From 51ebb3d19ed1baa312f56ceca5f1a322d6f640c4 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Fri, 21 Nov 2025 20:50:11 +0100
Subject: [PATCH 1/4] nixos/gonic: add package option

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 nixos/modules/services/audio/gonic.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/audio/gonic.nix b/nixos/modules/services/audio/gonic.nix
index 5ed639fb8a75..bcfff45a86f7 100644
--- a/nixos/modules/services/audio/gonic.nix
+++ b/nixos/modules/services/audio/gonic.nix
@@ -21,6 +21,8 @@ in
 
       enable = lib.mkEnableOption "Gonic music server";
 
+      package = lib.mkPackageOption pkgs "gonic" { };
+
       settings = lib.mkOption rec {
         type = settingsFormat.type;
         apply = lib.recursiveUpdate default;
@@ -62,7 +64,7 @@ in
               n: v: !((n == "tls-cert" || n == "tls-key") && v == null)
             ) cfg.settings;
           in
-          "${pkgs.gonic}/bin/gonic -config-path ${settingsFormat.generate "gonic" filteredSettings}";
+          "${lib.getExe cfg.package} -config-path ${settingsFormat.generate "gonic" filteredSettings}";
         DynamicUser = true;
         StateDirectory = "gonic";
         CacheDirectory = "gonic";

From 195c9839052350af6fe69196e1688c073d278192 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Fri, 21 Nov 2025 20:59:08 +0100
Subject: [PATCH 2/4] nixos/gonic: ensure paths from config are writable

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 nixos/tests/gonic.nix | 49 ++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 44 insertions(+), 5 deletions(-)

diff --git a/nixos/tests/gonic.nix b/nixos/tests/gonic.nix
index 836e7167035f..93b7c6df5346 100644
--- a/nixos/tests/gonic.nix
+++ b/nixos/tests/gonic.nix
@@ -1,19 +1,33 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 {
   name = "gonic";
 
-  nodes.machine =
-    { ... }:
+  nodes.default_cache_dir =
+    { config, ... }:
     {
       systemd.tmpfiles.settings = {
         "10-gonic" = {
           "/tmp/music"."d" = { };
           "/tmp/podcast"."d" = { };
           "/tmp/playlists"."d" = { };
+          "/tmp/secrets"."d" = { };
         };
       };
       services.gonic = {
         enable = true;
+        # Wrap gonic to check that the required paths are writable.
+        # This isn't necessarily checked by successful service startup.
+        package = pkgs.writeShellApplication {
+          name = "gonic-test-wrapper";
+          runtimeInputs = [ pkgs.gonic ];
+          text = ''
+            touch ${config.services.gonic.settings.cache-path}/foo && echo "cache dir writeable" >&2
+            touch /tmp/podcast/foo && echo "podcast dir writeable" >&2
+            touch /tmp/playlists/foo && echo "playlists dir writeable" >&2
+            touch /tmp/secrets/foo && echo "shouldn't be able to write /tmp/secrets" >&2 && exit 1
+            exec ${lib.getExe pkgs.gonic} "$@"
+          '';
+        };
         settings = {
           music-path = [ "/tmp/music" ];
           podcast-path = "/tmp/podcast";
@@ -22,8 +36,33 @@
       };
     };
 
+  nodes.custom_cache_dir =
+    { ... }:
+    {
+      systemd.tmpfiles.settings = {
+        "10-gonic" = {
+          "/tmp/music"."d" = { };
+          "/tmp/podcast"."d" = { };
+          "/tmp/playlists"."d" = { };
+          "/tmp/cache"."d" = { };
+        };
+      };
+      services.gonic = {
+        enable = true;
+        settings = {
+          music-path = [ "/tmp/music" ];
+          podcast-path = "/tmp/podcast";
+          playlists-path = "/tmp/playlists";
+          cache-path = "/tmp/cache";
+        };
+      };
+    };
+
   testScript = ''
-    machine.wait_for_unit("gonic")
-    machine.wait_for_open_port(4747)
+    default_cache_dir.wait_for_unit("gonic")
+    default_cache_dir.wait_for_open_port(4747)
+
+    custom_cache_dir.wait_for_unit("gonic")
+    custom_cache_dir.wait_for_open_port(4747)
   '';
 }

From 6cff5881e9897278ebc6b47bb9031ecee583cbed Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Sun, 23 Nov 2025 17:52:09 +0100
Subject: [PATCH 3/4] nixos/gonic: remove DynamicUser

It's not possible to let a user hand in paths that gonic should
write to if DynamicUser is used, remove it. The service should
still be sufficiently sandboxed as using chroot and only binding
paths selectively.

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 nixos/modules/services/audio/gonic.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/services/audio/gonic.nix b/nixos/modules/services/audio/gonic.nix
index bcfff45a86f7..da259d6957d9 100644
--- a/nixos/modules/services/audio/gonic.nix
+++ b/nixos/modules/services/audio/gonic.nix
@@ -65,7 +65,6 @@ in
             ) cfg.settings;
           in
           "${lib.getExe cfg.package} -config-path ${settingsFormat.generate "gonic" filteredSettings}";
-        DynamicUser = true;
         StateDirectory = "gonic";
         CacheDirectory = "gonic";
         WorkingDirectory = "/var/lib/gonic";

From 68daa1c784bb4dc0062ced1118305c892a788c75 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Sun, 23 Nov 2025 18:00:12 +0100
Subject: [PATCH 4/4] nixosTests.gonic: add maintainers

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 nixos/tests/gonic.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/tests/gonic.nix b/nixos/tests/gonic.nix
index 93b7c6df5346..9e8230f262ca 100644
--- a/nixos/tests/gonic.nix
+++ b/nixos/tests/gonic.nix
@@ -1,6 +1,7 @@
 { lib, pkgs, ... }:
 {
   name = "gonic";
+  meta.maintainers = pkgs.gonic.meta.maintainers;
 
   nodes.default_cache_dir =
     { config, ... }: