Merge master into staging-next

# fetchurl: nixfmt-rfc-style

ce21e97a1f20dee15da85c084f9d1148d84f853b

# percona: apply nixfmt

8d14fa2886fec877690c6d28cfcdba4503dbbcea

- [Immich](https://github.com/immich-app/immich), a self-hosted photo and video backup solution. Available as [services.immich](#opt-services.immich.enable).

- [saunafs](https://saunafs.com) Distributed POSIX file system. Available as [services.saunafs](options.html#opt-services.saunafs).

- [obs-studio](https://obsproject.com/), Free and open source software for video recording and live streaming. Available as [programs.obs-studio.enable](#opt-programs.obs-studio.enable).

- [Veilid](https://veilid.com), a headless server that enables privacy-focused data sharing and messaging on a peer-to-peer network. Available as [services.veilid](#opt-services.veilid.enable).

- The nvidia driver no longer defaults to the proprietary driver starting with version 560. You will need to manually set `hardware.nvidia.open` to select the proprietary or open driver.

- The `(buildPythonPackage { ... }).override` attribute is now deprecated and removed in favour of `overridePythonAttrs`.

  This change does not affect the override interface of most Python packages, as [`<pkg>.override`](https://nixos.org/manual/nixpkgs/unstable/#sec-pkg-override) provided by `callPackage` shadows such a locally-defined `override` attribute.

- All Cinnamon and XApp packages have been moved to top-level (i.e., `cinnamon.nemo` is now `nemo`).

- All GNOME packages have been moved to top-level (i.e., `gnome.nautilus` is now `nautilus`).

  Also be aware that if you have set additional options in `services.wstunnel.{clients,servers}.<name>.extraArgs`,

  that those might have been removed or modified upstream.

- `percona-server_8_4` and `mysql84` now have password authentication via the deprecated `mysql_native_password` disabled by default. This authentication plugin can be enabled via a CLI argument again, for detailed instructions and alternative authentication methods [see upstream documentation](https://dev.mysql.com/doc/refman/8.4/en/native-pluggable-authentication.html). The config file directive `default_authentication_plugin` has been removed.

- Percona has decided not to follow the LTS/ Innovation release scheme of upstream MySQL and thus [will only create releases for MySQL LTS versions](https://www.percona.com/blog/no-mysql-9-x-innovation-releases-from-percona/). Hence, the package names `percona-server_lts`, `percona-server_innovation`, `percona-xtrabackup_lts` and `percona-xtrabackup_innovation` are deprecated.

  - `percona-server` and `percona-server_lts` now point towards the new LTS release `percona-server_8_4`. The previous LTS continues to be supported and is available as `percona-server_8_0`. The same is true for the supporting `percona-xtrabackup` tooling.

- `clang-tools_<version>` packages have been moved into `llvmPackages_<version>` (i.e. `clang-tools_18` is now `llvmPackages_18.clang-tools`).

  - For convenience, the top-level `clang-tools` attribute remains and is now bound to `llvmPackages.clang-tools`.

  - Top-level `clang_tools_<version>` attributes are now aliases; these will be removed in a future release.

  ./services/network-filesystems/rsyncd.nix

  ./services/network-filesystems/samba-wsdd.nix

  ./services/network-filesystems/samba.nix

  ./services/network-filesystems/saunafs.nix

  ./services/network-filesystems/tahoe.nix

  ./services/network-filesystems/u9fs.nix

  ./services/network-filesystems/webdav-server-rs.nix

{

  config,

  lib,

  pkgs,

  ...

}:

let

  cfg = config.services.saunafs;

  settingsFormat =

    let

      listSep = " ";

      allowedTypes = with lib.types; [

        bool

        int

        float

        str

      ];

      valueToString =

        val:

        if lib.isList val then

          lib.concatStringsSep listSep (map (x: valueToString x) val)

        else if lib.isBool val then

          (if val then "1" else "0")

        else

          toString val;

    in

    {

      type =

        let

          valueType =

            lib.types.oneOf (

              [

                (lib.types.listOf valueType)

              ]

              ++ allowedTypes

            )

            // {

              description = "Flat key-value file";

