From b3b5f2033ba2503742e2db7573d7421319468e61 Mon Sep 17 00:00:00 2001
From: Andreas Fuchs <asf@boinkor.net>
Date: Thu, 11 Jun 2026 12:49:57 -0400
Subject: [PATCH] gonic: Set PrivateTmp=true for new go-sqlite3 behavior

When running migrations, the go-sqlite3 library used in v0.22.0 will now open files with names like /tmp/1418313342.db; without a tmp directory, that fails and causes errors on startup of the gonic service.

Giving the unit a private /tmp directory fixes this issue.
---
 nixos/modules/services/audio/gonic.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/audio/gonic.nix b/nixos/modules/services/audio/gonic.nix
index da259d6957d9..d1b150b6501f 100644
--- a/nixos/modules/services/audio/gonic.nix
+++ b/nixos/modules/services/audio/gonic.nix
@@ -93,6 +93,7 @@ in
         ];
         RestrictNamespaces = true;
         PrivateDevices = true;
+        PrivateTmp = true;
         PrivateUsers = true;
         ProtectClock = true;
         ProtectControlGroups = true;