From 6ed6d97fc448f05eb806970d3caa92d8e53d8f52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 9 Oct 2025 18:02:40 +0200
Subject: [PATCH] nixos/hedgedoc: fix configureNginx, set path per default,
 adjust nginx group

---
 nixos/modules/services/web-apps/hedgedoc.nix | 25 +++++++++++++-------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/nixos/modules/services/web-apps/hedgedoc.nix b/nixos/modules/services/web-apps/hedgedoc.nix
index 90cb958533ed..07ed6b3a056d 100644
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@@ -248,35 +248,42 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    users.groups.${name} = { };
-    users.users.${name} = {
-      description = "HedgeDoc service user";
-      group = name;
-      isSystemUser = true;
+    users = {
+      groups.${name} = { };
+      users = {
+        nginx = lib.mkIf cfg.configureNginx {
+          extraGroups = [ "hedgedoc" ];
+        };
+        ${name} = {
+          description = "HedgeDoc service user";
+          group = name;
+          isSystemUser = true;
+        };
+      };
     };
 
     services = {
       hedgedoc.settings = {
         defaultNotePath = lib.mkDefault "${cfg.package}/share/hedgedoc/public/default.md";
         docsPath = lib.mkDefault "${cfg.package}/share/hedgedoc/public/docs";
+        path = lib.mkIf cfg.configureNginx "/run/hedgedoc/hedgedoc.sock";
         viewPath = lib.mkDefault "${cfg.package}/share/hedgedoc/public/views";
       };
 
       nginx = lib.mkIf cfg.configureNginx {
         enable = true;
-        upstreams.hedgedoc.servers."unix:${config.services.hedgedoc.settings.path}" = { };
+        upstreams.hedgedoc.servers."unix:${cfg.settings.path}" = { };
         virtualHosts."${cfg.settings.domain}" = {
-          enableACME = true;
           forceSSL = true;
           locations = {
             "/" = {
               proxyPass = "http://hedgedoc";
-              recommendedProxySettings = true;
+              recommendedProxySettings = lib.mkDefault true;
             };
             "/socket.io/" = {
               proxyPass = "http://hedgedoc";
               proxyWebsockets = true;
-              recommendedProxySettings = true;
+              recommendedProxySettings = lib.mkDefault true;
             };
           };
         };