# app-users.conf -- the application accounts this machine runs GUI apps as. # # An application user is an account a program RUNS as, so a browser cannot # read your documents, your keys, or another application's data. The # account name gets the configured prefix (`packagemanager config # --user-prefix`, `u_` by default), so `claude` here becomes u_claude. # # `cfg app-users` reads this file and calls `packagemanager user setup` for # each line, which is idempotent: running it again changes nothing that is # already right, and it never overwrites a file it did not write. # # One line per LAUNCHER, fields separated by `|`, `-` for "not this one". # Several launchers can run as one account: # # account | name | app | share | dir | desktop | launcher | groups | icon # # account the account, without the prefix: browser -> u_browser. Also # the shared directory's name, capitalised: /home/Shared/Browser # name the launcher: ~/bin/ and .desktop. Empty: the # account's name # app the command line. Its first word must be on PATH. # {} what you type, as arguments (browser-mini {}) # ...?q={} what you type as a search term; with nothing # typed, the page before the ? (the front page) # ...?q={URL} the same, but with nothing typed you land on # URL. reddit's /search/ with no search in it # is a blank page; this is where you want to be # instead. `|` cannot appear in it -- it is # this file's field separator # no {} nothing you type is passed on # ~/ the ACCOUNT's home (--download-dir ~/Shared) # browser-mini and browser-big get --app-id when the line # has none, so sway and the taskbar tell the windows apart. The # lines below spell it out anyway, so what sway matches on is # readable here; the four browser lines leave it to the default. # share slim the desktop only: it can draw, NO audio, NO camera # full the desktop plus audio and video -- anything that plays # no no session access # An account takes the strongest share of its lines. # dir yes /home/Shared/ (2770, the account's group -- # which your login is in), and $SHARED_ in your # next login shell. The account's ~/Shared and yours # are links into /home/Shared, so its home can stay # 0700 (`packagemanager config --shared-hub DIR` moves it) # no nothing shared. What the account downloads stays in the # account -- which is the point of the account # desktop yes a menu entry # launcher yes ~/bin/ (a menu entry needs it, so desktop=yes # writes it too) # groups extra groups, comma separated; `-` for none # icon empty https://cdn.simpleicons.org/ # a word that simpleicons.org slug (gemini -> googlegemini) # a URL that image. Wikimedia's stable form is # https://commons.wikimedia.org/wiki/Special:FilePath/ # - no icon: the program's own # #RRGGBB at the end paints a ONE-COLOUR svg that colour, after # it is fetched: ...ChatGPT-Logo.svg#38BDF8 is sky blue # Fetched once into ~/.local/share/icons/lfs-apps/. # simpleicons.org has DROPPED some brands -- `openai` and `grok` # are gone, and a slug that is not there means no icon. Those # lines carry a URL instead. # # Missing trailing fields take: slim | yes | yes | yes | - | (auto icon). # # REMOVING ONE. Take the line out, then: # packagemanager user remove-launcher --run a launcher only # packagemanager user delete --run the account: home # archived to /root first # packagemanager user purge --run ALL of it, including # the parts the accounts # share (see below) # # THE SHELL VARIABLES. /etc/profile.d/shared-dirs.sh exports one per # link in the hub, e.g. SHARED_BROWSER=/home/Shared/Browser, and drops # the ones whose directory is gone. /etc/profile.d is read by LOGIN shells: # a terminal opened inside the session is not one, so it shows what the # session inherited when you logged in. The step also sources the fragment # from /etc/bashrc, which every interactive shell reads -- and any shell can # refresh itself with: . /etc/profile.d/shared-dirs.sh # # EXTRA SETUP PER ACCOUNT. A line starting with @setup runs a command, a # local script or a downloaded bash script AS the account (its own HOME), # once. `*` means every account. A changed line runs again; # APP_USERS_RERUN=1 runs all of them again. `|` is allowed here. # # @setup mpv mkdir -p ~/.config/mpv && echo "volume=60" > ~/.config/mpv/mpv.conf # @setup claude https://example.org/claude-setup.sh # @setup * /etc/pkgusr/stacks/app-common.sh # # su WITHOUT A PASSWORD: /etc/pam.d/su_u_user lists the accounts your login # may become; this step MERGES it (backup su_u_user.bak- first). account | name | app | share | dir | desktop | launcher | groups | icon browser | browser-mini | browser-mini {} --download-dir ~/Shared | full | yes | yes | yes | - | - browser | browser-big | browser-big {} --download-dir ~/Shared | full | yes | yes | yes | - | - browser | google | browser-mini https://www.google.com/search?q={https://www.google.com/} --download-dir ~/Shared | full | yes | yes | yes | - | browser | duckduckgo | browser-big https://duckduckgo.com/?q={https://duckduckgo.com/} --download-dir ~/Shared | full | yes | yes | yes | - | claude | | browser-mini --app-id claude https://claude.ai/new --download-dir ~/Shared | slim | yes | yes | yes | - | chatgpt | | browser-mini --app-id chatgpt https://chatgpt.com/ --download-dir ~/Shared | slim | yes | yes | yes | - | https://commons.wikimedia.org/wiki/Special:FilePath/ChatGPT-Logo.svg gemini | | browser-mini --app-id gemini https://gemini.google.com/app --download-dir ~/Shared | slim | yes | yes | yes | - | googlegemini nrwgpt | | browser-mini --app-id nrwgpt https://chat.kiconnect.nrw/app --download-dir ~/Shared | slim | yes | yes | yes | - | https://commons.wikimedia.org/wiki/Special:FilePath/ChatGPT-Logo.svg#38BDF8 grok | | browser-mini --app-id grok https://grok.com/ --download-dir ~/Shared | slim | yes | yes | yes | - | https://commons.wikimedia.org/wiki/Special:FilePath/Grok-icon.svg mercury | | browser-mini --app-id mercury https://chat.inceptionlabs.ai/ --download-dir ~/Shared | slim | yes | yes | yes | - | - deepseek | | browser-mini --app-id deepseek https://chat.deepseek.com/ --download-dir ~/Shared | slim | yes | yes | yes | - | github | | browser-mini --app-id github https://github.com/search?q={https://github.com/} --download-dir ~/Shared | slim | yes | yes | yes | - | git | | browser-mini --app-id git https://git.christianimmanuel.de --download-dir ~/Shared | slim | yes | yes | yes | - | codeberg | | browser-mini --app-id codeberg https://codeberg.org/explore/repos?q={https://codeberg.org/} --download-dir ~/Shared | slim | yes | yes | yes | - | reddit | | browser-mini --app-id reddit https://www.reddit.com/search/?q={https://www.reddit.com/} | full | no | yes | yes | - | discord | | browser-big --app-id discord https://discord.com/channels/@me | full | no | yes | yes | - | youtube | | browser-mini --app-id youtube https://www.youtube.com/results?search_query={https://www.youtube.com/} | full | no | yes | yes | - | dokus | arte | browser-mini --app-id arte https://www.arte.tv/de/videos/dokumentationen-und-reportagen/ | full | no | yes | yes | - | https://upload.wikimedia.org/wikipedia/commons/3/3b/Arte-Logo.svg dokus | ard | browser-mini --app-id ard https://www.ardmediathek.de/dokus | full | no | yes | yes | - | https://upload.wikimedia.org/wikipedia/commons/7/7c/ARD_2019_logo.svg dokus | zdf | browser-mini --app-id zdf https://www.zdf.de/dokus | full | no | yes | yes | - | - mpv | orchester | mpv https://www.youtube.com/playlist?list=PLijBjlV15UVRBj4-1D1AXKDlg2QLdPqk8 | full | no | yes | yes | - | mpv mpv | lieder | mpv https://www.youtube.com/playlist?list=PLijBjlV15UVTJSqHt_2TtbJB5zCq0UxHm | full | no | yes | yes | - | mpv