From 31f095fa1a25c7f1ef27ebb95fdb15ae8288e847 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Thu, 25 Sep 2025 14:22:20 +0200
Subject: [PATCH] nixos/redmine: Set up runtime directory by using
 RuntimeDirectory option

Instead of letting systemd tmpfiles set up the runtime directory, use
the option `RuntimeDirectory` from the systemd service config since the
configured path stays read-writable when ProtectSystem is set to
`strict`. This is equal to adding the path to ReadWritePaths.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 nixos/modules/services/misc/redmine.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 5771c766d285..6f0269d402bd 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -357,7 +357,6 @@ in
       "d '${cfg.stateDir}/themes' 0750 ${cfg.user} ${cfg.group} - -"
       "d '${cfg.stateDir}/tmp' 0750 ${cfg.user} ${cfg.group} - -"
 
-      "d /run/redmine - - - - -"
       "d /run/redmine/public - - - - -"
       "L+ /run/redmine/config - - - - ${cfg.stateDir}/config"
       "L+ /run/redmine/files - - - - ${cfg.stateDir}/files"
@@ -456,6 +455,8 @@ in
         TimeoutSec = "300";
         WorkingDirectory = "${cfg.package}/share/redmine";
         ExecStart = "${bundle} exec rails server -u webrick -e production -b ${toString cfg.address} -p ${toString cfg.port} -P '${cfg.stateDir}/redmine.pid'";
+        RuntimeDirectory = "redmine";
+        RuntimeDirectoryMode = "0750";
         AmbientCapabilities = "";
         CapabilityBoundingSet = "";
         LockPersonality = true;