Merge master into staging-next

- [ZITADEL](https://zitadel.com), a turnkey identity and access management platform. Available as [services.zitadel](#opt-services.zitadel.enable).

- [exportarr](https://github.com/onedr0p/exportarr), Prometheus Exporters for Bazarr, Lidarr, Prowlarr, Radarr, Readarr, and Sonarr. Available as [services.prometheus.exporters.exportarr-bazarr](#opt-services.prometheus.exporters.exportarr-bazarr.enable)/[services.prometheus.exporters.exportarr-lidarr](#opt-services.prometheus.exporters.exportarr-lidarr.enable)/[services.prometheus.exporters.exportarr-prowlarr](#opt-services.prometheus.exporters.exportarr-prowlarr.enable)/[services.prometheus.exporters.exportarr-radarr](#opt-services.prometheus.exporters.exportarr-radarr.enable)/[services.prometheus.exporters.exportarr-readarr](#opt-services.prometheus.exporters.exportarr-readarr.enable)/[services.prometheus.exporters.exportarr-sonarr](#opt-services.prometheus.exporters.exportarr-sonarr.enable).

- [netclient](https://github.com/gravitl/netclient), an automated WireGuard® Management Client. Available as [services.netclient](#opt-services.netclient.enable).

- [trunk-ng](https://github.com/ctron/trunk), A fork of `trunk`: Build, bundle & ship your Rust WASM application to the web

- The Linux kernel module `msr` (see [`msr(4)`](https://man7.org/linux/man-pages/man4/msr.4.html)), which provides an interface to read and write the model-specific registers (MSRs) of an x86 CPU, can now be configured via `hardware.cpu.x86.msr`.

- Docker now defaults to 24, as 20.10 is stopping to receive security updates and bug fixes after [December 10, 2023](https://github.com/moby/moby/discussions/45104).

- There is a new NixOS option when writing NixOS tests `testing.initrdBackdoor`, that enables `backdoor.service` in initrd. Requires `boot.initrd.systemd.enable` to be enabled. Boot will pause in stage 1 at `initrd.target`, and will listen for commands from the `Machine` python interface, just like stage 2 normally does. This enables commands to be sent to test and debug stage 1. Use `machine.switch_root()` to leave stage 1 and proceed to stage 2.

let

  inherit (lib) concatStrings foldl foldl' genAttrs literalExpression maintainers

                mapAttrsToList mkDefault mkEnableOption mkIf mkMerge mkOption

    mapAttrs mapAttrsToList mkDefault mkEnableOption mkIf mkMerge mkOption

    optional types mkOptionDefault flip attrNames;

  cfg = config.services.prometheus.exporters;

  #  systemd service must be provided by specifying either

  #  `serviceOpts.script` or `serviceOpts.serviceConfig.ExecStart`

  exporterOpts = genAttrs [

  exporterOpts = (genAttrs [

    "apcupsd"

    "artifactory"

    "bind"

    "domain"

    "dovecot"

    "fastly"

    "flow"

    "fritzbox"

    "graphite"

    "idrac"

    "imap-mailstat"

    "influxdb"

    "ipmi"

    "json"

    "jitsi"

    "json"

    "junos-czerwonk"

    "kea"

    "keylight"

    "scaphandre"

    "script"

    "shelly"

    "snmp"

    "smartctl"

    "smokeping"

    "snmp"

    "sql"

    "statsd"

    "surfboard"

    "v2ray"

    "varnish"

    "wireguard"

    "flow"

    "zfs"

  ] (name:

  ]

    (name:

      import (./. + "/exporters/${name}.nix") { inherit config lib pkgs options; }

    )) // (mapAttrs

    (name: params:

      import (./. + "/exporters/${params.name}.nix") { inherit config lib pkgs options; type = params.type ; })

    {

      exportarr-bazarr = {

        name = "exportarr";

        type = "bazarr";

      };

      exportarr-lidarr = {

        name = "exportarr";

        type = "lidarr";

      };

      exportarr-prowlarr = {

        name = "exportarr";

        type = "prowlarr";

      };

      exportarr-radarr = {

        name = "exportarr";

        type = "radarr";

      };

      exportarr-readarr = {

        name = "exportarr";

        type = "readarr";

      };

      exportarr-sonarr = {

        name = "exportarr";

        type = "sonarr";

      };

    }

  );

  mkExporterOpts = ({ name, port }: {

{ config, lib, pkgs, options, type }:

let

  cfg = config.services.prometheus.exporters."exportarr-${type}";

  exportarrEnvironment = (

    lib.mapAttrs (_: toString) cfg.environment

  ) // {

    PORT = toString cfg.port;

    URL = cfg.url;

    API_KEY_FILE = lib.mkIf (cfg.apiKeyFile != null) "%d/api-key";

  };

in

{

  port = 9708;

  extraOpts = {

    url = lib.mkOption {

      type = lib.types.str;

      default = "http://127.0.0.1";

      description = lib.mdDoc ''

        The full URL to Sonarr, Radarr, or Lidarr.

      '';

    };

    apiKeyFile = lib.mkOption {

      type = lib.types.nullOr lib.types.path;

      default = null;

      description = lib.mdDoc ''

        File containing the api-key.

      '';

    };

    package = lib.mkPackageOptionMD pkgs "exportarr" { };

    environment = lib.mkOption {

      type = lib.types.attrsOf lib.types.str;

      default = { };

      description = lib.mdDoc ''

        See [the configuration guide](https://github.com/onedr0p/exportarr#configuration) for available options.

      '';

      example = {

        PROWLARR__BACKFILL = true;

      };

    };

  };

  serviceOpts = {

    serviceConfig = {

      LoadCredential = lib.optionalString (cfg.apiKeyFile != null) "api-key:${cfg.apiKeyFile}";

      ExecStart = ''${cfg.package}/bin/exportarr ${type} "$@"'';

      ProcSubset = "pid";

      ProtectProc = "invisible";

      SystemCallFilter = ["@system-service" "~@privileged"];

    };

    environment = exportarrEnvironment;

  };

}

      '';

    };

    exportarr-sonarr = {

      nodeName = "exportarr_sonarr";

      exporterConfig = {

        enable = true;

        url = "http://127.0.0.1:8989";

        # testing for real data is tricky, because the api key can not be preconfigured

        apiKeyFile = pkgs.writeText "dummy-api-key" "eccff6a992bc2e4b88e46d064b26bb4e";

      };

      exporterTest = ''

        wait_for_unit("prometheus-exportarr-sonarr-exporter.service")

        wait_for_open_port(9707)

        succeed("curl -sSf 'http://localhost:9707/metrics")

      '';

    };

    fastly = {

      exporterConfig = {

        enable = true;