home/kakoune/kak.nix

@@ -95,12 +95,6 @@ in
     { face = "ts_markup_italic"; token = "text"; modifiers = [ "emph" ]; }
   ];
 
-  programs.kak-lsp.languageServers.elixir-ls = {
-    args = [ ];
-    command = "elixir-ls";
-    filetypes = [ "elixir" ];
-    roots = [ "mix.exs" ];
-  };
   programs.kak-lsp.languageServers.typescript-language-server = {
     args = [ "--stdio" ];
     command = "typescript-language-server";

home/kakoune/kakrc

@@ -92,7 +92,7 @@ hook global InsertCompletionHide .* %{
 try %{
     eval %sh{test -z "$WE_STARTED_KAK" && kak-lsp --kakoune -s $kak_session}
 }
-hook global WinSetOption filetype=(racket|rust|python|go|javascript|typescript|c|cpp|tex|latex|fsharp|ocaml|haskell|nix|scala|typst|html|css|json|markdown|templ|elixir) %{
+hook global WinSetOption filetype=(racket|rust|python|go|javascript|typescript|c|cpp|tex|latex|fsharp|ocaml|haskell|nix|scala|typst|html|css|json|markdown|templ) %{
     lsp-enable-window
     map window lsp N -docstring "Display the next message request" ": lsp-show-message-request-next<ret>"
     map window normal <c-l> ": enter-user-mode lsp<ret>"

home/modules/programs/my-kakoune/kak-lsp.nix

@@ -193,27 +193,29 @@ in
     };
   };
 
-  config = mkIf cfg.enable
+  config = mkIf cfg.enable {
-    {
+    home.packages = [ cfg.package ];
-      home.packages = [ cfg.package ];
 
-      # Configurations
+    # Configurations
-      xdg.configFile."kak-lsp/kak-lsp.toml" =
+    xdg.configFile."kak-lsp/kak-lsp.toml" = {
-        let
+      source = pkgs.runCommand "config.toml"
-          toml = pkgs.formats.toml { };
-          stripNulls = lib.filterAttrsRecursive (n: v: v != null);
-        in
         {
-          source = toml.generate "config.toml"
+          buildInputs = [ pkgs.yj ];
-            {
+          preferLocalBuild = true;
+        } ''
+        yj -jt -i \
+          < ${
+            pkgs.writeText "config.json" (builtins.toJSON {
               semantic_tokens.faces = cfg.semanticTokens.faces ++ cfg.semanticTokens.additionalFaces;
               server.timeout = cfg.serverTimeout;
               snippet_support = cfg.enableSnippets;
               verbosity = 255;
-              language_server = stripNulls (lspConfig.language_servers // cfg.languageServers);
+              language_server = lspConfig.language_servers // cfg.languageServers;
               language_ids = lspConfig.language_ids // cfg.languageIds;
-            };
+            })
-        };
+          } \
+          > $out
+      '';
     };
+  };
 }
-

home/modules/programs/my-sway/default.nix

@@ -124,12 +124,6 @@ in
   config.wayland.windowManager.sway = mkIf cfg.enable {
     enable = true;
     systemd.enable = true;
-    systemd.variables = [
-      "PATH" # for portals
-    ];
-    systemd.extraCommands = [
-      "systemctl --user restart xdg-desktop-portals.service"
-    ];
 
