From 22f19b998281032b29dbb3f6f368870429a66d32 Mon Sep 17 00:00:00 2001
From: Tom Vincent <git@tlvince.com>
Date: Tue, 11 Nov 2025 17:40:42 +0000
Subject: [PATCH] nixos/btrbk: add extraArgs option

---
 nixos/modules/services/backup/btrbk.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/backup/btrbk.nix b/nixos/modules/services/backup/btrbk.nix
index 4b705b3fb88b..68bb4af40ec3 100644
--- a/nixos/modules/services/backup/btrbk.nix
+++ b/nixos/modules/services/backup/btrbk.nix
@@ -10,6 +10,7 @@ let
     concatMap
     concatMapStringsSep
     concatStringsSep
+    escapeShellArgs
     filterAttrs
     flatten
     getAttr
@@ -276,6 +277,15 @@ in
                 ];
                 description = "What actions can be performed with this SSH key. See ssh_filter_btrbk(1) for details";
               };
+              extraArgs = mkOption {
+                type = listOf str;
+                description = "Additional arguments to pass to ssh_filter_btrbk";
+                default = [ ];
+                example = [
+                  "--log"
+                  "--restrict-path <path>"
+                ];
+              };
             };
           });
         default = [ ];
@@ -336,7 +346,7 @@ in
         in
         ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${
           optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"
-        } ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''
+        } ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options} ${escapeShellArgs v.extraArgs}" ${v.key}''
       ) cfg.sshAccess;
     };
     users.groups.btrbk = { };