stash-clipboard: init at 0.4.0; init module (#438722)

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -48,6 +48,8 @@
 
 - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service) is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as [services.matrix-authentication-service](#opt-services.matrix-authentication-service.enable).
 
+- [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -982,6 +982,7 @@
   ./services/misc/spice-webdavd.nix
   ./services/misc/spoolman.nix
   ./services/misc/sssd.nix
+  ./services/misc/stash-clipboard.nix
   ./services/misc/subsonic.nix
   ./services/misc/sundtek.nix
   ./services/misc/svnserve.nix

nixos/modules/services/misc/stash-clipboard.nix

@@ -0,0 +1,73 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.stash-clipboard;
+  inherit (lib)
+    mkPackageOption
+    mkEnableOption
+    mkOption
+    types
+    mkIf
+    getExe
+    concatStringsSep
+    ;
+in
+{
+  options.services.stash-clipboard = {
+    enable = mkEnableOption "stash, a Wayland clipboard manager";
+
+    package = mkPackageOption pkgs [ "stash-clipboard" ] { };
+
+    arguments = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "--max-items 10" ];
+      description = "A list of arguments to pass to stash watch.";
+    };
+
+    filterFile = mkOption {
+      type = types.str;
+      default = "";
+      example = "/etc/stash/clipboard_filter";
+      description = ''
+        Stash can be configured to avoid storing clipboard entries that match a sensitive pattern, using a regular expression.
+        The file set here should contain your regex pattern (no quotes).
+
+        Example regex to block common password patterns:
+        - (password|secret|api[_-]?key|token)[=: ]+[^\s]+
+      '';
+    };
+
+    excludedApps = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "Bitwarden" ];
+      description = ''
+        List of application classes to exclude from the database.
+        Entries from these apps are still copied to the clipboard, but it will never be put inside the database.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    systemd = {
+      user.services.stash-clipboard = {
+        description = "Stash clipboard manager daemon";
+        wantedBy = [ "graphical-session.target" ];
+        after = [ "graphical-session.target" ];
+        serviceConfig = {
+          ExecStart = "${getExe cfg.package} ${concatStringsSep " " cfg.arguments} watch";
+          LoadCredential = mkIf (cfg.filterFile != "") "clipboard_filter:${cfg.filterFile}";
+        };
+        environment = mkIf (cfg.excludedApps != [ ]) {
+          STASH_EXCLUDED_APPS = concatStringsSep "," cfg.excludedApps;
+        };
+      };
+    };
+  };
+}

pkgs/by-name/st/stash-clipboard/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "stash-clipboard";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "NotAShelf";
+    repo = "stash";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-L5UfPKzdU8qQIyXSCMglLhv22J7xInxg3NNKCLkxszM=";
+  };
+
+  cargoHash = "sha256-iXL3G1H8tNS1oPAoEvvx7qwWUef95NBU3dwlEe+34zw=";
+
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Wayland clipboard manager with fast persistent history and multi-media support";
+    homepage = "https://github.com/NotAShelf/stash";
+    changelog = "https://github.com/NotAShelf/stash/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mpl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      NotAShelf
+      fazzi
+    ];
+    mainProgram = "stash";
+  };
+})