From f2ca84ab536e73d51f791b451f3ec21c2fa80646 Mon Sep 17 00:00:00 2001
From: Simon Gardling <titaniumtown@proton.me>
Date: Sun, 12 Apr 2026 20:47:08 -0400
Subject: [PATCH] traccar: fix jdbc url escaping for envsubst and xml

---
 services/traccar.nix | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/services/traccar.nix b/services/traccar.nix
index 0019cc6..bf35026 100644
--- a/services/traccar.nix
+++ b/services/traccar.nix
@@ -1,4 +1,5 @@
 {
+  pkgs,
   service_configs,
   lib,
   ...
@@ -38,13 +39,23 @@
 
   services.traccar = {
     enable = true;
+
+    # The JDBC URL contains '$' (Java inner class) and '&' (query param
+    # separator) which break the NixOS module's XML generator + envsubst.
+    # Route it through environmentFile so envsubst replaces $TRACCAR_DB_URL
+    # with the literal value, and use &amp; for valid XML (the XML parser
+    # decodes it back to & for JDBC).
+    environmentFile = pkgs.writeText "traccar-db-env" ''
+      TRACCAR_DB_URL=jdbc:postgresql:///traccar?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&amp;socketFactoryArg=${service_configs.postgres.socket}/.s.PGSQL.5432
+    '';
+
     settings = {
       web.port = toString service_configs.ports.private.traccar_web.port;
 
       # PostgreSQL via Unix socket (peer auth, junixsocket is bundled)
       database = {
         driver = "org.postgresql.Driver";
-        url = "jdbc:postgresql:///traccar?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&socketFactoryArg=${service_configs.postgres.socket}/.s.PGSQL.5432";
+        url = "$TRACCAR_DB_URL";
         user = "traccar";
         password = "";
       };