From a385f6220c268ee6d3ae109692ecee799c924630 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 23 Dec 2025 01:07:25 +0100
Subject: [PATCH] nixos/syncoid: avoid leaking zfs list into journald log

---
 nixos/modules/services/backup/syncoid.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/backup/syncoid.nix b/nixos/modules/services/backup/syncoid.nix
index fa1abfe12e2e..7529bb453df6 100644
--- a/nixos/modules/services/backup/syncoid.nix
+++ b/nixos/modules/services/backup/syncoid.nix
@@ -27,7 +27,7 @@ let
   # Function to build "zfs allow" commands for the filesystems we've delegated
   # permissions to. It also checks if the target dataset exists before
   # delegating permissions, if it doesn't exist we delegate it to the parent
-  # dataset (if it exists). This should solve the case of provisoning new
+  # dataset (if it exists). This should solve the case of provisioning new
   # datasets.
   buildAllowCommand =
     permissions: dataset:
@@ -42,7 +42,7 @@ let
           "list"
           dataset
         ]
-      } 2> /dev/null; then
+      } 2>&1 >/dev/null; then
         ${lib.escapeShellArgs [
           "/run/booted-system/sw/bin/zfs"
           "allow"