From d16070a4a7ca95b13e0e22dcc753edf4411d7528 Mon Sep 17 00:00:00 2001 From: nevaforget Date: Wed, 30 Sep 2026 19:25:09 +0200 Subject: [PATCH] fix(desktop): xdg-open goes through the portal, so FHS sandboxes get Firefox acli auth login opened Chromium. buildFHSEnv binds only an allowlist of /etc entries into its bubblewrap sandbox, and /etc/xdg is not on it, so the mimeapps.list from xdg.mime is invisible there and xdg-open takes the first http handler in mimeinfo.cache. The same holds for Steam and AppImages. xdg.portal.xdgOpenUsePortal hands the URL to the OpenURI portal, which resolves it on the host (NixOS/nixpkgs#160923). acli and kubectl on the ThinkPad. Flake inputs updated. --- DECISIONS.md | 23 +++++++++++++++++++++++ flake.lock | 22 +++++++++++----------- hosts/thinkpad/default.nix | 2 ++ modules/desktop.nix | 8 ++++++++ 4 files changed, 44 insertions(+), 11 deletions(-) diff --git a/DECISIONS.md b/DECISIONS.md index d0717e0..96e831f 100644 --- a/DECISIONS.md +++ b/DECISIONS.md @@ -1,5 +1,28 @@ # Decisions +## 2026-09-30 – xdg-open goes through the portal, so FHS sandboxes get Firefox + +- **Who**: Dominik, ClaudeCode +- **Why**: `acli auth login` opened Chromium. acli is a `buildFHSEnv` wrapper, + which binds only an allowlist of `/etc` entries into its bubblewrap sandbox; + `/etc/xdg` is not on it, so the `mimeapps.list` from `xdg.mime` is invisible + there and `xdg-mime` falls back to `mimeinfo.cache`, which yields + `chromium-browser.desktop`. Reproduced on the host by querying with + `XDG_CONFIG_DIRS` pointed away from `/etc/xdg`. Affects every FHS env + (Steam, AppImages), not only acli. +- **Tradeoffs**: Considered binding `/etc/xdg` into acli via `extraBwrapArgs` + (fixes one package only), linking a second copy of `mimeapps.list` into + `/run/current-system/sw/etc/xdg` (a self-made workaround), stripping + Chromium's http claim (fixes the browser only), and `xdg-settings` (manual, + per user and machine). All rejected in favour of the option nixpkgs added + for exactly this (NixOS/nixpkgs#160923). +- **How**: `xdg.portal.xdgOpenUsePortal = true` in `modules/desktop.nix`. It + sets `NIXOS_XDG_OPEN_USE_PORTAL=1`; nixpkgs' patched `xdg-open` then hands + the URL to the OpenURI portal, which resolves it on the host with the host's + `mimeapps.list`. Verified: the thinkpad system builds and carries the + variable. The runtime check (`acli auth login` opening Firefox) needs a + switch and a new login, since it is a session variable. + ## 2026-09-28 – Nothing waits for a routable address at boot - **Who**: Dominik, ClaudeCode diff --git a/flake.lock b/flake.lock index b1e4b95..696d185 100644 --- a/flake.lock +++ b/flake.lock @@ -40,11 +40,11 @@ "moonarch": { "flake": false, "locked": { - "lastModified": 1790177314, - "narHash": "sha256-2YTKIvK8gtoDf+zE0QyLyoWT8KQW82O0WQ4pWkHgX6g=", + "lastModified": 1790681837, + "narHash": "sha256-tVi+c1wnXuWSSejndpE3IcLCY2T2z7tlsOrE4KjePRg=", "ref": "refs/heads/main", - "rev": "2774d0947de08376651c05fb1b68907c7e3ffd61", - "revCount": 188, + "rev": "bad576881b3c6ce31ddd9fef515baae727beb25e", + "revCount": 189, "type": "git", "url": "https://gitea.moonarch.de/nevaforget/moonarch.git" }, @@ -74,11 +74,11 @@ "nixpkgs": "nixpkgs" }, "locked": { - "lastModified": 1789978172, - "narHash": "sha256-FIRXajv1pPZ+l6On6ekkmcQ6le0Zi0ncRUoR3nB0vKA=", + "lastModified": 1790321948, + "narHash": "sha256-mZGHLGi217oLIwzDM4PNRZeCNa6g2WBXURyXbNMFs7Y=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "9ebcb7766700d7e006d9505247bd7ce0426f4232", + "rev": "30d48a0ec6035f8140d0125af274f0de95f1e9b5", "type": "github" }, "original": { @@ -102,11 +102,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1790046670, - "narHash": "sha256-MYiI+CzL0tuWgRPjGsKCDHqYs2T3OzMlMQWOYWG0qso=", + "lastModified": 1790578696, + "narHash": "sha256-ZoxIApko70jCdbH3l20HWXOBaT2HZd87orzd2yJ9dVE=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "6774f7bc253789b113a4f39285dc0fa100abeacc", + "rev": "7a0f122f5090cf4c2ade2a13a0e229d4e19ba71f", "type": "github" }, "original": { @@ -133,7 +133,7 @@ "lastModified": 1777359446, "narHash": "sha256-DqFak+NN9bxBSTWD+6luEjSIQo1FAkw5HeJRCQvnBuk=", "ref": "refs/heads/main", - "rev": "74ce3688e55318dec0af8e25f376e613243ed6c3", + "rev": "21c0f0655443650a48dc444a251afae1e0cc8dc8", "revCount": 2, "type": "git", "url": "https://gitea.moonarch.de/nevaforget/Sweet-cursors.git" diff --git a/hosts/thinkpad/default.nix b/hosts/thinkpad/default.nix index 6e98791..f2663d1 100644 --- a/hosts/thinkpad/default.nix +++ b/hosts/thinkpad/default.nix @@ -104,6 +104,8 @@ uv python3 glab + acli + kubectl ]; # The nixos-hardware profile only sets hardware.cpu.amd.updateMicrocode as a diff --git a/modules/desktop.nix b/modules/desktop.nix index e16e828..f44dfc2 100644 --- a/modules/desktop.nix +++ b/modules/desktop.nix @@ -118,6 +118,14 @@ in # awake. programs.niri leaves this interface unassigned, so stating it here # does not collide with the module's definition. config.niri."org.freedesktop.impl.portal.Inhibit" = "none"; + + # buildFHSEnv sandboxes (acli, Steam, AppImages) bind only an allowlist of + # /etc entries, and /etc/xdg is not on it, so an xdg-open inside them never + # sees the xdg.mime defaults and takes the first handler in mimeinfo.cache — + # Chromium for http. With this set, nixpkgs' xdg-open hands the URL to the + # OpenURI portal instead, which resolves it on the host. See + # NixOS/nixpkgs#160923. + xdgOpenUsePortal = true; }; # The file dialog every portal client opens — Firefox's save dialog among