From eecdf2b0cc813a737524cc7b2a7aa947b034e872 Mon Sep 17 00:00:00 2001
From: Patryk Wychowaniec <pwychowaniec@pm.me>
Date: Sat, 16 May 2026 17:30:21 +0200
Subject: [PATCH] nixos/unifi: pass Java version via passthru

---
 nixos/modules/services/networking/unifi.nix | 34 +++++++++++----------
 pkgs/by-name/un/unifi/package.nix           | 14 +++++++--
 2 files changed, 30 insertions(+), 18 deletions(-)

diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix
index eaee405f8bda..ff489fe5db92 100644
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@@ -4,6 +4,7 @@
   lib,
   pkgs,
   utils,
+  jdk25_headless,
   ...
 }:
 let
@@ -29,21 +30,16 @@ let
   );
 in
 {
-
   options = {
+    services.unifi.enable = lib.mkEnableOption "UniFi controller service";
+
+    services.unifi.jrePackage = lib.mkOption {
+      type = lib.types.package;
+      default = cfg.unifiPackage.passthru.jrePackage or jdk25_headless;
+      defaultText = lib.literalExpression "unifiPackage.passthru.jrePackage";
 
-    services.unifi.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
       description = ''
-        Whether or not to enable the unifi controller service.
-      '';
-    };
-
-    services.unifi.jrePackage = lib.mkPackageOption pkgs "jdk" {
-      default = "jdk25_headless";
-      extraDescription = ''
-        Check the UniFi controller release notes to ensure it is supported.
+        Which Java runtime to use.
       '';
     };
 
@@ -56,6 +52,7 @@ in
     services.unifi.openFirewall = lib.mkOption {
       type = lib.types.bool;
       default = false;
+
       description = ''
         Whether or not to open the minimum required ports on the firewall.
 
@@ -69,6 +66,7 @@ in
       type = with lib.types; nullOr int;
       default = null;
       example = 1024;
+
       description = ''
         Set the initial heap size for the JVM in MB. If this option isn't set, the
         JVM will decide this value at runtime.
@@ -79,6 +77,7 @@ in
       type = with lib.types; nullOr int;
       default = null;
       example = 4096;
+
       description = ''
         Set the maximum heap size for the JVM in MB. If this option isn't set, the
         JVM will decide this value at runtime.
@@ -89,15 +88,14 @@ in
       type = with lib.types; listOf str;
       default = [ ];
       example = lib.literalExpression ''["-Xlog:gc"]'';
+
       description = ''
         Set extra options to pass to the JVM.
       '';
     };
-
   };
 
   config = lib.mkIf cfg.enable {
-
     assertions = [
       {
         assertion =
@@ -128,16 +126,18 @@ in
       description = "UniFi controller daemon user";
       home = "${stateDir}";
     };
+
     users.groups.unifi = { };
 
+    # https://help.ubnt.com/hc/en-us/articles/218506997
     networking.firewall = lib.mkIf cfg.openFirewall {
-      # https://help.ubnt.com/hc/en-us/articles/218506997
       allowedTCPPorts = [
         8080 # Port for UAP to inform controller.
         8880 # Port for HTTP portal redirect, if guest portal is enabled.
         8843 # Port for HTTPS portal redirect, ditto.
         6789 # Port for UniFi mobile speed test.
       ];
+
       allowedUDPPorts = [
         3478 # UDP port used for STUN.
         10001 # UDP port used for device discovery.
@@ -151,6 +151,7 @@ in
 
       # This a HACK to fix missing dependencies of dynamic libs extracted from jars
       environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib";
+
       # Make sure package upgrades trigger a service restart
       restartTriggers = [
         cfg.unifiPackage
@@ -220,12 +221,13 @@ in
 
         # Needs network access
         PrivateNetwork = false;
+
         # Cannot be true due to OpenJDK
         MemoryDenyWriteExecute = false;
       };
     };
-
   };
+
   imports = [
     (lib.mkRemovedOptionModule [
       "services"
diff --git a/pkgs/by-name/un/unifi/package.nix b/pkgs/by-name/un/unifi/package.nix
index 8009886e0a45..d033331199ac 100644
--- a/pkgs/by-name/un/unifi/package.nix
+++ b/pkgs/by-name/un/unifi/package.nix
@@ -6,13 +6,17 @@
   nixosTests,
   systemd,
   autoPatchelfHook,
+  jdk25_headless,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "unifi-controller";
   version = "10.2.105";
 
-  # see https://community.ui.com/releases / https://www.ui.com/download/unifi
+  # See https://community.ui.com/releases or https://www.ui.com/download/unifi.
+  #
+  # When upgrading, make sure we don't need to bump `passthru.jrePackage` below
+  # as well.
   src = fetchurl {
     url = "https://dl.ui.com/unifi/${finalAttrs.version}/unifi_sysvinit_all.deb";
     hash = "sha256-MBTFxNwrIbx6UKZYCcZ+BjYjSlfdxL60Ogei/ba4O+U=";
@@ -36,7 +40,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.tests = { inherit (nixosTests) unifi; };
+  passthru = {
+    jrePackage = jdk25_headless;
+
+    tests = {
+      inherit (nixosTests) unifi;
+    };
+  };
 
   meta = {
     homepage = "https://www.ui.com";