     checkConfig = false; # Not working atm
     config = {

nki-personal-do/secrets/secrets.yaml

@@ -30,7 +30,7 @@ miniflux:
     oidc-client-secret: ENC[AES256_GCM,data:lvPFzc1ZXOTArs6VfFzJmKjW7pFpWU1XMCzHfUWC8WRq3CTvd6iQSwnGgBmUtHtDJCF1un/32fOaqBtSeMkgt5nkd/j8fLhTrTZyo8hJV2l1p16RBC2C0+igQh8PMah1Yp+V4zTMd5UKYMPkK9Iwb/tJ5zXeqQ20LvmGk+E7lCCVrnyyJrJNwr310mzYaUmpRz9/1AEM,iv:+9yhwYxnB5zPSRjX9o3PRvBpq4hM45jNF3acqT6lSJc=,tag:yMTWbxHlTZgg4XxNjfc8wQ==,type:str]
     pocket-consumer-key: ENC[AES256_GCM,data:NXY9Y8rFlzCVVG3ATUL/u7Sj6Im1RU/D16toUOLcIfKvddBjlu+QddKXWfLKppV1BQZ0,iv:nf3gkm098UhpZOgMbOdyG1FYVcl5G0gxoI6RTsZ1r14=,tag:bMOYwtFwUJ4SFornsWo8ig==,type:str]
     admin-creds: ENC[AES256_GCM,data:cBCwwRZR0B8nH7XLxHVZCThqmnUI6ZHFp3wH9TjdRbBTmySjPqU526ltn3lRQtopgqQ0IOuneTztXJ+wfqmLUABV6xlLBkXD7VX6Mf43RtIDyHL+UC56eIdn3xeawGsIjnta,iv:DOwHUL64ufLS7FbvnJCPxPYwMJF1pMPqjx78vltm9IY=,tag:A2Fpk4rI0/WK0jFtTlGhaA==,type:str]
-writefreely-oauth-secret: ENC[AES256_GCM,data:UTeJMo4MMLcPUL6RlSfNzluMs4Hu5iKkav3oH16Q0TvEhxCKMU1SkXgLAjbpjx5OidXKLXGc72kGQcVJegvWjfhVGH6eoDQiizyHSwznRyA4pGNhlJKm3w0tKKRzVJZjBKQgjQ6gODyeU7SdI6g0jK42t3Sm91404erRMOoKyZo=,iv:FQx/XE7FGhHhiKG7d4LfgIXQZq+nj9tvKgY6SRiZbXY=,tag:5rfCeM/yYFNukY4/CqOJ3g==,type:str]
+writefreely-dtth: ENC[AES256_GCM,data:Q2b3eCr5GLLyBMrGlTUSIuMN/vZXmMZV8T56+t7RjcoHQmEVDKGwPGgka4jf/yO9Nf6TdGB7iiXft+XK3t74XdnzTCTYYVFzFsv49eZDKpTeaR6pKcbesfJYyqOcHIuatQz/orQ1X6Ext9Xf9aBStY4GV6ticLpvdW3GtHzchMPuMm8vY8A8DYNH/kLGb96aHpQ53paKkckeDWcbDyCulUU=,iv:G4TNJ4vY6qo4iOrEBmsf6hHJWAqbl3t8JAyDIZ1lUUg=,tag:HEknuS+MjBBFbkpDEIRUfw==,type:str]
 matrix-synapse-dtth:
     oidc-config: ENC[AES256_GCM,data:06lv5ejqnQ1jBAhCBxXY3nNulXFnDt/S2ycma9+hlG6mSMGfRfIcfDZfKOfUUuV2uMI7ix4r0QdM3351VucvnWCZZlXz5YpVgNg1YZDvtSQxe3SJqKj/y3u+nYbPPIRgACiFpiajBeEvS/evIT8+Ty3myDVPHovYkuCb0U1eD3/xGK38lx6+H3Cjk3LyszMg1EwXdkDjbcDVYDhSEelkB9rWXH1vw5qNZOzGgIoYEe6ppMmPZjpUM9jyounuF/+FzLbkWz6YvY4zWD5fND5fFdT4AA1e1jzCLQIsaVZ8N6co5lwzfBfydLosEy+h/COv1wzvfXiEjNi4f+2Ol7kSu4+G3u3V6EcqTyVjj38oTLaAx1cG9pnPmAc/zTUCmepITAWysvuzIVd8gwde1CheANLp