gnome-clocks: fix sound an sandboxing artifacts

hosts/common/programs/assorted.nix

@@ -445,11 +445,6 @@ in
     "gnome.gnome-calendar".sandbox.method = "bwrap";
     "gnome.gnome-calendar".sandbox.whitelistWayland = true;
 
-    "gnome.gnome-clocks".buildCost = 1;
-    "gnome.gnome-clocks".sandbox.method = "bwrap";
-    "gnome.gnome-clocks".sandbox.whitelistWayland = true;
-    "gnome.gnome-clocks".suggestedPrograms = [ "dconf" ];
-
     # gnome-disks
     "gnome.gnome-disk-utility".buildCost = 1;
     "gnome.gnome-disk-utility".sandbox.method = "bwrap";

hosts/common/programs/default.nix

@@ -48,6 +48,7 @@
     ./gdbus.nix
     ./geary.nix
     ./git.nix
+    ./gnome-clocks.nix
     ./gnome-feeds.nix
     ./gnome-keyring
     ./gnome-maps.nix

hosts/common/programs/gnome-clocks.nix

@@ -0,0 +1,24 @@
+{ pkgs, ... }: {
+  sane.programs."gnome.gnome-clocks" = {
+    packageUnwrapped = pkgs.gnome.gnome-clocks.overrideAttrs (upstream: {
+      # TODO: upstream this
+      buildInputs = upstream.buildInputs ++ (with pkgs; [
+        # gnome-clocks needs `playbin` (gst-plugins-base) and `scaletempo` (gst-plugins-good)
+        # to play the alarm when a timer expires
+        gst_all_1.gstreamer
+        gst_all_1.gst-plugins-base
+        gst_all_1.gst-plugins-good
+      ]);
+    });
+
+    buildCost = 1;
+    sandbox.method = "bwrap";
+    sandbox.whitelistAudio = true;
+    sandbox.whitelistDbus = [ "user" ];  #< required (alongside .config/dconf) to remember timers
+    sandbox.whitelistWayland = true;
+    sandbox.extraPaths = [
+      ".config/dconf"  # required (alongside dbus) to remember timers
+    ];
+    suggestedPrograms = [ "dconf" ];
+  };
+}