From 6a5b87447d3719a43dbefbbc6a75e853ee439cd2 Mon Sep 17 00:00:00 2001
From: Soispha <soispha@vhack.eu>
Date: Tue, 4 Jul 2023 18:29:22 +0200
Subject: Fix(system/services/nix-sync): Add '/etc/nginx/websites' to kept dirs

---
 system/services/nix-sync/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'system/services/nix-sync')

diff --git a/system/services/nix-sync/default.nix b/system/services/nix-sync/default.nix
index de51f0b..ed2c6ac 100644
--- a/system/services/nix-sync/default.nix
+++ b/system/services/nix-sync/default.nix
@@ -81,7 +81,7 @@
       # Security
       NoNewPrivileges = true;
       # Sandboxing (sorted by occurrence in https://www.freedesktop.org/software/systemd/man/systemd.exec.html)
-      ReadWritePaths = ["${esa repo.path}" "-${esa repoCachePath}"];
+      ReadWritePaths = ["/etc/nginx/websites" "-${esa repoCachePath}"];
       ReadOnlyPaths = ["/nix"];
       ProtectSystem = "strict";
       ProtectHome = true;
@@ -199,6 +199,10 @@ in {
         message = "Your cachePath ('${cfg.cachePath}') ends with a slash ('/'), please use: '${lib.strings.removeSuffix "/" cfg.cachePath}'.";
       }
     ];
+
+    # generate the websites directory, so systemd can mount it rw
+    environment.etc."nginx/websites/.keep".text = "keep this directory";
+
     systemd.services = services;
     users.users =
       if cfg.user == "nix-sync"
-- 
cgit 1.4.1