From 5949a18871549dc7139d88e7e133319051bf7a13 Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Sun, 9 Nov 2025 18:14:14 +0100
Subject: [PATCH] treewide: use externalPath

---
 nixos/modules/services/backup/pgbackrest.nix       | 10 ++--------
 .../services/databases/postgres-websockets.nix     | 14 ++------------
 nixos/modules/services/databases/postgrest.nix     | 14 ++------------
 .../services/matrix/matrix-alertmanager.nix        | 10 ++--------
 .../monitoring/prometheus/exporters/storagebox.nix |  5 +----
 .../services/networking/cloudflare-dyndns.nix      |  6 +-----
 nixos/modules/services/networking/syncthing.nix    |  7 +------
 nixos/modules/services/security/step-ca.nix        |  7 +------
 nixos/modules/services/web-apps/librespeed.nix     |  9 +--------
 nixos/modules/services/web-apps/oncall.nix         |  5 +----
 nixos/modules/services/web-apps/photoprism.nix     | 14 ++------------
 11 files changed, 16 insertions(+), 85 deletions(-)

diff --git a/nixos/modules/services/backup/pgbackrest.nix b/nixos/modules/services/backup/pgbackrest.nix
index 6e5880ba1f90..bb5c45604926 100644
--- a/nixos/modules/services/backup/pgbackrest.nix
+++ b/nixos/modules/services/backup/pgbackrest.nix
@@ -83,10 +83,7 @@ let
   secretPathOption =
     with lib.types;
     lib.mkOption {
-      type = nullOr (pathWith {
-        inStore = false;
-        absolute = true;
-      });
+      type = nullOr externalPath;
       default = null;
       internal = true;
     };
@@ -142,10 +139,7 @@ in
               };
 
               options.sftp-private-key-file = lib.mkOption {
-                type = nullOr (pathWith {
-                  inStore = false;
-                  absolute = true;
-                });
+                type = nullOr externalPath;
                 default = null;
                 description = ''
                   SFTP private key file.
diff --git a/nixos/modules/services/databases/postgres-websockets.nix b/nixos/modules/services/databases/postgres-websockets.nix
index 738f33bd7b0f..2312ac69a01a 100644
--- a/nixos/modules/services/databases/postgres-websockets.nix
+++ b/nixos/modules/services/databases/postgres-websockets.nix
@@ -31,12 +31,7 @@ in
     enable = lib.mkEnableOption "postgres-websockets";
 
     pgpassFile = lib.mkOption {
-      type =
-        with lib.types;
-        nullOr (pathWith {
-          inStore = false;
-          absolute = true;
-        });
+      type = with lib.types; nullOr externalPath;
       default = null;
       example = "/run/keys/db_password";
       description = ''
@@ -54,12 +49,7 @@ in
     };
 
     jwtSecretFile = lib.mkOption {
-      type =
-        with lib.types;
-        nullOr (pathWith {
-          inStore = false;
-          absolute = true;
-        });
+      type = with lib.types; nullOr externalPath;
       example = "/run/keys/jwt_secret";
       description = ''
         Secret used to sign JWT tokens used to open communications channels.
diff --git a/nixos/modules/services/databases/postgrest.nix b/nixos/modules/services/databases/postgrest.nix
index 262a8e9433a3..503696540668 100644
--- a/nixos/modules/services/databases/postgrest.nix
+++ b/nixos/modules/services/databases/postgrest.nix
@@ -54,12 +54,7 @@ in
     enable = lib.mkEnableOption "PostgREST";
 
     pgpassFile = lib.mkOption {
-      type =
-        with lib.types;
-        nullOr (pathWith {
-          inStore = false;
-          absolute = true;
-        });
+      type = with lib.types; nullOr externalPath;
       default = null;
       example = "/run/keys/db_password";
       description = ''
@@ -77,12 +72,7 @@ in
     };
 
     jwtSecretFile = lib.mkOption {
-      type =
-        with lib.types;
-        nullOr (pathWith {
-          inStore = false;
-          absolute = true;
-        });
+      type = with lib.types; nullOr externalPath;
       default = null;
       example = "/run/keys/jwt_secret";
       description = ''
diff --git a/nixos/modules/services/matrix/matrix-alertmanager.nix b/nixos/modules/services/matrix/matrix-alertmanager.nix
index 6d588a1c78cd..3782d53a084d 100644
--- a/nixos/modules/services/matrix/matrix-alertmanager.nix
+++ b/nixos/modules/services/matrix/matrix-alertmanager.nix
@@ -76,17 +76,11 @@ in
       description = "Makes the bot mention @room when posting an alert";
     };
     tokenFile = lib.mkOption {
-      type = lib.types.pathWith {
-        inStore = false;
-        absolute = true;
-      };
+      type = lib.types.externalPath;
       description = "File that contains a valid Matrix token for the Matrix user.";
     };
     secretFile = lib.mkOption {
-      type = lib.types.pathWith {
-        inStore = false;
-        absolute = true;
-      };
+      type = lib.types.externalPath;
       description = "File that contains a secret for the Alertmanager webhook.";
     };
   };
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/storagebox.nix b/nixos/modules/services/monitoring/prometheus/exporters/storagebox.nix
index 10a102bbf62f..f4d30465f7be 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/storagebox.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/storagebox.nix
@@ -15,10 +15,7 @@ in
   extraOpts = {
     package = mkPackageOption pkgs "prometheus-storagebox-exporter" { };
     tokenFile = lib.mkOption {
-      type = lib.types.pathWith {
-        inStore = false;
-        absolute = true;
-      };
+      type = lib.types.externalPath;
       description = "File that contains the Hetzner API token to use.";
     };
 
