Merge branch 'upstream/master' into feat/ebusd-log-none

Conflicts:
	nixos/modules/services/home-automation/ebusd.nix

12 files changed, 826 insertions, 288 deletions

diff --git a/nixos/modules/services/home-automation/ebusd.nix b/nixos/modules/services/home-automation/ebusd.nix
index 32485176ab29..d388022d7b50 100644
--- a/nixos/modules/services/home-automation/ebusd.nix
+++ b/nixos/modules/services/home-automation/ebusd.nix
@@ -44,13 +44,13 @@ in
   meta.maintainers = with maintainers; [ nathan-gs ];
 
   options.services.ebusd = {
-    enable = mkEnableOption (lib.mdDoc "ebusd service");
+    enable = mkEnableOption "ebusd, a daemon for communication with eBUS heating systems";
 
     device = mkOption {
       type = types.str;
       default = "";
       example = "IP:PORT";
-      description = lib.mdDoc ''
+      description = ''
         Use DEV as eBUS device [/dev/ttyUSB0].
         This can be either:
           enh:DEVICE or enh:IP:PORT for enhanced device (only adapter v3 and newer),
@@ -64,7 +64,7 @@ in
     port = mkOption {
       default = 8888;
       type = types.port;
-      description = lib.mdDoc ''
+      description = ''
         The port on which to listen on
       '';
     };
@@ -72,7 +72,7 @@ in
     readonly = mkOption {
       type = types.bool;
       default = false;
-      description = lib.mdDoc ''
+      description = ''
          Only read from device, never write to it
       '';
     };
@@ -80,7 +80,7 @@ in
     configpath = mkOption {
       type = types.str;
       default = "https://cfg.ebusd.eu/";
-      description = lib.mdDoc ''
+      description = ''
         Read CSV config files from PATH (local folder or HTTPS URL) [https://cfg.ebusd.eu/]
       '';
     };
@@ -88,7 +88,7 @@ in
     scanconfig = mkOption {
       type = types.str;
       default = "full";
-      description = lib.mdDoc ''
+      description = ''
         Pick CSV config files matching initial scan ("none" or empty for no initial scan message, "full" for full scan, or a single hex address to scan, default is to send a broadcast ident message).
         If combined with --checkconfig, you can add scan message data as arguments for checking a particular scan configuration, e.g. "FF08070400/0AB5454850303003277201". For further details on this option,
         see [Automatic configuration](https://github.com/john30/ebusd/wiki/4.7.-Automatic-configuration).
@@ -99,7 +99,7 @@ in
       main = mkOption {
         type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
-        description = lib.mdDoc ''
+        description = ''
           Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
@@ -107,7 +107,7 @@ in
       network = mkOption {
         type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
-        description = lib.mdDoc ''
+        description = ''
           Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
@@ -115,7 +115,7 @@ in
       bus = mkOption {
         type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
-        description = lib.mdDoc ''
+        description = ''
           Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
@@ -123,7 +123,7 @@ in
       update = mkOption {
         type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
-        description = lib.mdDoc ''
+        description = ''
           Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
@@ -131,7 +131,7 @@ in
       other = mkOption {
         type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
-        description = lib.mdDoc ''
+        description = ''
           Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
@@ -139,7 +139,7 @@ in
       all = mkOption {
         type = types.enum [ "none" "error" "notice" "info" "debug"];
         default = "info";
-        description = lib.mdDoc ''
+        description = ''
           Only write log for matching AREAs (main|network|bus|update|other|all) below or equal to LEVEL (none|error|notice|info|debug) [all:notice].
         '';
       };
@@ -150,7 +150,7 @@ in
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = lib.mdDoc ''
+        description = ''
           Adds support for MQTT
         '';
       };
@@ -158,7 +158,7 @@ in
       host = mkOption {
         type = types.str;
         default = "localhost";
-        description = lib.mdDoc ''
+        description = ''
           Connect to MQTT broker on HOST.
         '';
       };
@@ -166,7 +166,7 @@ in
       port = mkOption {
         default = 1883;
         type = types.port;
-        description = lib.mdDoc ''
+        description = ''
           The port on which to connect to MQTT
         '';
       };
@@ -174,7 +174,7 @@ in
       home-assistant = mkOption {
         type = types.bool;
         default = false;
-        description = lib.mdDoc ''
+        description = ''
           Adds the Home Assistant topics to MQTT, read more at [MQTT Integration](https://github.com/john30/ebusd/wiki/MQTT-integration)
         '';
       };
@@ -182,21 +182,21 @@ in
       retain = mkOption {
         type = types.bool;
         default = false;
-        description = lib.mdDoc ''
+        description = ''
           Set the retain flag on all topics instead of only selected global ones
         '';
       };
 
