From 4a6c2ff4a08a7dcf0b7574bdebac79133f68771a Mon Sep 17 00:00:00 2001
From: MakiseKurisu <MakiseKurisu@users.noreply.github.com>
Date: Sun, 31 Aug 2025 16:55:15 +0800
Subject: [PATCH] nixos/home-assistant: set permission for input devices

Currently only keyboard_remote uses evdev.
---
 .../home-automation/home-assistant.nix        | 20 ++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 1c8e65a352f2..dc1900f52c1e 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -868,6 +868,10 @@ in
             "amshan"
             "benqprojector"
           ];
+          componentsUsingInputDevices = [
+            # Components that require access to input devices (/dev/input/*)
+            "keyboard_remote"
+          ];
         in
         {
           ExecStart = escapeSystemdExecArgs (
@@ -898,13 +902,15 @@ in
           # Hardening
           AmbientCapabilities = capabilities;
           CapabilityBoundingSet = capabilities;
-          DeviceAllow = (
+          DeviceAllow =
             optionals (any useComponent componentsUsingSerialDevices) [
               "char-ttyACM rw"
               "char-ttyAMA rw"
               "char-ttyUSB rw"
             ]
-          );
+            ++ optionals (any useComponent componentsUsingInputDevices) [
+              "char-input rw"
+            ];
           DevicePolicy = "closed";
           LockPersonality = true;
           MemoryDenyWriteExecute = true;
@@ -946,9 +952,13 @@ in
           RestrictNamespaces = true;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
-          SupplementaryGroups = optionals (any useComponent componentsUsingSerialDevices) [
-            "dialout"
-          ];
+          SupplementaryGroups =
+            optionals (any useComponent componentsUsingSerialDevices) [
+              "dialout"
+            ]
+            ++ optionals (any useComponent componentsUsingInputDevices) [
+              "input"
+            ];
           SystemCallArchitectures = "native";
           SystemCallFilter = [
             "@system-service"