1WnQrAAKJiHv/6bxPoi0ROu0BpQqupU9XUcTXRysuTjBH5/ABjlvk8lTiFi8Ryt7KzC23kPWf541B8BO/yfpmq8mheMz1AYm+fkTZOqKgkfm4NStN58oiYn6NEyWpuaAx7DEUgO/MIrIKXfTzGCT++33Cnr41fLSqWgqIUhBxd9P1s3cYk942UxC2VdKf1qq6IGZK4iq8T1FUoXqmTnjEfwvTm2hDkZqwEdvkKZUolKvnsZL44KRBow/LMGGsDDFoOMsMT9MqE2fBGOudTnHncs3I/T7eEDnHH+z+60Axo6mKGwmaHRHeqeiV4OIrPmM5X8uUIWvKoNsY3UvL/VgKA2Zh7wm8irB0rgcaKDW6QMmJIxqd3RK9WwmOT4hPy/SC5nm1ZRlag/f+H6q+WOtEaK+,iv:5pYzz4QzKHVhHh+YFnerD5Q2S93stqBKILM2sxD23Fc=,tag:V0rVa/nTH3hv77Z8KOQOiw==,type:str]
     appservice-discord: ENC[AES256_GCM,data:lAAEa6ltXi29+POrG87bMAvv8du3DiGYl8f7npqW0ga3YgrvofgYnC8QJUyznIQ3Ye9yWxzjzaClu7viFgkN0yIXlpENIOcSTrdlMgg5mdJ8f9elltp/VPiwVimubPa8QnpLNRy/NAEVpDFygw9VOM+Fu203M/pofK0qX6NfO9PeQGma1iKQeMKrV/6RwjF+70rnTMEhO0PCyTl2PEwZiDtkxgI7Yyl37p8bUuJ4YZ5MhZN94lODb+toPaN29BZT4q23VrJmxiW3VEeJj+tEmx4X+KeCO5AArtPl9YOkoRt/uSRKljsf109AIiclRj0wITqOx/QL2qntFuAidxTm8MoJQ6eoq/bwQp/BUpPubIMeY+z2b8XIgZGZSPZMdaObvaqDFdMLq7GW61GxYKFgNxHYA4uhndbE5VDNkcFkw4FEC5x40fwqGaunmqvAdb3p4I9EhlQ28e5S+hX1FFrMHjsJWlnjSySDRjCodJMtep19J+qVVgyf5A==,iv:PBo7+OSqBGxI7DzUpclcGWEFwTpcNqySRJzqHu7medU=,tag:fi06xru3e92WfqOJxHXd2w==,type:str]
@@ -73,8 +73,8 @@ sops:
             by9kZFlTRVdCZFkxYTVVb0RIRk8zUlkKCqMw9oL9RaYBV5Hhy3o8Nm5xmGrPH8Sd
             hv36sxRFFNZT/DCKaHaSRbT3mfpBZSTXJt1dgl4nZe6whH54t/1KmA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-06-11T20:55:31Z"
+    lastmodified: "2024-04-18T20:44:57Z"
-    mac: ENC[AES256_GCM,data:IdpNGX3E2TwGnmHhc7HXPjBEaYC7jO1dnEHQGoVra+scnKO66nt6uD2wK91G2wvdp2ekkR4qnF9/NYbpOt2vbzyaZG0xMHTr1w1Y5oqxzbTUned9sWjpsL2lCHpg4FQ+dImim05N76Qcna7gC5Y9wyh78/eB177SJ5mTEnyZhwE=,iv:3kjluCoHIMEQOTuDJbQZJWl3BLWzp/UqcC8jmlkVyDE=,tag:nmqkhmqXKB5/LKX7RpQB6g==,type:str]
+    mac: ENC[AES256_GCM,data:S8Z9P8gJIdjKZPHq3LEO0w1wxm6KsDYWB/Bb+JqoeuI0QyNzXqpfKtbthxtLisJJFcnS/ngnPjafVu6bG95ywjprfuB4o69l7PMd8rC4rZm38pG/pjw2tXYef+B3iuE2ZV7Y/7hXHhTd3ZPu8/ALD8kczTuZd+xFVsgTZu+F2F8=,iv:aFj0v+NB/NnnsReG234wmhyAhqkhADk7Ndpi/TaVNEg=,tag:7YlcGy68YACs+K10lMMohA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1

