xsession: Start applications in their own scopes and limit their memory usage

flake.lock

@@ -29,11 +29,11 @@
         "rev": "7e85f62e40cd585ce81fa1f3debd5385bb0cad03",
         "revCount": 160,
         "type": "git",
-        "url": "https://git2.dodsorf.as/Dandellion/NUR.git"
+        "url": "https://git.dodsorf.as/Dandellion/NUR.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git2.dodsorf.as/Dandellion/NUR.git"
+        "url": "https://git.dodsorf.as/Dandellion/NUR.git"
       }
     },
     "devshell": {
@@ -174,11 +174,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1671804785,
+        "lastModified": 1673624525,
-        "narHash": "sha256-vQA5zqnAgws8zxR6G/TFAqjBUYPbqWsE6LxRLnffjYg=",
+        "narHash": "sha256-lcNKkBEct4jVGqvkeIkc6lj9O8YjttEt0voUGLXGo14=",
         "owner": "helix-editor",
         "repo": "helix",
-        "rev": "24c3b00d10858a02c6c1c351a7509e204c2bc647",
+        "rev": "b6331394a3f341ad21f8fad3e6e0b93becda9ce5",
         "type": "github"
       },
       "original": {
@@ -195,11 +195,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1670253003,
+        "lastModified": 1672244468,
-        "narHash": "sha256-/tJIy4+FbsQyslq1ipyicZ2psOEd8dvl4OJ9lfisjd0=",
+        "narHash": "sha256-xaZb8AZqoXRCSqPusCk4ouf+fUNP8UJdafmMTF1Ltlw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0e8125916b420e41bf0d23a0aa33fadd0328beb3",
+        "rev": "89a8ba0b5b43b3350ff2e3ef37b66736b2ef8706",
         "type": "github"
       },
       "original": {
@@ -244,11 +244,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1661367362,
+        "lastModified": 1672992692,
-        "narHash": "sha256-Qc8MXcV+YCPREu8kk6oggk23ZBKLqeQRAIsLbHEviPE=",
+        "narHash": "sha256-/eLQLSNIa22ARTZbk+x8i0iE8khe1eiHWkuxgTVXZ7g=",
         "owner": "guibou",
         "repo": "nixGL",
-        "rev": "7165ffbccbd2cf4379b6cd6d2edd1620a427e5ae",
+        "rev": "643e730efb981ffaf8478f441ec9b9aeea1c89f5",
         "type": "github"
       },
       "original": {
@@ -259,11 +259,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1671752829,
+        "lastModified": 1673704454,
-        "narHash": "sha256-oFeJzAq0iRL6md9Si8Tx9bltjwjLmldvgUmAteMhYW4=",
+        "narHash": "sha256-5Wdj1MgdOgn3+dMFIBtg+IAYZApjF8JzwLWDPieg0C4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9898811c658d39b2692d0ab744377e02fd85d08b",
+        "rev": "a83ed85c14fcf242653df6f4b0974b7e1c73c6c6",
         "type": "github"
       },
       "original": {
@@ -293,11 +293,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1671811449,
+        "lastModified": 1673834776,
-        "narHash": "sha256-x3lmyHkfaDapYaMgKV3olLAxsdF36xvQFxnEUMVdydM=",
+        "narHash": "sha256-IZRrfTWEW3lfIA5hkd96VzJ7sNk3I/WsAzYrLWcMS0Q=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "e369ab33b7d8efc7821335b1e369ae0a7cfa62c5",
+        "rev": "661bfe579c879782223971324dc7799266a2e35e",
         "type": "github"
       },
       "original": {
@@ -341,11 +341,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1671788672,
+        "lastModified": 1673606088,
-        "narHash": "sha256-tLkPxJuos3jki2f/TZdHn+NuMQAzN9s2E4QudylQLg0=",
+        "narHash": "sha256-wdYD41UwNwPhTdMaG0AIe7fE1bAdyHe6bB4HLUqUvck=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2c74fcd6c5fc14a61de158fb796243543f46b217",
+        "rev": "37b97ae3dd714de9a17923d004a2c5b5543dfa6d",
         "type": "github"
       },
       "original": {

flake.nix

@@ -14,7 +14,7 @@
 
     nur.url = "github:nix-community/NUR";
 
