nixos-config

m3tam3re/nixos-config

Fork 0

Commit Graph

Author	SHA1	Message	Date
m3ta-chiron	6a5d8f0011	feat(agents): add strict security hardening for Pi and OpenCode Pi Guardrails: - Enables @aliou/pi-guardrails with strict default config - Sets onboarding.completed = true to skip onboarding prompt - Enables pathAccess in ask mode for /nix/store and /tmp - Adds noAccess policies for: SSH keys, GPG keys, AWS config, Kubernetes config, cloud CLI configs (gh/gcloud/1password/sops), agenix secrets, Pi auth/sessions, env files, private keys/certs - Adds auto-deny patterns for env leakage commands: env, printenv, /proc/*/environ, GPG secret exports, ssh-add -D, password manager reads OpenCode permissions: - Adds permission section with global security rules - external_directory: ask by default, allow /nix/store and /tmp - read/edit: allow by default, deny SSH/GPG/AWS/Kube/cloud configs, agenix secrets, Pi auth/sessions, env files, private keys/certs - glob: restrict sensitive path patterns - grep: deny SSH/GPG/agenix, ask for PASSWORD/SECRET/API_KEY/PRIVATE_KEY - bash: ask by default, allow safe git/nix commands, deny env/printenv/proc/GPG secret/sudo/ssh-add deletion/curl\|sh - webfetch: ask by default, allow github/nixos search - doom_loop: ask	2026-04-29 19:48:29 +02:00
m3tm3re	797ffb2b8a	fix: assert unknown profiles in mkHomeConfig; move agent modules to coding/agents - home/lib/default.nix: add assertion for unknown profile names instead of silently filtering them out; remove unused 'inherit (lib) optional' - home/coding/agents/{opencode,pi}.nix: moved from home/features/coding/ to co-locate with agents.nix (eliminating cross-directory back-references) - home/coding/agents/agents.nix: update imports to ./opencode.nix and ./pi.nix - home/features/coding/: remove now-dead default.nix (nothing imported it)	2026-04-26 11:17:03 +02:00

Author

SHA1

Message

Date

m3ta-chiron

6a5d8f0011

feat(agents): add strict security hardening for Pi and OpenCode

Pi Guardrails:
- Enables @aliou/pi-guardrails with strict default config
- Sets onboarding.completed = true to skip onboarding prompt
- Enables pathAccess in ask mode for /nix/store and /tmp
- Adds noAccess policies for: SSH keys, GPG keys, AWS config,
  Kubernetes config, cloud CLI configs (gh/gcloud/1password/sops),
  agenix secrets, Pi auth/sessions, env files, private keys/certs
- Adds auto-deny patterns for env leakage commands:
  env, printenv, /proc/*/environ, GPG secret exports,
  ssh-add -D, password manager reads

OpenCode permissions:
- Adds permission section with global security rules
- external_directory: ask by default, allow /nix/store and /tmp
- read/edit: allow by default, deny SSH/GPG/AWS/Kube/cloud configs,
  agenix secrets, Pi auth/sessions, env files, private keys/certs
- glob: restrict sensitive path patterns
- grep: deny SSH/GPG/agenix, ask for PASSWORD/SECRET/API_KEY/PRIVATE_KEY
- bash: ask by default, allow safe git/nix commands,
  deny env/printenv/proc/GPG secret/sudo/ssh-add deletion/curl|sh
- webfetch: ask by default, allow github/nixos search
- doom_loop: ask

2026-04-29 19:48:29 +02:00

m3tm3re

797ffb2b8a

fix: assert unknown profiles in mkHomeConfig; move agent modules to coding/agents

- home/lib/default.nix: add assertion for unknown profile names instead of
  silently filtering them out; remove unused 'inherit (lib) optional'
- home/coding/agents/{opencode,pi}.nix: moved from home/features/coding/
  to co-locate with agents.nix (eliminating cross-directory back-references)
- home/coding/agents/agents.nix: update imports to ./opencode.nix and ./pi.nix
- home/features/coding/: remove now-dead default.nix (nothing imported it)

2026-04-26 11:17:03 +02:00

2 Commits