nki-personal-do/writefreely.nix

@@ -11,7 +11,7 @@ in
   # traefik
   cloud.traefik.hosts.writefreely-dtth = { inherit host port; };
 
-  sops.secrets."writefreely-oauth-secret" = { owner = user; };
+  sops.secrets."writefreely-dtth" = { owner = user; };
 
   users.users.${user} = {
     isSystemUser = true;
@@ -53,24 +53,22 @@ in
         monetization = false;
       };
 
-      "oauth.generic" = { };
+      "oauth.generic" = {
-    };
+        client_id = "rpoTTr2Wz0h4EgOSCHe0G85O8DCQDMup7JW9U9fV";
-
+        host = "https://auth.dtth.ch";
-    oauth = {
+        display_name = "DTTH";
-      enable = true;
+        token_endpoint = "/application/o/token/";
-      clientId = "rpoTTr2Wz0h4EgOSCHe0G85O8DCQDMup7JW9U9fV";
+        inspect_endpoint = "/application/o/userinfo/";
-      clientSecretFile = config.sops.secrets."writefreely-oauth-secret".path;
+        auth_endpoint = "/application/o/authorize/";
-      host = "https://auth.dtth.ch";
+        scope = "email openid profile";
-      displayName = "DTTH";
+        map_user_id = "nickname";
-      tokenEndpoint = "/application/o/token/";
+        map_username = "preferred_username";
-      inspectEndpoint = "/application/o/userinfo/";
+        map_display_name = "name";
-      authEndpoint = "/application/o/authorize/";
+        allow_registration = true;
-      scopes = [ "email" "openid" "profile" ];
+      };
-      mapUserId = "nickname";
-      mapUsername = "preferred_username";
-      mapDisplayName = "name";
     };
 
+    extraSettingsFile = config.sops.secrets."writefreely-dtth".path;
 
     database.type = "sqlite3";
 

nki-personal-do/writefreely/module.nix

@@ -15,7 +15,8 @@ let
             if value == true then "true" else "false"
           else
             toString value);
-      in "${key} = ${value'}";
+      in
+      "${key} = ${value'}";
   };
 
   cfg = config.nki.services.writefreely;
@@ -31,19 +32,20 @@ let
       host = cfg.settings.app.host or "${hostProtocol}://${cfg.host}";
     };
 
-    database = if cfg.database.type == "sqlite3" then {
+    database =
-      type = "sqlite3";
+      if cfg.database.type == "sqlite3" then {
-      filename = cfg.settings.database.filename or "writefreely.db";
+        type = "sqlite3";
-      database = cfg.database.name;
+        filename = cfg.settings.database.filename or "writefreely.db";
-    } else {
+        database = cfg.database.name;
-      type = "mysql";
+      } else {
-      username = cfg.database.user;
+        type = "mysql";
-      password = "#dbpass#";
+        username = cfg.database.user;
-      database = cfg.database.name;
+        password = "#dbpass#";
-      host = cfg.database.host;
+        database = cfg.database.name;
-      port = cfg.database.port;
+        host = cfg.database.host;
-      tls = cfg.database.tls;
+        port = cfg.database.port;
-    };
+        tls = cfg.database.tls;
+      };
 
     server = cfg.settings.server or { } // {
       bind = cfg.settings.server.bind or "localhost";
@@ -56,24 +58,6 @@ let
         cfg.settings.server.pages_parent_dir or cfg.package.src;
       keys_parent_dir = cfg.settings.server.keys_parent_dir or cfg.stateDir;
     };
-
-    "oauth.generic" = cfg.settings."oauth.generic" or { } // (if cfg.oauth.enable then {
-      client_id = cfg.oauth.clientId;
-      client_secret = "#oauth_client_secret#";
-      host = cfg.oauth.host;
-      display_name = cfg.oauth.displayName;
-      callback_proxy = cfg.oauth.callbackProxy;
-      callback_proxy_api = cfg.oauth.callbackProxyApi;
-      token_endpoint = cfg.oauth.tokenEndpoint;
-      inspect_endpoint = cfg.oauth.inspectEndpoint;
-      auth_endpoint = cfg.oauth.authEndpoint;
-      scope = lib.concatStringsSep " " cfg.oauth.scopes;
-      allow_disconnect = cfg.oauth.allowDisconnect;
-      map_user_id = cfg.oauth.mapUserId;
-      map_username = cfg.oauth.mapUsername;
-      map_display_name = cfg.oauth.mapDisplayName;
-      map_email = cfg.oauth.mapEmail;
-    } else { });
   };
 
