From b0cce36acb45f73db759421e9dc6b63075b90d9d Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Mon, 19 Jan 2026 13:46:47 +0900
Subject: [PATCH] various: replace `systemd.services.<name>.{script,preStart}`
 with `ExecStart{,Pre}`

This is a partial revert of 39e9380
---
 nixos/modules/services/networking/tinydns.nix |  9 ++---
 nixos/modules/services/networking/toxvpn.nix  | 25 +++++++-------
 .../modules/services/networking/twingate.nix  |  2 +-
 nixos/modules/services/networking/xinetd.nix  |  3 +-
 nixos/modules/services/networking/xray.nix    |  4 +--
 nixos/modules/services/networking/zerobin.nix |  8 ++---
 nixos/modules/services/security/authelia.nix  |  2 +-
 nixos/modules/services/security/certmgr.nix   | 10 +++---
 .../services/security/hologram-agent.nix      |  4 +--
 nixos/modules/services/web-apps/bluemap.nix   |  4 +--
 nixos/modules/services/web-apps/cloudlog.nix  | 21 ++++++++----
 nixos/modules/services/web-apps/galene.nix    | 11 +++---
 nixos/modules/services/web-apps/glitchtip.nix | 11 +++---
 .../services/web-apps/healthchecks.nix        | 11 +++---
 .../modules/services/web-apps/mediagoblin.nix | 34 +++++++++----------
 nixos/modules/services/web-apps/miniflux.nix  | 12 ++-----
 nixos/modules/services/web-apps/misskey.nix   | 30 ++++++++--------
 nixos/modules/services/web-apps/nexus.nix     |  3 +-
 nixos/modules/services/web-apps/part-db.nix   |  5 +--
 .../services/web-apps/peering-manager.nix     |  5 +--
 .../services/web-apps/silverbullet.nix        |  4 ++-
 nixos/modules/services/web-apps/wakapi.nix    |  6 ++--
 .../services/web-servers/h2o/default.nix      |  3 +-
 .../services/web-servers/jboss/default.nix    |  2 +-
 24 files changed, 104 insertions(+), 125 deletions(-)

diff --git a/nixos/modules/services/networking/tinydns.nix b/nixos/modules/services/networking/tinydns.nix
index 145357b828b1..709f751ee825 100644
--- a/nixos/modules/services/networking/tinydns.nix
+++ b/nixos/modules/services/networking/tinydns.nix
@@ -58,10 +58,11 @@ with lib;
         ln -sf ${pkgs.writeText "tinydns-data" config.services.tinydns.data} data
         tinydns-data
       '';
-      script = ''
-        cd /var/lib/tinydns
-        exec ./run
-      '';
+      serviceConfig = {
+        StateDirectory = "tinydns";
+        WorkingDirectory = "/var/lib/tinydns";
+        ExecStart = "/var/lib/tinydns/run";
+      };
     };
   };
 }
diff --git a/nixos/modules/services/networking/toxvpn.nix b/nixos/modules/services/networking/toxvpn.nix
index 112c86187666..4688e410cee4 100644
--- a/nixos/modules/services/networking/toxvpn.nix
+++ b/nixos/modules/services/networking/toxvpn.nix
@@ -43,20 +43,19 @@ with lib;
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
 
-      preStart = ''
-        mkdir -p /run/toxvpn || true
-        chown toxvpn /run/toxvpn
-      '';
-
-      path = [ pkgs.toxvpn ];
-
-      script = ''
-        exec toxvpn -i ${config.services.toxvpn.localip} -l /run/toxvpn/control -u toxvpn -p ${toString config.services.toxvpn.port} ${
-          lib.concatMapStringsSep " " (x: "-a ${x}") config.services.toxvpn.auto_add_peers
-        }
-      '';
-
       serviceConfig = {
+        ExecStart =
+          let
+            args = lib.cli.toCommandLineShellGNU { } {
+              i = config.services.toxvpn.localip;
+              l = "/run/toxvpn/control";
+              u = "toxvpn";
+              p = config.services.toxvpn.port;
+              a = config.services.toxvpn.auto_add_peers;
+            };
+          in
+          "${lib.getExe pkgs.toxvpn} ${args}";
+        RuntimeDirectory = "toxvpn";
         KillMode = "process";
         Restart = "on-success";
         Type = "notify";
diff --git a/nixos/modules/services/networking/twingate.nix b/nixos/modules/services/networking/twingate.nix
index 4e9edf6bb23d..14baae06bc89 100644
--- a/nixos/modules/services/networking/twingate.nix
+++ b/nixos/modules/services/networking/twingate.nix
@@ -17,7 +17,7 @@ in
   config = lib.mkIf cfg.enable {
     systemd.packages = [ cfg.package ];
     systemd.services.twingate = {
-      preStart = "cp -r --update=none ${cfg.package}/etc/twingate/. /etc/twingate/";
+      serviceConfig.ExecStartPre = "${lib.getExe' pkgs.coreutils "cp"} -r --update=none ${cfg.package}/etc/twingate/. /etc/twingate/";
       wantedBy = [ "multi-user.target" ];
     };
 
