From 54610aaddcc01e335c34087bc0c3bc1de6d23cf8 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Mon, 15 Dec 2025 12:43:58 +0900
Subject: internal/outcome: expose pipewire via pipewire-pulse

This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst.

Closes #29.

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 nixos.nix | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

(limited to 'nixos.nix')

diff --git a/nixos.nix b/nixos.nix
index 2b2b42f7..d06495dc 100644
--- a/nixos.nix
+++ b/nixos.nix
@@ -68,7 +68,7 @@ in
 
     home-manager =
       let
-        privPackages = mapAttrs (username: userid: {
+        privPackages = mapAttrs (_: userid: {
           home.packages = foldlAttrs (
             acc: id: app:
             [
@@ -196,15 +196,6 @@ in
                             }
                           ]
                         )
-                        ++ optional (app.enablements.pipewire && app.pulse) {
-                          type = "daemon";
-                          dst = if app.mapRealUid then "/run/user/${toString config.users.users.${username}.uid}/pulse/native" else "/run/user/65534/pulse/native";
-                          path = cfg.shell;
-                          args = [
-                            "-lc"
-                            "exec pipewire-pulse"
-                          ];
-                        }
                         ++ [
                           {
                             type = "bind";
-- 
cgit v1.3.1