From 7f7d069ad7fdcee7762b512a167ff58aa90c9d15 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 20 Jun 2026 22:07:17 +0200
Subject: [PATCH] nixos/netbox: add services to redis group conditionally

This only makes sense when there is a local redis group, and then we
can scope the group membership to the service instead of the whole user.
---
 nixos/modules/services/web-apps/netbox.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index 0065fd382ab8..d74c9c926b80 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -81,6 +81,7 @@ let
             lib.cli.toCommandLineShellGNU { } {
               preserve-environment = true;
               user = "netbox";
+              supp-group = if cfg.redis.createLocally then config.services.redis.servers.netbox.group else null;
             }
           } -- ${finalPackage}/bin/netbox "$@";;
         "netbox")
@@ -608,6 +609,9 @@ in
               RestartSec = 30;
               Slice = "system-netbox.slice";
               EnvironmentFile = cfg.environmentFiles;
+              SupplementaryGroups = lib.optionals cfg.redis.createLocally [
+                config.services.redis.servers.netbox.group
+              ];
 
               AmbientCapabilities = [ "" ];
               CapabilityBoundingSet = [ "" ];
@@ -775,7 +779,6 @@ in
           group = "netbox";
         };
         users.groups.netbox = { };
-        users.groups."${config.services.redis.servers.netbox.user}".members = [ "netbox" ];
       }
 
       (lib.mkIf cfg.nginx.enable {