From 75ad530654c4bacd4095b739809afe6f5c124bff Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Thu, 27 Nov 2025 20:09:19 +0200
Subject: [PATCH 1/2] nixos/pulseaudio: allow to control tcp.port

---
 nixos/modules/services/audio/pulseaudio.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/audio/pulseaudio.nix b/nixos/modules/services/audio/pulseaudio.nix
index b4ef09f49760..8bba4ebd008c 100644
--- a/nixos/modules/services/audio/pulseaudio.nix
+++ b/nixos/modules/services/audio/pulseaudio.nix
@@ -36,6 +36,7 @@ let
           a = cfg.tcp.anonymousClients.allowedIpRanges;
         in
         lib.optional (a != [ ]) ''auth-ip-acl=${lib.concatStringsSep ";" a}'';
+      port = lib.optional (!(isNull cfg.tcp.port)) "port=${toString cfg.tcp.port}";
     in
     pkgs.writeTextFile {
       name = "default.pa";
@@ -44,7 +45,7 @@ let
         ${addModuleIf cfg.zeroconf.publish.enable "module-zeroconf-publish"}
         ${addModuleIf cfg.zeroconf.discovery.enable "module-zeroconf-discover"}
         ${addModuleIf cfg.tcp.enable (
-          lib.concatStringsSep " " ([ "module-native-protocol-tcp" ] ++ allAnon ++ ipAnon)
+          lib.concatStringsSep " " ([ "module-native-protocol-tcp" ] ++ allAnon ++ ipAnon ++ port)
         )}
         ${addModuleIf config.services.jack.jackd.enable "module-jack-sink"}
         ${addModuleIf config.services.jack.jackd.enable "module-jack-source"}
@@ -206,6 +207,18 @@ in
       tcp = {
         enable = lib.mkEnableOption "tcp streaming support";
 
+        port = lib.mkOption {
+          type = lib.types.nullOr lib.types.port;
+          description = ''
+            TCP connection port. The default `null` value, means
+            pulseaudio will try to use the default 4713 port, but if it is
+            occupied, it will fallback to a random port.
+          '';
+          # Per https://www.freedesktop.org/wiki/Software/PulseAudio/Documentation/User/Network/#directconnection
+          example = 4713;
+          default = null;
+        };
+
         anonymousClients = {
           allowAll = lib.mkEnableOption "all anonymous clients to stream to the server";
           allowedIpRanges = lib.mkOption {

From 1c77ea5916d409d92131ed82b0e202f1a3fe75a5 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Thu, 27 Nov 2025 20:10:17 +0200
Subject: [PATCH 2/2] nixos/pulseaudio add tcp.openFirewall option

Inspired by discussion at #34852
---
 nixos/modules/services/audio/pulseaudio.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/nixos/modules/services/audio/pulseaudio.nix b/nixos/modules/services/audio/pulseaudio.nix
index 8bba4ebd008c..8f1bfb98cd08 100644
--- a/nixos/modules/services/audio/pulseaudio.nix
+++ b/nixos/modules/services/audio/pulseaudio.nix
@@ -206,6 +206,7 @@ in
       # TODO: enable by default?
       tcp = {
         enable = lib.mkEnableOption "tcp streaming support";
+        openFirewall = lib.mkEnableOption "Open firewall for the specified port";
 
         port = lib.mkOption {
           type = lib.types.nullOr lib.types.port;
@@ -239,6 +240,12 @@ in
   config = lib.mkIf cfg.enable (
     lib.mkMerge [
       {
+        assertions = [
+          {
+            assertion = cfg.tcp.openFirewall -> (!isNull cfg.tcp.port);
+            message = "If you wish to open the firewall for the Pulseaudio's tcp.port, set the port explicitly";
+          }
+        ];
         environment.etc."pulse/client.conf".source = clientConf;
 
         environment.systemPackages = [ overriddenPackage ];
@@ -293,6 +300,9 @@ in
         services.avahi.publish.enable = true;
         services.avahi.publish.userServices = true;
       })
+      (lib.mkIf cfg.tcp.openFirewall {
+        networking.firewall.allowedTCPPorts = [ cfg.tcp.port ];
+      })
 
       (lib.mkIf (!cfg.systemWide) {
         environment.etc = {