traccar: fix jdbc url escaping for envsubst and xml

services/traccar.nix

@@ -1,4 +1,5 @@
 {
+  pkgs,
   service_configs,
   lib,
   ...
@@ -38,13 +39,23 @@
 
   services.traccar = {
     enable = true;
+
+    # The JDBC URL contains '$' (Java inner class) and '&' (query param
+    # separator) which break the NixOS module's XML generator + envsubst.
+    # Route it through environmentFile so envsubst replaces $TRACCAR_DB_URL
+    # with the literal value, and use & for valid XML (the XML parser
+    # decodes it back to & for JDBC).
+    environmentFile = pkgs.writeText "traccar-db-env" ''
+      TRACCAR_DB_URL=jdbc:postgresql:///traccar?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&socketFactoryArg=${service_configs.postgres.socket}/.s.PGSQL.5432
+    '';
+
     settings = {
       web.port = toString service_configs.ports.private.traccar_web.port;
 
       # PostgreSQL via Unix socket (peer auth, junixsocket is bundled)
       database = {
         driver = "org.postgresql.Driver";
-        url = "jdbc:postgresql:///traccar?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&socketFactoryArg=${service_configs.postgres.socket}/.s.PGSQL.5432";
+        url = "$TRACCAR_DB_URL";
         user = "traccar";
         password = "";
       };