From abb3c9aefa56ab22ea7268720db5a8f0000b1f67 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 10 Nov 2025 10:24:21 +0000
Subject: [PATCH 1/2] nixos/services.nginx.sso: use 'LoadCredential'

This removes the need for secret files to be readable by `nginx-sso`.

In fact, that was the entire reason for making the service use a named
user account.
---
 nixos/modules/services/security/nginx-sso.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/security/nginx-sso.nix b/nixos/modules/services/security/nginx-sso.nix
index 130cc4d8e09b..00e3df1f12ae 100644
--- a/nixos/modules/services/security/nginx-sso.nix
+++ b/nixos/modules/services/security/nginx-sso.nix
@@ -9,6 +9,9 @@ let
   cfg = config.services.nginx.sso;
   format = pkgs.formats.yaml { };
   configPath = "/var/lib/nginx-sso/config.yaml";
+  secretsReplacement = utils.genJqSecretsReplacement {
+    loadCredential = true;
+  } cfg.configuration configPath;
 in
 {
   options.services.nginx.sso = {
@@ -47,7 +50,7 @@ in
         Options containing secret data should be set to an attribute set
         with the singleton attribute `_secret` - a string value set to the path
         to the file containing the secret value which should be used in the
-        configuration. This file must be readable by `nginx-sso`.
+        configuration.
       '';
     };
   };
@@ -63,13 +66,14 @@ in
         ExecStartPre = pkgs.writeShellScript "merge-nginx-sso-config" ''
           rm -f '${configPath}'
           # Relies on YAML being a superset of JSON
-          ${utils.genJqSecretsReplacementSnippet cfg.configuration configPath}
+          ${secretsReplacement.script}
         '';
         ExecStart = ''
           ${lib.getExe cfg.package} \
             --config ${configPath} \
             --frontend-dir ${lib.getBin cfg.package}/share/frontend
         '';
+        LoadCredential = secretsReplacement.credentials;
         Restart = "always";
         User = "nginx-sso";
         Group = "nginx-sso";

From 513678ee60546ae9b3199b35295a43721822e359 Mon Sep 17 00:00:00 2001
From: Bruno BELANYI <bruno@belanyi.fr>
Date: Mon, 10 Nov 2025 10:25:49 +0000
Subject: [PATCH 2/2] nixos/services.nginx.sso: use 'DynamicUser'

Now that we use `LoadCredential` to read secrets, we can go back to
using `DynamicUser` for the service.
---
 nixos/modules/services/security/nginx-sso.nix | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/nixos/modules/services/security/nginx-sso.nix b/nixos/modules/services/security/nginx-sso.nix
index 00e3df1f12ae..273b860c359d 100644
--- a/nixos/modules/services/security/nginx-sso.nix
+++ b/nixos/modules/services/security/nginx-sso.nix
@@ -75,16 +75,8 @@ in
         '';
         LoadCredential = secretsReplacement.credentials;
         Restart = "always";
-        User = "nginx-sso";
-        Group = "nginx-sso";
+        DynamicUser = true;
       };
     };
-
-    users.users.nginx-sso = {
-      isSystemUser = true;
-      group = "nginx-sso";
-    };
-
-    users.groups.nginx-sso = { };
   };
 }