            };

        in

        lib.types.attrsOf valueType;

      generate =

        name: value:

        pkgs.writeText name (

          lib.concatStringsSep "\n" (lib.mapAttrsToList (key: val: "${key} = ${valueToString val}") value)

        );

    };

  initTool = pkgs.writeShellScriptBin "sfsmaster-init" ''

    if [ ! -e ${cfg.master.settings.DATA_PATH}/metadata.sfs ]; then

      cp --update=none ${pkgs.saunafs}/var/lib/saunafs/metadata.sfs.empty ${cfg.master.settings.DATA_PATH}/metadata.sfs

      chmod +w ${cfg.master.settings.DATA_PATH}/metadata.sfs

    fi

  '';

  # master config file

  masterCfg = settingsFormat.generate "sfsmaster.cfg" cfg.master.settings;

  # metalogger config file

  metaloggerCfg = settingsFormat.generate "sfsmetalogger.cfg" cfg.metalogger.settings;

  # chunkserver config file

  chunkserverCfg = settingsFormat.generate "sfschunkserver.cfg" cfg.chunkserver.settings;

  # generic template for all daemons

  systemdService = name: extraConfig: configFile: {

    wantedBy = [ "multi-user.target" ];

    wants = [ "network-online.target" ];

    after = [

      "network.target"

      "network-online.target"

    ];

    serviceConfig = {

      Type = "forking";

      ExecStart = "${pkgs.saunafs}/bin/sfs${name} -c ${configFile} start";

      ExecStop = "${pkgs.saunafs}/bin/sfs${name} -c ${configFile} stop";

      ExecReload = "${pkgs.saunafs}/bin/sfs${name} -c ${configFile} reload";

    } // extraConfig;

  };

in

{

  ###### interface

  options = {

    services.saunafs = {

      masterHost = lib.mkOption {

        type = lib.types.str;

        default = null;

        description = "IP or hostname name of master host.";

      };

      sfsUser = lib.mkOption {

        type = lib.types.str;

        default = "saunafs";

        description = "Run daemons as user.";

      };

      client.enable = lib.mkEnableOption "Saunafs client";

      master = {

        enable = lib.mkOption {

          type = lib.types.bool;

          description = ''

            Enable Saunafs master daemon.

            You need to run `sfsmaster-init` on a freshly installed master server to

            initialize the `DATA_PATH` directory.

          '';

          default = false;

        };

        exports = lib.mkOption {

          type = with lib.types; listOf str;

          default = null;

          description = "Paths to exports file (see {manpage}`sfsexports.cfg(5)`).";

          example = lib.literalExpression ''

            [ "* / rw,alldirs,admin,maproot=0:0" ];

          '';

        };

        openFirewall = lib.mkOption {

          type = lib.types.bool;

          description = "Whether to automatically open the necessary ports in the firewall.";

          default = false;

        };

        settings = lib.mkOption {

          type = lib.types.submodule {

            freeformType = settingsFormat.type;

            options.DATA_PATH = lib.mkOption {

              type = lib.types.str;

              default = "/var/lib/saunafs/master";

              description = "Data storage directory.";

            };

          };

          description = "Contents of config file ({manpage}`sfsmaster.cfg(5)`).";

        };

      };

      metalogger = {

        enable = lib.mkEnableOption "Saunafs metalogger daemon";

        settings = lib.mkOption {

          type = lib.types.submodule {

            freeformType = settingsFormat.type;

            options.DATA_PATH = lib.mkOption {

              type = lib.types.str;

              default = "/var/lib/saunafs/metalogger";

              description = "Data storage directory";

            };

          };

          description = "Contents of metalogger config file (see {manpage}`sfsmetalogger.cfg(5)`).";

        };

      };

      chunkserver = {

        enable = lib.mkEnableOption "Saunafs chunkserver daemon";

        openFirewall = lib.mkOption {

          type = lib.types.bool;

          description = "Whether to automatically open the necessary ports in the firewall.";

          default = false;

        };

        hdds = lib.mkOption {

          type = with lib.types; listOf str;

          default = null;

          example = lib.literalExpression ''

            [ "/mnt/hdd1" ];

          '';

          description = ''

            Mount points to be used by chunkserver for storage (see {manpage}`sfshdd.cfg(5)`).