diff --git a/nixos/modules/services/networking/xinetd.nix b/nixos/modules/services/networking/xinetd.nix
index d33b4d97519b..f1be424e075a 100644
--- a/nixos/modules/services/networking/xinetd.nix
+++ b/nixos/modules/services/networking/xinetd.nix
@@ -143,8 +143,7 @@ in
       description = "xinetd server";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.xinetd ];
-      script = "exec xinetd -syslog daemon -dontfork -stayalive -f ${configFile}";
+      serviceConfig.ExecStart = "${lib.getExe pkgs.xinetd} -syslog daemon -dontfork -stayalive -f ${configFile}";
     };
   };
 }
diff --git a/nixos/modules/services/networking/xray.nix b/nixos/modules/services/networking/xray.nix
index 1d0d514d2e48..8b55b24b008e 100644
--- a/nixos/modules/services/networking/xray.nix
+++ b/nixos/modules/services/networking/xray.nix
@@ -93,10 +93,8 @@ with lib;
         description = "xray Daemon";
         after = [ "network.target" ];
         wantedBy = [ "multi-user.target" ];
-        script = ''
-          exec "${cfg.package}/bin/xray" -config "$CREDENTIALS_DIRECTORY/config.json"
-        '';
         serviceConfig = {
+          ExecStart = "${cfg.package}/bin/xray -config \"\${CREDENTIALS_DIRECTORY}\"/config.json";
           DynamicUser = true;
           LoadCredential = "config.json:${settingsFile}";
           CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
diff --git a/nixos/modules/services/networking/zerobin.nix b/nixos/modules/services/networking/zerobin.nix
index 96cf4cc7148d..0673070d1ee6 100644
--- a/nixos/modules/services/networking/zerobin.nix
+++ b/nixos/modules/services/networking/zerobin.nix
@@ -91,14 +91,14 @@ in
       enable = true;
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
+      serviceConfig.ExecStartPre = [
+        "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}"
+        "${lib.getExe' pkgs.coreutils "chown"} ${cfg.user} ${cfg.dataDir}"
+      ];
       serviceConfig.ExecStart = "${pkgs.zerobin}/bin/zerobin ${cfg.listenAddress} ${toString cfg.listenPort} false ${cfg.user} ${cfg.group} ${zerobin_config}";
       serviceConfig.PrivateTmp = "yes";
       serviceConfig.User = cfg.user;
       serviceConfig.Group = cfg.group;
-      preStart = ''
-        mkdir -p ${cfg.dataDir}
-        chown ${cfg.user} ${cfg.dataDir}
-      '';
     };
   };
 }
diff --git a/nixos/modules/services/security/authelia.nix b/nixos/modules/services/security/authelia.nix
index 0632b7a21c9b..d669d986c710 100644
--- a/nixos/modules/services/security/authelia.nix
+++ b/nixos/modules/services/security/authelia.nix
@@ -389,10 +389,10 @@ in
           // lib.mapAttrs (_: v: "%d/${v}") nonNullEnvSecretsMap
           // instance.environmentVariables;
 