-    dan.url = "git+https://git2.dodsorf.as/Dandellion/NUR.git"; #"git+https://git.dodsorf.as/Dandellion/NUR";
+    dan.url = "git+https://git.dodsorf.as/Dandellion/NUR.git"; #"git+https://git.dodsorf.as/Dandellion/NUR";
     dan.inputs.nixpkgs.follows = "unstable";
     
     helix.url = "github:helix-editor/helix";

profiles/base/default.nix

@@ -23,6 +23,10 @@ in
     name = lib.mkOption {
       type = lib.types.str;
     };
+    systemd = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
     eth = lib.mkOption { };
     wlan = lib.mkOption { };
     secondary-fs = lib.mkOption {
@@ -136,7 +140,7 @@ in
           };
         };
       };
-      extensions = with pkgs.nur.repos.rycee.firefox-addons; [ bitwarden cookies-txt https-everywhere metamask no-pdf-download sponsorblock ublock-origin ];
+      extensions = with pkgs.nur.repos.rycee.firefox-addons; [ bitwarden cookies-txt metamask no-pdf-download sponsorblock ublock-origin ];
     };
 
 
@@ -250,7 +254,7 @@ in
       enable = true;
       matchBlocks = {
         "lilith" = {
-          hostname = "lilith.d.d.dodsorf.as";
+          hostname = "lilith.dods";
           user = "dandellion";
         };
         "desktop" = {

profiles/xsession/default.nix

@@ -4,6 +4,7 @@ let
   cfg = config.profiles.xsession;
   non-nixos = config.profiles.non-nixos;
   mkGL = program: "${lib.strings.optionalString non-nixos.enable "${pkgs.nixgl.auto.nixGLDefault}/bin/nixGL "}${program}";
+  execScope = program: "exec bash -c \"systemd-run --user --scope --unit='app-i3-exec-$RANDOM' -p CollectMode=inactive-or-failed -p MemoryHigh=92% -p MemoryMax=98% \"${program}\"\"";
 in
 {
   imports = [ ./dunstrc.nix ./terminal.nix ./polybar.nix ];
@@ -49,6 +50,7 @@ in
           terminal = "${pkgs.kitty}/bin/kitty";
           keybindings = let
             modifier = config.xsession.windowManager.i3.config.modifier;
+            dmenu = if config.machine.systemd then "${../../scripts/dmenu_run_systemd}" else "dmenu_run";
           in lib.mkOptionDefault {
             "${modifier}+0" = "workspace 10";
             "${modifier}+Shift+0" = "move container to workspace 10";
@@ -64,20 +66,22 @@ in
             "XF86MonBrightnessUp" = "exec --no-startup-id brightnessctl set +5%";
             "XF86MonBrightnessDown" = "exec --no-startup-id brightnessctl set 5%-";
 
-            "XF86Display" = "exec arandr";
-
             "Print" = "exec scrot %Y-%m-%d_$wx$h_scrot.png -z -e 'mv $f /home/daniel/Pictures/screenshots/'";
             "${modifier}+Print" = "exec scrot /home/daniel/Pictures/Screenshots/%Y-%m-%d_$wx$h_scrot.png -z";
+
+            "XF86Display" = "exec arandr";
+
             "${modifier}+Shift+U" = "exec $HOME/.config/nixpkgs/nix-dotfiles/scripts/dmenuunicode";
-
-            "${modifier}+n" = "exec dolphin";
-            "${modifier}+b" = "exec firefox";
-            "${modifier}+t" = "exec gedit";
-
             "${modifier}+Shift+s" = "exec $HOME/.config/nixpkgs/nix-dotfiles/scripts/dmenuaudio";
 
