nixos/replay-sorcery: add module

nixos/modules/module-list.nix

···
   ./services/wayland/cage.nix
   ./services/video/epgstation/default.nix
   ./services/video/mirakurun.nix
+  ./services/video/replay-sorcery.nix
   ./services/web-apps/atlassian/confluence.nix
   ./services/web-apps/atlassian/crowd.nix
   ./services/web-apps/atlassian/jira.nix

nixos/modules/services/video/replay-sorcery.nix

···
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.replay-sorcery;
+  configFile = generators.toKeyValue {} cfg.settings;
+in
+{
+  options = with types; {
+    services.replay-sorcery = {
+      enable = mkEnableOption "the ReplaySorcery service for instant-replays";
+
+      enableSysAdminCapability = mkEnableOption ''
+        the system admin capability to support hardware accelerated
+        video capture. This is equivalent to running ReplaySorcery as
+        root, so use with caution'';
+
+      autoStart = mkOption {
+        type = bool;
+        default = false;
+        description = "Automatically start ReplaySorcery when graphical-session.target starts.";
+      };
+
+      settings = mkOption {
+        type = attrsOf (oneOf [ str int ]);
+        default = {};
+        description = "System-wide configuration for ReplaySorcery (/etc/replay-sorcery.conf).";
+        example = literalExample ''
+          {
+            videoInput = "hwaccel"; # requires `services.replay-sorcery.enableSysAdminCapability = true`
+            videoFramerate = 60;
+          }
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = [ pkgs.replay-sorcery ];
+      etc."replay-sorcery.conf".text = configFile;
+    };
+
+    security.wrappers = mkIf cfg.enableSysAdminCapability {
+      replay-sorcery = {
+        source = "${pkgs.replay-sorcery}/bin/replay-sorcery";
+        capabilities = "cap_sys_admin+ep";
+      };
+    };
+
+    systemd = {
+      packages = [ pkgs.replay-sorcery ];
+      user.services.replay-sorcery = {
+        wantedBy = mkIf cfg.autoStart [ "graphical-session.target" ];
+        partOf = mkIf cfg.autoStart [ "graphical-session.target" ];
+        serviceConfig = {
+          ExecStart = mkIf cfg.enableSysAdminCapability [
+            "" # Tell systemd to clear the existing ExecStart list, to prevent appending to it.
+            "${config.security.wrapperDir}/replay-sorcery"
+          ];
+        };
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with maintainers; [ kira-bruneau ];
+  };
+}

pkgs/tools/video/replay-sorcery/default.nix

···
     sha256 = "sha256-HPkSOwfwcg4jLUzKfqdXgLu7mgD5H4wb9d2BrqWQeHc=";
   };
 
-  # Patch in libnotify if support is enabled.
-  patches = lib.optional notifySupport (substituteAll {
+  patches = [
+    # Use global config generated by NixOS (/etc/replay-sorcery.conf)
+    # instead of $out/etc/replay-sorcery.conf.
+    ./fix-global-config.patch
+  ] ++ lib.optional notifySupport (substituteAll {
+    # Patch in libnotify if support is enabled. Can't use makeWrapper
+    # since it would break the security wrapper in the NixOS module.
     src = ./hardcode-libnotify.patch;
     inherit libnotify;
   });
···
     "-DRS_SYSTEMD_DIR=${placeholder "out"}/lib/systemd/user"
 
     # SETUID & SETGID permissions required for hardware accelerated
-    # video capture can't be set during the build.
+    # video capture can't be set during the build. Use the NixOS
+    # module if you want hardware accelerated video capture.
     "-DRS_SETID=OFF"
   ];
 

pkgs/tools/video/replay-sorcery/fix-global-config.patch

···
+diff --git a/src/rsbuild.h.in b/src/rsbuild.h.in
+index ff0a0f6..5529556 100644
+--- a/src/rsbuild.h.in
++++ b/src/rsbuild.h.in
+@@ -20,7 +20,7 @@
+ #ifndef RS_BUILD_H
+ #define RS_BUILD_H
+ 
+-#define RS_BUILD_GLOBAL_CONFIG "@CMAKE_INSTALL_PREFIX@/etc/replay-sorcery.conf"
++#define RS_BUILD_GLOBAL_CONFIG "/etc/replay-sorcery.conf"
+ #define RS_BUILD_LOCAL_CONFIG "%s/.config/replay-sorcery.conf"
+ 
+ #cmakedefine RS_BUILD_PTHREAD_FOUND