-          preStart = "${execCommand} ${configArg} validate-config";
           serviceConfig = {
             User = instance.user;
             Group = instance.group;
+            ExecStartPre = "${execCommand} ${configArg} validate-config";
             ExecStart = "${execCommand} ${configArg}";
             Restart = "always";
             RestartSec = "5s";
diff --git a/nixos/modules/services/security/certmgr.nix b/nixos/modules/services/security/certmgr.nix
index 6a744e572101..a2e00ca35a82 100644
--- a/nixos/modules/services/security/certmgr.nix
+++ b/nixos/modules/services/security/certmgr.nix
@@ -34,11 +34,6 @@ let
         [ spec ]
     ) (lib.attrValues cfg.specs)
   );
-
-  preStart = ''
-    ${lib.concatStringsSep " \\\n" ([ "mkdir -p" ] ++ map lib.escapeShellArg specPaths)}
-    ${cfg.package}/bin/certmgr -f ${certmgrYaml} check
-  '';
 in
 {
   options.services.certmgr = {
@@ -215,11 +210,14 @@ in
       wants = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
-      inherit preStart;
 
       serviceConfig = {
         Restart = "always";
         RestartSec = "10s";
+        ExecStartPre = [
+          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${lib.escapeShellArgs specPaths}"
+          "${lib.getExe cfg.package} -f ${certmgrYaml} check"
+        ];
         ExecStart = "${cfg.package}/bin/certmgr -f ${certmgrYaml}";
       };
     };
diff --git a/nixos/modules/services/security/hologram-agent.nix b/nixos/modules/services/security/hologram-agent.nix
index 21bedc4fabd2..6152a57ffb8c 100644
--- a/nixos/modules/services/security/hologram-agent.nix
+++ b/nixos/modules/services/security/hologram-agent.nix
@@ -55,10 +55,8 @@ in
         "network-link-dummy0.service"
         "network-addresses-dummy0.service"
       ];
-      preStart = ''
-        /run/current-system/sw/bin/rm -fv /run/hologram.sock
-      '';
       serviceConfig = {
+        ExecStartPre = "/run/current-system/sw/bin/rm -fv /run/hologram.sock";
         ExecStart = "${pkgs.hologram}/bin/hologram-agent -debug -conf ${cfgFile} -port ${cfg.httpPort}";
       };
     };
diff --git a/nixos/modules/services/web-apps/bluemap.nix b/nixos/modules/services/web-apps/bluemap.nix
index 5829b7c3e0dd..bd01d6470186 100644
--- a/nixos/modules/services/web-apps/bluemap.nix
+++ b/nixos/modules/services/web-apps/bluemap.nix
@@ -298,10 +298,8 @@ in
         Type = "oneshot";
         Group = "nginx";
         UMask = "026";
+        ExecStart = "${lib.getExe pkgs.bluemap} -c ${configFolder} -gs -r";
       };
-      script = ''
-        ${lib.getExe pkgs.bluemap} -c ${configFolder} -gs -r
-      '';
     };
 
     systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
diff --git a/nixos/modules/services/web-apps/cloudlog.nix b/nixos/modules/services/web-apps/cloudlog.nix
index 8b750aaacfc5..bf8e0dba60fd 100644
--- a/nixos/modules/services/web-apps/cloudlog.nix
+++ b/nixos/modules/services/web-apps/cloudlog.nix
@@ -380,37 +380,44 @@ in
         cloudlog-upload-lotw = {
           description = "Upload QSOs to LoTW if certs have been provided";
           enable = cfg.upload-lotw.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/lotw_upload";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/lotw/lotw_upload";
+          serviceConfig.Type = "oneshot";
         };
         cloudlog-update-lotw-users = {
           description = "Update LOTW Users Database";
           enable = cfg.update-lotw-users.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/load_users";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/lotw/load_users";
+          serviceConfig.Type = "oneshot";
         };
         cloudlog-update-dok = {
           description = "Update DOK File for autocomplete";
           enable = cfg.update-dok.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_dok";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_dok";
+          serviceConfig.Type = "oneshot";
         };
         cloudlog-update-clublog-scp = {
           description = "Update Clublog SCP Database File";
           enable = cfg.update-clublog-scp.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_clublog_scp";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_clublog_scp";
+          serviceConfig.Type = "oneshot";
         };
         cloudlog-update-wwff = {
           description = "Update WWFF File for autocomplete";
           enable = cfg.update-wwff.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_wwff";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_wwff";
+          serviceConfig.Type = "oneshot";
         };
         cloudlog-upload-qrz = {
           description = "Upload QSOs to QRZ Logbook";
           enable = cfg.upload-qrz.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/qrz/upload";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/qrz/upload";
+          serviceConfig.Type = "oneshot";
         };
         cloudlog-update-sota = {
           description = "Update SOTA File for autocomplete";
           enable = cfg.update-sota.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_sota";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_sota";
+          serviceConfig.Type = "oneshot";
         };
       };
       timers = {
diff --git a/nixos/modules/services/web-apps/galene.nix b/nixos/modules/services/web-apps/galene.nix
index 969615e6490a..6733a95d706c 100644
--- a/nixos/modules/services/web-apps/galene.nix
+++ b/nixos/modules/services/web-apps/galene.nix
@@ -133,19 +133,16 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      preStart = ''
-        ${optionalString (cfg.insecure != true && cfg.certFile != null && cfg.keyFile != null) ''
-          install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.certFile} ${cfg.dataDir}/cert.pem
-          install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.keyFile} ${cfg.dataDir}/key.pem
-        ''}
-      '';
-
       serviceConfig = mkMerge [
         {
           Type = "simple";
           User = cfg.user;
           Group = cfg.group;
           WorkingDirectory = cfg.stateDir;
+          ExecStartPre = lib.mkIf (cfg.insecure != true && cfg.certFile != null && cfg.keyFile != null) [
+            "${lib.getExe' pkgs.coreutils "install"} -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.certFile} ${cfg.dataDir}/cert.pem"
+            "${lib.getExe' pkgs.coreutils "install"} -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.keyFile} ${cfg.dataDir}/key.pem"
+          ];
           ExecStart = ''
             ${cfg.package}/bin/galene \
             ${optionalString (cfg.insecure) "-insecure"} \
diff --git a/nixos/modules/services/web-apps/glitchtip.nix b/nixos/modules/services/web-apps/glitchtip.nix
index 3660b83807bd..9aa5b5466501 100644
--- a/nixos/modules/services/web-apps/glitchtip.nix
+++ b/nixos/modules/services/web-apps/glitchtip.nix
@@ -280,13 +280,12 @@ in
           bindsTo = [ "glitchtip-worker.service" ];
           before = [ "glitchtip-worker.service" ];
 
-          preStart = ''
-            ${lib.getExe pkg} migrate
-            ${lib.getExe pkg} createcachetable
-            ${lib.getExe pkg} maintain_partitions
-          '';
-
           serviceConfig = commonServiceConfig // {
+            ExecStartPre = [
+              "${lib.getExe pkg} migrate"
+              "${lib.getExe pkg} createcachetable"
+              "${lib.getExe pkg} maintain_partitions"
+            ];
             ExecStart = ''
               ${lib.getExe python.pkgs.granian} \
                 --interface ${if cfg.settings.GLITCHTIP_ENABLE_MCP then "asgi" else "asginl"} \
diff --git a/nixos/modules/services/web-apps/healthchecks.nix b/nixos/modules/services/web-apps/healthchecks.nix
index 80f10b4af6af..f6c8a43cd329 100644
--- a/nixos/modules/services/web-apps/healthchecks.nix
+++ b/nixos/modules/services/web-apps/healthchecks.nix
@@ -237,14 +237,13 @@ in
           wantedBy = [ "healthchecks.target" ];
           after = [ "healthchecks-migration.service" ];
 