       user = mkOption {
         type = types.str;
-        description = lib.mdDoc ''
+        description = ''
           The MQTT user to use
         '';
       };
 
       password = mkOption {
         type = types.str;
-        description = lib.mdDoc ''
+        description = ''
           The MQTT password.
         '';
       };
@@ -206,7 +206,7 @@ in
     extraArguments = mkOption {
       type = types.listOf types.str;
       default = [];
-      description = lib.mdDoc ''
+      description = ''
         Extra arguments to the ebus daemon
       '';
     };
diff --git a/nixos/modules/services/home-automation/esphome.nix b/nixos/modules/services/home-automation/esphome.nix
index 3c0fd8aed08a..faae5ec8ff45 100644
--- a/nixos/modules/services/home-automation/esphome.nix
+++ b/nixos/modules/services/home-automation/esphome.nix
@@ -7,7 +7,6 @@ let
     mkEnableOption
     mkIf
     mkOption
-    mdDoc
     types
     ;
 
@@ -24,38 +23,38 @@ in
   meta.maintainers = with maintainers; [ oddlama ];
 
   options.services.esphome = {
-    enable = mkEnableOption (mdDoc "esphome");
+    enable = mkEnableOption "esphome, for making custom firmwares for ESP32/ESP8266";
 
     package = lib.mkPackageOption pkgs "esphome" { };
 
     enableUnixSocket = mkOption {
       type = types.bool;
       default = false;
-      description = lib.mdDoc "Listen on a unix socket `/run/esphome/esphome.sock` instead of the TCP port.";
+      description = "Listen on a unix socket `/run/esphome/esphome.sock` instead of the TCP port.";
     };
 
     address = mkOption {
       type = types.str;
       default = "localhost";
-      description = mdDoc "esphome address";
+      description = "esphome address";
     };
 
     port = mkOption {
       type = types.port;
       default = 6052;
-      description = mdDoc "esphome port";
+      description = "esphome port";
     };
 
     openFirewall = mkOption {
       default = false;
       type = types.bool;
-      description = mdDoc "Whether to open the firewall for the specified port.";
+      description = "Whether to open the firewall for the specified port.";
     };
 
     allowedDevices = mkOption {
       default = ["char-ttyS" "char-ttyUSB"];
       example = ["/dev/serial/by-id/usb-Silicon_Labs_CP2102_USB_to_UART_Bridge_Controller_0001-if00-port0"];
-      description = lib.mdDoc ''
+      description = ''
         A list of device nodes to which {command}`esphome` has access to.
         Refer to DeviceAllow in systemd.resource-control(5) for more information.
         Beware that if a device is referred to by an absolute path instead of a device category,
@@ -67,7 +66,7 @@ in
     usePing = mkOption {
       default = false;
       type = types.bool;
-      description = lib.mdDoc "Use ping to check online status of devices instead of mDNS";
+      description = "Use ping to check online status of devices instead of mDNS";
     };
   };
 
diff --git a/nixos/modules/services/home-automation/evcc.nix b/nixos/modules/services/home-automation/evcc.nix
index f360f525b04b..a952437b1b56 100644
--- a/nixos/modules/services/home-automation/evcc.nix
+++ b/nixos/modules/services/home-automation/evcc.nix
@@ -19,19 +19,19 @@ in
   meta.maintainers = with lib.maintainers; [ hexa ];
 
