nixos/stash-clipboard: init

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -36,6 +36,8 @@
 
 - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service) is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as [services.matrix-authentication-service](#opt-services.matrix-authentication-service.enable).
 
+- [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -981,6 +981,7 @@
   ./services/misc/spice-webdavd.nix
   ./services/misc/spoolman.nix
   ./services/misc/sssd.nix
+  ./services/misc/stash-clipboard.nix
   ./services/misc/subsonic.nix
   ./services/misc/sundtek.nix
   ./services/misc/svnserve.nix

nixos/modules/services/misc/stash-clipboard.nix

@@ -0,0 +1,73 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.stash-clipboard;
+  inherit (lib)
+    mkPackageOption
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    getExe
+    concatStringsSep
+    ;
+in
+{
+  options.services.stash-clipboard = {
+    enable = mkEnableOption "stash, a Wayland clipboard manager";
+
+    package = mkPackageOption pkgs [ "stash-clipboard" ] { };
+
+    arguments = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "--max-items 10" ];
+      description = "A list of arguments to pass to stash watch.";
+    };
+
+    filterFile = mkOption {
+      type = types.str;
+      default = "";
+      example = "/etc/stash/clipboard_filter";
+      description = ''
+        Stash can be configured to avoid storing clipboard entries that match a sensitive pattern, using a regular expression.
+        The file set here should contain your regex pattern (no quotes).
+
+        Example regex to block common password patterns:
+        - (password|secret|api[_-]?key|token)[=: ]+[^\s]+
+      '';
+    };
+
+    excludedApps = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "Bitwarden" ];
+      description = ''
+        List of application classes to exclude from the database.
+        Entries from these apps are still copied to the clipboard, but it will never be put inside the database.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    systemd = {
+      user.services.stash-clipboard = {
+        description = "Stash clipboard manager daemon";
+        wantedBy = [ "graphical-session.target" ];
+        after = [ "graphical-session.target" ];
+        serviceConfig = {
+          ExecStart = "${getExe cfg.package} ${concatStringsSep " " cfg.arguments} watch";
+          LoadCredential = mkIf (cfg.filterFile != "") "clipboard_filter:${cfg.filterFile}";
+        };
+        environment = mkIf (cfg.excludedApps != [ ]) {
+          STASH_EXCLUDED_APPS = concatStringsSep "," cfg.excludedApps;
+        };
+      };
+    };
+  };
+}