   configFile = format.generate "config.ini" settings;
@@ -107,14 +91,10 @@ let
       optionalString (cfg.database.passwordFile != null)
       "$(head -n1 ${cfg.database.passwordFile})"
     }
-    oauth_client_secret=${
-      optionalString cfg.oauth.enable
-      "$(head -n1 ${cfg.oauth.clientSecretFile})"
-    }
 
-    cp -f ${configFile} '${cfg.stateDir}/config.ini'
+    install -m 0660 ${configFile} '${cfg.stateDir}/config.ini'
     sed -e "s,#dbpass#,$db_pass,g" -i '${cfg.stateDir}/config.ini'
-    sed -e "s,#oauth_client_secret#,$oauth_client_secret,g" -i '${cfg.stateDir}/config.ini'
+    ${if cfg.extraSettingsFile != null then "cat ${cfg.extraSettingsFile} >> ${cfg.stateDir}/config.ini" else ""}
     chmod 440 '${cfg.stateDir}/config.ini'
 
     ${text}
@@ -143,7 +123,7 @@ let
     withConfigFile ''
       query () {
         local result=$(${sqlite}/bin/sqlite3 \
-          '${cfg.stateDir}/${settings.database.filename}' \
+          '${cfg.stateDir}/${settings.database.filename}'
           "$1" \
         )
 
@@ -152,46 +132,53 @@ let
 
       ${text}
     '';
-in {
+in
+{
   options.nki.services.writefreely = {
     enable =
-      lib.mkEnableOption "Writefreely, build a digital writing community";
+      lib.mkEnableOption (lib.mdDoc "Writefreely, build a digital writing community");
 
     package = lib.mkOption {
       type = lib.types.package;
       default = pkgs.writefreely;
       defaultText = lib.literalExpression "pkgs.writefreely";
-      description = "Writefreely package to use.";
+      description = lib.mdDoc "Writefreely package to use.";
     };
 
     stateDir = mkOption {
       type = types.path;
       default = "/var/lib/writefreely";
-      description = "The state directory where keys and data are stored.";
+      description = lib.mdDoc "The state directory where keys and data are stored.";
     };
 
     user = mkOption {
       type = types.str;
       default = "writefreely";
-      description = "User under which Writefreely is ran.";
+      description = lib.mdDoc "User under which Writefreely is ran.";
     };
 
     group = mkOption {
       type = types.str;
       default = "writefreely";
-      description = "Group under which Writefreely is ran.";
+      description = lib.mdDoc "Group under which Writefreely is ran.";
     };
 
     host = mkOption {
       type = types.str;
       default = "";
-      description = "The public host name to serve.";
+      description = lib.mdDoc "The public host name to serve.";
       example = "example.com";
     };
 
+    extraSettingsFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = lib.mdDoc "Additional configs to be appended to the config file";
+    };
+
     settings = mkOption {
       default = { };
-      description = ''
+      description = lib.mdDoc ''
         Writefreely configuration ({file}`config.ini`). Refer to
         <https://writefreely.org/docs/latest/admin/config>
         for details.
@@ -205,7 +192,7 @@ in {
             theme = mkOption {
               type = types.str;
               default = "write";
-              description = "The theme to apply.";
+              description = lib.mdDoc "The theme to apply.";
             };
           };
 
