From ecd7277d5032bd0dcd5f119ad0df8be57106a310 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Mon, 11 Aug 2025 23:30:49 -0400
Subject: [PATCH] nix/modules/knot: don't use an activation script to set up
 git user home

It's unidiomatic, and doesn't allow extension by way of changing the
systemd service options (like is done in the following commit).

Signed-off-by: Winter <winter@winter.cafe>
---
 nix/modules/knot.nix | 51 +++++++++++++++++++++++---------------------
 1 file changed, 27 insertions(+), 24 deletions(-)

diff --git a/nix/modules/knot.nix b/nix/modules/knot.nix
index e4310457..3376f516 100644
--- a/nix/modules/knot.nix
+++ b/nix/modules/knot.nix
@@ -126,30 +126,6 @@ in
         cfg.package
       ];
 
-      system.activationScripts.gitConfig = let
-        setMotd =
-          if cfg.motdFile != null && cfg.motd != null
-          then throw "motdFile and motd cannot be both set"
-          else ''
-            ${optionalString (cfg.motdFile != null) "cat ${cfg.motdFile} > ${cfg.stateDir}/motd"}
-            ${optionalString (cfg.motd != null) ''printf "${cfg.motd}" > ${cfg.stateDir}/motd''}
-          '';
-      in ''
-        mkdir -p "${cfg.repo.scanPath}"
-        chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.repo.scanPath}"
-
-        mkdir -p "${cfg.stateDir}/.config/git"
-        cat > "${cfg.stateDir}/.config/git/config" << EOF
-        [user]
-            name = Git User
-            email = git@example.com
-        [receive]
-            advertisePushOptions = true
-        EOF
-        ${setMotd}
-        chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.stateDir}"
-      '';
-
       users.users.${cfg.gitUser} = {
         isSystemUser = true;
         useDefaultShell = true;
@@ -185,8 +161,35 @@ in
         description = "knot service";
         after = ["network.target" "sshd.service"];
         wantedBy = ["multi-user.target"];
+        enableStrictShellChecks = true;
+
+        preStart = let
+          setMotd =
+            if cfg.motdFile != null && cfg.motd != null
+            then throw "motdFile and motd cannot be both set"
+            else ''
+              ${optionalString (cfg.motdFile != null) "cat ${cfg.motdFile} > ${cfg.stateDir}/motd"}
+              ${optionalString (cfg.motd != null) ''printf "${cfg.motd}" > ${cfg.stateDir}/motd''}
+            '';
+        in ''
+          mkdir -p "${cfg.repo.scanPath}"
+          chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.repo.scanPath}"
+
+          mkdir -p "${cfg.stateDir}/.config/git"
+          cat > "${cfg.stateDir}/.config/git/config" << EOF
+          [user]
+              name = Git User
+              email = git@example.com
+          [receive]
+              advertisePushOptions = true
+          EOF
+          ${setMotd}
+          chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.stateDir}"
+        '';
+
         serviceConfig = {
           User = cfg.gitUser;
+          PermissionsStartOnly = true;
           WorkingDirectory = cfg.stateDir;
           Environment = [
             "KNOT_REPO_SCAN_PATH=${cfg.repo.scanPath}"
-- 
2.51.2