From 3aca9c4155f5f58ef39ef3dd97e7f4c456da81f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 19 May 2026 22:02:06 +0200
Subject: [PATCH] nixos/pangolin: disable sign up per default

Otherwise pangolin has open registration and we want to have secure defaults.
---
 nixos/modules/services/networking/pangolin.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/networking/pangolin.nix b/nixos/modules/services/networking/pangolin.nix
index 354e496cab02..37fb0935be87 100644
--- a/nixos/modules/services/networking/pangolin.nix
+++ b/nixos/modules/services/networking/pangolin.nix
@@ -58,7 +58,10 @@ in
             internal_hostname = "localhost";
           };
           gerbil.base_endpoint = cfg.dashboardDomain;
-          flags.enable_integration_api = false;
+          flags = {
+            disable_signup_without_invite = true;
+            enable_integration_api = false;
+          };
         };
         defaultText = lib.literalExpression ''
           {
@@ -77,7 +80,10 @@ in
               internal_hostname = "localhost";
             };
             gerbil.base_endpoint = config.services.pangolin.dashboardDomain;
-            flags.disable_signup_without_invite = true;
+            flags = {
+              disable_signup_without_invite = true;
+              enable_integration_api = false;
+            };
           }
         '';
         description = ''