   options.services.evcc = with types; {
-    enable = mkEnableOption (lib.mdDoc "EVCC, the extensible EV Charge Controller with PV integration");
+    enable = mkEnableOption "EVCC, the extensible EV Charge Controller with PV integration";
 
     extraArgs = mkOption {
       type = listOf str;
       default = [];
-      description = lib.mdDoc ''
+      description = ''
         Extra arguments to pass to the evcc executable.
       '';
     };
 
     settings = mkOption {
       type = format.type;
-      description = lib.mdDoc ''
+      description = ''
         evcc configuration as a Nix attribute set.
 
         Check for possible options in the sample [evcc.dist.yaml](https://github.com/andig/evcc/blob/${package.version}/evcc.dist.yaml].
@@ -63,6 +63,7 @@ in
         DynamicUser = true;
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
+        Restart = "on-failure";
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 3423eebe9ed6..d94adfb4aa1c 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -95,12 +95,12 @@ in {
   options.services.home-assistant = {
     # Running home-assistant on NixOS is considered an installation method that is unsupported by the upstream project.
     # https://github.com/home-assistant/architecture/blob/master/adr/0012-define-supported-installation-method.md#decision
-    enable = mkEnableOption (lib.mdDoc "Home Assistant. Please note that this installation method is unsupported upstream");
+    enable = mkEnableOption "Home Assistant. Please note that this installation method is unsupported upstream";
 
     configDir = mkOption {
       default = "/var/lib/hass";
       type = types.path;
-      description = lib.mdDoc "The config directory, where your {file}`configuration.yaml` is located.";
+      description = "The config directory, where your {file}`configuration.yaml` is located.";
     };
 
     defaultIntegrations = mkOption {
@@ -164,7 +164,7 @@ in {
           "wled"
         ]
       '';
-      description = lib.mdDoc ''
+      description = ''
         List of [components](https://www.home-assistant.io/integrations/) that have their dependencies included in the package.
 
         The component name can be found in the URL, for example `https://www.home-assistant.io/integrations/ffmpeg/` would map to `ffmpeg`.
@@ -183,7 +183,7 @@ in {
           psycopg2
         ];
       '';
-      description = lib.mdDoc ''
+      description = ''
         List of packages to add to propagatedBuildInputs.
 
         A popular example is `python3Packages.psycopg2`
@@ -199,7 +199,7 @@ in {
           prometheus_sensor
         ];
       '';
-      description = lib.mdDoc ''
+      description = ''
         List of custom component packages to install.
 
         Available components can be found below `pkgs.home-assistant-custom-components`.
@@ -215,7 +215,7 @@ in {
           mini-media-player
         ];
       '';
-      description = lib.mdDoc ''
+      description = ''
         List of custom lovelace card packages to load as lovelace resources.
 
