From bac7da2cfa0cd67a764a4f1199119eaa3164add2 Mon Sep 17 00:00:00 2001
From: Martin Fischer <martin@push-f.com>
Date: Fri, 26 Dec 2025 09:56:17 +0100
Subject: fix(nix): don't run service as root

---
 service.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/service.nix b/service.nix
index 8114223..ccf3b69 100644
--- a/service.nix
+++ b/service.nix
@@ -8,6 +8,10 @@ in
   options.services.osm-proposals = {
     enable = lib.mkEnableOption "osm-proposals";
 
+    user = lib.mkOption {
+      type = lib.types.str;
+    };
+
     virtualHost = lib.mkOption {
       type = lib.types.str;
       description = "Name of the nginx virtualhost to set up.";
@@ -41,10 +45,9 @@ in
     systemd.services.osm-proposals = {
       serviceConfig = {
         Type = "oneshot";
+        User = cfg.user;
         StateDirectory = "osm-proposals"; # creates /var/lib/osm-proposals
         ExecStart = "${osm_proposals}/bin/osm-proposals /var/lib/osm-proposals/proposals.json";
-        # Not using DynamicUser because then the StateDirectory becomes unreadable
-        # by other users, even when setting StateDirectoryMode for some reason.
         LogExtraFields = "LOG_FORMAT=logfmt";
       };
       startAt = "hourly";
-- 
cgit v1.3.1