lytedev/nix
Watch
1
0
Fork
You've already forked nix
 2
Code Pull requests 13 Activity Actions

feat(education): generalize the picobricks account; add musiquest and the fleet desktop #1299

Open
lytedev wants to merge 2 commits from propose/education-account into main
pull from: propose/education-account
merge into: lytedev:main
Conversation 0 Commits 2 Files changed 12 +490 -254
lytedev commented 2026-10-11 18:27:43 -05:00
Owner
Copy link

See the commit message for details.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B6cqrFV8RjyhzQmRu3mcfo

See the commit message for details. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01B6cqrFV8RjyhzQmRu3mcfo
feat(education): generalize the picobricks account; add musiquest and the fleet desktop
All checks were successful
/ check-format (push) Successful in 11s
Details
/ build (push) Successful in 10m55s
Details
7213ebcb88 
lyte.picobricks-account becomes lyte.education-account. The login
stays `picobricks`: renaming it would give the account a new uid
and home and strand the documents already copied into
/home/picobricks. The egress chain keeps its name for the reason
recorded beside it (a renamed chain leaves the old jump behind).

Web access goes through an allowlisting tinyproxy on loopback rather
than new iptables holes. Opening 443 to beefcake would have exposed
every site behind its caddy, and musiquest's sync host resolves to
the WAN address, so it would have needed a second hole. The account
egress stays loopback-only and it still has no DNS of its own.
Musiquest gets a launcher that opens a Chromium app window with its
own profile and the proxy flag. Pairing needs no sign-in on the
device, so kanidm stays unreachable. The YouTube embeds in the app
are not allowlisted.

The account previously ran noctalia with stock defaults and without
the noctalia keybindings, because the include resolved into
daniel's mode-700 checkout. It now gets store copies of the fleet
noctalia layer and the bindings, the living-room Deck's top bar and
auto-hiding dock (pinned with its own apps), and overrides for the
fleet's daniel-specific wallpaper and theme-template paths.

Tested: the generated tinyproxy.conf allows files.lyte.dev and
musiquest-sync.k.lyte.dev and refuses git.lyte.dev and google.com,
for both CONNECT and plain HTTP. The generated niri config passes
`niri validate`. The thinker toplevel evaluates. Not yet deployed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6cqrFV8RjyhzQmRu3mcfo
feat(education): launcher entry for every allowlisted web app; never lock
All checks were successful
/ check-format (push) Successful in 11s
Details
/ build (push) Successful in 10m9s
Details
54d37ade9a 
Web access is now declared per web app: an app's own host is
allowlisted automatically and other hosts it needs go in its
extraHosts, so every web app that can load also has a launcher entry.
allowedWebHosts remains for sites without a launcher of their own.

The account no longer locks: the lock screen, the idle lock rung, and
niri's lid-close lock are all off for it. The last idle rung now
suspends only while on battery, through a script, because noctalia's
idle actions cannot ask about the power source.

Hibernation is not added. lyte.multiboot keeps thinker from
hibernating (AllowHibernation=no, no resume device) because the disk
is shared with Omarchy. Allowing it is a host-wide decision, not an
account one.

Tested: the battery check, run on thinker with suspend replaced by
echo, skips on AC and suspends with the charger treated as absent. The
generated niri config with the edited bindings passes niri validate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6cqrFV8RjyhzQmRu3mcfo
All checks were successful
/ check-format (push) Successful in 11s
Required
Details
/ build (push) Successful in 10m9s
Required
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin propose/education-account:propose/education-account
git switch propose/education-account
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is wrong

  
enhancement
New feature

  
question
Awaiting information

  
scary
Potentially problematic change

  
upstream
Awaiting upstream changes

No labels
bug
enhancement
question
scary
upstream
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
lytedev/nix!1299
No description provided.