-            # "${modifier}+Return" = lib.mkForce "exec kitty";
+            "${modifier}+d" = "exec ${dmenu}";
-            "${modifier}+Shift+Return" = "exec kitty -e ssh dandellion@lilith";
+
+            "${modifier}+n" = execScope "dolphin";
+            "${modifier}+b" = execScope "firefox";
+            "${modifier}+t" = execScope "gedit";
+
+            "${modifier}+Return" = execScope "kitty";
+            "${modifier}+Shift+Return" = execScope "kitty -e ssh dandellion@lilith";
           };
           startup = [
             { 

scripts/dmenu_run_systemd

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+#
+# dmenu_run_systemd: start a program from dmenu as transient systemd .scope
+# (C) Copyright Benjamin Block 2021
+# (C) Copyright Daniel Olsen 2023
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice (including the next
+# paragraph) shall be included in all copies or substantial portions of the
+# Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+# DEALINGS IN THE SOFTWARE.
+#
+# Requirements:
+#   - Package: bash
+#   - Package: dmenu
+#     - dmenu_path
+#     - dmenu
+#   - Package: coreutils
+#     - basenc
+#     - tr
+#   - Package: systemd
+#     - systemd-run
+#   - Package: util-linux
+#     - getopt
+#
+# Usage: dmenu_run_systemd
+#
+#   Start demnu to select program to execute, then start selected program in
+#   background.
+#
+# Usage: dmenu_run_systemd [Options] [--] <command> [<arg1>[, <arg2>[...]]]
+#
+#   Start <command> with <arg1..N> without involving dmenu.
+#   E.g. in i3 config: `bindsym $mod+Return exec dmenu_run_systemd alacritty`.
+#
+#   Options:
+#    -f, --forground  Start <command> as forground task (default: no)
+#    -p, --pwd        Use the current ${PWD} as working directory (default:
+#                     ${HOME})
+
+declare -g prefix forground=false cpwd=false
+declare -ga selection
+if [ "${#}" -lt 1 ]; then
+     prefix="dmenu-"
+     selection=("$(dmenu_path | dmenu)")                     || exit 127
+else
+     prefix="xrun-"
+
+     declare opts
+     opts="$(getopt --shell bash                                     \
+                     -o "fp"                                         \
+                     -l "forground,pwd"                              \
+                     -n "dmenu_run_systemd" -- "${@}")"      || exit 122
+     eval set -- "${opts}"
+     unset opts
+
+     while true; do
+             case "${1}" in
+             '-f'|'--forground')
+                     forground=true
+             ;;
+             '-p'|'--pwd')
+                     cpwd=true
+             ;;
+             '--')   shift; break;;
+             esac
+             shift
+     done
+
+     selection=("${@}")
+fi
+readonly selection prefix
+
+declare -g name
+# Max unit name length:     256
+#        -    ".scope"   -    6
+#        - "<prefix>-"   -    6
+#        -   "-<rand>"   -   33
+#                        ------
+#            "<name>" <=    211
+read -r -d '' -n 192 name < <(
+     echo -n "${selection[*]}" | tr -c 'a-zA-Z0-9_-' '[_*]'  || exit 1
+     echo -e '\0'                                            || exit 2
+)                                                            || exit 126
+readonly name
+{ [ "${#name}" -gt 0 ] && [ "${#name}" -le 211 ]; }          || exit 125
+
+declare -g rand
+# ~5 bits per character => 32*5 = ~160 bits random number
+read -r -N 32 rand < <(basenc --base32 < /dev/urandom)               || exit 124
+readonly rand
+[ "${#rand}" -eq 32 ]                                                || exit 123
+
+declare -ga runargs=(
+     --quiet
+     --user                          # run in per-User slice
+     --scope                         # create transient `.scope` unit,
+                                     # instead of `.service`
+     --collect                       # garbage collect everything after run,
+                                     # even on failure
+     --slice="app.slice"             # run as part of `app.slice`
+     --unit="${prefix}${name}-${rand}"
+
+     -p MemoryHigh=92%
+     -p MemoryMax=98%
+                                     # unit name
+     --description="dmenu selection ${selection[*]@Q}"
+)
+
+if ${cpwd}; then
+     runargs+=( --working-directory="${PWD:-/}" )
+else
+     runargs+=( --working-directory="${HOME:-/}" )
+fi
+
+readonly runargs
+
+## Debugging:
+#declare -p prefix selection name rand runargs
+
+if ${forground}; then
+     systemd-run "${runargs[@]}" -- "${selection[@]}"
+else
+     systemd-run "${runargs[@]}" -- "${selection[@]}" &
+fi