Add TTS to Home Assistant

hosts/iron/services/default.nix

@@ -20,6 +20,7 @@
     ./snapclient.nix
     ./snapserver.nix
     ./sturzbach.nix
+    ./tts.nix
     ./unifi-controller.nix
     ./whatsapp.nix
   ];

hosts/iron/services/home-assistant.nix

@@ -2,6 +2,7 @@ args@{ lib, pkgs, config, custom-utils, ... }:
 let
   ports = import ../ports.nix args;
   interfaces = import ../interfaces.nix;
+  domain = "hass.jalr.de";
 in
 {
   sops.secrets.home-assistant = {
@@ -64,7 +65,9 @@ in
       "esphome"
       "local_todo"
       "openweathermap"
+      "wyoming"
       "xiaomi_ble"
+      "vlc_telnet"
     ];
     customComponents = with pkgs.home-assistant-custom-components; [
       adaptive_lighting
@@ -87,6 +90,8 @@ in
         temperature_unit = "C";
         longitude = config.location.longitude;
         latitude = config.location.latitude;
+        external_url = "https://${domain}/";
+        internal_url = "https://${domain}/";
       };
       default_config = { };
       adaptive_lighting = {
@@ -194,6 +199,49 @@ in
       }
     ];
   };
+
+  systemd.services.hass-vlc = {
+    script = ''
+      exec ${pkgs.vlc}/bin/cvlc \
+          --no-video \
+          -I telnet \
+          --telnet-password=vlc \
+          --sout='#transcode{acodec=s16le,channels=2,samplerate=48000}:std{access=file,mux=raw,dst=/run/snapserver/hass.fifo}' \
+          --aout=none
+    '';
+    serviceConfig = {
+      BindPaths = [ "/run/snapserver/hass.fifo" ];
+      BindReadOnlyPaths = [ "/nix/store" "/etc/ssl/certs" "/etc/static/ssl/certs" ];
+      CapabilityBoundingSet = "";
+      DynamicUser = "true";
+      Group = "snapserver";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = lib.mkForce true;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "noaccess";
+      ProtectSystem = "strict";
+      RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      RootDirectory = "/run/hass-vlc";
+      RuntimeDirectory = "hass-vlc";
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [ "@system-service" "~@privileged" ];
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+
   networking.firewall.interfaces."${interfaces.lan}".allowedTCPPorts = [ ports.mqtt.tcp ];
   networking.firewall.interfaces.iot.allowedTCPPorts = [ ports.mqtt.tcp ];
 
@@ -210,7 +258,7 @@ in
     "f ${config.services.home-assistant.configDir}/scenes.yaml 0755 hass hass"
   ];
 
-  services.nginx.virtualHosts."hass.jalr.de" = {
+  services.nginx.virtualHosts."${domain}" = {
     enableACME = true;
     forceSSL = true;
     kTLS = true;

hosts/iron/services/snapserver.nix

@@ -7,10 +7,18 @@ in
   services.snapserver = {
     enable = true;
     streams = {
+      default = {
+        type = "meta";
+        location = "meta:///hass/airplay/mopidy";
+      };
       mopidy = {
         type = "pipe";
         location = "/run/snapserver/mopidy.fifo";
       };
+      hass = {
+        type = "pipe";
+        location = "/run/snapserver/hass.fifo";
+      };
       airplay = {
         type = "airplay";
         location = lib.getExe' pkgs.shairport-sync "shairport-sync";

hosts/iron/services/tts.nix

@@ -0,0 +1,7 @@
+{
+  services.wyoming.piper.servers.default = {
+    enable = true;
+    uri = "tcp://127.0.0.1:10200";
+    voice = "de_DE-thorsten-high";
+  };
+}