Make shell and browser opt-in blocks, decoupled from the desktop #26

New issue

Open

opened 2026-06-18 12:36:58 +00:00 by bram.buijs · 0 comments

bram.buijs commented

2026-06-18 12:36:58 +00:00

Collaborator

Part of making the generic image lean (see the app-sets issue). The shell and
browser modules are forced on in profiles-dawo-generic and carry maatwerk and a
hard Plasma coupling.

programs-zsh is always on with a personal setup: oh-my-zsh (agnoster), lsd
aliases, and an update alias that hardcodes ~/Git/nixos. Shell choice is a
per-workplace preference, and the hardcoded path does not belong in a shared
core. Proposal: dawo.zsh.enable (opt-in), drop the hardcoded path, keep the
generic quality-of-life bits as tunables.
programs-firefox and programs-chromium are forced on and wire in
plasma-browser-integration, so they assume the Plasma desktop. Proposal:
dawo.browser.<name> blocks that keep the privacy/policy hardening but make the
desktop integration conditional on the selected desktop, so a GNOME or headless
host is not dragged into Plasma.

Net effect: a host opts into a shell and a browser; neither is forced, and neither
assumes a specific desktop.

Question: keep zsh as the suggested default shell (opt-in but recommended), or
leave the core shell-agnostic and let each workplace pick? And should the browser
hardening (Firefox policies) be a separate block from the browser package itself,
so an org can harden a browser it ships from its own repo?

Part of making the generic image lean (see the app-sets issue). The shell and browser modules are forced on in `profiles-dawo-generic` and carry maatwerk and a hard Plasma coupling. - `programs-zsh` is always on with a personal setup: oh-my-zsh (agnoster), lsd aliases, and an `update` alias that hardcodes `~/Git/nixos`. Shell choice is a per-workplace preference, and the hardcoded path does not belong in a shared core. Proposal: `dawo.zsh.enable` (opt-in), drop the hardcoded path, keep the generic quality-of-life bits as tunables. - `programs-firefox` and `programs-chromium` are forced on and wire in plasma-browser-integration, so they assume the Plasma desktop. Proposal: `dawo.browser.<name>` blocks that keep the privacy/policy hardening but make the desktop integration conditional on the selected desktop, so a GNOME or headless host is not dragged into Plasma. Net effect: a host opts into a shell and a browser; neither is forced, and neither assumes a specific desktop. Question: keep zsh as the suggested default shell (opt-in but recommended), or leave the core shell-agnostic and let each workplace pick? And should the browser hardening (Firefox policies) be a separate block from the browser package itself, so an org can harden a browser it ships from its own repo?

bram.buijs added the

Kind/Discussion

label

2026-06-18 12:38:53 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

MinBZK/DAWO-NixOS#26

No description provided.

Rows
Columns