nixos/kanidm: only eliminate directory prefixes when merging BindPaths

nixos/modules/services/security/kanidm.nix

@@ -67,12 +67,20 @@ let
   # Merge bind mount paths and remove paths where a prefix is already mounted.
   # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount
   # paths, no new bind mount is added. Adding subpaths caused problems on ofborg.
-  hasPrefixInList = list: newPath: any (path: hasPrefix (toString path) (toString newPath)) list;
+  hasDirPrefix =
+    prefix: path:
+    let
+      normalizedDir = builtins.match "(.*[^/])/*" (toString prefix);
+      normalizedPrefix =
+        (if normalizedDir != null then builtins.head normalizedDir else toString prefix) + "/";
+    in
+    hasPrefix normalizedPrefix (toString path);
+  hasPrefixInList = list: newPath: any (path: hasDirPrefix path newPath) list;
   mergePaths = foldl' (
     merged: newPath:
     let
-      # If the new path is a prefix to some existing path, we need to filter it out
-      filteredPaths = filter (p: !hasPrefix (toString newPath) (toString p)) merged;
+      # If the new path is a prefix to some existing path, we need to filter it out. We make sure the prefix is a directory.
+      filteredPaths = filter (p: !hasDirPrefix newPath p) merged;
       # If a prefix of the new path is already in the list, do not add it
       filteredNew = optional (!hasPrefixInList filteredPaths newPath) newPath;
     in