colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

pipewire: split rtkit into own file, and use defaults from pipewire project

Browse Source
This commit is contained in:
Colin
2024-04-23 06:10:59 +00:00
parent 5006692594
commit 87e3f2a9ef
2 changed files with 60 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
hosts/common/programs/pipewire.nix
View File

@@ -21,10 +21,13 @@ in
};
};
suggestedPrograms = [ "rtkit" "wireplumber" ];
suggestedPrograms = [
"rtkit"
"wireplumber"
];
sandbox.method = "landlock";
# sandbox.method = "bwrap"; #< also works, but can't claim the full scheduling priority it wants
# sandbox.method = "landlock";
sandbox.method = "bwrap"; #< also works, but can't claim the full scheduling priority it wants
sandbox.whitelistAudio = true;
sandbox.whitelistDbus = [
# dbus is used for rtkit integration
@@ -38,13 +41,13 @@ in
];
sandbox.wrapperType = "inplace"; #< its config files refer to its binaries by full path
sandbox.extraConfig = [
"--sane-sandbox-keep-namespace" "pid"
];
sandbox.capabilities = [
# if using landlock, these capabilities allow pipewire to claim higher scheduling priority
"ipc_lock"
"sys_nice"
"--sane-sandbox-keep-namespace" "pid" #< required for rtkit
];
# sandbox.capabilities = [
# # if rtkit isn't present, and sandboxing is via landlock, these capabilities allow pipewire to claim higher scheduling priority
# "ipc_lock"
# "sys_nice"
# ];
sandbox.usePortal = false;
sandbox.extraPaths = [
"/dev/snd"
@@ -88,7 +91,7 @@ in
services.pipewire = {
description = "pipewire: multimedia service";
partOf = [ "sound" ];
depends = [ "rtkit" ];
# depends = [ "rtkit" ];
# depends = [ "xdg-desktop-portal" ]; # for Realtime portal (dependency cycle)
# env PIPEWIRE_LOG_SYSTEMD=false"
# env PIPEWIRE_DEBUG"*:3,mod.raop*:5,pw.rtsp-client*:5"

53
hosts/common/programs/rtkit.nix
View File

@@ -5,20 +5,61 @@
# - note that `rtkit-daemon` can be launched with a lot of config
# - suggest using a much less aggressive canary. maybe try that?
# - see: <https://gitlab.freedesktop.org/pipewire/pipewire/-/wikis/Performance-tuning>
{ config, lib, ... }:
{ config, lib, pkgs, ... }:
let
cfg = config.sane.programs.rtkit;
in
{
sane.programs.rtkit = {
services.rtkit = {
description = "rtkit: grant realtime scheduling privileges to select processes";
command = "${cfg.package}/libexec/rtkit-daemon";
};
packageUnwrapped = pkgs.rmDbusServices pkgs.rtkit;
# services.rtkit = {
# description = "rtkit: grant realtime scheduling privileges to select processes";
# command = "${cfg.package}/libexec/rtkit-daemon";
# };
};
systemd.services.rtkit-daemon = lib.mkIf cfg.enabled {
description = "rtkit: grant realtime scheduling privileges to select processes";
wantedBy = [ "default.target" ];
serviceConfig = {
ExecStart = lib.escapeShellArgs [
"${cfg.package}/libexec/rtkit-daemon"
"--scheduling-policy=FIFO"
"--our-realtime-priority=89"
"--max-realtime-priority=88"
"--min-nice-level=-19"
"--rttime-usec-max=2000000"
"--users-max=100"
"--processes-per-user-max=1000"
"--threads-per-user-max=10000"
"--actions-burst-sec=10"
"--actions-per-burst-max=1000"
"--canary-cheep-msec=30000"
"--canary-watchdog-msec=60000"
];
Type = "simple";
# Type = "dbus";
# BusName = "org.freedesktop.RealtimeKit1";
Restart = "on-failure";
# User = "rtkit"; # it wants starts as root
# Group = "rtkit";
# wantedBy = [ "default.target" ];
# TODO: harden
CapabilityBoundingSet = "CAP_SYS_NICE CAP_DAC_READ_SEARCH CAP_SYS_CHROOT CAP_SETGID CAP_SETUID";
};
};
users.users.rtkit = lib.mkIf cfg.enabled {
isSystemUser = true;
group = "rtkit";
description = "RealtimeKit daemon";
};
users.groups.rtkit = lib.mkIf cfg.enabled {};
environment.systemPackages = lib.mkIf cfg.enabled [
cfg.package # "to make polkit pickup rtkit policies". TODO: needed?
# for /share/polkit-1, but unclear if actually needed
cfg.package
];
security.polkit = lib.mkIf cfg.enabled {
enable = true;