From 53cc22c0f5a954aefe3d91b14bb93007c0d3268d Mon Sep 17 00:00:00 2001
From: Nathan Henrie <nate@n8henrie.com>
Date: Tue, 8 Jul 2025 16:00:19 -0600
Subject: [PATCH] nixos/espanso: provide required capabilities for
 espanso-wayland

Extensive discussion in:
- https://github.com/NixOS/nixpkgs/pull/328890
- https://github.com/NixOS/nixpkgs/issues/249364
---
 nixos/modules/services/desktops/espanso.nix | 16 ++++++++++++++-
 pkgs/by-name/es/espanso/package.nix         | 22 ++++++++++++++-------
 2 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/services/desktops/espanso.nix b/nixos/modules/services/desktops/espanso.nix
index c2a783b15731..251789701d42 100644
--- a/nixos/modules/services/desktops/espanso.nix
+++ b/nixos/modules/services/desktops/espanso.nix
@@ -25,10 +25,24 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    security.wrappers.espanso = lib.mkIf (cfg.package.waylandSupport or false) {
+      capabilities = "cap_dac_override+p";
+      owner = "root";
+      group = "root";
+      source = lib.getExe (
+        pkgs.espanso-wayland.override { securityWrapperPath = config.security.wrapperDir; }
+      );
+
+    };
     systemd.user.services.espanso = {
       description = "Espanso daemon";
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} daemon";
+        ExecStart = "${
+          if (cfg.package.waylandSupport or false) then
+            "${config.security.wrapperDir}/espanso"
+          else
+            lib.getExe cfg.package
+        } daemon";
         Restart = "on-failure";
       };
       wantedBy = [ "default.target" ];
diff --git a/pkgs/by-name/es/espanso/package.nix b/pkgs/by-name/es/espanso/package.nix
index 2bf5508cb431..f2f22eb08ac3 100644
--- a/pkgs/by-name/es/espanso/package.nix
+++ b/pkgs/by-name/es/espanso/package.nix
@@ -20,6 +20,7 @@
   wl-clipboard,
   wxGTK32,
   makeWrapper,
+  securityWrapperPath ? null,
   nix-update-script,
   stdenv,
   waylandSupport ? false,
@@ -87,13 +88,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
     xdotool
   ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace scripts/create_bundle.sh \
-      --replace-fail target/mac/ $out/Applications/ \
-      --replace-fail /bin/echo ${coreutils}/bin/echo
-    substituteInPlace espanso/src/path/macos.rs  espanso/src/path/linux.rs \
-      --replace-fail '"/usr/local/bin/espanso"' '"${placeholder "out"}/bin/espanso"'
-  '';
+  postPatch =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      substituteInPlace scripts/create_bundle.sh \
+        --replace-fail target/mac/ $out/Applications/ \
+        --replace-fail /bin/echo ${coreutils}/bin/echo
+      substituteInPlace espanso/src/path/macos.rs  espanso/src/path/linux.rs \
+        --replace-fail '"/usr/local/bin/espanso"' '"${placeholder "out"}/bin/espanso"'
+    ''
+    + lib.optionalString (securityWrapperPath != null) ''
+      substituteInPlace espanso/src/cli/daemon/mod.rs \
+        --replace-fail \
+          'std::env::current_exe().expect("unable to obtain espanso executable location");' \
+          'std::ffi::OsString::from("${securityWrapperPath}/espanso");'
+    '';
 
   # Some tests require networking
   doCheck = false;