Octoprint: hardening and RFC 42

[PatrickDaG]

Description of changes

I've added rfc 42 compliant options to the octoprint module, which in my opinion make it easier to read and understand.
Additionally I've added some basic systemd hardening for the service and remove the default enabled raspberryPi specific option. This might break some setup but previously for none raspberry Pi setups there was no option to remove the tempfiles.
Lastly I removed the ffmpeg patch from the package. This breaks timelapses for people using the package without the module, who I expecte to be able to, or even want to set their own ffmpeg, something that wasn't possible previously.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[gador]

Since octoprint was developed with raspberypi in mind, I would suggest adding a release note about the enableRaspberryPi option.
Other than that: This looks good to me 👍

[gador]

This is a semi-automatic executed nixpkgs-review with nixpkgs-review-checks extension. It is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).

Result of nixpkgs-review pr 335827 run on x86_64-linux 1

2 packages blacklisted:

• nixos-install-tools
• tests.nixos-functions.nixos-test

2 packages built:

• octoprint
• octoprint.dist

[gador]

This is a semi-automatic executed nixpkgs-review with nixpkgs-review-checks extension. It is checked by a human on a best effort basis and does not build all packages (e.g. lumo, tensorflow or pytorch).

Result of nixpkgs-review pr 335827 run on aarch64-linux 1

1 package blacklisted:

• nixos-install-tools

2 packages built:

• octoprint
• octoprint.dist

[PatrickDaG]

I've added a release note.

[gador]

I'm ok with this 👍

@abbradar @gebner @WhittlesJr what do you think?

[Scrumplex]

Because of the freeze of breaking changes, I'd recommend adding a state version condition for the Raspberry Pi option.

LGTM otherwise

[Scrumplex]

Suggested change

	enableRaspberryPi = mkEnableOption "RaspberryPi specific hardware access rules";
	enableRaspberryPi = mkEnableOption "RaspberryPi specific hardware access rules" // {
	default = lib.versionOlder config.system.stateVersion "25.05";
	};