         Available cards can be found below `pkgs.home-assistant-custom-lovelace-modules`.
@@ -240,7 +240,7 @@ in {
               type = types.nullOr types.str;
               default = null;
               example = "Home";
-              description = lib.mdDoc ''
+              description = ''
                 Name of the location where Home Assistant is running.
               '';
             };
@@ -249,7 +249,7 @@ in {
               type = types.nullOr (types.either types.float types.str);
               default = null;
               example = 52.3;
-              description = lib.mdDoc ''
+              description = ''
                 Latitude of your location required to calculate the time the sun rises and sets.
               '';
             };
@@ -258,7 +258,7 @@ in {
               type = types.nullOr (types.either types.float types.str);
               default = null;
               example = 4.9;
-              description = lib.mdDoc ''
+              description = ''
                 Longitude of your location required to calculate the time the sun rises and sets.
               '';
             };
@@ -267,7 +267,7 @@ in {
               type = types.nullOr (types.enum [ "metric" "imperial" ]);
               default = null;
               example = "metric";
-              description = lib.mdDoc ''
+              description = ''
                 The unit system to use. This also sets temperature_unit, Celsius for Metric and Fahrenheit for Imperial.
               '';
             };
@@ -276,7 +276,7 @@ in {
               type = types.nullOr (types.enum [ "C" "F" ]);
               default = null;
               example = "C";
-              description = lib.mdDoc ''
+              description = ''
                 Override temperature unit set by unit_system. `C` for Celsius, `F` for Fahrenheit.
               '';
             };
@@ -288,7 +288,7 @@ in {
                 config.time.timeZone or null
               '';
               example = "Europe/Amsterdam";
-              description = lib.mdDoc ''
+              description = ''
                 Pick your time zone from the column TZ of Wikipedia’s [list of tz database time zones](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones).
               '';
             };
@@ -303,7 +303,7 @@ in {
                 "::"
               ];
               example = "::1";
-              description = lib.mdDoc ''
+              description = ''
                 Only listen to incoming requests on specific IP/host. The default listed assumes support for IPv4 and IPv6.
               '';
             };
@@ -311,7 +311,7 @@ in {
             server_port = mkOption {
               default = 8123;
               type = types.port;
-              description = lib.mdDoc ''
+              description = ''
                 The port on which to listen.
               '';
             };
@@ -330,7 +330,7 @@ in {
                 else "storage";
               '';
               example = "yaml";
-              description = lib.mdDoc ''
+              description = ''
                 In what mode should the main Lovelace panel be, `yaml` or `storage` (UI managed).
               '';
             };
@@ -354,7 +354,7 @@ in {
           feedreader.urls = [ "https://nixos.org/blogs.xml" ];
         }
       '';
-      description = lib.mdDoc ''
+      description = ''
         Your {file}`configuration.yaml` as a Nix attribute set.
 
         YAML functions like [secrets](https://www.home-assistant.io/docs/configuration/secrets/)
@@ -369,7 +369,7 @@ in {
     configWritable = mkOption {
       default = false;
       type = types.bool;
-      description = lib.mdDoc ''
+      description = ''
         Whether to make {file}`configuration.yaml` writable.
 
         This will allow you to edit it from Home Assistant's web interface.
@@ -396,7 +396,7 @@ in {
           } ];
         }
       '';
-      description = lib.mdDoc ''
+      description = ''
         Your {file}`ui-lovelace.yaml` as a Nix attribute set.
         Setting this option will automatically set `lovelace.mode` to `yaml`.
 
@@ -407,7 +407,7 @@ in {
     lovelaceConfigWritable = mkOption {
       default = false;
       type = types.bool;
-      description = lib.mdDoc ''
+      description = ''
         Whether to make {file}`ui-lovelace.yaml` writable.
 
         This will allow you to edit it from Home Assistant's web interface.
@@ -439,7 +439,7 @@ in {
           ];
         }
       '';
-      description = lib.mdDoc ''
+      description = ''
         The Home Assistant package to use.
       '';
     };
@@ -447,7 +447,7 @@ in {
     openFirewall = mkOption {
       default = false;
       type = types.bool;
-      description = lib.mdDoc "Whether to open the firewall for the specified port.";
+      description = "Whether to open the firewall for the specified port.";
     };
   };
 
