GUI applications

Note

A GUI application module installs graphical applications and their configuration optimized for DNF.

🖼 darkone.graphic.gnome

Pre-configured gnome environment with dependences.

Login keyring after just passwd

PAM unlocks the login keyring with the session password, which a change made by the admin cannot re-encrypt (the old password is unknown). The next password login drops the keyring: GNOME recreates it, empty, on the new password. No prompt, and the old password opens nothing anymore.

Keyring secrets lost on each admin password change

Apps ask once again for their credentials. Opt-out, for a keyring with a password of its own: darkone.home.gnome.keepKeyring.

• enable bool Pre-configured gnome WM
• enableDashToDock bool Dash to dock plugin
• enableLightDM bool Enable LightDM instead of GDM
• enableGdmSelector bool GDM user list instead of a typed login
• enableCaffeine bool Disable auto-suspend
• enableGsConnect bool Communication with devices
• enableOnlineServices bool Online Accounts, CalDAV, CardDAV…
• xkbVariant nullOr str Keyboard variant; null follows the locale (config/locales.json), as the layout does.
• screenBlankDelay ints.unsigned Screen-blank delay in seconds (0 = never). Laptops override it to 900 (15 min).
• cursorSize ints.positive Default pointer size in pixels, user-overridable (Settings > Accessibility).

darkone.graphic.gnome = {
  enable = false;
  enableDashToDock = false;
  enableLightDM = false;
  enableGdmSelector = false;
  enableCaffeine = false;
  enableGsConnect = false;
  enableOnlineServices = false;
  xkbVariant = null;
  screenBlankDelay = 1800;
  cursorSize = 24;
};

---

🖼 darkone.graphic.qemu

QEMU test VMs bridged on the DNF LAN

Used by dnf/scripts/vm-start.sh. Enslaves the wired NIC into a NetworkManager bridge and lets unprivileged users plug VMs into it through the setuid qemu-bridge-helper. A VM then gets its address from the zone gateway like a physical machine, so just full-install <host> nixos <ip> reaches it.

Bridge MAC address

bridge.macAddress must be the NIC’s own MAC: the bridge takes over the host IP, and the zone DHCP reservation (mac in etc/config.yaml) matches on it.

Activation

Deploying only loads the profiles. Reboot, or nmcli connection up br0, to move the host IP onto the bridge.

darkone.graphic.qemu = {
  enable = true;
  bridge.interface = "enp2s0";
  bridge.macAddress = "aa:bb:cc:dd:ee:ff";
};

• enable bool QEMU test VMs bridged on the DNF LAN
• bridge.name str Bridge interface the VMs plug into.
• bridge.interface str Wired NIC enslaved into the bridge.
• bridge.macAddress str Bridge MAC address: the NIC’s own, to keep the zone DHCP reservation.

darkone.graphic.qemu = {
  enable = false;
  bridge.name = "br0";
  bridge.interface = "enp2s0";
  bridge.macAddress = "aa:bb:cc:dd:ee:ff";
};

---

🖼 darkone.graphic.remote-desktop

Admin remote desktop: attach to an open graphical session, or open one, over RDP.

Nothing is installed, nothing is exposed

gnome-remote-desktop already ships and runs on every GNOME host (the nixpkgs GNOME module enables it by default); it simply sits idle until its RDP backend is turned on. This module adds no daemon and opens no port: it installs dnf-remote-desktop, a helper the just remote-desktop recipe calls over ssh to arm a session, then disarm it. The RDP listener binds only while a support session runs and is reached exclusively through an ssh tunnel — the firewall stays shut.

Three modes

ro mirrors the screen read-only, rw mirrors it and takes control. Both need somebody logged in and fail otherwise, rather than quietly handing out a private session an admin who asked to watch a user would not expect. login is that private session, asked for explicitly: a GDM login screen served by the system daemon, whoever is in front of the machine.

Three backends, one protocol

A GNOME Wayland session is served by gnome-remote-desktop, driven through grdctl inside the session owner’s own bus. A Cinnamon X11 session — the UMI (multimodal input) workstation, since GNOME 50 dropped its Xorg session — is served by freerdp-shadow-cli on the existing display. A login session is served by the same gnome-remote-desktop, in its system runtime mode, which hands the client over to GDM. Same protocol, same client, ro/rw enforced server-side.

Attaching is taking over someone’s screen

The target session belongs to a user who is very likely sitting in front of it. GNOME shows a sharing indicator, but nothing asks for consent: this is a support tool for machines you administer, and enabling it on a host is a deliberate, auditable declaration in config.yaml. login is the discreet one: it never touches the screen on the monitor.

Activation

A host opts in through its features list in config.yaml: features: [ "remote-desktop", ... ]. Unlike services:, features are inherited by templated host groups (range: / hosts:), so a whole family of identical desktops is covered by one line.

• enable bool Remote desktop support access (driven by the host feature, avoid enabling manually).
• timeout ints.positive Minutes before an armed support session closes itself.
• embedCursor bool Patch gnome-remote-desktop so the pointer is composited into the video. Without it the observer cannot see where the user points, which defeats the read-only mode. Costs a local rebuild of gnome-remote-desktop.

darkone.graphic.remote-desktop = {
  enable = hasFeature;
  timeout = 60;
  embedCursor = true;
};

---

🖼 darkone.graphic.supertuxkart

SuperTuxKart with configurations to play in local network.

Tip

To use in conjonction with homemanager games module!

Shared tracks

The tracks share itself lives in service/stk.nix. enableNfsClient and nfsServer are the only knobs a host needs: they wire darkone.service.stk.{enableClient,serverName} so a machine configuration never has to name two modules for one game.

Playing across zones

Game and discovery ports accept every zone prefix and the tailnet. Broadcast discovery stays inside the zone: from another zone, join with “Enter server address” (server IP, port 2759).

Fleet-scoped firewall

Sources are matched on fleet prefixes, never on an interface: a STK host that also holds a WAN address does not publish the game there.

• enable bool SuperTuxKart + firewall config
• enableNfsClient bool Mount the shared tracks of the zone’s stk server
• nfsServer nullOr str Hostname serving the tracks, default is the zone’s stk service host

darkone.graphic.supertuxkart = {
  enable = false;
  enableNfsClient = false;
  nfsServer = null;
};

---

🖼 darkone.graphic.virt-manager

Virt manager + viewer with spice, win-virtio and ovmf.

• enable bool Virt manager with dependencies

darkone.graphic.virt-manager.enable = false;

---

🖼 darkone.graphic.virtualbox

Virtualbox host installation.

• enable bool Pre-configured virtualbox installation
• enableExtensionPack bool Enable extension pack (causes recompilations)

darkone.graphic.virtualbox = {
  enable = false;
  enableExtensionPack = false;
};

---