From 6f4a4bcccb1bfc9825dc718f40dccde3415d1a61 Mon Sep 17 00:00:00 2001
From: Davis Schirmer <git@djds.dev>
Date: Sun, 30 Nov 2025 16:12:41 -0500
Subject: [PATCH] nixos/incus: replace environment.PATH with path

Allows users to amend the path without updating the module.
---
 nixos/modules/virtualisation/incus.nix | 160 +++++++++++++------------
 1 file changed, 85 insertions(+), 75 deletions(-)

diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 311a5860c750..5bd28551c5bc 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -11,79 +11,90 @@ let
 
   nvidiaEnabled = (lib.elem "nvidia" config.services.xserver.videoDrivers);
 
-  serverBinPath = ''/run/wrappers/bin:${pkgs.qemu_kvm}/libexec:${
-    lib.makeBinPath (
-      with pkgs;
-      [
-        cfg.package
+  path =
+    with pkgs;
+    [
+      cfg.package
+      "/run/wrappers"
 
-        acl
-        attr
-        bash
-        btrfs-progs
-        cdrkit
-        coreutils
-        criu
-        dnsmasq
-        e2fsprogs
-        findutils
-        getent
-        gawk
-        gnugrep
-        gnused
-        gnutar
-        gptfdisk
-        gzip
-        iproute2
-        iptables
-        iw
-        kmod
-        libxfs
-        lvm2
-        lxcfs
-        minio
-        minio-client
-        nftables
-        qemu-utils
-        qemu_kvm
-        rsync
-        squashfs-tools-ng
-        squashfsTools
-        sshfs
-        swtpm
-        systemd
-        thin-provisioning-tools
-        util-linux
-        virtiofsd
-        xdelta
-        xz
-        zstd
-      ]
-      ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.3.0") [
-        skopeo
-        umoci
-      ]
-      ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.11.0") [
-        lego
-      ]
-      ++ lib.optionals config.security.apparmor.enable [
-        apparmor-bin-utils
+      # some qemu helpers not in bin
+      (linkFarm "incus-qemu-libexec" [
+        {
+          name = "bin";
+          path = "${qemu_kvm}/libexec";
+        }
+      ])
 
-        (writeShellScriptBin "apparmor_parser" ''
-          exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
-        '')
-      ]
-      ++ lib.optionals config.services.ceph.client.enable [ ceph-client ]
-      ++ lib.optionals config.virtualisation.vswitch.enable [ config.virtualisation.vswitch.package ]
-      ++ lib.optionals config.boot.zfs.enabled [
-        config.boot.zfs.package
-        "${config.boot.zfs.package}/lib/udev"
-      ]
-      ++ lib.optionals nvidiaEnabled [
-        libnvidia-container
-      ]
-    )
-  }'';
+      acl
+      attr
+      bash
+      btrfs-progs
+      cdrkit
+      coreutils
+      criu
+      dnsmasq
+      e2fsprogs
+      findutils
+      getent
+      gawk
+      gnugrep
+      gnused
+      gnutar
+      gptfdisk
+      gzip
+      iproute2
+      iptables
+      iw
+      kmod
+      libxfs
+      lvm2
+      lxcfs
+      minio
+      minio-client
+      nftables
+      qemu-utils
+      qemu_kvm
+      rsync
+      squashfs-tools-ng
+      squashfsTools
+      sshfs
+      swtpm
+      systemd
+      thin-provisioning-tools
+      util-linux
+      virtiofsd
+      xdelta
+      xz
+      zstd
+    ]
+    ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.3.0") [
+      skopeo
+      umoci
+    ]
+    ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.11.0") [
+      lego
+    ]
+    ++ lib.optionals config.security.apparmor.enable [
+      apparmor-bin-utils
+
+      (writeShellScriptBin "apparmor_parser" ''
+        exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
+      '')
+    ]
+    ++ lib.optionals config.services.ceph.client.enable [ ceph-client ]
+    ++ lib.optionals config.virtualisation.vswitch.enable [ config.virtualisation.vswitch.package ]
+    ++ lib.optionals config.boot.zfs.enabled [
+      config.boot.zfs.package
+      (linkFarm "incus-zfs-udev" [
+        {
+          name = "bin";
+          path = "${config.boot.zfs.package}/lib/udev";
+        }
+      ])
+    ]
+    ++ lib.optionals nvidiaEnabled [
+      libnvidia-container
+    ];
 
   # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
   OVMF2MB = pkgs.OVMF.override {
@@ -136,7 +147,6 @@ let
       INCUS_LXC_TEMPLATE_CONFIG = "${pkgs.lxcfs}/share/lxc/config";
       INCUS_USBIDS_PATH = "${pkgs.hwdata}/share/hwdata/usb.ids";
       INCUS_AGENT_PATH = "${cfg.package}/share/agent";
-      PATH = lib.mkForce serverBinPath;
     }
     (lib.mkIf (cfg.ui.enable) { "INCUS_UI" = cfg.ui.package; })
   ];
@@ -382,7 +392,7 @@ in
     systemd.services.incus = {
       description = "Incus Container and Virtual Machine Management Daemon";
 
-      inherit environment;
+      inherit environment path;
 
       wantedBy = lib.mkIf (!cfg.socketActivation) [ "multi-user.target" ];
       after = [
@@ -421,7 +431,7 @@ in
     systemd.services.incus-user = {
       description = "Incus Container and Virtual Machine Management User Daemon";
 
-      inherit environment;
+      inherit environment path;
 
       after = [
         "incus.service"
@@ -442,7 +452,7 @@ in
     systemd.services.incus-startup = lib.mkIf cfg.softDaemonRestart {
       description = "Incus Instances Startup/Shutdown";
 
-      inherit environment;
+      inherit environment path;
 
       after = [
         "incus.service"