From 465ffab65d0680ea64052d9a9990788966675d10 Mon Sep 17 00:00:00 2001
From: Adam Dinwoodie <adam@dinwoodie.org>
Date: Mon, 30 Dec 2024 21:34:18 +0000
Subject: [PATCH] nixos/taskserver: fix systemd shellcheck warning

The taskserver-init systemd unit fails to build with
systemd.enableStrictShellChecks enabled, due to using the potentially
unsafe `mkdir -m`.  Fix that by moving directory creation out to
systemd.tmpfiles.
---
 nixos/modules/services/misc/taskserver/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/misc/taskserver/default.nix b/nixos/modules/services/misc/taskserver/default.nix
index 64ff7437fb08..592514718940 100644
--- a/nixos/modules/services/misc/taskserver/default.nix
+++ b/nixos/modules/services/misc/taskserver/default.nix
@@ -498,16 +498,16 @@ in
         ca.cert = if needToCreateCA then "${cfg.dataDir}/keys/ca.cert" else "${cfg.pki.manual.ca.cert}";
       };
 
+      systemd.tmpfiles.rules = [
+        "d ${cfg.dataDir} 0770 ${cfg.user} ${cfg.group}"
+        "z ${cfg.dataDir} 0770 ${cfg.user} ${cfg.group}"
+      ];
+
       systemd.services.taskserver-init = {
         wantedBy = [ "taskserver.service" ];
         before = [ "taskserver.service" ];
         description = "Initialize Taskserver Data Directory";
 
-        preStart = ''
-          mkdir -m 0770 -p "${cfg.dataDir}"
-          chown "${cfg.user}:${cfg.group}" "${cfg.dataDir}"
-        '';
-
         script = ''
           ${taskd} init
           touch "${cfg.dataDir}/.is_initialized"