build(deps): bump actions/checkout from 6 to 7

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/build.yaml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - uses: tj-actions/changed-files@v47
         id: filter
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:
@@ -83,7 +83,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:
@@ -114,7 +114,7 @@ jobs:
         check: ${{ fromJson(needs.build-matrix.outputs.check) }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:

.github/workflows/demo.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - uses: tj-actions/changed-files@v47
         id: filter
@@ -66,7 +66,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: cachix/install-nix-action@v31

.github/workflows/format.yaml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:

.github/workflows/lock-update.yaml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install Nix
         uses: cachix/install-nix-action@v31
         with:

.github/workflows/pages.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Nix
         uses: cachix/install-nix-action@v31

.github/workflows/version.yaml

@@ -11,7 +11,7 @@ jobs:
   create-tag:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 1
       - name: Get version

lib/default.nix

@@ -352,16 +352,12 @@ let
                   "expected"
                   "result"
                 ];
-
-                nativeBuildInputs = [
-                  (pkgs.python3.withPackages (ps: [ ps.deepdiff ] ++ ps.deepdiff.optional-dependencies.cli))
-                ];
               }
               ''
                 echo "${name} failed (- expected, + result)" > $out
                 cp ''${expectedPath} ''${expectedPath}.json
                 cp ''${resultPath} ''${resultPath}.json
-                deep diff ''${expectedPath}.json ''${resultPath}.json >> $out
+                ${pkgs.deepdiff}/bin/deep diff ''${expectedPath}.json ''${resultPath}.json >> $out
               ''
           );
 

modules/blocks/davfs.nix

@@ -75,30 +75,6 @@ in
   config = {
     services.davfs2.enable = builtins.length cfg.mounts > 0;
 
-    systemd.services = lib.optionalAttrs (builtins.length cfg.mounts > 0) {
-      davfs2-password-generation = {
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig.Type = "oneshot";
-        script = ''
-          mkdir -p /etc/davfs2
-          [ -f /etc/davfs2/secrets ] && mv /etc/davfs2/secrets /etc/davfs2/secrets.prev
-          touch /etc/davfs2/secrets
-          chown root: /etc/davfs2
-          chown root: /etc/davfs2/secrets
-          chmod 700 /etc/davfs2
-          chmod 600 /etc/davfs2/secrets
-        ''
-        + (
-          let
-            mkPasswordCmd = cfg': ''
-              printf "%s %s %s\n" "${cfg'.mountPoint}" "${cfg'.username}" "$(cat ${cfg'.passwordFile})" >> /etc/davfs2/secrets
-            '';
-          in
-          lib.concatStringsSep "\n" (map mkPasswordCmd cfg.mounts)
-        );
-      };
-    };
-
     systemd.mounts =
       let
         mkMountCfg = c: {
@@ -106,7 +82,6 @@ in
           description = "Webdav mount point";
           after = [ "network-online.target" ];
           wants = [ "network-online.target" ];
-          wantedBy = [ "multi-user.target" ];
 
           what = c.remoteUrl;
           where = c.mountPoint;

modules/blocks/zfs.nix

@@ -249,10 +249,9 @@ in
         let
           recursiveFlag = lib.optionalString cfg.snapshotBeforeActivation.recursive "-r";
         in
-        lib.concatMapStringsSep "\n" (ds: ''
-          echo "Taking ZFS snapshot of ${ds}@$name"
-          zfs snapshot ${recursiveFlag} ${ds}@"$name"
-        '') (lib.uniqueStrings datasets)
+        lib.concatMapStringsSep "\n" (ds: "zfs snapshot ${recursiveFlag} ${ds}@\"$name\"") (
+          lib.uniqueStrings datasets
+        )
       )
     );
   };

modules/services/home-assistant.nix

@@ -11,13 +11,23 @@ let
 
   fqdn = "${cfg.subdomain}.${cfg.domain}";
 
