fix path and directory permissions by letting systemd-tmpfiles manage the directories

mod-seafile-server.nix

@@ -84,18 +84,26 @@ in
         directoriesToManage = [ cfg.storagePath ];
       in
       lib.mkIf cfg.enable {
-        systemd.services.seafile-server = {
+        systemd = {
+          # state directory permissions managed by systemd
+          tmpfiles.rules = [
+            "d ${cfg.storagePath} 0750 ${cfg.user} ${cfg.group} -"
+          ];
+          services.seafile-server = {
 
+          script = ''
+            ${pkgs.seafile-server.ccnet-server}/bin/ccnet-init
+            '';
           serviceConfig = {
-            ExecStartPre = "+${pkgs.writeScript "seafile-server-preStart" ''
+            ExecStartPre = [
-              #!${pkgs.runtimeShell}
+              ("+${pkgs.writeScript "seafile-server-preStart-privileged" ''
-              #set -ex
+                #!${pkgs.runtimeShell}
-                for DIR in ${escapeShellArgs directoriesToManage}; do
+                #  stuff run as root
-                mkdir -p "$DIR"
+              ''}")
-                chown ${cfg.user}:${cfg.group} "$DIR"
+              ("${pkgs.writeShellScript "seafile-server-preStart-unprivileged" ''
-                done;
+                # stuff run as seafile user
-            ''}";
+              ''}")
-            ExecStart = "${pkgs.seafile-server}/seafile-core/bin/seaf-server-init";
+            ];
             User = cfg.user;
             Group = cfg.group;
             Type = "oneshot";
@@ -104,11 +112,14 @@ in
           enable = cfg.autorun;
           wantedBy = [ "multi-user.target" ];
         };
+      };
 
         users.users.${cfg.user} = {
-          home = cfg.storagePath;
+          home = "${cfg.storagePath}/home";
           group = cfg.group;
-          createHome = true;
+          # don't make NixOS create the home directory as otherwise the permissions for /srv might be 0700,
+          # making it impossible to cd into the storagePath
+          createHome = false;
           isNormalUser = false;
         };
         users.groups.${cfg.group}.members = [ cfg.user ];