@@ -214,7 +201,7 @@ in {
               type = types.port;
               default = if cfg.nginx.enable then 18080 else 80;
               defaultText = "80";
-              description = "The port WriteFreely should listen on.";
+              description = lib.mdDoc "The port WriteFreely should listen on.";
             };
           };
         };
@@ -225,158 +212,74 @@ in {
       type = mkOption {
         type = types.enum [ "sqlite3" "mysql" ];
         default = "sqlite3";
-        description = "The database provider to use.";
+        description = lib.mdDoc "The database provider to use.";
       };
 
       name = mkOption {
         type = types.str;
         default = "writefreely";
-        description = "The name of the database to store data in.";
+        description = lib.mdDoc "The name of the database to store data in.";
       };
 
       user = mkOption {
         type = types.nullOr types.str;
         default = if cfg.database.type == "mysql" then "writefreely" else null;
         defaultText = "writefreely";
-        description = "The database user to connect as.";
+        description = lib.mdDoc "The database user to connect as.";
       };
 
       passwordFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        description = "The file to load the database password from.";
+        description = lib.mdDoc "The file to load the database password from.";
       };
 
       host = mkOption {
         type = types.str;
         default = "localhost";
-        description = "The database host to connect to.";
+        description = lib.mdDoc "The database host to connect to.";
       };
 
       port = mkOption {
         type = types.port;
         default = 3306;
-        description = "The port used when connecting to the database host.";
+        description = lib.mdDoc "The port used when connecting to the database host.";
       };
 
       tls = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether or not TLS should be used for the database connection.";
+        description =
+          lib.mdDoc "Whether or not TLS should be used for the database connection.";
       };
 
       migrate = mkOption {
         type = types.bool;
         default = true;
-        description = "Whether or not to automatically run migrations on startup.";
+        description =
+          lib.mdDoc "Whether or not to automatically run migrations on startup.";
       };
 
       createLocally = mkOption {
         type = types.bool;
         default = false;
-        description = ''
+        description = lib.mdDoc ''
           When {option}`services.writefreely.database.type` is set to
           `"mysql"`, this option will enable the MySQL service locally.
         '';
       };
     };
 
-    oauth = {
-      enable = lib.mkEnableOption "Enable generic OAuth authentication";
-      clientId = mkOption {
-        type = types.str;
-        description = "The client ID associated with WriteFreely in the OAuth provider application.";
-      };
-      clientSecretFile = mkOption {
-        type = types.str;
-        description = "The file to load the OAuth client secret from.";
-      };
-      host = mkOption {
-        type = types.str;
-        description = "The base url of the OAuth provider application, including the protocol.";
-        example = "https://example.com";
-      };
-      displayName = mkOption {
-        type = types.str;
-        description = "The human-readable name of the OAuth service that appears on the login button, will appear as `Log in with [display_name]`.";
-      };
-
-      callbackProxy = mkOption {
-        type = types.str;
-        default = "";
-        description = "The url of an inbound proxy that sits in front of the default `/oauth/callback/generic` endpoint. Use if you want the OAuth callback to be somewhere other than that generic location. Default is blank.";
-        example = "https://example.com/whatever/path";
-      };
-      callbackProxyApi = mkOption {
-        type = types.str;
-        default = "";
-        description = "The url of an outbound proxy to send your OAuth requests through. Default is blank.";
-        example = "https://my-proxy.example.com";
-      };
-
-      tokenEndpoint = mkOption {
-        type = types.str;
-        description = "The API endpoint of the OAuth provider implementation to obtain an access token by presenting an authorization grant or refresh token. This is a fragment of a url, appended to host as described above.";
-        example = "/oauth/token";
-      };
-      inspectEndpoint = mkOption {
-        type = types.str;
-        description = "The API endpoint of the OAuth provider that returns basic user info given their authentication information. This is a fragment of a url, appended to host as described above.";
-        example = "/oauth/userinfo";
-      };
-      authEndpoint = mkOption {
-        type = types.str;
-        description = "The API endpoint of the OAuth provider that returns an authorization grant. This is a fragment of a url, appended to host as described above.";
-        example = "public";
-      };
-
-      scopes = mkOption {
-        type = types.listOf types.str;
-        default = [ "read_user" ];
-        description = "A scope or set of scopes required by some OAuth providers. This will usually be blank in this config file, and is set to `read_user` by default.";
-      };
-      allowDisconnect = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether or not an individual user is allowed to disconnect this OAuth provider from their account.";
-      };
-
-      mapUserId = mkOption {
-        type = types.str;
-        default = "";
-        defaultText = "<none>";
-        description = "Use this User ID key in the provider's user info, instead of the default key (user_id).";
-      };
-      mapUsername = mkOption {
-        type = types.str;
-        default = "";
-        defaultText = "<none>";
-        description = "Use this Username key in the provider's user info, instead of the default key (username)";
-      };
-      mapDisplayName = mkOption {
-        type = types.str;
-        default = "";
-        defaultText = "<none>";
-        description = "Use this Display Name key in the provider's user info, instead of the default key (*none*)";
-      };
-      mapEmail = mkOption {
-        type = types.str;
-        default = "";
-        defaultText = "<none>";
-        description = "Use this Email key in the provider's user info, instead of the default key (email)";
-      };
-    };
-
     admin = {
       name = mkOption {
         type = types.nullOr types.str;
-        description = "The name of the first admin user.";
+        description = lib.mdDoc "The name of the first admin user.";
         default = null;
       };
 
