nixos/hddfancontrol: use attrset for config

- All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.

- hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes.

- hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes. The settings options have been modified to use an attrset, enabling configurations with multiple instances of the daemon running at once, eg, for two separate drive bays.

- `services.cloudflared` now uses a dynamic user, and its `user` and `group` options have been removed. If the user or group is still necessary, they can be created manually.

      "hddfancontrol"

      "smartctl"

    ] "Smartctl is now automatically used when necessary, which makes this option redundant")

    (lib.mkRemovedOptionModule [

      "services"

      "hddfancontrol"

      "disks"

    ] "Disks should now be specified per hddfancontrol instance in its attrset")

    (lib.mkRemovedOptionModule [

      "services"

      "hddfancontrol"

      "pwmPaths"

    ] "Pwm Paths should now be specified per hddfancontrol instance in its attrset")

    (lib.mkRemovedOptionModule [

      "services"

      "hddfancontrol"

      "logVerbosity"

    ] "Log Verbosity should now be specified per hddfancontrol instance in its attrset")

    (lib.mkRemovedOptionModule [

      "services"

      "hddfancontrol"

      "extraArgs"

    ] "Extra Args should now be specified per hddfancontrol instance in its attrset")

  ];

  options = {

    services.hddfancontrol.enable = lib.mkEnableOption "hddfancontrol daemon";

    services.hddfancontrol.disks = lib.mkOption {

    services.hddfancontrol.settings = lib.mkOption {

      type = lib.types.attrsWith {

        placeholder = "drive-bay-name";

        elemType = (

          lib.types.submodule (

            { ... }:

            {

              options = {

                disks = lib.mkOption {

                  type = lib.types.listOf lib.types.path;

                  default = [ ];

                  description = ''

                  example = [ "/dev/sda" ];

                };

    services.hddfancontrol.pwmPaths = lib.mkOption {

                pwmPaths = lib.mkOption {

                  type = lib.types.listOf lib.types.path;

                  default = [ ];

                  description = ''

                  example = [ "/sys/class/hwmon/hwmon2/pwm1:30:10" ];

                };

    services.hddfancontrol.logVerbosity = lib.mkOption {

                logVerbosity = lib.mkOption {

                  type = lib.types.enum [

                    "TRACE"

                    "DEBUG"

                  '';

                };

    services.hddfancontrol.extraArgs = lib.mkOption {

                extraArgs = lib.mkOption {

                  type = lib.types.listOf lib.types.str;

                  default = [ ];

                  description = ''

                  ];

                };

              };

            }

          )

        );

      };

      default = { };

      description = ''

        Parameter-sets for each instance of hddfancontrol.

      '';

      example = lib.literalExpression ''

        {

          harddrives = {

            disks = [

              "/dev/sda"

              "/dev/sdb"

              "/dev/sdc"

            ];

            pwmPaths = [

              "/sys/class/hwmon/hwmon1/pwm1:25:10"

            ];

            logVerbosity = "DEBUG";

          };

          ssddrives = {

            disks = [

              "/dev/sdd"

              "/dev/sde"

              "/dev/sdf"

            ];

            pwmPaths = [

              "/sys/class/hwmon/hwmon1/pwm2:25:10"

            ];

            extraArgs = [

              "--interval=30s"

            ];

          };

        }

      '';

    };

  };

  config = lib.mkIf cfg.enable (

    let

      args = lib.concatLists [

      args =

        cnf:

        lib.concatLists [

          [ "-d" ]

        cfg.disks

          cnf.disks

          [ "-p" ]

        cfg.pwmPaths

        cfg.extraArgs

          cnf.pwmPaths

          cnf.extraArgs

        ];

      createService = cnf: {

        description = "HDD fan control";

        documentation = [ "man:hddfancontrol(1)" ];

        after = [ "hddtemp.service" ];

        wants = [ "hddtemp.service" ];

        serviceConfig = {

          ExecStart = "${lib.getExe pkgs.hddfancontrol} -v ${cnf.logVerbosity} daemon ${lib.escapeShellArgs (args cnf)}";

          CPUSchedulingPolicy = "rr";

          CPUSchedulingPriority = 49;

          ProtectSystem = "strict";

          PrivateTmp = true;

          ProtectHome = true;

          SystemCallArchitectures = "native";

          MemoryDenyWriteExecute = true;

          NoNewPrivileges = true;

        };

        wantedBy = [ "multi-user.target" ];

      };

      services = lib.attrsets.mergeAttrsList [

        (lib.attrsets.mapAttrs' (

          name: cnf: lib.nameValuePair "hddfancontrol-${name}" (createService cnf)

        ) cfg.settings)

        {

          "hddfancontrol".enable = false;

        }

      ];

    in

    {

      hardware.sensor.hddtemp = {

        enable = true;

        drives = cfg.disks;

        drives = lib.lists.flatten (lib.attrsets.catAttrs "disks" (lib.attrsets.attrValues cfg.settings));

      };

      systemd.services.hddfancontrol = {

        wantedBy = [ "multi-user.target" ];

        environment = {

          HDDFANCONTROL_LOG_LEVEL = cfg.logVerbosity;

          HDDFANCONTROL_DAEMON_ARGS = lib.escapeShellArgs args;

        };

      };

      systemd.services = services;

    }

  );

}