+  ldap_auth_script_repo = pkgs.fetchFromGitHub {
+    owner = "lldap";
+    repo = "lldap";
+    rev = "7d1f5abc137821c500de99c94f7579761fc949d8";
+    sha256 = "sha256-8D+7ww70Ja6Qwdfa+7MpjAAHewtCWNf/tuTAExoUrg0=";
+  };
+
+  ldap_auth_script = pkgs.writeShellScriptBin "ldap_auth.sh" ''
+    export PATH=${pkgs.gnused}/bin:${pkgs.curl}/bin:${pkgs.jq}/bin
+    exec ${pkgs.bash}/bin/bash ${ldap_auth_script_repo}/example_configs/lldap-ha-auth.sh $@
+  '';
+
   # Filter secrets from config. Secrets are those of the form { source = <path>; }
   secrets = lib.attrsets.filterAttrs (k: v: builtins.isAttrs v) cfg.config;
 
   nonSecrets = (lib.attrsets.filterAttrs (k: v: !(builtins.isAttrs v)) cfg.config);
 
-  lldap_ha_auth = pkgs.callPackage ./home-assistant/lldap_ha_auth.nix { };
-
   configWithSecretsIncludes = nonSecrets // (lib.attrsets.mapAttrs (k: v: "!secret ${k}") secrets);
 in
 {
@@ -270,10 +280,9 @@ in
               }
             ])
             ++ (lib.optionals cfg.ldap.enable [
-              # https://www.home-assistant.io/docs/authentication/providers/#command-line
               {
                 type = "command_line";
-                command = lldap_ha_auth + "/bin/lldap-ha-auth";
+                command = ldap_auth_script + "/bin/ldap_auth.sh";
                 args = [
                   "http://${cfg.ldap.host}:${toString cfg.ldap.port}"
                   cfg.ldap.userGroup

modules/services/home-assistant/lldap_ha_auth.nix

@@ -1,37 +0,0 @@
-{
-  lib,
-  pkgs,
-  stdenvNoCC,
-}:
-stdenvNoCC.mkDerivation {
-  name = "lldap-ha-auth";
-
-  src = pkgs.fetchFromGitHub {
-    owner = "lldap";
-    repo = "lldap";
-    rev = "7d1f5abc137821c500de99c94f7579761fc949d8";
-    sha256 = "sha256-8D+7ww70Ja6Qwdfa+7MpjAAHewtCWNf/tuTAExoUrg0=";
-  };
-
-  nativeBuildInputs = [
-    pkgs.makeWrapper
-  ];
-
-  buildPhase = ''
-    mkdir -p $out/bin
-
-    cp example_configs/lldap-ha-auth.sh $out/bin/lldap-ha-auth
-    chmod a+x $out/bin/lldap-ha-auth
-  '';
-
-  installPhase = ''
-    wrapProgram $out/bin/lldap-ha-auth \
-      --prefix PATH : ${
-        lib.makeBinPath [
-          pkgs.gnused
-          pkgs.curl
-          pkgs.jq
-        ]
-      }
-  '';
-}

modules/services/open-webui.nix

@@ -59,12 +59,12 @@ in
           WEBUI_NAME = "SelfHostBlocks";
 
           OLLAMA_BASE_URL = "http://127.0.0.1:''${toString config.services.ollama.port}";
-          RAG_EMBEDDING_ENGINE = "ollama";
           RAG_EMBEDDING_MODEL = "nomic-embed-text:v1.5";
 
           ENABLE_OPENAI_API = "True";
           OPENAI_API_BASE_URL = "http://127.0.0.1:''${toString config.services.llama-cpp.port}";
           ENABLE_WEB_SEARCH = "True";
+          RAG_EMBEDDING_ENGINE = "openai";
         }
       '';
     };

test/modules/davfs.nix

@@ -34,7 +34,6 @@ in
     expected = {
       services.davfs2.enable = false;
       systemd.mounts = [ ];
-      systemd.services = { };
     };
     expr = testConfig { };
   };