From 442655157820f3985ff5c041b159fc5272e485ed Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Wed, 29 Apr 2026 14:13:16 -0400
Subject: [PATCH] nixos/incus: gate bucket support since it requires insecure
 minio

If upstream replaces minio for v7, we can drop this, but minio is now insecure forcing us to act.
---
 nixos/modules/virtualisation/incus.nix | 13 +++++++++++--
 nixos/tests/incus/incus-tests.nix      |  1 +
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index cd49fc870e0f..a0842be7e93d 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -54,8 +54,6 @@ let
       lvm2
       lz4
       lxcfs
-      minio
-      minio-client
       nftables
       qemu-utils
       qemu_kvm
@@ -99,6 +97,10 @@ let
     ]
     ++ lib.optionals nvidiaEnabled [
       libnvidia-container
+    ]
+    ++ lib.optionals cfg.bucketSupport [
+      minio
+      minio-client
     ];
 
   # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
@@ -211,6 +213,13 @@ in
         description = "The incus client package to use. This package is added to PATH.";
       };
 
+      bucketSupport = lib.mkOption {
+        type = lib.types.bool;
+        description = "Enable bucket support using minio, which is an insecure and unmaintained S3 provider.";
+        default = if lib.versionAtLeast config.system.stateVersion "26.11" then false else null;
+        defaultText = lib.literalExpression ''if lib.versionAtLeast config.system.stateVersion "26.11" then false else null;'';
+      };
+
       softDaemonRestart = lib.mkOption {
         type = lib.types.bool;
         default = true;
diff --git a/nixos/tests/incus/incus-tests.nix b/nixos/tests/incus/incus-tests.nix
index b28eb12b2ef1..34cfdc63e219 100644
--- a/nixos/tests/incus/incus-tests.nix
+++ b/nixos/tests/incus/incus-tests.nix
@@ -51,6 +51,7 @@ in
       incus = {
         enable = true;
         package = cfg.package;
+        bucketSupport = false;
 
         preseed = {
           networks = [