-          preStart = ''
-            ${pkg}/opt/healthchecks/manage.py collectstatic --no-input
-            ${pkg}/opt/healthchecks/manage.py remove_stale_contenttypes --no-input
-          ''
-          + lib.optionalString (cfg.settings.DEBUG != "True") "${pkg}/opt/healthchecks/manage.py compress";
-
           serviceConfig = commonConfig // {
             Restart = "always";
+            ExecStartPre = [
+              "${pkg}/opt/healthchecks/manage.py collectstatic --no-input"
+              "${pkg}/opt/healthchecks/manage.py remove_stale_contenttypes --no-input"
+            ]
+            ++ lib.optionals (cfg.settings.DEBUG != "True") [ "${pkg}/opt/healthchecks/manage.py compress" ];
             ExecStart = ''
               ${pkgs.python3Packages.gunicorn}/bin/gunicorn hc.wsgi \
                 --bind ${cfg.listenAddress}:${toString cfg.port} \
diff --git a/nixos/modules/services/web-apps/mediagoblin.nix b/nixos/modules/services/web-apps/mediagoblin.nix
index 081bfa763f9b..934afe082dae 100644
--- a/nixos/modules/services/web-apps/mediagoblin.nix
+++ b/nixos/modules/services/web-apps/mediagoblin.nix
@@ -310,19 +310,6 @@ in
       in
       {
         mediagoblin-celeryd = lib.recursiveUpdate serviceDefaults {
-          # we cannot change DEFAULT.data_dir inside mediagoblin.ini because of an annoying bug
-          # https://todo.sr.ht/~mediagoblin/mediagoblin/57
-          preStart = ''
-            cp --remove-destination ${
-              pkgs.writeText "mediagoblin.ini" (
-                lib.generators.toINI { } (lib.filterAttrsRecursive (n: v: n != "plugins") cfg.settings)
-                + "\n"
-                + lib.generators.toINI { mkKeyValue = mkSubSectionKeyValue 2; } {
-                  inherit (cfg.settings.mediagoblin) plugins;
-                }
-              )
-            } /var/lib/mediagoblin/mediagoblin.ini
-          '';
           serviceConfig = {
             Environment = [
               "CELERY_CONFIG_MODULE=mediagoblin.init.celery.from_celery"
@@ -331,6 +318,19 @@ in
               "MEDIAGOBLIN_CONFIG=/var/lib/mediagoblin/mediagoblin.ini"
               "PASTE_CONFIG=${pasteConfig}"
             ];
+            # we cannot change DEFAULT.data_dir inside mediagoblin.ini because of an annoying bug
+            # https://todo.sr.ht/~mediagoblin/mediagoblin/57
+            ExecStartPre = ''
+              ${lib.getExe' pkgs.coreutils "cp"} --remove-destination ${
+                pkgs.writeText "mediagoblin.ini" (
+                  lib.generators.toINI { } (lib.filterAttrsRecursive (n: v: n != "plugins") cfg.settings)
+                  + "\n"
+                  + lib.generators.toINI { mkKeyValue = mkSubSectionKeyValue 2; } {
+                    inherit (cfg.settings.mediagoblin) plugins;
+                  }
+                )
+              } /var/lib/mediagoblin/mediagoblin.ini
+            '';
             ExecStart = "${lib.getExe' finalPackage "celery"} worker --loglevel=INFO";
           };
           unitConfig.Description = "MediaGoblin Celery";
@@ -345,16 +345,16 @@ in
             "mediagoblin-celeryd.service"
             "postgresql.target"
           ];
-          preStart = ''
-            cp --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini
-            ${lib.getExe' finalPackage "gmg"} dbupdate
-          '';
           serviceConfig = {
             Environment = [
               "CELERY_ALWAYS_EAGER=false"
               "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
               "GST_PLUGIN_PATH=${GST_PLUGIN_PATH}"
             ];
+            ExecStartPre = [
+              "${lib.getExe' pkgs.coreutils "cp"} --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini"
+              "${lib.getExe' finalPackage "gmg"} dbupdate"
+            ];
             ExecStart = "${lib.getExe' finalPackage "paster"} serve /var/lib/mediagoblin/paste.ini";
           };
           unitConfig.Description = "Mediagoblin";
diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 2130427813f5..ebc77394ad53 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -17,14 +17,6 @@ let
   cfg = config.services.miniflux;
 
   boolToInt = b: if b then 1 else 0;
-
-  pgbin = "${config.services.postgresql.package}/bin";
-  # The hstore extension is no longer needed as of v2.2.14
-  # and would prevent Miniflux from starting.
-  preStart = pkgs.writeScript "miniflux-pre-start" ''
-    #!${pkgs.runtimeShell}
-    ${pgbin}/psql "miniflux" -c "DROP EXTENSION IF EXISTS hstore"
-  '';
 in
 
 {
@@ -142,7 +134,9 @@ in
       serviceConfig = {
         Type = "oneshot";
         User = config.services.postgresql.superUser;
-        ExecStart = preStart;
+        # The hstore extension is no longer needed as of v2.2.14
+        # and would prevent Miniflux from starting.
+        ExecStart = ''${config.services.postgresql.package}/bin/psql "miniflux" -c "DROP EXTENSION IF EXISTS hstore"'';
       };
     };
 
