From ae5a4970962ac70f02aa198d09bce07073891fe2 Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Fri, 31 Oct 2025 16:11:33 +0900
Subject: [PATCH] nixos/wg-access-server: replace systemd `script` with
 `ExecStart{,Pre}`

---
 .../services/networking/wg-access-server.nix    | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/nixos/modules/services/networking/wg-access-server.nix b/nixos/modules/services/networking/wg-access-server.nix
index c5fb98d527e6..0b26c7f5e5ba 100644
--- a/nixos/modules/services/networking/wg-access-server.nix
+++ b/nixos/modules/services/networking/wg-access-server.nix
@@ -109,18 +109,9 @@ in
       wantedBy = [ "multi-user.target" ];
       requires = [ "network-online.target" ];
       after = [ "network-online.target" ];
-      script = ''
-        # merge secrets into main config
-        yq eval-all "select(fileIndex == 0) * select(fileIndex == 1)" ${configFile} $CREDENTIALS_DIRECTORY/SECRETS_FILE \
-          > "$STATE_DIRECTORY/config.yml"
-
-        ${lib.getExe cfg.package} serve --config "$STATE_DIRECTORY/config.yml"
-      '';
 
       path = with pkgs; [
         iptables
-        # needed by startup script
-        yq-go
       ];
 
       serviceConfig =
@@ -138,6 +129,14 @@ in
             "SECRETS_FILE:${cfg.secretsFile}"
           ];
 
+          # merge secrets into main config
+          ExecStartPre = [
+            "${lib.getExe' pkgs.coreutils "install"} '${configFile}' \"\${STATE_DIRECTORY}\"/config.yml"
+            "${lib.getExe pkgs.yq-go} eval-all 'select(fileIndex == 0) * select(fileIndex == 1)' \"\${STATE_DIRECTORY}\"/config.yml --inplace \"\${CREDENTIALS_DIRECTORY}\"/SECRETS_FILE"
+          ];
+
+          ExecStart = "${lib.getExe cfg.package} serve --config \"\${STATE_DIRECTORY}\"/config.yml";
+
           # Hardening
           DynamicUser = true;
           AmbientCapabilities = capabilities;