From 1c19cb81e72ad5600aac1e6c4c92844f133c6535 Mon Sep 17 00:00:00 2001
From: Pratham Patel <prathampatel@thefossguy.com>
Date: Sun, 15 Jun 2025 11:47:25 +0530
Subject: [PATCH 1/2] nixos/geoclue2: add option to manage whitelisted agents

The geoclue2 module recommends that the guest agent be disabled when the
desktop environment provides their own geoclue2 agent. But when a
desktop environment uses the demo agent directly, like COSMIC does, the
demo agent must be whitelisted. But disabling the demo agent also
removes it from the whitelisted agents.

This commit adds an option which holds a list of all whitelisted
geoclue2 agents. It allows for consumers like COSMIC to have the demo
agent disabled but still whitelisted for such use cases.
---
 nixos/modules/services/desktops/geoclue2.nix | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/services/desktops/geoclue2.nix b/nixos/modules/services/desktops/geoclue2.nix
index b9d423acf9f3..ec7afa03c656 100644
--- a/nixos/modules/services/desktops/geoclue2.nix
+++ b/nixos/modules/services/desktops/geoclue2.nix
@@ -8,11 +8,6 @@
 let
   cfg = config.services.geoclue2;
 
-  defaultWhitelist = [
-    "gnome-shell"
-    "io.elementary.desktop.agent-geoclue2"
-  ];
-
   appConfigModule = lib.types.submodule (
     { name, ... }:
     {
@@ -85,6 +80,16 @@ in
           that provides location information for accessing.
         '';
       };
+      whitelistedAgents = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [
+          "gnome-shell"
+          "io.elementary.desktop.agent-geoclue2"
+        ];
+        description = ''
+          Desktop IDs (without the .desktop extension) of whitelisted agents.
+        '';
+      };
 
       enableDemoAgent = lib.mkOption {
         type = lib.types.bool;
@@ -321,7 +326,10 @@ in
       {
         agent = {
           whitelist = lib.concatStringsSep ";" (
-            lib.optional cfg.enableDemoAgent "geoclue-demo-agent" ++ defaultWhitelist
+            lib.lists.unique (
+              cfg.whitelistedAgents
+              ++ lib.optionals config.services.geoclue2.enableDemoAgent [ "geoclue-demo-agent" ]
+            )
           );
         };
         network-nmea = {

From 358d8a18bd778f688f6dea76f41afc2f5f5df031 Mon Sep 17 00:00:00 2001
From: Pratham Patel <prathampatel@thefossguy.com>
Date: Sun, 15 Jun 2025 11:59:54 +0530
Subject: [PATCH 2/2] cosmic/nixos: whitelist `geoclue-demo-agent`

---
 nixos/modules/services/desktop-managers/cosmic.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/desktop-managers/cosmic.nix b/nixos/modules/services/desktop-managers/cosmic.nix
index 67a6f8625c6e..58e4a10177be 100644
--- a/nixos/modules/services/desktop-managers/cosmic.nix
+++ b/nixos/modules/services/desktop-managers/cosmic.nix
@@ -140,13 +140,21 @@ in
     security.rtkit.enable = true;
     services.accounts-daemon.enable = true;
     services.displayManager.sessionPackages = [ pkgs.cosmic-session ];
-    services.geoclue2.enable = true;
-    services.geoclue2.enableDemoAgent = false;
     services.libinput.enable = true;
     services.upower.enable = true;
     # Required for screen locker
     security.pam.services.cosmic-greeter = { };
 
+    # geoclue2 stuff
+    services.geoclue2.enable = true;
+    # We _do_ use the demo agent in the `cosmic-settings-daemon` package,
+    # but this option also creates a systemd service that conflicts with the
+    # `cosmic-settings-daemon` package's geoclue2 agent. Therefore, disable it.
+    services.geoclue2.enableDemoAgent = false;
+    # As mentioned above, we do use the demo agent. And it needs to be
+    # whitelisted, otherwise it doesn't run.
+    services.geoclue2.whitelistedAgents = [ "geoclue-demo-agent" ]; # whitelist our own geoclue2 agent o
+
     # Good to have defaults
     hardware.bluetooth.enable = lib.mkDefault true;
     networking.networkmanager.enable = lib.mkDefault true;