programs.tmux: implement secureSocket

modules/programs/tmux.nix

@@ -251,7 +251,7 @@ in
           ++ optional cfg.tmuxinator.enable pkgs.tmuxinator
           ++ optional cfg.tmuxp.enable      pkgs.tmuxp;
 
-          home.file.".tmux.conf".text = tmuxConf;
+        home.file.".tmux.conf".text = tmuxConf;
       }
 
       (mkIf cfg.sensibleOnTop {
@@ -264,6 +264,12 @@ in
         '';
       })
 
+      (mkIf cfg.secureSocket {
+        home.sessionVariables = {
+          TMUX_TMPDIR = ''''${XDG_RUNTIME_DIR:-"/run/user/\$(id -u)"}'';
+        };
+      })
+
       (mkIf (cfg.plugins != []) {
         assertions = [(
           let

tests/modules/programs/tmux/default.nix

@@ -2,4 +2,5 @@
   tmux-emacs-with-plugins = ./emacs-with-plugins.nix;
   tmux-not-enabled = ./not-enabled.nix;
   tmux-vi-all-true = ./vi-all-true.nix;
+  tmux-secure-socket-enabled = ./secure-socket-enabled.nix;
 }

tests/modules/programs/tmux/hm-session-vars.sh

@@ -0,0 +1,5 @@
+# Only source this once.
+if [ -n "$__HM_SESS_VARS_SOURCED" ]; then return; fi
+export __HM_SESS_VARS_SOURCED=1
+
+export TMUX_TMPDIR="${XDG_RUNTIME_DIR:-"/run/user/\$(id -u)"}"

tests/modules/programs/tmux/secure-socket-enabled.nix

@@ -0,0 +1,17 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  config = {
+    programs.tmux = {
+      enable = true;
+      secureSocket = true;
+    };
+
+    nmt.script = ''
+      assertFileExists home-path/etc/profile.d/hm-session-vars.sh
+      assertFileContent home-path/etc/profile.d/hm-session-vars.sh ${./hm-session-vars.sh}
+    '';
+  };
+}