diff --git a/nixos/modules/services/home-automation/homeassistant-satellite.nix b/nixos/modules/services/home-automation/homeassistant-satellite.nix
deleted file mode 100644
index 6ca428f2af81..000000000000
--- a/nixos/modules/services/home-automation/homeassistant-satellite.nix
+++ /dev/null
@@ -1,225 +0,0 @@
-{ config
-, lib
-, pkgs
-, ...
-}:
-
-let
-  cfg = config.services.homeassistant-satellite;
-
-  inherit (lib)
-    escapeShellArg
-    escapeShellArgs
-    mkOption
-    mdDoc
-    mkEnableOption
-    mkIf
-    mkPackageOption
-    types
-    ;
-
-  inherit (builtins)
-    toString
-    ;
-
-  # override the package with the relevant vad dependencies
-  package = cfg.package.overridePythonAttrs (oldAttrs: {
-    propagatedBuildInputs = oldAttrs.propagatedBuildInputs
-      ++ lib.optional (cfg.vad == "webrtcvad") cfg.package.optional-dependencies.webrtc
-      ++ lib.optional (cfg.vad == "silero") cfg.package.optional-dependencies.silerovad
-      ++ lib.optional (cfg.pulseaudio.enable) cfg.package.optional-dependencies.pulseaudio;
-  });
-
-in
-
-{
-  meta.buildDocsInSandbox = false;
-
-  options.services.homeassistant-satellite = with types; {
-    enable = mkEnableOption (mdDoc "Home Assistant Satellite");
-
-    package = mkPackageOption pkgs "homeassistant-satellite" { };
-
-    user = mkOption {
-      type = str;
-      example = "alice";
-      description = mdDoc ''
-        User to run homeassistant-satellite under.
-      '';
-    };
-
-    group = mkOption {
-      type = str;
-      default = "users";
-      description = mdDoc ''
-        Group to run homeassistant-satellite under.
-      '';
-    };
-
-    host = mkOption {
-      type = str;
-      example = "home-assistant.local";
-      description = mdDoc ''
-        Hostname on which your Home Assistant instance can be reached.
-      '';
-    };
-
-    port = mkOption {
-      type = port;
-      example = 8123;
-      description = mdDoc ''
-        Port on which your Home Assistance can be reached.
-      '';
-      apply = toString;
-    };
-
-    protocol = mkOption {
-      type = enum [ "http" "https" ];
-      default = "http";
-      example = "https";
-      description = mdDoc ''
-        The transport protocol used to connect to Home Assistant.
-      '';
-    };
-
-    tokenFile = mkOption {
-      type = path;
-      example = "/run/keys/hass-token";
-      description = mdDoc ''
-        Path to a file containing a long-lived access token for your Home Assistant instance.
-      '';
-      apply = escapeShellArg;
-    };
-
-    sounds = {
-      awake = mkOption {
-        type = nullOr str;
-        default = null;
-        description = mdDoc ''
-          Audio file to play when the wake word is detected.
-        '';
-      };
-
-      done = mkOption {
-        type = nullOr str;
-        default = null;
-        description = mdDoc ''
-          Audio file to play when the voice command is done.
-        '';
-      };
-    };
-
-    vad = mkOption {
-      type = enum [ "disabled" "webrtcvad" "silero" ];
-      default = "disabled";
-      example = "silero";
-      description = mdDoc ''
-        Voice activity detection model. With `disabled` sound will be transmitted continously.
-      '';
-    };
-
-    pulseaudio = {
-      enable = mkEnableOption "recording/playback via PulseAudio or PipeWire";
-
-      socket = mkOption {
-        type = nullOr str;
-        default = null;
-        example = "/run/user/1000/pulse/native";
-        description = mdDoc ''
