From 3df910d75fa98a7d0291e6b8c6889905c6088f64 Mon Sep 17 00:00:00 2001 From: "Henry J. Webster" Date: Mon, 3 Aug 2026 22:00:49 -0500 Subject: profiles: extract shared sandbox profile for enzo + kusanagi Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir, scoped sudo de-escalation, and the local-clones workflow docs) out of machines/enzo into a shared profiles/sandbox.nix that both machines import. The only per-machine value is the human owner allowed to drop into the sandbox, exposed as a `sandbox.owner` string option so the profile stays username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox it didn't have before; enzo's inline block collapses to one setting. Assisted-by: claude-code:claude-opus-4-8 --- machines/kusanagi/default.nix | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'machines/kusanagi/default.nix') diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix index a22843d..bb719d1 100644 --- a/machines/kusanagi/default.nix +++ b/machines/kusanagi/default.nix @@ -9,9 +9,14 @@ ./desktop.nix ../../profiles/dev.nix ../../profiles/apps.nix + ../../profiles/sandbox.nix ./hardware-configuration.nix ]; + # Run coding agents under the isolated `yokai` sandbox user; henz owns the + # canonical repos in ~. See profiles/sandbox.nix for the full workflow. + sandbox.owner = "henz"; + networking.hostName = "kusanagi"; # This value determines the NixOS release from which the default -- cgit v1.3