       initialPasswordFile = mkOption {
         type = types.path;
-        description = ''
+        description = lib.mdDoc ''
           Path to a file containing the initial password for the admin user.
           If not provided, the default password will be set to `nixos`.
         '';
@@ -389,13 +292,14 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether or not to enable and configure nginx as a proxy for WriteFreely.";
+        description =
+          lib.mdDoc "Whether or not to enable and configure nginx as a proxy for WriteFreely.";
       };
 
       forceSSL = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether or not to force the use of SSL.";
+        description = lib.mdDoc "Whether or not to force the use of SSL.";
       };
     };
 
@@ -403,7 +307,8 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether or not to automatically fetch and configure SSL certs.";
+        description =
+          lib.mdDoc "Whether or not to automatically fetch and configure SSL certs.";
       };
     };
   };
@@ -439,12 +344,11 @@ in {
         optionalAttrs (cfg.group == "writefreely") { writefreely = { }; };
     };
 
-    systemd.tmpfiles.settings."10-writefreely".${cfg.stateDir}.d = {
+    systemd.tmpfiles.rules =
-      inherit (cfg) user group;
+      [ "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group} - -" ];
-      mode = "0750";
-    };
 
     systemd.services.writefreely = {
+      path = with pkgs; [ openssl ];
       after = [ "network.target" ]
         ++ optional isSqlite "writefreely-sqlite-init.service"
         ++ optional isMysql "writefreely-mysql-init.service"
@@ -489,27 +393,29 @@ in {
           cfg.admin.initialPasswordFile;
       };
 
-      script = let
+      script =
-        migrateDatabase = optionalString cfg.database.migrate ''
+        let
-          ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' db migrate
+          migrateDatabase = optionalString cfg.database.migrate ''
-        '';
+            ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' db migrate
+          '';
 
-        createAdmin = optionalString (cfg.admin.name != null) ''
+          createAdmin = optionalString (cfg.admin.name != null) ''
-          if [[ $(query "SELECT COUNT(*) FROM users") == 0 ]]; then
+            if [[ $(query "SELECT COUNT(*) FROM users") == 0 ]]; then
-            admin_pass=$(head -n1 ${cfg.admin.initialPasswordFile})
+              admin_pass=$(head -n1 ${cfg.admin.initialPasswordFile})
 
-            ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' --create-admin ${cfg.admin.name}:$admin_pass
+              ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' --create-admin ${cfg.admin.name}:$admin_pass
+            fi
+          '';
+        in
+        withSqlite ''
+          if ! test -f '${settings.database.filename}'; then
+            ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' db init
           fi
+
+          ${migrateDatabase}
+
+          ${createAdmin}
         '';
-      in withSqlite ''
-        if ! test -f '${settings.database.filename}'; then
-          ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' db init
-        fi
-
-        ${migrateDatabase}
-
-        ${createAdmin}
-      '';
     };
 
     systemd.services.writefreely-mysql-init = mkIf isMysql {
@@ -526,36 +432,38 @@ in {
           cfg.admin.initialPasswordFile;
       };
 
