modules/system/nixos/bluetooth.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

{
  lib,
  config,
  ...
}: let
  cfg = config.collinux.system.bluetooth;
in
  lib.mkIf cfg.enable {
    hardware.bluetooth = {
      enable = true;
      powerOnBoot = true;

      settings.General = {
        ControllerMode = "bredr";
        FastConnectable = true;
        JustWorksRepairing = "always";
      };
    };

    systemd.user.services."mpris-proxy" = {
      unitConfig = {
        BindsTo = ["bluetooth.target"];
        After = ["bluetooth.target"];
      };

      wantedBy = ["bluetooth.target"];

      # serviceConfig already exists (?)
    };

    # hardening (down to 2.1 OK)
    systemd.services."bluetooth".serviceConfig = {
      IPAddressDeny = "any";
      ProtectKernelLogs = true;
      ProtectKernelModules = lib.mkForce true;
      RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
      ProtectClock = true;
      ProcSubset = "pid";
    };
  }