From bc72dc08f2e8cb846c56955a69c025d7b97a0c7c Mon Sep 17 00:00:00 2001
From: schnusch <schnusch@users.noreply.github.com>
Date: Wed, 29 Nov 2023 21:09:21 +0100
Subject: [PATCH] nixos/vdirsyncer: only use ProtectHome=yes with
 DynamicUser=yes

If a user is given it seems likely that their home directory is accessed.
---
 nixos/modules/services/networking/vdirsyncer.nix | 2 +-
 nixos/tests/vdirsyncer.nix                       | 7 -------
 2 files changed, 1 insertion(+), 8 deletions(-)

diff --git a/nixos/modules/services/networking/vdirsyncer.nix b/nixos/modules/services/networking/vdirsyncer.nix
index 692ce12c7a6c..325c7e60a11d 100644
--- a/nixos/modules/services/networking/vdirsyncer.nix
+++ b/nixos/modules/services/networking/vdirsyncer.nix
@@ -45,6 +45,7 @@ let
       }
       // (optionalAttrs (cfg'.user == null) {
         DynamicUser = true;
+        ProtectHome = true;
       })
       // (optionalAttrs (cfg'.additionalGroups != [ ]) {
         SupplementaryGroups = cfg'.additionalGroups;
@@ -63,7 +64,6 @@ let
       PrivateTmp = true;
       NoNewPrivileges = true;
       ProtectSystem = "strict";
-      ProtectHome = true;
       ProtectKernelTunables = true;
       ProtectKernelModules = true;
       ProtectControlGroups = true;
diff --git a/nixos/tests/vdirsyncer.nix b/nixos/tests/vdirsyncer.nix
index bd7b8316eff3..2376a6d689a1 100644
--- a/nixos/tests/vdirsyncer.nix
+++ b/nixos/tests/vdirsyncer.nix
@@ -217,13 +217,6 @@ import ./make-test-python.nix (
           };
         };
 
-        # ProtectHome is the default, but we must access our storage
-        # in ~.
-        systemd.services = {
-          "vdirsyncer@alice".serviceConfig.ProtectHome = lib.mkForce false;
-          "vdirsyncer@bob".serviceConfig.ProtectHome = lib.mkForce false;
-        };
-
         users.users = {
           alice.isNormalUser = true;
           bob.isNormalUser = true;