From 1cca27fcf931d260b358ea2162c416d896062c4f Mon Sep 17 00:00:00 2001
From: lschuetze <lschuetze@mpi-sws.org>
Date: Wed, 21 Jan 2026 17:36:32 +0100
Subject: [PATCH 1/3] sabnzbd: create intermediate tmpfile for config merge

---
 .../services/networking/sabnzbd/default.nix       | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/networking/sabnzbd/default.nix b/nixos/modules/services/networking/sabnzbd/default.nix
index 8b7cfce32514..e33e757f2643 100644
--- a/nixos/modules/services/networking/sabnzbd/default.nix
+++ b/nixos/modules/services/networking/sabnzbd/default.nix
@@ -13,7 +13,6 @@ let
     mkOptionDefault
     mkIf
     literalExpression
-    optionalString
     types
     ;
   inherit (lib.generators)
@@ -79,7 +78,6 @@ let
       mkSection = (
         depth: attrs:
         let
-          atoms = extractAtoms attrs;
           sections = extractSections attrs;
           sectionHeadingLeft = lib.concatStrings (lib.replicate (depth + 1) "[");
           sectionHeadingRight = lib.concatStrings (lib.replicate (depth + 1) "]");
@@ -531,11 +529,18 @@ in
 
           ${lib.toShellVar "files" files}
 
+          tmpfile=$(mktemp)
+
           ${lib.getExe (pkgs.python3.withPackages (py: [ py.configobj ]))} \
             ${./config_merge.py} \
-            "''${files[@]}" | \
-          install -D -m ${if cfg.allowConfigWrite then "600" else "400"} \
-            -o '${cfg.user}' -g '${cfg.group}' /dev/stdin ${iniPathQuoted}
+            "''${files[@]}" \
+            > "$tmpfile"
+
+          install -D \
+            -m ${if cfg.allowConfigWrite then "600" else "400"} \
+            -o '${cfg.user}' -g '${cfg.group}' \
+            "$tmpfile" \
+            ${iniPathQuoted}
         '';
       };
 

From 3b80034a8b716986b0da1b5d659157b27f9b6317 Mon Sep 17 00:00:00 2001
From: lschuetze <lschuetze@mpi-sws.org>
Date: Wed, 21 Jan 2026 17:36:32 +0100
Subject: [PATCH 2/3] sabnzbd: remove intermediate tmpfile once done

---
 nixos/modules/services/networking/sabnzbd/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/networking/sabnzbd/default.nix b/nixos/modules/services/networking/sabnzbd/default.nix
index e33e757f2643..9dd01172b557 100644
--- a/nixos/modules/services/networking/sabnzbd/default.nix
+++ b/nixos/modules/services/networking/sabnzbd/default.nix
@@ -541,6 +541,8 @@ in
             -o '${cfg.user}' -g '${cfg.group}' \
             "$tmpfile" \
             ${iniPathQuoted}
+
+          rm "$tmpfile"
         '';
       };
 

From 3870875942dd25e326addf83f33b85a2915024e5 Mon Sep 17 00:00:00 2001
From: lschuetze <lschuetze@mpi-sws.org>
Date: Sat, 24 Jan 2026 18:15:27 +0100
Subject: [PATCH 3/3] sabnzbd: do not render config by default at system state
 version < 26.05

---
 .../services/networking/sabnzbd/default.nix      | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/networking/sabnzbd/default.nix b/nixos/modules/services/networking/sabnzbd/default.nix
index 9dd01172b557..4d16ddfd9a22 100644
--- a/nixos/modules/services/networking/sabnzbd/default.nix
+++ b/nixos/modules/services/networking/sabnzbd/default.nix
@@ -101,7 +101,8 @@ let
     else
       (configObjIni { }).generate "public-settings.ini" allSettings;
 
-  sabnzbdIniPath = "/var/lib/${cfg.stateDir}/sabnzbd.ini";
+  sabnzbdIniPath =
+    if cfg.configFile != null then cfg.configFile else "/var/lib/${cfg.stateDir}/sabnzbd.ini";
 in
 
 {
@@ -113,8 +114,12 @@ in
 
       configFile = mkOption {
         type = types.nullOr types.path;
-        default = null;
-        description = "Path to config file (deprecated, use `settings` instead)";
+        default =
+          if lib.versionOlder config.system.stateVersion "26.05" then
+            "/var/lib/sabnzbd/sabnzbd.ini"
+          else
+            null;
+        description = "Path to config file (deprecated, use `settings` instead and set this value to null)";
       };
 
       stateDir = mkOption {
@@ -509,7 +514,10 @@ in
     systemd.services.sabnzbd =
       let
         files =
-          (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
+          if cfg.configFile != null then
+            [ sabnzbdIniPath ]
+          else
+            (lib.optional cfg.allowConfigWrite sabnzbdIniPath) ++ [ publicSettingsIni ] ++ cfg.secretFiles;
         iniPathQuoted = lib.escapeShellArg sabnzbdIniPath;
       in
       {