nixos/restic: add test for command option, add release notes

Test checks that we are able to run a backup from a command, and that
the resulting backup has the contents that we passed into it.

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -204,6 +204,8 @@
 
 - Immich now has support for [VectorChord](https://github.com/tensorchord/VectorChord) when using the PostgreSQL configuration provided by `services.immich.database.enable`, which replaces `pgvecto-rs`. VectorChord support can be toggled with the option `services.immich.database.enableVectorChord`. Additionally, `pgvecto-rs` support is now disabled from NixOS 25.11 onwards using the option `services.immich.database.enableVectors`. This option will be removed fully in the future once Immich drops support for `pgvecto-rs` fully. See [Immich migration instructions](#module-services-immich-vectorchord-migration)
 
+- `services.restic.backups` now includes a `command` option for passing a command to the [--stdin-from-command](https://github.com/restic/restic/pull/4410) flag.
+
 - `services.postsrsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.postsrsd.configurePostfix](#opt-services.postsrsd.configurePostfix) option.
 
 - `services.pfix-srsd` now automatically integrates with the local Postfix instance, when enabled. This behavior can disabled using the [services.pfix-srsd.configurePostfix](#opt-services.pfix-srsd.configurePostfix) option.

nixos/tests/restic.nix

@@ -1,5 +1,4 @@
 { pkgs, ... }:
-
 let
   inherit (import ./ssh-keys.nix pkgs)
     snakeOilEd25519PrivateKey
@@ -8,6 +7,7 @@ let
 
   remoteRepository = "/root/restic-backup";
   remoteFromFileRepository = "/root/restic-backup-from-file";
+  remoteFromCommandRepository = "/root/restic-backup-from-command";
   remoteInhibitTestRepository = "/root/restic-backup-inhibit-test";
   remoteNoInitRepository = "/root/restic-backup-no-init";
   rcloneRepository = "rclone:local:/root/restic-rclone-backup";
@@ -45,6 +45,12 @@ let
     "--keep-monthly 1"
     "--keep-yearly 99"
   ];
+  commandString = "testing";
+  command = [
+    "echo"
+    "-n"
+    commandString
+  ];
 in
 {
   name = "restic";
@@ -127,6 +133,15 @@ in
               find /opt -mindepth 1 -maxdepth 1 ! -name a_dir # all files in /opt except for a_dir
             '';
           };
+          remote-from-command-backup = {
+            inherit
+              passwordFile
+              pruneOpts
+              command
+              ;
+            initialize = true;
+            repository = remoteFromCommandRepository;
+          };
           inhibit-test = {
             inherit
               passwordFile
@@ -267,6 +282,11 @@ in
         "${pkgs.restic}/bin/restic -r ${remoteRepository} -p ${passwordFile} restore latest -t /tmp/restore-3",
         "diff -ru ${testDir} /tmp/restore-3/opt",
 
+        # test that remote-from-command-backup produces a snapshot, with the expected contents
+        "systemctl start restic-backups-remote-from-command-backup.service",
+        'restic-remote-from-command-backup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',
+        '[[ $(restic-remote-from-command-backup dump --path /stdin latest stdin) == ${commandString} ]]',
+
         # test that rclonebackup produces a snapshot
         "systemctl start restic-backups-rclonebackup.service",
         'restic-rclonebackup snapshots --json | ${pkgs.jq}/bin/jq "length | . == 1"',