diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md index 01507338ec5f..072975692cf9 100644 --- a/nixos/doc/manual/release-notes/rl-2611.section.md +++ b/nixos/doc/manual/release-notes/rl-2611.section.md @@ -36,6 +36,8 @@ - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service) is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as [services.matrix-authentication-service](#opt-services.matrix-authentication-service.enable). +- [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable). + ## Backward Incompatibilities {#sec-release-26.11-incompatibilities} diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 5c360229753f..cfe338617627 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -981,6 +981,7 @@ ./services/misc/spice-webdavd.nix ./services/misc/spoolman.nix ./services/misc/sssd.nix + ./services/misc/stash-clipboard.nix ./services/misc/subsonic.nix ./services/misc/sundtek.nix ./services/misc/svnserve.nix diff --git a/nixos/modules/services/misc/stash-clipboard.nix b/nixos/modules/services/misc/stash-clipboard.nix new file mode 100644 index 000000000000..634f6433f118 --- /dev/null +++ b/nixos/modules/services/misc/stash-clipboard.nix @@ -0,0 +1,73 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.services.stash-clipboard; + inherit (lib) + mkPackageOption + mkEnableOption + mkOption + types + mkIf + getExe + concatStringsSep + ; +in +{ + options.services.stash-clipboard = { + enable = mkEnableOption "stash, a Wayland clipboard manager"; + + package = mkPackageOption pkgs [ "stash-clipboard" ] { }; + + arguments = mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "--max-items 10" ]; + description = "A list of arguments to pass to stash watch."; + }; + + filterFile = mkOption { + type = types.str; + default = ""; + example = "/etc/stash/clipboard_filter"; + description = '' + Stash can be configured to avoid storing clipboard entries that match a sensitive pattern, using a regular expression. + The file set here should contain your regex pattern (no quotes). + + Example regex to block common password patterns: + - (password|secret|api[_-]?key|token)[=: ]+[^\s]+ + ''; + }; + + excludedApps = mkOption { + type = types.listOf types.str; + default = [ ]; + example = [ "Bitwarden" ]; + description = '' + List of application classes to exclude from the database. + Entries from these apps are still copied to the clipboard, but it will never be put inside the database. + ''; + }; + }; + + config = mkIf cfg.enable { + environment.systemPackages = [ cfg.package ]; + systemd = { + user.services.stash-clipboard = { + description = "Stash clipboard manager daemon"; + wantedBy = [ "graphical-session.target" ]; + after = [ "graphical-session.target" ]; + serviceConfig = { + ExecStart = "${getExe cfg.package} ${concatStringsSep " " cfg.arguments} watch"; + LoadCredential = mkIf (cfg.filterFile != "") "clipboard_filter:${cfg.filterFile}"; + }; + environment = mkIf (cfg.excludedApps != [ ]) { + STASH_EXCLUDED_APPS = concatStringsSep "," cfg.excludedApps; + }; + }; + }; + }; +}