-          Path or hostname to connect with the PulseAudio server.
-        '';
-      };
-
-      duckingVolume = mkOption {
-        type = nullOr float;
-        default = null;
-        example = 0.4;
-        description = mdDoc ''
-          Reduce output volume (between 0 and 1) to this percentage value while recording.
-        '';
-      };
-
-      echoCancellation = mkEnableOption "acoustic echo cancellation";
-    };
-
-    extraArgs = mkOption {
-      type = listOf str;
-      default = [ ];
-      description = mdDoc ''
-        Extra arguments to pass to the commandline.
-      '';
-      apply = escapeShellArgs;
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services."homeassistant-satellite" = {
-      description = "Home Assistant Satellite";
-      after = [
-        "network-online.target"
-      ];
-      wants = [
-        "network-online.target"
-      ];
-      wantedBy = [
-        "multi-user.target"
-      ];
-      path = with pkgs; [
-        ffmpeg-headless
-      ] ++ lib.optionals (!cfg.pulseaudio.enable) [
-        alsa-utils
-      ];
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        # https://github.com/rhasspy/hassio-addons/blob/master/assist_microphone/rootfs/etc/s6-overlay/s6-rc.d/assist_microphone/run
-        ExecStart = ''
-          ${package}/bin/homeassistant-satellite \
-            --host ${cfg.host} \
-            --port ${cfg.port} \
-            --protocol ${cfg.protocol} \
-            --token-file ${cfg.tokenFile} \
-            --vad ${cfg.vad} \
-            ${lib.optionalString cfg.pulseaudio.enable "--pulseaudio"}${lib.optionalString (cfg.pulseaudio.socket != null) "=${cfg.pulseaudio.socket}"} \
-            ${lib.optionalString (cfg.pulseaudio.enable && cfg.pulseaudio.duckingVolume != null) "--ducking-volume=${toString cfg.pulseaudio.duckingVolume}"} \
-            ${lib.optionalString (cfg.pulseaudio.enable && cfg.pulseaudio.echoCancellation) "--echo-cancel"} \
-            ${lib.optionalString (cfg.sounds.awake != null) "--awake-sound=${toString cfg.sounds.awake}"} \
-            ${lib.optionalString (cfg.sounds.done != null) "--done-sound=${toString cfg.sounds.done}"} \
-            ${cfg.extraArgs}
-        '';
-        CapabilityBoundingSet = "";
-        DeviceAllow = "";
-        DevicePolicy = "closed";
-        LockPersonality = true;
-        MemoryDenyWriteExecute = false; # onnxruntime/capi/onnxruntime_pybind11_state.so: cannot enable executable stack as shared object requires: Operation not permitted
-        PrivateDevices = true;
-        PrivateUsers = true;
-        ProtectHome = false; # Would deny access to local pulse/pipewire server
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectControlGroups = true;
-        ProtectProc = "invisible";
-        ProcSubset = "all"; # Error in cpuinfo: failed to parse processor information from /proc/cpuinfo
-        Restart = "always";
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        SupplementaryGroups = [
-          "audio"
-        ];
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-        ];
-        UMask = "0077";
-      };
-    };
-  };
-}
diff --git a/nixos/modules/services/home-automation/matter-server.nix b/nixos/modules/services/home-automation/matter-server.nix
index 864ef9e20083..7bf1cfe54d17 100644
--- a/nixos/modules/services/home-automation/matter-server.nix
+++ b/nixos/modules/services/home-automation/matter-server.nix
@@ -17,7 +17,7 @@ in
   meta.maintainers = with lib.maintainers; [ leonm1 ];
 
