From bff068e51434ddd14ab6ec0e13a4a678cabc1d5a Mon Sep 17 00:00:00 2001
From: Meghea Iulian <iulian.meghea@gmail.com>
Date: Sun, 22 Oct 2023 09:13:56 +0300
Subject: [PATCH] esphome: remove ProcSubset from serviceConfig

Remove ProcSubset from esphome serviceConfig because esphome/bwrap needs to
access it.
According to
https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#ProcSubset=
ProcSubset isn't even recommended for most programs.
Fixes #262674
---
 nixos/modules/services/home-automation/esphome.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/home-automation/esphome.nix b/nixos/modules/services/home-automation/esphome.nix
index d7dbb6f0b90e..080c8876382f 100644
--- a/nixos/modules/services/home-automation/esphome.nix
+++ b/nixos/modules/services/home-automation/esphome.nix
@@ -112,7 +112,7 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
-        ProcSubset = "pid";
+        ProcSubset = "all"; # Using "pid" breaks bwrap
         ProtectSystem = "strict";
         #RemoveIPC = true; # Implied by DynamicUser
         RestrictAddressFamilies = [