wip

kimat · Mar 12, 2024 · 3f68698 · 3f68698
1 parent 0b206ad
commit 3f68698
Showing 1 changed file with 15 additions and 9 deletions.
diff --git a/nixos/modules/services/desktops/espanso.nix b/nixos/modules/services/desktops/espanso.nix
@@ -5,30 +5,36 @@ let cfg = config.services.espanso;
 in {
   meta = { maintainers = with lib.maintainers; [ numkem ]; };
 
-  options = {
-    services.espanso = {
-      enable = options.mkEnableOption (lib.mdDoc "Espanso");
+  options.services.espanso = {
+    enable = options.mkEnableOption (lib.mdDoc "Espanso");
+    package = mkOption {
+      type = types.package;
+      default = pkgs.espanso;
+      defaultText = literalExpression "pkgs.espanso";
+      description = mdDoc "The espanso package to use.";
     };
   };
 
   config = mkIf cfg.enable {
     systemd.user.services.espanso = {
       description = "Espanso daemon";
       serviceConfig = {
-        ExecStart = "${pkgs.espanso}/bin/espanso daemon";
+        ExecStart = "${cfg.package}/bin/espanso daemon";
         Restart = "on-failure";
+        CapabilityBoundingSet = [ "CAP_DAC_OVERRIDE" "~CAP_SETPCAP" ];
+        AmbientCapabilites = [ "~CAP_SETPCAP" "CAP_DAC_OVERRIDE" ];
       };
       wantedBy = [ "default.target" ];
     };
 
-    environment.systemPackages = [ pkgs.espanso ];
+    environment.systemPackages = [ cfg.package ];
 
-    security.wrappers.dumpcap = {
-      source = "${pkgs.espanso}/bin/espanso";
+    security.wrappers.espanso = {
+      source = "${pkgs.espanso-wayland}/bin/espanso";
       capabilities = "cap_dac_override+p";
       owner = "root";
-      group = "espanso";
-      permissions = "u+rw";
+      group = "users";
+      permissions = "u+rw,g+rw";
     };
   };
 }