nixos/ytdl-sub: add readWritePaths option

nixos/modules/services/misc/ytdl-sub.nix

@@ -11,6 +11,7 @@ let
 
   settingsFormat = pkgs.formats.yaml { };
 in
+
 {
   meta.maintainers = with lib.maintainers; [ defelo ];
 
@@ -46,6 +47,14 @@ in
                 example = "0/6:0";
               };
 
+              readWritePaths = lib.mkOption {
+                type = lib.types.listOf lib.types.path;
+                description = ''
+                  List of paths that ytdl-sub can write to.
+                '';
+                default = [ ];
+              };
+
               config = lib.mkOption {
                 type = settingsFormat.type;
                 description = "Configuration for ytdl-sub. See <https://ytdl-sub.readthedocs.io/en/latest/config_reference/config_yaml.html> for more information.";
@@ -127,6 +136,7 @@ in
               ProtectKernelTunables = true;
               ProtectProc = "invisible";
               ProtectSystem = "strict";
+              ReadWritePaths = instance.readWritePaths;
               RestrictAddressFamilies = [
                 "AF_INET"
                 "AF_INET6"
@@ -148,8 +158,6 @@ in
       };
     };
 
-    users.groups = lib.mkIf (cfg.group == "ytdl-sub") {
-      ytdl-sub = { };
-    };
+    users.groups = lib.mkIf (cfg.group == "ytdl-sub") { ytdl-sub = { }; };
   };
 }