone's own ownership is set when seeded (see the notes above). - systemd.tmpfiles.rules = [ - "d /srv/git 2770 root ikai -" - ]; + # The yokai user, ikai group, /srv/git drop dir, and the sudo de-escalation + # rule all live in profiles/sandbox.nix (imported above); that file also + # documents the local-clones workflow. Only the owner name is per-machine: + sandbox.owner = "hwebs"; nix.settings.trusted-users = [ "root" |