From e08cc214fb790307feeccb3e1888219e62995a24 Mon Sep 17 00:00:00 2001
From: Aaron Kaiser <a_kaiser@posteo.de>
Date: Tue, 3 Mar 2026 12:42:14 +0100
Subject: [PATCH] nixos/calibre-web: fix ReadWritePaths when dataDir or
 calibreLibrary is set

---
 nixos/modules/services/web-apps/calibre-web.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/services/web-apps/calibre-web.nix b/nixos/modules/services/web-apps/calibre-web.nix
index c452f25b7984..85e0348ed78a 100644
--- a/nixos/modules/services/web-apps/calibre-web.nix
+++ b/nixos/modules/services/web-apps/calibre-web.nix
@@ -187,6 +187,9 @@ in
 
           NoNewPrivileges = true;
           ProtectSystem = "strict";
+          ReadWritePaths =
+            lib.optional (lib.hasPrefix "/" cfg.dataDir) cfg.dataDir
+            ++ lib.optional (cfg.options.calibreLibrary != null) cfg.options.calibreLibrary;
           PrivateTmp = true;
           PrivateDevices = true;
           PrivateIPC = true;