-      script = let
+      script =
-        updateUser = optionalString isMysqlLocal ''
+        let
-          # WriteFreely currently *requires* a password for authentication, so we
+          updateUser = optionalString isMysqlLocal ''
-          # need to update the user in MySQL accordingly. By default MySQL users
+            # WriteFreely currently *requires* a password for authentication, so we
-          # authenticate with auth_socket or unix_socket.
+            # need to update the user in MySQL accordingly. By default MySQL users
-          # See: https://github.com/writefreely/writefreely/issues/568
+            # authenticate with auth_socket or unix_socket.
-          ${config.services.mysql.package}/bin/mysql --skip-column-names --execute "ALTER USER '${cfg.database.user}'@'localhost' IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD('$db_pass'); FLUSH PRIVILEGES;"
+            # See: https://github.com/writefreely/writefreely/issues/568
-        '';
+            ${config.services.mysql.package}/bin/mysql --skip-column-names --execute "ALTER USER '${cfg.database.user}'@'localhost' IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD('$db_pass'); FLUSH PRIVILEGES;"
+          '';
 
-        migrateDatabase = optionalString cfg.database.migrate ''
+          migrateDatabase = optionalString cfg.database.migrate ''
-          ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' db migrate
+            ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' db migrate
-        '';
+          '';
 
-        createAdmin = optionalString (cfg.admin.name != null) ''
+          createAdmin = optionalString (cfg.admin.name != null) ''
-          if [[ $(query 'SELECT COUNT(*) FROM users') == 0 ]]; then
+            if [[ $(query 'SELECT COUNT(*) FROM users') == 0 ]]; then
-            admin_pass=$(head -n1 ${cfg.admin.initialPasswordFile})
+              admin_pass=$(head -n1 ${cfg.admin.initialPasswordFile})
-            ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' --create-admin ${cfg.admin.name}:$admin_pass
+              ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' --create-admin ${cfg.admin.name}:$admin_pass
+            fi
+          '';
+        in
+        withMysql ''
+          ${updateUser}
+
+          if [[ $(query "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = '${cfg.database.name}'") == 0 ]]; then
+            ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' db init
           fi
+
+          ${migrateDatabase}
+
+          ${createAdmin}
         '';
-      in withMysql ''
-        ${updateUser}
-
-        if [[ $(query "SELECT COUNT(*) FROM information_schema.tables WHERE table_schema = '${cfg.database.name}'") == 0 ]]; then
-          ${cfg.package}/bin/writefreely -c '${cfg.stateDir}/config.ini' db init
-        fi
-
-        ${migrateDatabase}
-
-        ${createAdmin}
-      '';
     };
 
     services.mysql = mkIf isMysqlLocal {
@@ -589,3 +497,4 @@ in {
     };
   };
 }
+

overlay.nix

@@ -24,7 +24,7 @@ let
 
   overlay-versioning = final: prev: {
     gotosocial = prev.gotosocial.overrideAttrs (attrs: rec {
-      version = "0.16.0-rc2";
+      version = "0.16.0-rc1";
       ldflags = [
         "-s"
         "-w"
@@ -34,13 +34,13 @@ let
 
       web-assets = final.fetchurl {
         url = "https://github.com/superseriousbusiness/gotosocial/releases/download/v${version}/gotosocial_${version}_web-assets.tar.gz";
-        hash = "sha256-fufQP9xaaaVBrgFSunDn9/jQd6eUMXqGL7TcoQHatnI=";
+        hash = "sha256-bSMbqiRslDQd+HEaB0AA1pIgXeqAhamhxAq22B9gUHk=";
       };
       src = final.fetchFromGitHub {
         owner = "superseriousbusiness";
         repo = "gotosocial";
         rev = "v${version}";
-        hash = "sha256-+H4rpUgjDlCc6tEIGTzkPYktwo9aCWgXr5sln8M6DNk=";
+        hash = "sha256-nO6WvGkWm5K5sitNypDLEESBAO+4ZXBMGDrkYmGDIks=";
       };
       postInstall = ''
         tar xf ${web-assets}