This repository has no description
machines.coaxmetal.strom: let lass sudo to strom without a password
The kiosk account owns everything needed to test a game the way a player
meets it, and none of it is reachable from outside: sway holds seat0,
XDG_RUNTIME_DIR is 0700, the Xbox pad's evdev nodes are ACL'd to strom
(only the legacy js0 is world-readable, and SDL2 does not use it), and
/home/strom carries both the game state and the /home/strom/strom
checkout that strom-session resolves STROM_FLAKE from.
Follows the existing 2configs/{wine,review,ableton}.nix pattern.
author
lassulus
date
(Aug 7, 2026, 4:35 PM CEST)
commit
176daabc
176daabcaf528d05f52fa83d479e8bf71619ce94
parent
a93e9b27
a93e9b27d8a3d8994e96ec33dc2b733b8826aebd
+13
+13
machines/coaxmetal/strom.nix
+13
machines/coaxmetal/strom.nix
···
4
4
...
5
5
}:
6
6
let
7
+
mainUser = config.users.extraUsers.mainUser;
8
+
7
9
# Run the launcher + games from the on-disk strom checkout at
8
10
# /home/strom/strom when it exists, else the public github flake (see the
9
11
# STROM_FLAKE selection in strom-session below).
···
110
112
"pipewire"
111
113
];
112
114
};
115
+
116
+
# Let the main user become `strom` without a password. Everything that makes
117
+
# this kiosk a kiosk belongs to that account and is unreachable from outside
118
+
# it: sway owns seat0, XDG_RUNTIME_DIR is 0700, the pad's evdev nodes are
119
+
# ACL'd to strom (js0 alone is world-readable, and SDL2 does not use it), and
120
+
# /home/strom holds both the game state and the /home/strom/strom checkout the
121
+
# launcher resolves STROM_FLAKE from. So testing a game the way a player
122
+
# actually meets it - on the TV, with the pad - means being strom.
123
+
security.sudo.extraConfig = ''
124
+
${mainUser.name} ALL=(strom) NOPASSWD: ALL
125
+
'';
113
126
114
127
# Kiosk autostart: greetd autologins the strom user on tty1 into sway, which
115
128
# runs the couch launcher as its sole fullscreen client. default_session