fix(nix): don't run service as rootHEADmaster

1 files changed, 5 insertions, 2 deletions

diff --git a/service.nix b/service.nix
index 8114223..ccf3b69 100644
--- a/service.nix
+++ b/service.nix
@@ -8,6 +8,10 @@ in
   options.services.osm-proposals = {
     enable = lib.mkEnableOption "osm-proposals";
 
+    user = lib.mkOption {
+      type = lib.types.str;
+    };
+
     virtualHost = lib.mkOption {
       type = lib.types.str;
       description = "Name of the nginx virtualhost to set up.";
@@ -41,10 +45,9 @@ in
     systemd.services.osm-proposals = {
       serviceConfig = {
         Type = "oneshot";
+        User = cfg.user;
         StateDirectory = "osm-proposals"; # creates /var/lib/osm-proposals
         ExecStart = "${osm_proposals}/bin/osm-proposals /var/lib/osm-proposals/proposals.json";
-        # Not using DynamicUser because then the StateDirectory becomes unreadable
-        # by other users, even when setting StateDirectoryMode for some reason.
         LogExtraFields = "LOG_FORMAT=logfmt";
       };
       startAt = "hourly";