Fix noctalia, add qoder

2026-08-13 19:40:32 +02:00
parent 37d6977223
commit b471966e8a
6 changed files with 311 additions and 2 deletions
@@ -0,0 +1,92 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.dov.development.qoder;
+  qoder = pkgs.callPackage ./package.nix {
+    inherit (cfg)
+      version
+      url
+      hash
+      extraFlags
+      ;
+  };
+in
+{
+  options.dov.development.qoder = {
+    enable = mkEnableOption "Qoder IDE (unfree, repackaged from the upstream .deb)";
+
+    version = mkOption {
+      type = types.str;
+      default = "1.19.2";
+      description = ''
+        Label only — upstream publishes a rolling "latest" URL, so this is
+        just what the store path is called. Bump it together with `hash`.
+      '';
+    };
+
+    url = mkOption {
+      type = types.str;
+      default = "https://download.qoder.com/release/latest/qoder_amd64.deb";
+      description = "Upstream .deb to repackage.";
+    };
+
+    hash = mkOption {
+      type = types.str;
+      default = "";
+      example = "sha256-0000000000000000000000000000000000000000000=";
+      description = ''
+        SRI hash of the .deb. Refresh whenever upstream ships a new build:
+          nix store prefetch-file --json <url> | jq -r .hash
+      '';
+    };
+
+    extraFlags = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "--disable-gpu-sandbox" ];
+      description = "Extra Electron/Chromium flags appended to the wrapper.";
+    };
+
+    keyring = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Enable gnome-keyring. Qoder is wrapped with
+        --password-store=gnome-libsecret; without a running secret service
+        the sign-in token is lost on every restart.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable (mkMerge [
+    {
+      assertions = [
+        {
+          assertion = cfg.hash != "";
+          message = ''
+            dov.development.qoder.hash is empty. Prefetch the .deb first:
+              nix store prefetch-file --json ${cfg.url} | jq -r .hash
+          '';
+        }
+      ];
+
+      environment.systemPackages = [ qoder ];
+    }
+
+    (mkIf cfg.keyring {
+      services.gnome.gnome-keyring.enable = true;
+
+      # gnome-keyring enables gcr-ssh-agent by default, which asserts against
+      # programs.ssh.startAgent from dov.yubikey. We only want the secret
+      # service here — SSH keys stay with the OpenSSH agent.
+      services.gnome.gcr-ssh-agent.enable = false;
+    })
+  ]);
+}