Git Sagar
1510b6c5ff
username/password move from the sealed image to makeConfigMedium, so two
VMs get distinct logins (and, as before, distinct SIDs). The sealed
image bakes only a generic bootstrap account ("vmixsetup") whose sole job
is to carry OOBE to a logon; post-oobe then creates the real account from
the config CD, switches autologon to it, and reboots so it builds its own
SID-bound profile on D:\Users\<username>. A one-shot cleanup (RunOnce,
first logon of the real account) retires the bootstrap and its profile
and applies the per-user tint. So nothing about the account is shared or
baked, and the on-disk profile folder matches the real username.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117qMyjpuXsjpVAcpJbFD8g
108 lines
3.8 KiB
Nix
108 lines
3.8 KiB
Nix
# Windows customization templates.
|
|
# Templates can provide:
|
|
# windowsRegistry — offline registry merge (fast, no boot)
|
|
# auditScript — runs in Audit Mode via QEMU boot
|
|
# cdroms — ISOs to attach when booting for auditScript
|
|
# uploads — files to inject into the image before auditScript
|
|
{ pkgs, lib, system, drivers, makeFilesISO, ... }:
|
|
let
|
|
args = { inherit pkgs lib system drivers makeFilesISO; };
|
|
in rec {
|
|
# Essentials (drivers, runtimes, removals, performance)
|
|
essentials = {
|
|
virtioTools = import ./essentials/virtio-tools.nix args;
|
|
removeEdge = import ./essentials/remove-edge.nix args;
|
|
removeIE = import ./essentials/remove-ie.nix args;
|
|
removeWMP = import ./essentials/remove-wmp.nix args;
|
|
removePaint = import ./essentials/remove-paint.nix args;
|
|
amdGpuDrivers = import ./essentials/amd-gpu-drivers.nix args;
|
|
vcppRuntimes = import ./essentials/vcpp-runtimes.nix args;
|
|
bestPerformance = import ./essentials/best-performance.nix args;
|
|
clearFileAssociations = import ./essentials/clear-file-associations.nix args;
|
|
virtioDrivers = import ./essentials/virtio-drivers.nix args;
|
|
};
|
|
|
|
# Applications
|
|
apps = {
|
|
thorium = import ./apps/thorium.nix args;
|
|
edgeWebview = import ./apps/edge-webview.nix args;
|
|
sevenZip = import ./apps/7zip.nix args;
|
|
vlc = import ./apps/vlc.nix args;
|
|
imageGlass = import ./apps/imageglass.nix args;
|
|
sandboxie = import ./apps/sandboxie.nix args;
|
|
office = import ./apps/office.nix args;
|
|
};
|
|
|
|
# Default file associations policy
|
|
defaultApps = import ./default-apps.nix args;
|
|
|
|
# Generalize (sysprep + OOBE). Pass seal=true for hardware deployment.
|
|
generalize = import ./generalize.nix args;
|
|
|
|
# Seal: a generic OOBE-deferred base whose per-VM data is not baked but
|
|
# delivered at deploy time on a config medium (helpers/makeConfigMedium.nix).
|
|
# One sealed store path is shared by every VM; each VM's first boot mints its
|
|
# own SID and builds the whole profile on the relocated data volume (D:).
|
|
#
|
|
# The baked account is a generic bootstrap that only exists to carry OOBE to a
|
|
# logon -- the real, per-VM account (username/password) comes from the config
|
|
# medium, and the bootstrap is retired on the target. So nothing per-VM is
|
|
# baked. RDP and locale stay caller args.
|
|
seal = templateArgs: generalize ({
|
|
delayOobeRun = true;
|
|
configMedium = true;
|
|
username = "vmixsetup";
|
|
password = "vmixsetup";
|
|
profilesDirectory = "D:\\Users";
|
|
dataDisk = { driveLetter = "D"; label = "data"; };
|
|
} // templateArgs);
|
|
|
|
# Offline registry templates
|
|
reg = import ./registry args;
|
|
|
|
# Bundles — reusable template lists for common use cases
|
|
bundles = {
|
|
# Essentials only: debloat + registry tweaks, no apps
|
|
laptopSlim = [
|
|
essentials.removeIE
|
|
essentials.removeWMP
|
|
essentials.removeEdge
|
|
essentials.vcppRuntimes
|
|
essentials.bestPerformance
|
|
reg.disableTelemetry
|
|
reg.disableErrorReporting
|
|
reg.disableUpdates
|
|
reg.disableSmartScreen
|
|
reg.disablePrivacyTracking
|
|
reg.disableAI
|
|
reg.disableConsumerFeatures
|
|
reg.performanceTweaks
|
|
apps.thorium
|
|
apps.sevenZip
|
|
];
|
|
|
|
# Full: essentials + apps
|
|
laptop = [
|
|
essentials.removeIE
|
|
essentials.removeWMP
|
|
essentials.removeEdge
|
|
essentials.vcppRuntimes
|
|
essentials.bestPerformance
|
|
reg.disableTelemetry
|
|
reg.disableErrorReporting
|
|
reg.disableUpdates
|
|
reg.disableSmartScreen
|
|
reg.disablePrivacyTracking
|
|
reg.disableAI
|
|
reg.disableConsumerFeatures
|
|
reg.performanceTweaks
|
|
apps.edgeWebview
|
|
apps.thorium
|
|
apps.sevenZip
|
|
apps.vlc
|
|
apps.imageGlass
|
|
essentials.virtioDrivers # needed for network during Office download
|
|
apps.office
|
|
];
|
|
};
|
|
}
|