bootstrap home manager and nix packages on login

README.md

@@ -1,43 +1,42 @@
 # randofin-os   [![bluebuild build badge](https://github.com/randogoth/randofin-os/actions/workflows/build.yml/badge.svg)](https://github.com/randogoth/randofin-os/actions/workflows/build.yml)
 
-See the [BlueBuild docs](https://blue-build.org/how-to/setup/) for quick setup instructions for setting up your own repository based on this template.
+randofin-os is a personal spin of the UBlue Bluefin DX image with Nix baked in and a first-login bootstrap for home-manager packages.
 
-After setup, it is recommended you update this README to describe your custom image.
+## What’s inside
+- Base: `ghcr.io/ublue-os/bluefin-dx:latest` without Cockpit, Docker, Firefox, VS Code
+- Nix: multi-user install baked in; `nix-overlay.service` and `nix-daemon.service` enabled.
+- First-login bootstrap: installs nix packages `uv micro vscodium mc` via `home-manager`.
+- System packages added: `syncthing`, `waydroid`;
+- System flatpaks added: Telegram Desktop, Waterfox
 
-## Installation
+## First login behavior
+- Triggers for each non-root user on their first session.
+- Writes state to `~/.local/state/randofin-os/nixpkgs-init.done`; delete it to rerun.
+- Bootstraps `~/.config/home-manager/home.nix` and runs `home-manager switch` with the package set above.
 
+## Install / Rebase
 > [!WARNING]
-> [This is an experimental feature](https://www.fedoraproject.org/wiki/Changes/OstreeNativeContainerStable), try at your own discretion.
+> Uses the Fedora Atomic native container workflow.
 
-To rebase an existing atomic Fedora installation to the latest build:
+```bash
+# First pull unsigned to get signing policy
+rpm-ostree rebase ostree-unverified-registry:ghcr.io/randogoth/randofin-os:latest
+systemctl reboot
 
-- First rebase to the unsigned image, to get the proper signing keys and policies installed:
+# Then move to the signed image
-  ```
+rpm-ostree rebase ostree-image-signed:docker://ghcr.io/randogoth/randofin-os:latest
-  rpm-ostree rebase ostree-unverified-registry:ghcr.io/randogoth/randofin-os:latest
+systemctl reboot
-  ```
+```
-- Reboot to complete the rebase:
-  ```
-  systemctl reboot
-  ```
-- Then rebase to the signed image, like so:
-  ```
-  rpm-ostree rebase ostree-image-signed:docker://ghcr.io/randogoth/randofin-os:latest
-  ```
-- Reboot again to complete the installation
-  ```
-  systemctl reboot
-  ```
 
-The `latest` tag will automatically point to the latest build. That build will still always use the Fedora version specified in `recipe.yml`, so you won't get accidentally updated to the next major version.
+The `latest` tag always tracks the latest build for the Fedora base set in `recipes/recipe.yml`.
 
-## ISO
+## Building locally
-
+```bash
-If build on Fedora Atomic, you can generate an offline ISO with the instructions available [here](https://blue-build.org/learn/universal-blue/#fresh-install-from-an-iso). These ISOs cannot unfortunately be distributed on GitHub for free due to large sizes, so for public projects something else has to be used for hosting.
+bluebuild build --recipe recipes/recipe.yml
-
+```
-## Verification
-
-These images are signed with [Sigstore](https://www.sigstore.dev/)'s [cosign](https://github.com/sigstore/cosign). You can verify the signature by downloading the `cosign.pub` file from this repo and running the following command:
 
+## Signature verification
+Images are signed with Sigstore/cosign. Verify with the repo's `cosign.pub`:
 ```bash
 cosign verify --key cosign.pub ghcr.io/randogoth/randofin-os
 ```

files/scripts/nixpkgs.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-set -oue pipefail
-nix run github:nix-community/home-manager/release-25.11 -- init --switch
-
-pkgs='uv micro vscodium mc lagrange'
-f=~/.config/home-manager/home.nix
-tmp="$(mktemp)"
-{
-  echo "  home.packages = ["
-  for p in $pkgs; do echo "    pkgs.$p"; done
-  echo "  ];"
-} > "$tmp"
-
-sed -i "/^[[:space:]]*home\.packages[[:space:]]*=[[:space:]]*\[/,/^[[:space:]]*];[[:space:]]*$/{
-  /^[[:space:]]*home\.packages[[:space:]]*=/{
-    r $tmp
-  }
-  d
-}" "$f"
-
-rm -f "$tmp"
-
-home-manager switch

files/scripts/nixpkgs.sh

@@ -0,0 +1 @@
+../system/usr/libexec/randofin-os/nixpkgs.sh

files/system/usr/lib/systemd/user/default.target.wants/randofin-nixpkgs-init.service

@@ -0,0 +1 @@
+../randofin-nixpkgs-init.service

files/system/usr/lib/systemd/user/randofin-nixpkgs-init.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Install Nix Home Manager and packages on first login
+ConditionUser=!root
+ConditionPathExists=!%h/.local/state/randofin-os/nixpkgs-init.done
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/randofin-os/nixpkgs.sh
+ExecStartPost=/usr/bin/mkdir -p %h/.local/state/randofin-os
+ExecStartPost=/usr/bin/touch %h/.local/state/randofin-os/nixpkgs-init.done
+
+[Install]
+WantedBy=default.target

files/system/usr/libexec/randofin-os/nixpkgs.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+set -oue pipefail
+nix run github:nix-community/home-manager/release-25.11 -- init --switch
+
+pkgs='uv micro vscodium mc'
+f=~/.config/home-manager/home.nix
+tmp="$(mktemp)"
+{
+  echo "  home.packages = ["
+  for p in $pkgs; do echo "    pkgs.$p"; done
+  echo "  ];"
+} > "$tmp"
+
+sed -i "/^[[:space:]]*home\.packages[[:space:]]*=[[:space:]]*\[/,/^[[:space:]]*];[[:space:]]*$/{
+  /^[[:space:]]*home\.packages[[:space:]]*=/{
+    r $tmp
+  }
+  d
+}" "$f"
+
+rm -f "$tmp"
+
+home-manager switch

recipes/recipe.yml

@@ -65,8 +65,4 @@ modules:
           - org.mozilla.firefox
       - scope: user # Also add Flathub user repo, but no user packages
 
-  - type: script
-    scripts:
-      - nixpkgs.sh
-
   - type: signing # this sets up the proper policy & signing files for signed images to work fully