libretechandClaude Opus 4.7
622531d78d
The tmpfs overlay on $HOME hid the host GPG keyring inside the sandbox, so git commits with commit.gpgsign failed with "can't connect to the keyboxd". Bind ~/.gnupg rw, bind the gpg-agent socket dir (XDG_RUNTIME_DIR/gnupg), and propagate GPG_TTY so pinentry-tty works. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
127 lines
3.8 KiB
Nix
127 lines
3.8 KiB
Nix
{
|
|
description = "librenotes development environment";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, flake-utils }:
|
|
flake-utils.lib.eachDefaultSystem (system:
|
|
let
|
|
pkgs = import nixpkgs { inherit system; config.allowUnfree = true; };
|
|
|
|
packages = with pkgs; [
|
|
# Go toolchain
|
|
go_1_25
|
|
gopls
|
|
gotools
|
|
go-tools
|
|
golangci-lint
|
|
gnumake
|
|
# Project CLIs
|
|
tea
|
|
bubblewrap
|
|
];
|
|
|
|
shellFunctions = ''
|
|
yolo() { claude --dangerously-skip-permissions --resume; }
|
|
'';
|
|
|
|
shellFunctionsScript = pkgs.writeText "shell-functions.sh" shellFunctions;
|
|
|
|
sandboxScript = pkgs.writeShellScriptBin "enter-sandbox" ''
|
|
PROJECT_DIR="''${SANDBOX_PROJECT_DIR:-$PWD}"
|
|
|
|
BWRAP_ARGS=(
|
|
--unshare-all
|
|
--share-net
|
|
--die-with-parent
|
|
|
|
--ro-bind / /
|
|
--dev /dev
|
|
--proc /proc
|
|
|
|
--tmpfs "$HOME"
|
|
|
|
--bind "$PROJECT_DIR" "$PROJECT_DIR"
|
|
--bind "$HOME/.claude" "$HOME/.claude"
|
|
--bind "$HOME/.claude.json" "$HOME/.claude.json"
|
|
|
|
# Writable: GPG keyring + agent socket (commit signing)
|
|
--bind "$HOME/.gnupg" "$HOME/.gnupg"
|
|
--bind-try "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/gnupg" "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/gnupg"
|
|
|
|
--ro-bind "$HOME/.gitconfig" "$HOME/.gitconfig"
|
|
--ro-bind "$HOME/.ssh" "$HOME/.ssh"
|
|
--setenv GIT_SSH_COMMAND "ssh -F ~/.ssh/config"
|
|
--ro-bind "$HOME/.config/tea" "$HOME/.config/tea"
|
|
--ro-bind "$HOME/.config/gh" "$HOME/.config/gh"
|
|
--ro-bind "$HOME/.local/bin" "$HOME/.local/bin"
|
|
|
|
--tmpfs /tmp
|
|
|
|
--setenv HOME "$HOME"
|
|
--setenv PATH "$PATH"
|
|
--setenv TERM "''${TERM:-xterm}"
|
|
--setenv SANDBOX_ACTIVE "1"
|
|
--setenv GPG_TTY "''${GPG_TTY:-}"
|
|
--chdir "$PROJECT_DIR"
|
|
)
|
|
|
|
mkdir -p "$HOME/.claude"
|
|
touch "$HOME/.claude.json"
|
|
|
|
if [ $# -gt 0 ]; then
|
|
exec ${pkgs.bubblewrap}/bin/bwrap "''${BWRAP_ARGS[@]}" "$@"
|
|
else
|
|
exec ${pkgs.bubblewrap}/bin/bwrap "''${BWRAP_ARGS[@]}" ${pkgs.bash}/bin/bash
|
|
fi
|
|
'';
|
|
in
|
|
{
|
|
devShells = {
|
|
default = pkgs.mkShell {
|
|
buildInputs = packages ++ [ sandboxScript ];
|
|
shellHook = ''
|
|
export SANDBOX_PROJECT_DIR="$PWD"
|
|
export SHELL_FUNCTIONS="${shellFunctionsScript}"
|
|
|
|
if [ ! -t 0 ] || [ -n "$NIX_DEVELOP_COMMAND" ]; then
|
|
echo "=== librenotes (sandbox: enter-sandbox) ==="
|
|
else
|
|
echo "=== librenotes Sandbox ==="
|
|
echo "WRITE: $PWD, ~/.claude"
|
|
exec enter-sandbox ${pkgs.bash}/bin/bash --rcfile <(cat << 'SANDBOX_BASHRC'
|
|
source "$SHELL_FUNCTIONS"
|
|
PS1="[sandbox] \w \$ "
|
|
SANDBOX_BASHRC
|
|
)
|
|
fi
|
|
'';
|
|
};
|
|
|
|
yolo = pkgs.mkShell {
|
|
buildInputs = packages;
|
|
shellHook = ''
|
|
${shellFunctions}
|
|
echo "=== librenotes (YOLO - no sandbox) ==="
|
|
'';
|
|
};
|
|
|
|
# Plain Go dev shell, no sandbox wrapping. For contributors who
|
|
# just want `nix develop .#dev` to get a working toolchain.
|
|
dev = pkgs.mkShell {
|
|
buildInputs = with pkgs; [
|
|
go_1_25 gopls gotools go-tools golangci-lint gnumake
|
|
];
|
|
shellHook = ''
|
|
echo "=== librenotes dev ==="
|
|
echo "go: $(go version)"
|
|
'';
|
|
};
|
|
};
|
|
}
|
|
);
|
|
}
|