From d59ff0c996a702e8352b7f0a4eb61992ff4e719f Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Sun, 31 May 2026 23:38:09 -0600
Subject: [PATCH] nixos/oo7: init

---
 nixos/modules/module-list.nix           |  1 +
 nixos/modules/services/desktops/oo7.nix | 41 +++++++++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 nixos/modules/services/desktops/oo7.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e01a409f45b3..febedc650e54 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -593,6 +593,7 @@
   ./services/desktops/linyaps.nix
   ./services/desktops/malcontent.nix
   ./services/desktops/neard.nix
+  ./services/desktops/oo7.nix
   ./services/desktops/pipewire/pipewire.nix
   ./services/desktops/pipewire/wireplumber.nix
   ./services/desktops/playerctld.nix
diff --git a/nixos/modules/services/desktops/oo7.nix b/nixos/modules/services/desktops/oo7.nix
new file mode 100644
index 000000000000..29c95ccf91a3
--- /dev/null
+++ b/nixos/modules/services/desktops/oo7.nix
@@ -0,0 +1,41 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.oo7;
+in
+{
+  options.services.oo7 = {
+    enable = lib.mkEnableOption ''
+      oo7, a service providing the Secret Service D-Bus API.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.dbus.packages = [ pkgs.oo7-server ];
+
+    systemd.packages = [ pkgs.oo7-server ];
+
+    systemd.user.services.oo7-daemon.wantedBy = [ "default.target" ];
+
+    xdg.portal.extraPortals = [ pkgs.oo7-portal ];
+
+    security.pam.services.login.oo7.enable = true;
+
+    security.wrappers.oo7-daemon = {
+      owner = "root";
+      group = "root";
+      capabilities = "cap_ipc_lock=ep";
+      source = "${pkgs.oo7-server}/libexec/oo7-daemon";
+    };
+  };
+
+  meta = {
+    inherit (pkgs.oo7.meta)
+      maintainers
+      ;
+  };
+}