From 7036e667cc7179836434cbd3ea7de969498bb402 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Mon, 1 Dec 2025 23:57:31 +0100
Subject: [PATCH 1/2] nixos/glance: refactor to use
 `genJqSecretsReplacementSnippet`

---
 nixos/modules/services/web-apps/glance.nix | 45 +++-------------------
 1 file changed, 5 insertions(+), 40 deletions(-)

diff --git a/nixos/modules/services/web-apps/glance.nix b/nixos/modules/services/web-apps/glance.nix
index 6cccc83ebaa0..7b46c966de3f 100644
--- a/nixos/modules/services/web-apps/glance.nix
+++ b/nixos/modules/services/web-apps/glance.nix
@@ -2,14 +2,13 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 let
   cfg = config.services.glance;
 
   inherit (lib)
-    catAttrs
-    concatMapStrings
     getExe
     mkEnableOption
     mkIf
@@ -18,17 +17,8 @@ let
     types
     ;
 
-  inherit (builtins)
-    concatLists
-    isAttrs
-    isList
-    attrNames
-    getAttr
-    ;
-
   settingsFormat = pkgs.formats.yaml { };
-  settingsFile = settingsFormat.generate "glance.yaml" cfg.settings;
-  mergedSettingsFile = "/run/glance/glance.yaml";
+  settingsFile = "/run/glance/glance.yaml";
 in
 {
   options.services.glance = {
@@ -180,41 +170,16 @@ in
       requires = [
         "nss-user-lookup.target"
       ];
-      path = [ pkgs.replace-secret ];
 
       serviceConfig = {
         ExecStartPre =
-          let
-            findSecrets =
-              data:
-              if isAttrs data then
-                if data ? _secret then
-                  [ data ]
-                else
-                  concatLists (map (attr: findSecrets (getAttr attr data)) (attrNames data))
-              else if isList data then
-                concatLists (map findSecrets data)
-              else
-                [ ];
-            secretPaths = catAttrs "_secret" (findSecrets cfg.settings);
-            mkSecretReplacement = secretPath: ''
-              replace-secret ${
-                lib.escapeShellArgs [
-                  "_secret: ${secretPath}"
-                  secretPath
-                  mergedSettingsFile
-                ]
-              }
-            '';
-            secretReplacements = concatMapStrings mkSecretReplacement secretPaths;
-          in
           # Use "+" to run as root because the secrets may not be accessible to glance
           "+"
           + pkgs.writeShellScript "glance-start-pre" ''
-            install -m 600 -o $USER ${settingsFile} ${mergedSettingsFile}
-            ${secretReplacements}
+            ${utils.genJqSecretsReplacementSnippet cfg.settings settingsFile}
+            chown $USER ${settingsFile}
           '';
-        ExecStart = "${getExe cfg.package} --config ${mergedSettingsFile}";
+        ExecStart = "${getExe cfg.package} --config ${settingsFile}";
         Restart = "on-failure";
         WorkingDirectory = "/var/lib/glance";
         EnvironmentFile = cfg.environmentFile;

From fcd8c8386218c9fab04c5463e7d22494421dc4eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Tue, 2 Dec 2025 00:25:56 +0100
Subject: [PATCH 2/2] nixos/glance: add maintainer gepbird

---
 nixos/modules/services/web-apps/glance.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/glance.nix b/nixos/modules/services/web-apps/glance.nix
index 7b46c966de3f..016fb9f7d993 100644
--- a/nixos/modules/services/web-apps/glance.nix
+++ b/nixos/modules/services/web-apps/glance.nix
@@ -210,5 +210,7 @@ in
   };
 
   meta.doc = ./glance.md;
-  meta.maintainers = [ ];
+  meta.maintainers = with lib.maintainers; [
+    gepbird
+  ];
 }