   options.services.matter-server = with types; {
-    enable = mkEnableOption (lib.mdDoc "Matter-server");
+    enable = mkEnableOption "Matter-server";
 
     package = mkPackageOptionMD pkgs "python-matter-server" { };
 
diff --git a/nixos/modules/services/home-automation/wyoming/faster-whisper.nix b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
new file mode 100644
index 000000000000..d0fca6a41c7b
--- /dev/null
+++ b/nixos/modules/services/home-automation/wyoming/faster-whisper.nix
@@ -0,0 +1,183 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+let
+  cfg = config.services.wyoming.faster-whisper;
+
+  inherit (lib)
+    escapeShellArgs
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    types
+    ;
+
+  inherit (builtins)
+    toString
+    ;
+
+in
+
+{
+  options.services.wyoming.faster-whisper = with types; {
+    package = mkPackageOption pkgs "wyoming-faster-whisper" { };
+
+    servers = mkOption {
+      default = {};
+      description = ''
+        Attribute set of faster-whisper instances to spawn.
+      '';
+      type = types.attrsOf (types.submodule (
+        { ... }: {
+          options = {
+            enable = mkEnableOption "Wyoming faster-whisper server";
+
+            model = mkOption {
+              type = str;
+              default = "tiny-int8";
+              example = "Systran/faster-distil-whisper-small.en";
+              description = ''
+                Name of the voice model to use.
+
+                Check the [2.0.0 release notes](https://github.com/rhasspy/wyoming-faster-whisper/releases/tag/v2.0.0) for possible values.
+              '';
+            };
+
+            uri = mkOption {
+              type = strMatching "^(tcp|unix)://.*$";
+              example = "tcp://0.0.0.0:10300";
+              description = ''
+                URI to bind the wyoming server to.
+              '';
+            };
+
+            device = mkOption {
+              # https://opennmt.net/CTranslate2/python/ctranslate2.models.Whisper.html#
+              type = types.enum [
+                "cpu"
+                "cuda"
+                "auto"
+              ];
+              default = "cpu";
+              description = ''
+                Determines the platform faster-whisper is run on. CPU works everywhere, CUDA requires a compatible NVIDIA GPU.
+              '';
+            };
+
+            language = mkOption {
+              type = enum [
+                # https://github.com/home-assistant/addons/blob/master/whisper/config.yaml#L20
+                "auto" "af" "am" "ar" "as" "az" "ba" "be" "bg" "bn" "bo" "br" "bs" "ca" "cs" "cy" "da" "de" "el" "en" "es" "et" "eu" "fa" "fi" "fo" "fr" "gl" "gu" "ha" "haw" "he" "hi" "hr" "ht" "hu" "hy" "id" "is" "it" "ja" "jw" "ka" "kk" "km" "kn" "ko" "la" "lb" "ln" "lo" "lt" "lv" "mg" "mi" "mk" "ml" "mn" "mr" "ms" "mt" "my" "ne" "nl" "nn" "no" "oc" "pa" "pl" "ps" "pt" "ro" "ru" "sa" "sd" "si" "sk" "sl" "sn" "so" "sq" "sr" "su" "sv" "sw" "ta" "te" "tg" "th" "tk" "tl" "tr" "tt" "uk" "ur" "uz" "vi" "yi" "yo" "zh"
+              ];
+              example = "en";
+              description = ''
+                The language used to to parse words and sentences.
+              '';
+            };
+
+            beamSize = mkOption {
+              type = ints.unsigned;
+              default = 1;
+              example = 5;
+              description = ''
+                The number of beams to use in beam search.
+              '';
+              apply = toString;
+            };
+
+            extraArgs = mkOption {
+              type = listOf str;
+              default = [ ];
+              description = ''
+                Extra arguments to pass to the server commandline.
+              '';
+              apply = escapeShellArgs;
+            };
+          };
+        }
+      ));
+    };
+  };
+
+  config = let
+    inherit (lib)
+      mapAttrs'
+      mkIf
+      nameValuePair
+    ;
+  in mkIf (cfg.servers != {}) {
+    systemd.services = mapAttrs' (server: options:
+      nameValuePair "wyoming-faster-whisper-${server}" {
+        inherit (options) enable;
+        description = "Wyoming faster-whisper server instance ${server}";
+        after = [
+          "network-online.target"
+        ];
+        wantedBy = [
+          "multi-user.target"
+        ];
+        # https://github.com/rhasspy/wyoming-faster-whisper/issues/27
+        environment."HF_HUB_CACHE" = "/tmp";
+        serviceConfig = {
+          DynamicUser = true;
+          User = "wyoming-faster-whisper";
+          StateDirectory = "wyoming/faster-whisper";
+          # https://github.com/home-assistant/addons/blob/master/whisper/rootfs/etc/s6-overlay/s6-rc.d/whisper/run
+          ExecStart = ''
+            ${cfg.package}/bin/wyoming-faster-whisper \
+              --data-dir $STATE_DIRECTORY \
+              --download-dir $STATE_DIRECTORY \
+              --uri ${options.uri} \
+              --device ${options.device} \
+              --model ${options.model} \
+              --language ${options.language} \
+              --beam-size ${options.beamSize} ${options.extraArgs}
+          '';
+          CapabilityBoundingSet = "";
+          DeviceAllow = if builtins.elem options.device [ "cuda" "auto" ] then [
+            # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf
+            # CUDA not wor