1.3 KiB
Register window icons
Rule
Each graphical application has a registry.window-icon entry with a window-class match and rendered icon.
Rationale
Hyprland uses this registry to render workspace icons for open application windows.
Run this command to list window classes from the running compositor:
hyprctl clients -j | jq -r '.[].class' | sort -u
Separate guest wrappers from service modules
Rule
Each guest module wraps one service module.
The guest enables its service through guests.<name>.interior.
Service modules own service configuration.
Guest modules configure bind mounts, secret delivery, resource limits, and registry entries.
Host configuration supplies deployment-specific paths, volumes, addresses, and routes.
Rationale
Service modules support a service without guest infrastructure. Guest modules adapt a service module to a guest. Host configuration provides deployment-specific values.
Decrypt guest secrets on the host
Rule
A host user owns each guest secret before SOPS decrypts it. Each guest service group accesses its secrets through a read-only bind mount.
Rationale
Guest service accounts do not exist on the host, where SOPS creates secrets. The shared service group preserves read access across the guest boundary.