diff --git a/nixos/modules/services/web-apps/misskey.nix b/nixos/modules/services/web-apps/misskey.nix
index e02e4106a5ad..c4cf26ca2177 100644
--- a/nixos/modules/services/web-apps/misskey.nix
+++ b/nixos/modules/services/web-apps/misskey.nix
@@ -326,22 +326,22 @@ in
       environment = {
         MISSKEY_CONFIG_YML = "/run/misskey/default.yml";
       };
-      preStart = ''
-        install -m 700 ${settingsFormat.generate "misskey-config.yml" cfg.settings} /run/misskey/default.yml
-        install -m 700 ${
-          (pkgs.formats.json { }).generate "misskey-config.json" cfg.settings
-        } /run/misskey/default.json
-      ''
-      + (lib.optionalString (cfg.database.passwordFile != null) ''
-        ${pkgs.replace-secret}/bin/replace-secret '@DATABASE_PASSWORD@' "${cfg.database.passwordFile}" /run/misskey/default.yml
-      '')
-      + (lib.optionalString (cfg.redis.passwordFile != null) ''
-        ${pkgs.replace-secret}/bin/replace-secret '@REDIS_PASSWORD@' "${cfg.redis.passwordFile}" /run/misskey/default.yml
-      '')
-      + (lib.optionalString (cfg.meilisearch.keyFile != null) ''
-        ${pkgs.replace-secret}/bin/replace-secret '@MEILISEARCH_KEY@' "${cfg.meilisearch.keyFile}" /run/misskey/default.yml
-      '');
       serviceConfig = {
+        ExecStartPre = [
+          "${lib.getExe' pkgs.coreutils "install"} -m 700 ${settingsFormat.generate "misskey-config.yml" cfg.settings} /run/misskey/default.yml"
+          "${lib.getExe' pkgs.coreutils "install"} -m 700 ${
+            (pkgs.formats.json { }).generate "misskey-config.json" cfg.settings
+          } /run/misskey/default.json"
+        ]
+        ++ (lib.optionals (cfg.database.passwordFile != null) [
+          "${lib.getExe pkgs.replace-secret} '@DATABASE_PASSWORD@' '${cfg.database.passwordFile}' /run/misskey/default.yml"
+        ])
+        ++ (lib.optionals (cfg.redis.passwordFile != null) [
+          "${lib.getExe pkgs.replace-secret} '@REDIS_PASSWORD@' '${cfg.redis.passwordFile}' /run/misskey/default.yml"
+        ])
+        ++ (lib.optionals (cfg.meilisearch.keyFile != null) [
+          "${lib.getExe pkgs.replace-secret} '@MEILISEARCH_KEY@' '${cfg.meilisearch.keyFile}' /run/misskey/default.yml"
+        ]);
         ExecStart = "${cfg.package}/bin/misskey migrateandstart";
         RuntimeDirectory = "misskey";
         RuntimeDirectoryMode = "700";
diff --git a/nixos/modules/services/web-apps/nexus.nix b/nixos/modules/services/web-apps/nexus.nix
index 1a97c88900f9..8afba754315f 100644
--- a/nixos/modules/services/web-apps/nexus.nix
+++ b/nixos/modules/services/web-apps/nexus.nix
@@ -142,9 +142,8 @@ in
         fi
       '';
 
-      script = "${cfg.package}/bin/nexus run";
-
       serviceConfig = {
+        ExecStart = "${cfg.package}/bin/nexus run";
         User = cfg.user;
         Group = cfg.group;
         PrivateTmp = true;
diff --git a/nixos/modules/services/web-apps/part-db.nix b/nixos/modules/services/web-apps/part-db.nix
index 006481e6dda7..ef5f5d076163 100644
--- a/nixos/modules/services/web-apps/part-db.nix
+++ b/nixos/modules/services/web-apps/part-db.nix
@@ -257,6 +257,7 @@ in
           ];
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
+            ExecStart = "${lib.getExe cfg.phpPackage} ${lib.getExe' cfg.package "console"} doctrine:migrations:migrate --no-interaction";
             Type = "oneshot";
             RemainAfterExit = true;
             User = "part-db";
@@ -264,10 +265,6 @@ in
           restartTriggers = [
             cfg.package
           ];
-          script = ''
-            set -euo pipefail
-            ${lib.getExe cfg.phpPackage} ${lib.getExe' cfg.package "console"} doctrine:migrations:migrate --no-interaction
-          '';
         };
 
         phpfpm-part-db = {
diff --git a/nixos/modules/services/web-apps/peering-manager.nix b/nixos/modules/services/web-apps/peering-manager.nix
index 4c6738035576..ed55062d6edf 100644
--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@@ -307,11 +307,8 @@ in
           ]
           ++ lib.optionals (cfg.environmentFile != null) [ "peering-manager-config.service" ];
 
