From f76c4fdb7f2908b66b5c243cebc4d0f8893285d5 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Fri, 12 Jun 2026 20:40:31 +0200
Subject: [PATCH] nixos/netbox: merge nixos options support in concatFile

While types.lines has a custom merge function it is generally not great
style to configure module options needlessly from the config section.
---
 nixos/modules/services/web-apps/netbox.nix | 38 ++++++++++++----------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index fdfe33e6f970..307681d46b0f 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -23,12 +23,33 @@ let
     text = cfg.extraConfig;
   };
   configFile = pkgs.concatText "configuration.py" [
+    nixosOptionsConfig
     settingsFile
     extraConfigFile
   ];
   secretKeyFile =
     if cfg.secretKeyFile != null then cfg.secretKeyFile else "${cfg.dataDir}/secret.key";
 
+  nixosOptionsConfig = pkgs.writeTextFile {
+    name = "netbox-nixos-options.py";
+    text = ''
+      with open("${secretKeyFile}", "r") as file:
+          SECRET_KEY = file.readline()
+
+      API_TOKEN_PEPPERS = {
+        ${lib.concatStringsSep "\n" (
+          lib.mapAttrsToList (id: file: ''
+            ${id}: open("${file}", "r").read().strip(),
+          '') cfg.apiTokenPepperFiles
+        )}
+      }
+    ''
+    + (lib.optionalString (cfg.keycloakClientSecret != null) ''
+      with open("${cfg.keycloakClientSecret}", "r") as file:
+          SOCIAL_AUTH_KEYCLOAK_SECRET = file.readline()
+    '');
+  };
+
   pkg =
     (cfg.package.overrideAttrs (old: {
       installPhase =
@@ -349,23 +370,6 @@ in
           };
         };
       };
-
-      extraConfig = ''
-        with open("${secretKeyFile}", "r") as file:
-            SECRET_KEY = file.readline()
-
-        API_TOKEN_PEPPERS = {
-          ${lib.concatStringsSep "\n" (
-            lib.mapAttrsToList (id: file: ''
-              ${id}: open("${file}", "r").read().strip(),
-            '') cfg.apiTokenPepperFiles
-          )}
-        }
-      ''
-      + (lib.optionalString (cfg.keycloakClientSecret != null) ''
-        with open("${cfg.keycloakClientSecret}", "r") as file:
-            SOCIAL_AUTH_KEYCLOAK_SECRET = file.readline()
-      '');
     };
 
     services.redis.servers.netbox.enable = true;