diff --git a/nixos/modules/services/networking/cloudflare-dyndns.nix b/nixos/modules/services/networking/cloudflare-dyndns.nix
index 675fedeaf9b4..2dedbe9b7922 100644
--- a/nixos/modules/services/networking/cloudflare-dyndns.nix
+++ b/nixos/modules/services/networking/cloudflare-dyndns.nix
@@ -15,11 +15,7 @@ in
       package = lib.mkPackageOption pkgs "cloudflare-dyndns" { };
 
       apiTokenFile = lib.mkOption {
-        type = lib.types.pathWith {
-          absolute = true;
-          inStore = false;
-        };
-
+        type = lib.types.externalPath;
         description = ''
           The path to a file containing the CloudFlare API token.
         '';
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index f1fcaf855e96..9bc65451a1e0 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -559,12 +559,7 @@ in
                                     '';
                                   };
                                   encryptionPasswordFile = mkOption {
-                                    type = types.nullOr (
-                                      types.pathWith {
-                                        inStore = false;
-                                        absolute = true;
-                                      }
-                                    );
+                                    type = types.nullOr types.externalPath;
                                     default = null;
                                     description = ''
                                       Path to encryption password. If set, the file will be read during
diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index 746d3c0b3839..3e57180a5b28 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -55,12 +55,7 @@ in
         '';
       };
       intermediatePasswordFile = lib.mkOption {
-        type = lib.types.nullOr (
-          lib.types.pathWith {
-            inStore = false;
-            absolute = true;
-          }
-        );
+        type = lib.types.nullOr lib.types.externalPath;
         default = null;
         example = "/run/keys/smallstep-password";
         description = ''
diff --git a/nixos/modules/services/web-apps/librespeed.nix b/nixos/modules/services/web-apps/librespeed.nix
index 2f7658339751..09a0ee4767bd 100644
--- a/nixos/modules/services/web-apps/librespeed.nix
+++ b/nixos/modules/services/web-apps/librespeed.nix
@@ -71,14 +71,7 @@ in
         The contents of the specified paths will be read at service start time and merged with the attributes provided in `settings`.
       '';
       default = { };
-      type =
-        with lib.types;
-        nullOr (
-          attrsOf (pathWith {
-            inStore = false;
-            absolute = true;
-          })
-        );
+      type = with lib.types; nullOr (attrsOf externalPath);
     };
 
     settings = lib.mkOption {
diff --git a/nixos/modules/services/web-apps/oncall.nix b/nixos/modules/services/web-apps/oncall.nix
index 98ddae259e7a..19b71dd92f02 100644
--- a/nixos/modules/services/web-apps/oncall.nix
+++ b/nixos/modules/services/web-apps/oncall.nix
@@ -78,10 +78,7 @@ in
     };
 
     secretFile = lib.mkOption {
-      type = lib.types.pathWith {
-        inStore = false;
-        absolute = true;
-      };
+      type = lib.types.externalPath;
       example = "/run/keys/oncall-dbpassword";
       description = ''
         A YAML file containing secrets such as database or user passwords.
diff --git a/nixos/modules/services/web-apps/photoprism.nix b/nixos/modules/services/web-apps/photoprism.nix
index f33899ce22f9..f4b91288b1d2 100644
--- a/nixos/modules/services/web-apps/photoprism.nix
+++ b/nixos/modules/services/web-apps/photoprism.nix
@@ -33,12 +33,7 @@ in
     enable = lib.mkEnableOption "Photoprism web server";
 
     passwordFile = lib.mkOption {
-      type = lib.types.nullOr (
-        lib.types.pathWith {
-          inStore = false;
-          absolute = true;
-        }
-      );
+      type = lib.types.nullOr lib.types.externalPath;
       default = null;
       description = ''
         Admin password file.
@@ -46,12 +41,7 @@ in
     };
 
     databasePasswordFile = lib.mkOption {
-      type = lib.types.nullOr (
-        lib.types.pathWith {
-          inStore = false;
-          absolute = true;
-        }
-      );
+      type = lib.types.nullOr lib.types.externalPath;
       default = null;
       description = ''
         Database password file.