-          preStart = ''
-            ${pkg}/bin/peering-manager remove_stale_contenttypes --no-input
-          '';
-
           serviceConfig = {
+            ExecStartPre = "${pkg}/bin/peering-manager remove_stale_contenttypes --no-input";
             ExecStart = ''
               ${pkg.python.pkgs.gunicorn}/bin/gunicorn peering_manager.wsgi \
                 --bind ${cfg.listenAddress}:${toString cfg.port} \
diff --git a/nixos/modules/services/web-apps/silverbullet.nix b/nixos/modules/services/web-apps/silverbullet.nix
index 789fafb68f7f..6d14842ebebc 100644
--- a/nixos/modules/services/web-apps/silverbullet.nix
+++ b/nixos/modules/services/web-apps/silverbullet.nix
@@ -95,7 +95,6 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      preStart = lib.mkIf (!lib.hasPrefix "/var/lib/" cfg.spaceDir) "mkdir -p '${cfg.spaceDir}'";
       serviceConfig = {
         Type = "simple";
         User = "${cfg.user}";
@@ -104,6 +103,9 @@ in
         StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/" cfg.spaceDir) (
           lib.last (lib.splitString "/" cfg.spaceDir)
         );
+        ExecStartPre = lib.mkIf (
+          !lib.hasPrefix "/var/lib/" cfg.spaceDir
+        ) "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.spaceDir}'";
         ExecStart =
           "${lib.getExe cfg.package} --port ${toString cfg.listenPort} --hostname '${cfg.listenAddress}' '${cfg.spaceDir}' "
           + lib.concatStringsSep " " cfg.extraArgs;
diff --git a/nixos/modules/services/web-apps/wakapi.nix b/nixos/modules/services/web-apps/wakapi.nix
index e3861f889e19..6878276ed91b 100644
--- a/nixos/modules/services/web-apps/wakapi.nix
+++ b/nixos/modules/services/web-apps/wakapi.nix
@@ -144,13 +144,11 @@ in
       ++ optional (cfg.database.dialect == "postgres") "postgresql.target";
       wantedBy = [ "multi-user.target" ];
 
-      script = ''
-        exec ${getExe cfg.package} -config ${settingsFile}
-      '';
-
       serviceConfig = {
         EnvironmentFile = cfg.environmentFiles;
 
+        ExecStart = "${getExe cfg.package} -config ${settingsFile}";
+
         User = config.users.users.wakapi.name;
         Group = config.users.users.wakapi.group;
 
diff --git a/nixos/modules/services/web-servers/h2o/default.nix b/nixos/modules/services/web-servers/h2o/default.nix
index bea521ccc624..ba2066d70306 100644
--- a/nixos/modules/services/web-servers/h2o/default.nix
+++ b/nixos/modules/services/web-servers/h2o/default.nix
@@ -443,6 +443,7 @@ in
       ++ map (certName: "acme-${certName}.service") acmeCertNames.all;
 
       serviceConfig = {
+        ExecStartPre = "${h2oExe} --mode 'test'";
         ExecStart = "${h2oExe} --mode 'master'";
         ExecReload = [
           "${h2oExe} --mode 'test'"
@@ -483,8 +484,6 @@ in
         AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         CapabilitiesBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
       };
-
-      preStart = "${h2oExe} --mode 'test'";
     };
 
     # This service waits for all certificates to be available before reloading
diff --git a/nixos/modules/services/web-servers/jboss/default.nix b/nixos/modules/services/web-servers/jboss/default.nix
index 88bd1071b35b..516f887022b8 100644
--- a/nixos/modules/services/web-servers/jboss/default.nix
+++ b/nixos/modules/services/web-servers/jboss/default.nix
@@ -93,7 +93,7 @@ in
   config = mkIf config.services.jboss.enable {
     systemd.services.jboss = {
       description = "JBoss server";
-      script = "${jbossService}/bin/control start";
+      serviceConfig.ExecStart = "${jbossService}/bin/control start";
       wantedBy = [ "multi-user.target" ];
     };
   };