nixos/nfsd: allow exports to be an attrset (#538589)

nixos/modules/services/network-filesystems/nfsd.nix

@@ -6,6 +6,14 @@
 }:
 let
 
+  attrsToExports = lib.concatMapAttrsStringSep "\n" (
+    exportPoint: clientsAndOptions:
+    exportPoint
+    + lib.concatMapAttrsStringSep "" (
+      client: options: " ${client}(${lib.concatStringsSep "," options})"
+    ) clientsAndOptions
+  );
+
   cfg = config.services.nfs.server;
 
   exports = pkgs.writeText "exports" cfg.exports;
@@ -48,12 +56,26 @@ in
         };
 
         exports = lib.mkOption {
-          type = lib.types.lines;
+          type = with lib.types; coercedTo (attrsOf (attrsOf (listOf str))) attrsToExports lines;
           default = "";
           description = ''
             Contents of the /etc/exports file.  See
             {manpage}`exports(5)` for the format.
           '';
+          example = {
+            "/usr" = {
+              "*.local.domain" = [ "ro" ];
+              "@trusted" = [ "rw" ];
+            };
+            "/home/joe" = {
+              "pc001" = [
+                "rw"
+                "all_squash"
+                "anonuid=150"
+                "anongid=100"
+              ];
+            };
+          };
         };
 
         hostName = lib.mkOption {

nixos/tests/nfs/kerberos.nix

@@ -83,9 +83,16 @@ import ../make-test-python.nix (
 
           services.nfs.server.enable = true;
           services.nfs.server.createMountPoints = true;
-          services.nfs.server.exports = ''
-            /data *(rw,no_root_squash,fsid=0,sec=krb5p)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "*" = [
+                "rw"
+                "no_root_squash"
+                "fsid=0"
+                "sec=krb5p"
+              ];
+            };
+          };
         };
     };
 

nixos/tests/nfs/simple.nix

@@ -37,9 +37,16 @@ import ../make-test-python.nix (
         { ... }:
         {
           services.nfs.server.enable = true;
-          services.nfs.server.exports = ''
-            /data 192.168.1.0/255.255.255.0(rw,no_root_squash,no_subtree_check,fsid=0)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "192.168.1.0/255.255.255.0" = [
+                "rw"
+                "no_root_squash"
+                "no_subtree_check"
+                "fsid=0"
+              ];
+            };
+          };
           services.nfs.server.createMountPoints = true;
           networking.firewall.enable = false; # FIXME: figure out what ports need to be allowed
         };