            Note, that these mount points must writeable by the user defined by the saunafs user.

          '';

        };

        settings = lib.mkOption {

          type = lib.types.submodule {

            freeformType = settingsFormat.type;

            options.DATA_PATH = lib.mkOption {

              type = lib.types.str;

              default = "/var/lib/saunafs/chunkserver";

              description = "Directory for chunck meta data";

            };

          };

          description = "Contents of chunkserver config file (see {manpage}`sfschunkserver.cfg(5)`).";

        };

      };

    };

  };

  ###### implementation

  config =

    lib.mkIf (cfg.client.enable || cfg.master.enable || cfg.metalogger.enable || cfg.chunkserver.enable)

      {

        warnings = [

          (lib.mkIf (cfg.sfsUser == "root") "Running saunafs services as root is not recommended.")

        ];

        # Service settings

        services.saunafs = {

          master.settings = lib.mkIf cfg.master.enable {

            WORKING_USER = cfg.sfsUser;

            EXPORTS_FILENAME = toString (

              pkgs.writeText "sfsexports.cfg" (lib.concatStringsSep "\n" cfg.master.exports)

            );

          };

          metalogger.settings = lib.mkIf cfg.metalogger.enable {

            WORKING_USER = cfg.sfsUser;

            MASTER_HOST = cfg.masterHost;

          };

          chunkserver.settings = lib.mkIf cfg.chunkserver.enable {

            WORKING_USER = cfg.sfsUser;

            MASTER_HOST = cfg.masterHost;

            HDD_CONF_FILENAME = toString (

              pkgs.writeText "sfshdd.cfg" (lib.concatStringsSep "\n" cfg.chunkserver.hdds)

            );

          };

        };

        # Create system user account for daemons

        users =

          lib.mkIf

            (cfg.sfsUser != "root" && (cfg.master.enable || cfg.metalogger.enable || cfg.chunkserver.enable))

            {

              users."${cfg.sfsUser}" = {

                isSystemUser = true;

                description = "saunafs daemon user";

                group = "saunafs";

              };

              groups."${cfg.sfsUser}" = { };

            };

        environment.systemPackages =

          (lib.optional cfg.client.enable pkgs.saunafs) ++ (lib.optional cfg.master.enable initTool);

        networking.firewall.allowedTCPPorts =

          (lib.optionals cfg.master.openFirewall [

            9419

            9420

            9421

          ])

          ++ (lib.optional cfg.chunkserver.openFirewall 9422);

        # Ensure storage directories exist

        systemd.tmpfiles.rules =

          lib.optional cfg.master.enable "d ${cfg.master.settings.DATA_PATH} 0700 ${cfg.sfsUser} ${cfg.sfsUser} -"

          ++ lib.optional cfg.metalogger.enable "d ${cfg.metalogger.settings.DATA_PATH} 0700 ${cfg.sfsUser} ${cfg.sfsUser} -"

          ++ lib.optional cfg.chunkserver.enable "d ${cfg.chunkserver.settings.DATA_PATH} 0700 ${cfg.sfsUser} ${cfg.sfsUser} -";

        # Service definitions

        systemd.services.sfs-master = lib.mkIf cfg.master.enable (

          systemdService "master" {

            TimeoutStartSec = 1800;

            TimeoutStopSec = 1800;

            Restart = "no";

          } masterCfg

        );

        systemd.services.sfs-metalogger = lib.mkIf cfg.metalogger.enable (

          systemdService "metalogger" { Restart = "on-abort"; } metaloggerCfg

        );

        systemd.services.sfs-chunkserver = lib.mkIf cfg.chunkserver.enable (

          systemdService "chunkserver" { Restart = "on-abort"; } chunkserverCfg

        );

      };

}

  samba-wsdd = handleTest ./samba-wsdd.nix {};

  sane = handleTest ./sane.nix {};

  sanoid = handleTest ./sanoid.nix {};

  saunafs = handleTest ./saunafs.nix {};

  scaphandre = handleTest ./scaphandre.nix {};

  schleuder = handleTest ./schleuder.nix {};

  scion-freestanding-deployment = handleTest ./scion/freestanding-deployment {};