traccar: fix jdbc url escaping for envsubst and xml

AGENTS.md

@@ -112,6 +112,7 @@ Each service file in `services/` follows this structure:
 - **Hugepages**: Services needing large pages declare their budget in `service-configs.nix` under `hugepages_2m.services`. The kernel sysctl is set automatically from the total.
 - **Domain**: Primary domain is `sigkill.computer`. Old domain `gardling.com` redirects automatically.
 - **Hardened kernel**: Uses `_hardened` kernel. Security-sensitive defaults apply.
+- **PostgreSQL as central database**: All services that support PostgreSQL MUST use it instead of embedded databases (H2, SQLite, etc.). Connect via Unix socket with peer auth when possible (JDBC services can use junixsocket). The PostgreSQL instance is declared in `services/postgresql.nix` with ZFS-backed storage. Use `ensureDatabases`/`ensureUsers` to auto-create databases and roles.
 
 ### Test Pattern
 Tests use `pkgs.testers.runNixOSTest` (NixOS VM tests):

services/traccar.nix

@@ -1,4 +1,5 @@
 {
+  pkgs,
   service_configs,
   lib,
   ...
@@ -38,13 +39,23 @@
 
   services.traccar = {
     enable = true;
+
+    # The JDBC URL contains '$' (Java inner class) and '&' (query param
+    # separator) which break the NixOS module's XML generator + envsubst.
+    # Route it through environmentFile so envsubst replaces $TRACCAR_DB_URL
+    # with the literal value, and use & for valid XML (the XML parser
+    # decodes it back to & for JDBC).
+    environmentFile = pkgs.writeText "traccar-db-env" ''
+      TRACCAR_DB_URL=jdbc:postgresql:///traccar?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&socketFactoryArg=${service_configs.postgres.socket}/.s.PGSQL.5432
+    '';
+
     settings = {
       web.port = toString service_configs.ports.private.traccar_web.port;
 
       # PostgreSQL via Unix socket (peer auth, junixsocket is bundled)
       database = {
         driver = "org.postgresql.Driver";
-        url = "jdbc:postgresql:///traccar?socketFactory=org.newsclub.net.unix.AFUNIXSocketFactory$FactoryArg&socketFactoryArg=${service_configs.postgres.socket}/.s.PGSQL.5432";
+        url = "$TRACCAR_DB_URL";
         user = "traccar";
         password = "";
       };