From f8f8731303e238b9b45a368e3c81b75b635e8901 Mon Sep 17 00:00:00 2001
From: vi <vi@slack.church>
Date: Mon, 1 Dec 2025 00:00:00 +0000
Subject: [PATCH] neptune: lan hosts can stream audio to speakers

---
 inventories/default.nix                    | 11 ++++++
 modules/clan/pulse-stream/default.nix      | 43 ++++++++++++++++++++++
 modules/clan/pulse-stream/flake-module.nix |  9 +++++
 3 files changed, 63 insertions(+)
 create mode 100644 modules/clan/pulse-stream/default.nix
 create mode 100644 modules/clan/pulse-stream/flake-module.nix

diff --git a/inventories/default.nix b/inventories/default.nix
index c820b80..3badb1b 100644
--- a/inventories/default.nix
+++ b/inventories/default.nix
@@ -169,6 +169,17 @@
           };
           roles.default.machines.b4l = { };
         };
+        pulse-stream = {
+          module = {
+            name = "pulse-stream";
+            input = "self";
+          };
+          roles.default.machines.neptune = {
+            settings.client-ip-ranges = [
+              "10.0.0.0/24"
+            ];
+          };
+        };
       };
     };
   };
diff --git a/modules/clan/pulse-stream/default.nix b/modules/clan/pulse-stream/default.nix
new file mode 100644
index 0000000..399dd64
--- /dev/null
+++ b/modules/clan/pulse-stream/default.nix
@@ -0,0 +1,43 @@
+{ ... }:
+{
+  _class = "clan.service";
+  manifest.name = "pulse-stream";
+  manifest.description = "stream audio to attached speakers";
+  manifest.categories = [ "System" ];
+
+  roles.default = {
+    interface =
+      { lib, ... }:
+      {
+        options.client-ip-ranges = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          description = "ip subnets permitted to stream to the server";
+          default = [];
+        };
+      };
+    perInstance =
+      {
+        roles,
+        settings,
+        ...
+      }:
+      {
+        nixosModule =
+          { ... }:
+          {
+            services.pulseaudio = {
+              enable = true;
+              systemWide = true;
+              tcp = {
+                enable = true;
+                anonymousClients.allowedIpRanges =
+                  settings.client-ip-ranges;
+                anonymousClients.allowAll = true;
+              };
+              zeroconf.publish.enable = true;
+            };
+            networking.firewall.allowedTCPPorts = [ 4713 ];
+          };
+      };
+  };
+}
diff --git a/modules/clan/pulse-stream/flake-module.nix b/modules/clan/pulse-stream/flake-module.nix
new file mode 100644
index 0000000..1b20f6d
--- /dev/null
+++ b/modules/clan/pulse-stream/flake-module.nix
@@ -0,0 +1,9 @@
+{ lib, ... }:
+let
+  module = lib.modules.importApply ./default.nix { };
+in
+{
+  clan.modules = {
+    pulse-stream = module;
+  };
+}