nixos/linuxcnc: init module

Add a LinuxCNC module for real-time control of CNC machines from NixOS.

Signed-off-by: wucke13 <wucke13+github@gmail.com>

Author: wucke13

doc/release-notes/rl-2605.section.md

@@ -286,6 +286,8 @@
 
 - Switch inhibitors were introduced, which add a pre-switch check that compares a list of strings between the previous and the new generation, and refuses to switch into the new generation when there is a difference between the two lists. This allows to avoid switching into a system when for instance the systemd version changed by adding `config.systemd.package.version` to the switch inhibitors for your system. You can still forcefully switch into any generation by setting `NIXOS_NO_CHECK=1`.
 
+- A LinuxCNC module has been added. This provides a notable alternative to Debian based distros for CNC machine control.
+
 - GNU Taler has been updated to version 1.3.
   This release focuses on getting everything ready for a deployment of GNU Taler by Magnet bank.
   For more details, see the [upstream release notes](https://www.taler.net/en/news/2025-13.html).

nixos/modules/module-list.nix

@@ -259,6 +259,7 @@
   ./programs/less.nix
   ./programs/liboping.nix
   ./programs/librepods.nix
+  ./programs/linuxcnc.nix
   ./programs/lix.nix
   ./programs/localsend.nix
   ./programs/mdevctl.nix

nixos/modules/programs/linuxcnc.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.${moduleName};
+  moduleName = "linuxcnc";
+in
+{
+  meta.maintainers = with lib.maintainers; [ wucke13 ];
+
+  options.programs.${moduleName} = {
+
+    enable = lib.options.mkEnableOption moduleName;
+
+    package =
+      (lib.options.mkPackageOption pkgs "linuxcnc" {
+        default = [ "linuxcnc" ];
+      })
+      // {
+        apply = p: p.override { enableSetuidWrapperRedirection = true; };
+      };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    # use RT_PREEMPT kernel
+    boot.kernelPackages = pkgs.linuxKernel.packagesFor pkgs.linux-rt;
+
+    # create wrapper with setuid bit set
+    security.wrappers = lib.mkIf cfg.enable (
+      lib.attrsets.genAttrs' cfg.package.setuidApps (program: {
+        name = "linuxcnc-${program}";
+        value = {
+          owner = "root";
+          group = "root";
+          inherit program;
+          setuid = true;
+          source = lib.meta.getExe' cfg.package "${program}-nosetuid";
+        };
+      })
+    );
+
+    # Make all LinuxCNC programs and required tools available
+    environment.systemPackages = [
+      cfg.package
+      pkgs.iptables
+    ];
+  };
+}