From dd7ad02f76af89a7cac43f09446ec9c390f1092d Mon Sep 17 00:00:00 2001
From: Aly Raffauf <aly@raffauflabs.com>
Date: Tue, 20 May 2025 05:04:52 -0400
Subject: [PATCH] nixos/prowlarr: add configurable dataDir and user/group
 options (#408902)

---
 .../services/misc/servarr/prowlarr.nix        | 65 +++++++++++++++----
 1 file changed, 52 insertions(+), 13 deletions(-)

diff --git a/nixos/modules/services/misc/servarr/prowlarr.nix b/nixos/modules/services/misc/servarr/prowlarr.nix
index dcf5b18005b4..b8d93bd6e8a4 100644
--- a/nixos/modules/services/misc/servarr/prowlarr.nix
+++ b/nixos/modules/services/misc/servarr/prowlarr.nix
@@ -13,6 +13,12 @@ in
     services.prowlarr = {
       enable = lib.mkEnableOption "Prowlarr, an indexer manager/proxy for Torrent trackers and Usenet indexers";
 
+      dataDir = lib.mkOption {
+        type = lib.types.str;
+        default = "/var/lib/prowlarr";
+        description = "The directory where Prowlarr stores its data files.";
+      };
+
       package = lib.mkPackageOption pkgs "prowlarr" { };
 
       openFirewall = lib.mkOption {
@@ -24,30 +30,63 @@ in
       settings = servarr.mkServarrSettingsOptions "prowlarr" 9696;
 
       environmentFiles = servarr.mkServarrEnvironmentFiles "prowlarr";
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "prowlarr";
+        description = ''
+          User account under which Prowlarr runs.
+        '';
+      };
+
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = "prowlarr";
+        description = ''
+          Group under which Prowlarr runs.
+        '';
+      };
     };
   };
 
   config = lib.mkIf cfg.enable {
-    systemd.services.prowlarr = {
-      description = "Prowlarr";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      environment = servarr.mkServarrSettingsEnvVars "PROWLARR" cfg.settings // {
-        HOME = "/var/empty";
+    systemd = {
+      services.prowlarr = {
+        description = "Prowlarr";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        environment = servarr.mkServarrSettingsEnvVars "PROWLARR" cfg.settings;
+
+        serviceConfig = {
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+          EnvironmentFile = cfg.environmentFiles;
+          ExecStart = "${lib.getExe cfg.package} -nobrowser -data='${cfg.dataDir}'";
+          Restart = "on-failure";
+        };
       };
 
-      serviceConfig = {
-        Type = "simple";
-        DynamicUser = true;
-        StateDirectory = "prowlarr";
-        EnvironmentFile = cfg.environmentFiles;
-        ExecStart = "${lib.getExe cfg.package} -nobrowser -data=/var/lib/prowlarr";
-        Restart = "on-failure";
+      tmpfiles.settings."10-prowlarr".${cfg.dataDir}.d = {
+        inherit (cfg) user group;
+        mode = "0700";
       };
     };
 
     networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.settings.server.port ];
     };
+
+    users.users = lib.mkIf (cfg.user == "prowlarr") {
+      prowlarr = {
+        isSystemUser = true;
+        group = cfg.group;
+        home = cfg.dataDir;
+      };
+    };
+
+    users.groups = lib.mkIf (cfg.group == "prowlarr") {
+      prowlarr = { };
+    };
   };
 }