From d848c1fa08de263672aa89809d97dcc26db5ca91 Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 19:04:29 -0700
Subject: [PATCH 1/7] kanboard: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/kanboard.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/kanboard.nix b/nixos/modules/services/web-apps/kanboard.nix
index 4f541a712853..8318282ecdd2 100644
--- a/nixos/modules/services/web-apps/kanboard.nix
+++ b/nixos/modules/services/web-apps/kanboard.nix
@@ -123,7 +123,7 @@ in
           "pm" = "dynamic";
           "php_admin_value[error_log]" = "stderr";
           "php_admin_flag[log_errors]" = true;
-          "listen.owner" = "nginx";
+          "listen.owner" = config.services.nginx.user;
           "catch_workers_output" = true;
           "pm.max_children" = "32";
           "pm.start_servers" = "2";

From 0f8dab97c999bbc2b56abf3463a3cfb63397c3f3 Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 20:44:39 -0700
Subject: [PATCH 2/7] roundcube: don't hard-code nginx user in service

---
 nixos/modules/services/mail/roundcube.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 9a6ca6fa9635..c58832daac19 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -256,8 +256,8 @@ in
         upload_max_filesize = ${cfg.maxAttachmentSize}
       '';
       settings = lib.mapAttrs (name: lib.mkDefault) {
-        "listen.owner" = "nginx";
-        "listen.group" = "nginx";
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
         "listen.mode" = "0660";
         "pm" = "dynamic";
         "pm.max_children" = 75;

From c8d883c148a161014b4ccbd891054114c5a2605a Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 20:45:22 -0700
Subject: [PATCH 3/7] baikal: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/baikal.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/baikal.nix b/nixos/modules/services/web-apps/baikal.nix
index 1c3f89c510d2..568f250df0df 100644
--- a/nixos/modules/services/web-apps/baikal.nix
+++ b/nixos/modules/services/web-apps/baikal.nix
@@ -57,8 +57,8 @@ in
           "BAIKAL_PATH_SPECIFIC" = "/var/lib/baikal/specific/";
         };
         settings = lib.mapAttrs (name: lib.mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;

From e1ab6b934d6fc441e946e6824adb24d16ae0069f Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 22:08:34 -0700
Subject: [PATCH 4/7] grocy: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/grocy.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/grocy.nix b/nixos/modules/services/web-apps/grocy.nix
index 8106cc06fd2b..a6860a0902b3 100644
--- a/nixos/modules/services/web-apps/grocy.nix
+++ b/nixos/modules/services/web-apps/grocy.nix
@@ -44,7 +44,7 @@ in
         "pm" = "dynamic";
         "php_admin_value[error_log]" = "stderr";
         "php_admin_flag[log_errors]" = true;
-        "listen.owner" = "nginx";
+        "listen.owner" = config.services.nginx.user;
         "catch_workers_output" = true;
         "pm.max_children" = "32";
         "pm.start_servers" = "2";
@@ -52,6 +52,20 @@ in
         "pm.max_spare_servers" = "4";
         "pm.max_requests" = "500";
       };
+      defaultText = lib.literalExpression ''
+        {
+          "pm" = "dynamic";
+          "php_admin_value[error_log]" = "stderr";
+          "php_admin_flag[log_errors]" = true;
+          "listen.owner" = config.services.nginx.user;
+          "catch_workers_output" = true;
+          "pm.max_children" = "32";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "2";
+          "pm.max_spare_servers" = "4";
+          "pm.max_requests" = "500";
+        }
+      '';
 
       description = ''
         Options for grocy's PHPFPM pool.

From 7028da51c2c10f24cb60dc0c7fa852736be44971 Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 22:08:45 -0700
Subject: [PATCH 5/7] icingaweb2: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
index 597d4951a0db..b7d9dd3dbfe1 100644
--- a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
+++ b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
@@ -200,8 +200,8 @@ in
           date.timezone = "${cfg.timezone}"
         '';
         settings = mapAttrs (name: mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;

From febd95b49f23bfd15ee976ca6f23c560cd35728e Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 22:09:12 -0700
Subject: [PATCH 6/7] selfoss: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/selfoss.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/web-apps/selfoss.nix b/nixos/modules/services/web-apps/selfoss.nix
index f4aa61a4c910..6c1d4a0f46e5 100644
--- a/nixos/modules/services/web-apps/selfoss.nix
+++ b/nixos/modules/services/web-apps/selfoss.nix
@@ -37,7 +37,8 @@ in
 
       user = mkOption {
         type = types.str;
-        default = "nginx";
+        default = config.services.nginx.user;
+        defaultText = lib.literalExpression "config.services.nginx.user";
         description = ''
           User account under which both the service and the web-application run.
         '';
@@ -122,10 +123,10 @@ in
   config = mkIf cfg.enable {
     services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
       ${poolName} = {
-        user = "nginx";
+        user = config.services.nginx.user;
         settings = mapAttrs (name: mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;

From 6b6166c53168dcabf80c9ede0c0d0c32893068a1 Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 22:09:25 -0700
Subject: [PATCH 7/7] tt-rss: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/tt-rss.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index 607b99537f30..eb33661a8637 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -594,8 +594,8 @@ in
         inherit (cfg) user;
         inherit phpPackage;
         settings = mapAttrs (name: mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;