From 08a81f0e1060f76b78f368b2b2b95f4691d3456e Mon Sep 17 00:00:00 2001
From: Andrew Benbow <andrew.benbow@posteo.com>
Date: Fri, 10 Apr 2026 11:06:11 -0400
Subject: [PATCH] nixos/drupal: synchronize config sync yamls from src into
 drupal state dir

---
 doc/release-notes/rl-2605.section.md       |  2 +-
 nixos/modules/services/web-apps/drupal.nix | 69 ++++++++++++++++++++--
 2 files changed, 66 insertions(+), 5 deletions(-)

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 2e5d9f73d444..5b795f986f2f 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -328,4 +328,4 @@ gnuradioMinimal.override {
 
 - The builder `php.buildComposerProject2` for PHP applications has been improved for better reliability and stability.
 
-- The `services.drupal` module has a few improvements aimed at making it better for installing custom Drupal instances, namely a `webRoot` option and a some new settings for managing variable content and filepaths.
+- The `services.drupal` module has a few improvements aimed at making it better for installing custom Drupal instances, namely a new `webRoot` option for identifying custom webroots in source code, a new `configRoot` option for identifying and synchronizing config yamls onto NixOS, and a some new settings for managing variable content and filepaths.
diff --git a/nixos/modules/services/web-apps/drupal.nix b/nixos/modules/services/web-apps/drupal.nix
index a6fa29cbd351..dff3450553be 100644
--- a/nixos/modules/services/web-apps/drupal.nix
+++ b/nixos/modules/services/web-apps/drupal.nix
@@ -23,10 +23,12 @@ let
     mkPackageOption
     nameValuePair
     optionalAttrs
+    optionalString
     types
     ;
   inherit (lib.strings)
     removePrefix
+    removeSuffix
     ;
   inherit (pkgs)
     mariadb
@@ -51,7 +53,13 @@ let
         runHook preInstall
 
         mkdir -p $out
-        rsync -aq * $out/ --exclude=${removePrefix "/" cfg.webRoot}/sites --exclude=sites
+        EXCLUDES="--exclude=${removePrefix "/" cfg.webRoot}/sites --exclude=sites"
+
+        if [ ! -z "${cfg.configRoot}" ]; then
+          EXCLUDES="$EXCLUDES --exclude=${removePrefix "/" cfg.configRoot}"
+        fi
+
+        rsync -aq * $out/ $EXCLUDES
 
         runHook postInstall
       '';
@@ -81,6 +89,26 @@ let
       '';
     });
 
+  configSync =
+    hostName: cfg:
+    optionalString (cfg.configRoot != "") (
+      stdenv.mkDerivation (finalAttrs: {
+        pname = "drupal-config-${hostName}";
+        name = "drupal-config-${hostName}";
+        src = cfg.package;
+        buildInputs = with pkgs; [ rsync ];
+
+        installPhase = ''
+          runHook preInstall
+
+          mkdir -p $out/config
+          rsync -a ./share/php/${cfg.package.pname}${cfg.configRoot}/* $out/config/
+
+          runHook postInstall
+        '';
+      })
+    );
+
   drupalSettings =
     hostName: cfg:
     pkgs.writeTextFile {
@@ -136,7 +164,10 @@ let
     hostName: cfg:
     pkgs.writeShellApplication {
       name = "drupal-state-init-${hostName}";
-      excludeShellChecks = [ "SC2194" ];
+      excludeShellChecks = [
+        "SC2194"
+        "SC2157"
+      ];
       runtimeInputs = with pkgs; [ rsync ];
       text = ''
         echo "Updating the sites directory for ${hostName}..."
@@ -144,6 +175,12 @@ let
           --exclude "*/files" \
           --delete-before
 
+        if [ ! -z "${cfg.configRoot}" ]; then
+          echo "Updating config sync directory for ${hostName}..."
+          rsync -auq "${configSync hostName cfg}/config/" "${removeSuffix "/sync" cfg.configSyncDir}" \
+            --delete-before
+        fi
+
         if [ ! -d "${cfg.filesDir}" ]; then
           echo "Preparing files directory..."
           mkdir -p "${cfg.filesDir}"
@@ -221,6 +258,10 @@ let
             The location of the user-managed Drupal config sync directory.
             Drupal will both read from and write to this directory when executing
             configuration management operations.
+
+            This option differs from the `configRoot` option,
+            which this service uses to discover
+            the location of the config sync directory in the package's source code.
           '';
         };
 
@@ -229,12 +270,32 @@ let
           default = "";
           description = ''
             An optional path string with a leading slash
-            indicating the location of the Drupal webroot relative to the
-            project root directory, if one exists.
+            indicating the location of the Drupal webroot
+            in your package's source code.
+
+            The path relative to the project root directory.
           '';
           example = "/web";
         };
 
+        configRoot = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            An optional path string with a leading slash
+            indicating the location of the config sync directory on
+            the Drupal package. Your package will probably have a config sync
+            directory if it has been significantly customized.
+
+            The path must be relative to the project root directory.
+
+            This option differs from the `configSyncDir` option, which
+            tells this service where to create a user-writeable config directory
+            on NixOS.
+          '';
+          example = "/config";
+        };
+
         extraConfig = mkOption {
           type = types.lines;
           default = "";